Identity Woman

Independent Advocate for the Rights and Dignity of our Digital Selves

Reviews of Events

What is your title…mine is Identity Woman

· · Leave a Comment

So I am back from the Art of Leadership at HollyHock that was both a vacation and a bit of work. While I was away the announcement went out about a conference I agreed to speak at about identity in October – Office 2.0.
I didn’t really have time to do a bio while off retreating and I pointed them to my broad “who I am” page at kaliyasblogs. In reading this they picked up on a positional title I had and decided to list me with that just linking to Identity Woman under the blog link (without mentioning it in text). I find this odd because Ismael asked me to speak at the conference because I am Identity Woman.

From IT Redux: Kaliya’s participation should help us understand if there is a chance that we could get single sign-on for Office 2.0 in our lifetimes.

I would like to ask all the folks who blogged about the upcoming conference to list me as “Kaliya Hamlin aka Identity Woman, Network Director Planetwork”.
I find it interesting there is such a focus on that positional title to have legitimacy in this industry. I really think it is a disservice all around there are people who contribute a lot without positional ‘titles’ who deserve to be on stage some times perhaps more then those on stage who have ‘titles’. I hope we as a community can look at this bias towards ‘titles’ and reflect on the unique gifts and talents that are not being recognized because of it.
Think about it. If you can change my title listing on your blogs…thanks 🙂
Criag
Ross
Rob
David
Woodrow

BlogHer and Microsoft Live….

· · Leave a Comment

I have lots to say about BlogHer – and will be sharing it over the next few weeks. It was quite an emotional event for me on a bunch of levels. With all the buzz about Microsoft is launching Windows Live Spaces tonight I thought I would chime in on that aspect of BlogHer.
Basically I was completely turned off what ever they might be doing in there space by the “BE JANE” skit at BlogHer.
Amy Gahran sums it up:

“Still, I had to cringe at the campy, off-target Microsoft presentation during the welcome session just a few minutes ago.
To promote its new Windows Live Spaces service, someone at Microsoft thought it would be appropriate and fun to send a couple of bouncy, bubbly, sexy, carefully scripted 20-somethings uniformed in tight t-shirts and jeans to banter giddily for about 10 minutes on home improvement. It sounded like Barbie doing ‘Tool Time’ in stereo.”

Teachermama also had thoughts:

All around me, people were making comments about feeling like ‘Math is hard’ Barbie was up on stage talking WAY down to us. Here’s a hint: if you’re facing a ballroom full of hundreds of smart, tech-savvy women, ‘home improvement is scary’ isn’t the way to our hearts.”

I know some great people at MSFT – Kim Cameron, Lilly Chang and some other great folks who are actually the best human being marketer types you could imagine – Brady who just left for O’Reilly, Liz Lawley who just left after her sabbatical year there and of course the biggest loss of all – Scoble.
Imagine how cool MSFT’s blogging tools platform and approach could have been if they had just listened to the people who get it and have a relationship to the community (like Scoble who instead he is off making PodTech cool).
Note to Balmer – stop letting the good people you have go and stop putting the marketing morons in charge. And for god sakes don’t fuck up the messaging around Vista, Cardspace and Identity. I think we need to have an intensive heart to heart with the identity community and your marketing ‘army’ before things roll out.
Some folks like Kevin O’Keefe at Lexblog picked up on this, and gave some constructive feedback –

Microsoft “should have gone the low key approach as at Gnomedex. Write a check to a worthwhile program, get thanked on various occasions, and get out of the way.”

On the up side….Kim just blogged this…
An unequivocal Yes: Windows Live ID will accept third party authentication for access to Microsoft properties.

OSCON 06 Day 5 – cxap is launched

· · Leave a Comment

Today opened with a great talk about the history of the IBM PC. Dave Bradley the advice I liked was ‘choose your partners carefully‘ and ‘small decisions may last forever‘ -he was talking about a 5 hour meeting with 3 people that created the character set that is now ‘the official standard.’
————
Technology trend spotting by Roger Magoulas the research director at O’Reilly was sort of interesting but why? What are the trends coming besides rails and ajax.
————
We had an ok presentation about a really important topic – hacking government by Carl Malamud.
The real danger that Tim O’Reilly highlights those who have the power to make the laws/regulations not understanding the realm in which they make those rools.
ITU world summit on information technology – for starters the ‘corspondent’ from O’Reilly could not get ‘press credentials to attend. WHAT! They were talking about Internet Governance and their are noises about another governance body for the web emerging by those ‘heads of state’.
Hack2: Get Standing Join the operation
He highlighted the Smithsonian – Showtime Network issue (they signed a 30 year exclusive agreement with the network limiting there ability to put content up in other forms.
Hack3: Be Governmnet
put more of what is happening in government online and support annotation – They are working on launching the Public Memory Trust starting with the Washington Bridge to have 18 hearings running simoltaniously online. There exit strategy – Make the Government Do it.
Hack4: Mirror the FCC
Hack5: Enforce ODF open document format
Hack6: Audit Validity (for disabilities)
Hack7: Rank by Bad Links (links on government pages are notoriously stale)
Hack8: Annotate Hearings

Hack9: Hold Hearings
Hack10: Map Spectrum
he said that only 2% of the spectrum is actually used and that we as the hacker community could map spectrum and make a case for opening up the spectrum our common resources.
Skills using for builing open source are citizenship skills for the common good. To resist private interest taking over government
___________
OpenTalk 2.0 Maximizing non-stakeholder buy-in by leveraging departed Generic informaiton transfer protocols
Damian Conway gave an amazing presentation about OpenTalk 2.0 – cxap. This presentation was even better because on on day 0 of OSCON – sunday he gave a presentation on presentations to speakers. In this talk he basically in this presentation made fun of presentations and did everything you are not supposed to do in presentations….
Zak Greant’s summary –
Damien Conway’s is giving the funniest public whipping I have ever seen. He is simulatenously kicking the ass of Web 2.0, Sxip, patents, patent vulture firms, snake oil crypto, Microsoft, Google, r0ml and the rest of us all at the same time.
Great quotes include:

  • We have a patent on replacing the letter in a name with x, but still pronouncing it the same way.
  • Every time you read the name Microsoft, you will see a kitten. We call it “Pavlovian Marketing”
  • We thought that we might call it … firefly, fireangel, firebuffy. Then it became obvious – the new browser is called FireWhedon.

Exciting Day for User-Centric Identity

· · Leave a Comment

Tomorrow the 20th of June at 7pm we are opening the global registry for i-names. This was announced a few weeks ago by the XDI.org board. There will be 7 initial ibrokers 6 of whom are opening there doors tomorrow. There is a great site explaining i-names broadly for people and organizations along with a developer site. Cordance (Drummond Reed’s company) has a new website up too articulating its pioneering role in brining user centric, privacy protecting digital addresses to the market 🙂
This day is a big day for many folks who have been working on this for various lengths of time (any where from 14 years to several months). I began working in the identity space first with the very early alpha experiment that Planetwork did for its 2004 conference. While preparing for that conference (which I worked to evangelize for) I had my first “identity woman” experience about 10 guys gathered to figure out how to kluge several systems together this identity stuff together and all day I listened – learning a lot and said one thing all day. At the end of the day we took a picture and I was the only woman there.
At the conference I was hired by Owen and the Identity Commons (1.0)along with Jan Hauser to work on driving adoption of these new tools in civil society. I was thinking today while talking to Bill Washburn saying that I didn’t think we would be meeting today at Harvard on all these topics if it had not been for Owen’s significant visionary personal investment in the vision of this new identity layer – that really empowered people. The specifics of that early program never came to fruition in exactly the way originally envisioned but the results have been demonstrable in many ways. So tomorrow if you get a chance be sure to say THANK YOU! Owen.
Yesterday, Monday the 19th was a big day with this proposal put forward to the Apache Foundation to become a project there.

The project would start with Yadis for URL/XRI-based service discovery, OpenID for web based single-sign-on and the basis of exchanging profile data, and to create a desktop component with a standard look and feel, ideally working with the Open Source Identity Selector (OSIS) project.

Technorati Tags: , , , , , , , , , ,

Harvard through Canadian Eyes

· · Leave a Comment

Landing in in Cambridge at Harvard today for the start of the ‘identity Mashup‘. The experience of east coast norms of ‘elitism’ have been something that I have had to acclimatize to as I come out here to go to events and conferences. It also is something that rubs up against my “west coast” and “Canadian egalitarianism.” Malcome Gladwell a Canadian and author of The Tipping POint and Blink, captures the subtle world view difference in his recent essay in the New Yorker “Getting In” The article is long but I have exerted here if you want to get the gist of his thesis.
Here is the main thesis from the end of the article in case you don’t want to read to the end.

Élite schools, like any luxury brand, are an aesthetic experience—an exquisitely constructed fantasy of what it means to belong to an élite —and they have always been mindful of what must be done to maintain that experience.

Some quotes from the beginning of the essay…

There was, first of all, that strange initial reluctance to talk about the matter of college at all—a glance downward, a shuffling of the feet, a mumbled mention of Cambridge. “Did you go to Harvard?” I would ask. I had just moved to the United States. I didn’t know the rules. An uncomfortable nod would follow. Don’t define me by my school, they seemed to be saying, which implied that their school actually could define them. And, of course, it did.
What is this “Harvard” of which you Americans speak so reverently?
By the nineteen-sixties, Harvard’s admissions system had evolved into a series of complex algorithms. The school began by lumping all applicants into one of twenty-two dockets, according to their geographical origin. (There was one docket for Exeter and Andover, another for the eight Rocky Mountain states.)
Social scientists distinguish between what are known as treatment effects and selection effects. The Marine Corps, for instance, is largely a treatment-effect institution. It doesn’t have an enormous admissions office grading applicants along four separate dimensions of toughness and intelligence. It’s confident that the experience of undergoing Marine Corps basic training will turn you into a formidable soldier. A modelling agency, by contrast, is a selection-effect institution. You don’t become beautiful by signing up with an agency. You get signed up by an agency because you’re beautiful.
At the heart of the American obsession with the Ivy League is the belief that schools like Harvard provide the social and intellectual equivalent of Marine Corps basic training—that being taught by all those brilliant professors and meeting all those other motivated students and getting a degree with that powerful name on it will confer advantages that no local state university can provide.
The extraordinary emphasis the Ivy League places on admissions policies, though, makes it seem more like a modeling agency than like the Marine Corps, and, sure enough, the studies based on those two apparently equivalent students turn out to be flawed.
You are whom you admit in the élite-education business, and when Harvard changed whom it admitted, it changed Harvard.
The Ivy League schools justified their emphasis on character and personality, however, by arguing that they were searching for the students who would have the greatest success after college. They were looking for leaders, and leadership, the officials of the Ivy League believed, was not a simple matter of academic brilliance. “Should our goal be to select a student body with the highest possible proportions of high-ranking students, or should it be to select, within a reasonably high range of academic ability, a student body with a certain variety of talents, qualities, attitudes, and backgrounds?
Harvard didn’t want lots of relatively happy and successful graduates. It wanted superstars,
This is, in no small part, what Ivy League admissions directors do. They are in the luxury-brand-management business, and “The Chosen,” in the end, is a testament to just how well the brand managers in Cambridge, New Haven, and Princeton have done their job in the past seventy-five years.
Harvard wants good graduates, and part of their definition of a good graduate is someone who is a generous and loyal alumnus. And if you want generous and loyal alumni you have to reward them. Aren’t the tremendous resources provided to Harvard by its alumni part of the reason so many people want to go to Harvard in the first place? The endless battle over admissions in the United States proceeds on the assumption that some great moral principle is at stake in the matter of whom schools like Harvard choose to let in—that those who are denied admission by the whims of the admissions office have somehow been harmed. If you are sick and a hospital shuts its doors to you, you are harmed. But a selective school is not a hospital, and those it turns away are not sick. Élite schools, like any luxury brand, are an aesthetic experience—an exquisitely constructed fantasy of what it means to belong to an élite —and they have always been mindful of what must be done to maintain that experience.

Technorati Tags: , , , ,

Citizen Action Team – distributed disaster help matching

· · Leave a Comment

One of the most impressive things that I saw at the Organizers Collaborative Conference was the Citizen Action Team. In the wake of Katrina they build a Ruby on Rails Database to match donors offerings of help to groups and institutions who need help. The demoed the database and it was really impressive.

We are a politically unaffiliated, independent group of volunteers that have come together to provide supplies to folks of the hurricane ravaged Gulf coastline. We are serving the least served areas. We are working directly with shelter relief teams in areas such as Lafayette and Baton Rouge, LA, Gulfport and Hattiesburg, MS .
This list will grow as we pin-point and identify needs of other under-served, under-supplied pop-up shelters in the most needy areas. Our campaign begins by establishing need, supplying the basics and then gauging what next will most aid “our” shelters. With efficiency tempered by compassion, we stay in close contact, following donations from collection to distribution. We have established warehouse operations in Lafayette, Gulfport and are now developing other locations.

Hopefully in the next big disaster there will be a real digital addressing infrastructure working to make it even more efficient.

Catalyzing Hospitality night one

· · Leave a Comment

The Hospitality suites were once again fun this year. I thought I would hand out some ‘awards’:
I think First Prize goes to Novell for their Star Trek theme. The whole room was spacey covered in fabric with pinpoints of light. They had live spacy groovy yet ambient music. I have a 1 min video of it here.
Fun and Engaging goes to the ActiveIdentity San Fransico Idol Suite with Karaoke. Eve Maler and I did a duet (sort of – I was back up). Later on in the evening William Hung gave a performance too.
Theme aligned with Name of company for the second year in the row goes to Element – for their Earth Wind Water Fire Theme complete with the ICE Bar and dramatic ‘elemental’ video on the wall.
Women are lovely. I am not against them helping out in a hospitality suite that are after all supposed to be fun. There are all sorts of ways to employ their help in tasteful and respectful ways. So these to awards are a pair –

  1. Lovely Lady Suite Support is a tie going to the Horse Racing lady and the Nascar recruiter. There work was captured on video.
  2. Worst Booth Babe goes to Layer Seven for this lovely number in a very reveling mini skirt propositioning people to come to their wine tasting in the hall way. Runner up goes to passlogic.

Worst Theme to build trust goes to IBM for Alcatraz Prison “Hotel” complete with the IBM staff being prison guards or perhaps prisoners.
Bland goes to Microsoft Apparently didn’t get “MARKETING” involved in anyway with its room. It had Italian food in the middle and booths of all these different companies sharing how they were all working together. Ping, and Sun among them.

Technorati Tags: , , , , , , , , , , ,

Mashup Banking a no go – says Jamie Lewis

· · Leave a Comment

This morning’s opening session at Catalyst was great.
Jamie talked about a range of issues including the Inconvenient truths.
That stronger authentication by itself will not make us more secure. All Authentication is dependent on assurance that is a human process and is vulnerable to low tech attacks.
He highlighted the fact that identity management and particularly as it moves into the web is very much a social problem.
The fact that much of the Web 2.0 crowd was going towards simpler protocols was happening but also that these tools would not really work in the context of online banking….
Mashups and Banking just don’t go together.

Union Passionista's Yell at Conference Attendees

· · Leave a Comment

Walking into the Hilton Hotel where the Burton Group Catalyst Conference is this morning was very unpleasant.
These young people in their 20s some with bullhorns and some thrusting flyers towards people walking in where ‘from the union’ letting us know that the hotel was under boycott and that we should turn around and not go in. They were there on behalf of Local 2 and the hotel workers rising campaign.
One Monday while at this same hotel the conversation went towards the cost of setting up ‘booths and suites’ etc. at conferences and conventions.

  • The union required that this organization pay $50 to simply release 40 balloons so they float on the ceiling.
  • Three unions had to get involved in turning the electricity switch on in the booth – so three different people all at $200 an hour were required costing $600.
  • The cost for each plug used would be $120.
  • I have heard other stories from people who are hard core change the world social activist who have worked for some radical organizations talking about their experience in this realm very very similar stories.

I really think that “unions” need to figure out how to modernize and get with it. Stop alienating businesses that are basically on their side.
I know that SF is a very expensive city. The house keepers and cooks and servers all deserve living wages. One of the facts that I learned from the young woman who was yelling at us as we went in was that House Keepers have more on the job injuries the coal miners. They deserve good wages, good benefits and good working conditions. For god sakes we pay at least $200 a night to sleep in such hotels they can pay their workers decently.
I decided to attempt to dialogue with these young “passionistas” sharing the fact that that there were people and businesses on their side but that their experiences with “unions” charging arbitrarily high amounts of money to do simple things alienates them from caring or being on their side. Instead of saying …ahh that is interesting. I understand that might be an issue. All she could do was parrot back to me that I shouldn’t go into the hotel and how the hotel had refused to negotiate for 2 years. All of which I am sure are true but the fact that they have people ‘representing’ them to the public that can’t even engage in meaningful dialogue and can only parrot ‘the party line’ is very disappointing.
Orville Schell the outgoing chair of the journalism school at UC Berkelye also had a run in with the unions recently written about in the East Bay Express. They are working to preasure the university for higher wages (I went to UC Berkeley I am basically for this). The Unioin threatened to block Al Gore’s coming to talk. So Orville decided to try and work with them bending over backwards to put forward their point of view to the audience at the event. In the end they would not agree to not cause trouble and Orville had to cancel the event.

Schell says. Unable to connect and unwilling to have Gore fly in from Cannes only to face a protest, he nixed the event. At which point Grabelle [the union leader] finally called him back.
“She said she was terribly sorry to hear I’d canceled it,” recalls the dean, who offered a reenactment of their talk in a voice bordering on stupefied. “‘We canceled it because of you!’ I told her. ‘Would you stand here before me and say you won’t picket? Because I can revive this event.’ And she said, ‘No, I can’t tell you that.’ So I said, “Well, then, don’t be sorry!”
Still, if the dean didn’t have a distaste for union tactics before, he does now. “I find it pretty … ” — he searches for something restrained — “unconstructive of them to be canceling graduations and things like that. I really don’t understand.” He vows never to contact the union again. “Nor would I think most people at the university would choose to speak to Grabelle.”

I think unions have to figure out how to actually relate to people and get people on their side instead of just being obstructionists jerks to normal doing normal events.
I know this summer there several Web2.0 activities happening at these hotels (SuperNova is happening at the Palace). Do these unions even know even know how to have a real dialogue? Is yelling and screaming your only modality? The Market is a conversation not a sort of ‘fuck you attitude’ yelling match. Maybe those hip union guys into technology that were at Esther’s conference, PC Forum last year (Andy Stern head of the SEIU) and this year (Gina Glantz, Senior Advisor to the President at SEIU) can help these young hotel passionista’s accosting people as they enter get it.

  • Argent Hotel
  • Crowne Plaza Union Square
  • Four Seasons
  • Fairmont
  • Grand Hyatt
  • Hilton San Francisco
  • Holiday Inn Civic Center
  • Holiday Inn Express
  • Holiday Inn Fisherman’s Wharf
  • Hyatt Regency
  • Mark Hopkins InterContinental
  • Omni Hotel
  • Palace Hotel

Technorati Tags: , , , ,

Learning about Liberty People Service

· · Leave a Comment

I got to learn all about the Liberty People Service proposed spec. yesterday at their workshop. I was hoping I would just get to understand more about enterprise federation stuff. However I was very excited to see that it might be very helpful as a viable privacy protecting meta social network standard. At the conference this week there will be a demo built out based on the working draft spec. I am excited because it seems like a more viable privacy protecting system then moving around FOAF or XFN files with my entire social graph around. There are two white papers I am hoping to get through in the next two days..
Personal Identity
LIberty Federated Social Identity

I-Tags at Net2

· · Leave a Comment

I am at the Net2 session on Tagging.Here is how I described the value itags to Beth Kanter.
I have been working with Mary Hodder, Drummond Reed and Andy Dale on itags. It is an open adhoc standard we are proposing for alowing people to use their identity while they tag. This could be a URL they ‘own’ (OpenID) an i-name (XRI) they have or another UUID.
Creators of content could use this to assert CC licenses and provide a long term persistent way to have attribution. People can assert tags across silos – multiple blogs that one posts on and multiple media tagging sites that one tags on.

Technorati Tags: , , , , , ,

PCForum: Reputation, Attention, Behavioral Targeting…

· · Leave a Comment

It is serious here at PCForum with Mary and Roml.
This morning’s panels were good.
Trusted ID – I can pay them to pay experian and the credit agencies not to sell my data. It seems like an interesting business model.
Apparently form talking to congress things the finacial system is “working just fine” and they don’t want to touch it. Seems like this is quite far from the truth. I have to borrow money I don’t need to get a credit rating so I can borrow money I do need.
Ted from Opinity and Seth from Root Markets were also on the panel.
We had a new word in the audience ‘attestations’ for what we call assertions. The work on vocabulary development although it drives some folks crazy is really needed so we can communicate about the ideas.
There was a defense of GoodMail – certified e-mail that is causing all this ruckus from EFF And Moveon. I talked to the PR guy from there company yesterday and shared that I felt it was wrong to charge postage on the net – that it should be solved in other ways with authentication and reputation.
Who owns your data – lots of questions form IP land. If someone took a picture of the panel ‘they would own’ it but if there was a public figure in the picture ‘the public figure’ would own it.
Panel 2 was less inspiring because it was like how to we track you in slightly better ways and give you ads targeted at you better. STOP – I don’t want ads.
I don’t want to pay on a per site basis for ad freeness but I would pay into a consortium and then travel around the web in an ‘ad free way’ and then my money would be divided up based on my actual use in that month. I will pay these sites in aggregate for providing me good services add free.
The company that did the RNC work for the last election grassroots.com. They also work with the Sierra club. But what happens when we build out good information in an open citizens based way an innovate. It makes me hopeful about the 1society project we are working on at Planetwork.
He also has a sense of how to foster relationship with folks, saying thank you, knowing you know someone, personalization. These fundamental qualities are often missing in those seeking to do social change.
There was a guy there from Takota he is not in program so that name is not spelt write. He really was not able to understand what ‘creativity’ was when Esther put it forward as what people want to do.
Looking at the amazing success of Make and Martha Stewart – people fundamentally want to be creative – not just to buy unique items to define themselves. Yesterday the fact that the ‘working class’ does not buy items to differentiate themselves but the middle class does this a lot. It seems that human creativity is a market opportunity that if understood better is a great opportunity.
“Companies are driven by FEAR and GREED” another one agreed this “fear, greed and ego” are what motivates people.
These views are not true or correct. I have been reading DRIVEN – they make the assertion there are two ancient drives – to acquire and defend and very human ones – the drive to BOND and the drive to LEARN. So there are fear and greed at a root in a way but we have so much abundance in this society that we can really do so much with the higher level drives. Flickr works because it supports in a big way the drive to Bond and drive to Learn.
I think this ‘fear greed ego paradigm’ is a fundamental problem in the current business culture. Building a world based on this world view is an energy is really making our world an ‘unfun’ place.
The elephant in the room around this stuff was highlighted – what happens when you the government shows up and wants to see someone’s data.
Q: Has anyone thought about the open source environment the ability to manage a whole variety of these things – identity data, attention data.
I give someone the keys to my garage – how do I take the keys back. This is the question – revocation is key. Seth said that he thought next year we would be talking about erasing things.

Technorati Tags:

Bruce Schneier: Why Security Has So Little To Do With Security

· · 1 Comment

Sorry for the delay this is Bruce Schneiers talk at RSA on Why Security has so Little to do with Security.
There is no such thing as absolute security!
Security involves trade-offs:

  • If no airplanes flew – 9/11 couldn’t have happened.
  • Air port security has trade offs – tax dollars, time, “calmness”)
  • Gated communities offere more security but less privacy vs. buying home alarm system costs money and convenience.
  • We are not wearing bullet proof vests… we don’t want to spend the money or fashion tradeoff.

We make decisions every day about these trade-offs
Additional security depends on the risk and the effectiveness of the counter measure. People are security consumers the right question is ‘it worthit.’

  • People RARELY perform this analysis explicitly
  • People succumb to fear and uncertainty
  • People beleive falus promieces
  • peopel regularly do things that compromise their security
  • people don’t do what they say

Security trade offs can be financial, social and non-security
The Barrier model doen’t quite work…There are legitimate users and attachers are bounced. Failures in this model are that the good guys get bounced or the- bad guys in. When system fails most likely fail against legitimate users!!!
Threat = Attacker -> Goals -> Attacks
There are multiples of all these criminals and hobbiest hackers
Attackers – can also be legitimate users (they can get a lot of information about systems to find out how they work – 9/11 they flew airlines).
Attacks divert to other targets…(go attack someone else)
Assets are owned by someone else. -> Trade offs are made by the asset owner. They don’t make the decision.
Security system (access control tarmack, passengers)
ASSETS (airplane)
Perceived Risks + Other considerations “everything else” [ social/moral | technological | legal | economic ]
The owner of the asset around which risks can be mitigated.
Owner -> Policy -> Trusted people -> Trusted systems – security systems to protect assets.
There are things we can not do to protect assets:

  • Banks – strip search everyone who comes into bank.
  • House – put landminds in lawn

Legitimate users influence owners:

  • We can’t put cameras in dressing rooms.
  • Government – wanted to ban laptops on airplanes (legitimate users forced decision)

Trusted people influence: –

Urin test for federal employees in Regan years. They said no.

The effectiveness of security system…minor component in complex decision graph.

Look at the sum of the stuff pointing at the owner. Every security decision affects multiple players and the party who gets to make the decision will make one thats’ benificial to him.
Every security decision affects multiple players… Look at Guns on airplanes .. pilots, flight attendants, citizens legislators
If they don’t want to buy it they are not ‘irrational’ it is rational within their world view…
Every player has his own unique perspective, his own trade-offs and his own risk analysis. You have to evaluate security options based on the positions of the players. Often security decisions are made for non-security reasons. The major security issues have nothing to do with security technology.
Detecting counterfeit money there is no incentive to detect it. I as a customer if we find it in our wallet just want to spend it the merchant if they find it will not report it as long as they can deposit it.
Look at KAL 007 the last western flight to get shot down over Russian.

  • The reason was that the prior time a western airline flew over Russian airspace general in charge lost his charge. So this general did not want that to happen to him. The agenda general who decides to shoot plane down (I need to save my career.)

Look at salesclerks and credit card verification.

  • They never check – they don’t care it is not their agenda. Make transaction go through with minimal stress. Owner of store more likely to check.

Look at Tylenol poisonings and random stupid crimes

  • Security is the science of tamper resistant packaging. They are silly security measures but they address the real problem (public no longer trusts over the counter drugs).

Look at banning things on airplanes.

  • Didn’t ban matches and lighters – cigaret lobby got to congress.. better the knitting needle lobby

SECURITY PROXIES are a way we address risk.
Proxies are players who acts in the interest of other players
(airline security:TSA…airlines not alowd to compete on everyone – more secure airlines, background checks – less secure airlines – no lines)
Proxies are a necessary aspect of the security because people arn’t proficient at risk management. Proxies are not going to make the same risk management decisions that the people they represent would have…
Home building inspectors
They ultimately work for the real estate business if deny to many timse they won’t have business…They are Mercenaries. If you hire them make sure you pay them….turn around and attack people who hire them.

DVD region encoding

  • There are secret features to defeat…manufactures as proxies…manufactures want the cheat codes piss of media companies.

Government regulatory bodies

  • yes safety but also their jobs (my comment: embedded autonomy)

Banks’ verification of signature on checks

  • They don’t do this – why check? No security problem until customer complains. Push security onto the consumer. Bank to centralize security – checks signatures? distirubuting it is cheaper then…

Banks’ verification of balance in account

Compare – bank security of overdrafts – they will spend a lot to deal with that kind of fraud.

Cell phone security against eavesdropping

  • Ridiculous that they don’t have encription. Phone companies don’t care – voice privacy not affect bottom line. In who’s agenda is voice privacy? the customers.

Cell phone security against third-party batteries

  • Third party batteries they care – security device ‘security of their revenue’

Security is never an isolated good. It always makes sence in the context of a greater system. That system is more important then security. Security is a secondary consideration ( it is an after thought). Understanding the context is just as important understanding the security.
The context of the interent today is a lot of spying stuff. Fighting the context won’t help…must work with the context.
Subscribe to Crypto-Gram: Free Monthly Security Newsletter

Questions:
About Proxie diversion: NSA protects us by snooping on us. NSA – protect ours and attack theres. Equities issue If you are in the NSA and tell Microsoft about major flaws…If you don’t then do you tell them — you can spy on chinese etc. defend good guys or attack bad guys. NSA eaves dropping on Americans. Police start making these decisions you get security that looks like a police state – powers of investigation and who. That is the way they think… This is a good example of proxie divergence. Important that the POLICE don’t run the countyr. somone above the police making the decisions above them civilian control of intelligence – pull the proxie back a bit.
Someone in government today [elected official]…their agenda in getting re-elected is measures to incent proxies properly understanding it we might be able to correct for it. Elections are about fundraising. Clever electoral reform systems…try to deal with proxie problem recognize them and then figuring out risk…I act as a proxie for corporation and vendors. What are the METRICS for measureing risk.
Regulations not most of my data is not controled by me company X (Choicepoint) the have controle over it but I am not a costomer…
The delta value is extreme. underprotected….
Regulation to choice point to take security more serioiusly. Does it work? is it effective? Increasing the cost to the company – make it more expensive to ignore security – vendors SOX is good for us there is more money to spend more money on security.

Find Use Share and Expand all Knowledge

· · Leave a Comment

danah boyd talked briefly about this new initiative at BlogHer yesterday. FUSE is the name of the new initiative that Jeff Weiner from Yahoo outlined at SuperNova.
I had fun at BlogHer 🙂 I did my first podcast there with Halley (you can see the picture over on Marc’s site) It was about 10 min talking about identity in various forms. I wonder when Podtech will put it up?
Yahoo! who hosted the cocktail party and did demo’s of Yahoo 360. I got to talk with one of the guys from the company and he raised some issues about identity 2.0 that I had not thought about. The power to enforce the of the EULA (end user license agreement) for a company like Yahoo! is in large part tied to their right to ‘terminate’ identities when the principles behind them misbehave. It seems key to include them more of the folks working for ‘the big guys’ in our identity workshop discussions and perhaps particularly policy usability.
Talk about changing identity (if where you work is a part of ones identity) Dana now works for the Yahoo! Berkeley Research and resigned from Google.

Catalyst Round UP

· · Leave a Comment

First of all thanks to Cordance, Opinity and ooTao who supported me in representing them and the whole ecology of folks around Identity Commons. It was a great week with lots of fruitful networking.
Jamie you are the calmest conference organizer I have ever met. Your staff was together and very helpful. Thanks!
Here are the roundup highlights:
Identity Management Market Trends – guitar introduction by Mike Neuenschwander.

Every move of your mouse you make
You’ll get a browser cookie for pete’s sake
Every username you fake, every federated claim you stake
They’ll be watching you
Every night and day
Every online game you play
Everything you say in IM, e-mail, VoIp or some other way
They’ll be watching you

Jamie Lewis kicked of the final afternoon with a keynote on user-centric Identity summed up by Dave Kearns with these talking points

*Heady mix of optimists, pessimists, idealists, cynics
*Agendas, governments, commercial interests could subvert the process
*Indicators of the constant tensions virtualization, digital ID create
*The tug of war will continue, and we all have a stake in the outcome
*Demonstrates the relativistic nature of identity, need for
polycentrism

Bob Blakley talked about his Axiom’s of Identity – they were quite though provoking and a great addition to the Identity Gang/Workshop conversation.
Dick gave a new and improved lessig style presentation on Identity 2.0 / User Centric Identity.
These two both belong to the “mac” community and gave their presentation on them. I got a lot of comments about my decorated Mac. It is nothing compared to Mary’s though.
Identity Workshop on stage. It was great to get a name and face for more of the Identity folks this included Stefan Brands of ID Corner and Scott Blackmer. Who I know was there but didn’t meet was David Kerns.
Strangest Job title: Ryan from Sxip – Sales Engineer (huh?)
Best Hospitality Suite themes matching the company:

  • Elementalwith their Ice Carved Bar and Earth and Fire graphics on the wall.
  • BridgeStream does role based enterprise Identity Management. So they had had Impro Theater (IT) Shakespeare provided by Theater Sports LA (Michelle, Brianand Floyd) where they each played improvised “roles.” They were kind enough to do an improvised sonnet about Identity Woman (I was really sad I didn’t have a tape recorder :() They also handed out world beach balls for the ‘globe theater.’

Talked to Scott Mace a bit on the first hospitality suite evening about podcasting. It is something Identity Woman might start doing.
Phil Windley, Doc Searls and myself worked out more details regarding the Independent Identity Workshop we are pulling together for the fall.
The Spiritual element of what identity is – the unnameable quality was honored with two different Lau Tzu quotes.
Sailing San Diego Bay with Mary Rundle was the closing highlight.
Thanks to all for a great conference! I am looking forward to coming back next year.

Reputation System for Web 2.0

· · Leave a Comment

Jamie Lewis is giving a great talk here at his conference on User-Centrism Meets Polycentrism: Creating Identity Infrastructure for the Internet. One of the things that he mentioned was Identity Commons and my representation of that ecology here at the conference.
He also highlighted the fact that reputation systems have a role to play. I have been working as the Blogosphere Advisor to a start up working on OPEN REPUTATION SERVICES – Opinity. They have a blog too.
One of my new friends in the industry who is a Service Integrator (SI) working on massive enterprise integration projects thought that the talk likely went over the majority of the audience’s head.