Independent Advocate for the Rights and Dignity of our Digital Selves

Identity Woman

Indpendent Advocate for the Rights and Dignity of our Digital Selves

Field Guide to Internet Trust Models: Peer-to-Peer Trust and Identity

By 2 Comments

Peer-to-Peer Identity

When no central identity provider or governance agreement is present, participants assert their own identities and each individual decides who they trust and who they do not. Each participant is a peer with equal standing and each can communicate with anyone else in the network.

Examples: The most familiar peer-to-peer network is probably e-mail. An internet host can join the e-mail network with little more effort than updating its DNS entry and installing some software. Once a host has joined the network, individual e-mail addresses are easily created with no requirement for approval by any central authority. This flexibility and ease of account creation helped spur the growth of the internet, but also allows spam marketers to create false emails.

The best known secure peer-to-peer identity networks on the Internet have been implemented using public key cryptography, which allows participants to trust messages sent over insecure channels like email. Products like PGP and it’s open source counterpart gpg are the most common implementations of public key messaging tools.

When To Use: No central identity provider is available but network participants can exchange credentials.

Advantages: No dependence on a central identity provider. No formal agreement needed to join the network. Participants can assert any identity that they want. Secure peer-to-peer technologies can provide a high degree of confidence once identities have been exchanged. Peer-to-peer models are very flexible, and can support a wide range of trust policies.

Disadvantages: No governing agreement or requirement to implement any policies. Secure deployment requires a high degree of technical sophistication and active management. Individually verifying each participant can be labor intensive. Tracking identities that have been revoked can be complex and error prone.

Ability to Scale: If security requirements are low, peer-to-peer networks can grow very large because new members can join easily. Higher levels of security can be complex to deploy and operate, and can impose a practical limit on the size of the network.

The full papers is downloadable [Field-Guide-Internet-TrustID] Here is a link to introduction of the paper and a at the bottom of that post is a link to all the other models with descriptions.  Below are links to all the different models.

Sole source, Pairwise Federation,  Peer-to-Peer,

Three-Party Model 1) “Bring your Own” Portable Identity 2) “Winner Take All” Three Party Model:

Federations 1) Mesh Federations 2) Technical Federations 3) Inter-Federation Federations

Four-Party Model, Centralized Token Issuance, Distributed Enrollment, Individual Contract Wrappers, Open Trust Framework Listing

Starting on the OASIS IDtrust member steering committee

By Leave a Comment

I started a new “job” last week, serving on the OASIS Identity and Trusted Infrastructure (IDtrust) Member Section, member steering committee.  I was elected to a 2 year term on this 5 member board.  This was my candidate statement and remains as my profile. On my first call as a member of the committee I was part of approving 8K of money including sponsoring the upcoming Interent Identity Workshop.

I shared with my fellow board members

in my introductory call that I was keen to link this work with other work that is related and ongoing at other standards efforts like the W3C where I have been participating in the Federated Social Web work.  There is also independent efforts like OpenID and OAuth happening within IETF.  One of our next tasks at Personal Data Ecosystem Consortium is to outline the core standards relevant to personal data.  We are not going to invent anything new – rather help what is be found and adopted and adapted.

Why Does participation in an International Standards body matter?

If “code is law,” then standards are like the Senate.  – Bruce Sterling, commenting on the April 2011 Augmented Reality Standards gathering

[Read more…]

Google+ and my "real" name: Yes, I'm Identity Woman

By 28 Comments

When Google+ launched, I went with my handle as my last name.  This makes a ton of sense to me. If you asked most people what my last name is, they wouldn’t know. It isn’t “common” for me.  Many people don’t even seem to know my first name. I can’t tell you how many times I have found myself talking with folks at conferences this past year and seeing ZERO lighbulbs going off when I say my name “Kaliya”, but when I say I have the handle or blog “Identity Woman” they are like “Oh wow! You’re Identity Woman… cool!” with a tone of recognition – because they know my work by that name.

One theory I have about why this works is because it is not obvious how you pronounce my name when you read it.  And conversely, it isn’t obvious how you write my name when you hear it.  So the handle that is a bit longer but everyone can say spell “Identity Woman” really serves me well professionally.  It isn’t like some “easy to say and spell” google guy name like Chris Messina or Joseph Smarr or Eric Sachs or Andrew Nash. I don’t have the privilege of a name like that so I have this way around it.

So today…I get this

I have “violated” community standards when using a name I choose to express my identity – an identity that is known by almost all who meet me. I, until last October, had a business card for 5 years that just had Identity Woman across the top.

Display Name – To help fight spam and prevent fake profiles, use the name your friends, family, or co-workers usually call you. For example, if your full legal name is Charles Jones Jr. but you normally use Chuck Jones or Junior Jones, either of these would be acceptable. Learn more about your name and Google Profiles.

[Read more…]

Trust is at all time low in they West….why leading with "trust frameworks" might not work

By 1 Comment

The ID Coach has this quote at the top of her current blog post:

…trust indices in the Western world are at an all time low. We don’t trust our lawyers, or accountants — they shred lots of documents. Many believe that bankers recently brought the world economic system to its knees in the crisis of 2008 and subsequent recession. Most people aren’t too enamored of politicians, either.

It is from the current issue of the Harvard Business Review in an article about trust.

It makes another very clear point about why leading with the word “trust” to describe “trust frameowrks” when the institutions touting them are the very ones that people have skepticism about (lawyers, accountants, bankers) as a good way to solve all our problems online by having people prove who they are.

People don’t want to accept “trust” blindly form these institutions they want to understand how it works and then decide if they do trust it or not.  Asking questions about accountability seems much easier to be concrete about the actual mechanics that then may are may not be trustworthy.

Accountability Framework – renaming "Trust Frameworks"

By Leave a Comment

I challenged the choice of the phrase “trust frameworks” to describe policy/technology frameworks that have the goal of creating networks of interoperability in the question and answer part of the NSTIC governance workshop.  Jeremy Grant challenged me to think of a better name for  “trust frameworks” and I think I found it…

Accountability Frameworks

So far everyone I have shared this with likes this new potential name.

* It is 2 words.

* It captures the heart of the intention behind their purpose – Accountability

* Accountability is achieved in these frameworks via both technology standards and policies that are adopted and audible.

* Trust remains an emergent property of these accountability frameworks.

* There can be real conversations by various stakeholders who may have different needs and interests about the nature of the accountability in different frameworks. They can look to see weather particular accountability frameworks are trustworthy from a particular point of view.

* It avoids the problem of talking about the “trustability of trust frameworks”.