ID Technology

Identity for Online Community Managers

Kaliya Young · August 19, 2009 · Leave a Comment

I was asked by Bill Johnson of Forum One Networks to kick off the discussion on the next Online Community Research Network call this week with the topic Identity for Online Community Managers – drawing on the presentation that I put together for the Community 2.0 Summit. I cover the basics of how OpenID, OAuth and Information Cards work, who is “in” terms of supporting the projects and what community managers/platforms can do. We will discuss the implications of these new identity and data sharing protocols on the call.

Online Identity for Community Managers: OpenID, OAuth, Information Cards

View more documents from Kaliya Hamlin.

I will also be attending the Online Community Summit in October Sonoma and will be sharing about these and other technologies there.

Web Finger! moving out into world

Kaliya Young · August 14, 2009 · 1 Comment

I love the Internet Identity Workshop! it is where innovative ideas are hatched, answers to hard problems are vetted and standards consensus emerges. This is just the latest in amazing collaborations that have emerged.

Web Finger was covered on Tech Crunch today with this headline – Google Points At WebFinger. Your Gmail Address Could Soon Be Your ID.

At IIW in May they had a session lead by John Panzer. The notes were not filled out that much but (All the Notes from IIW)

but there is a white board of their conversation and a link to what google had up.

Chris Messina spliced it together

XRD the discovery protocol is part of how Web Finger works. This spun out of XRI.

Techcrunch didn’t explicitly pick up on the fact that Eran Hammer-Lahev has been a key collaborator and is at Yahoo! (they did link to the mailing list where he is posting). He has been really driving XRD forward lately.

All exciting stuff.

DiSo ideas are not that new.

Kaliya Young · August 14, 2009 · 3 Comments

Reading these:

A Perfect Storm Forming for Distributed Social Networking– Read Write Web

Evolution of Blogging – GigaOm

The Push Button Web – Anil Dash

The inside Out Social Network – Chris Messina

The Future Social Web – Jeremiah Owyang

I realize how incredibly ahead of the times I was along with many of the people I have been working with on open standards identity and social web standards.

I wrote this describing open standards for distributed social networking online in April of 2004f or the Planetwork Conference (from Archive.org) that I was promoting.

———————— From Archive.org April 2004 ——————

ID Commons: Social Networking For Social Good: Creating Community Trust Infrastructure Through An Identity Commons

In 2003 the Planetwork LinkTank white paper The Augmented Social Network: Building Identity and Trust into the Next-Generation Internet proposed weaving new layers of identity and trust into the fabric of the Internet to facilitate social networking for social good – online citizenship for the information age.

The LinkTank white paper outlined three main objectives:

Establishing a new kind of persistent online identity that supports the public commons and the values of civil society.
Enhancing the ability of citizens to form relationships and self-organize around shared interests in communities of practice and engage in democratic governance.
Creating an Internet-wide system for more efficient and effective knowledge sharing between people across institutional, geographic, and social boundaries.

Currently each site with a login or membership profile is like an island, or at worst a walled castle, as no common inter-operation is possible among large numbers of them. Creating a truly interoperable network will require an explicit social agreement that governs the operation of the trusted network, and implementation of a new software protocol consistent with that agreement.

Identity Commons

[note this is a reference to the “first” Identity Commons – the current Identity Commons shares the values and some of the organizing principles of this first organization but evolved from it]

The Identity Commons is an open distributive membership organization, designed to develop and operate a common digital identity infrastructure standard based on the shared principle of protecting each user’s control of their own identity data. A common identity infrastructure must be embedded within a binding social agreement ensuring that the technology and its institutional users operate in accordance with core principles. In addition to developing this agreement, Identity Commons is managing the development and implementation of the new technology needed to achieve this as a fiscal project of Planetwork, a California 501(c)3 non-profit.

The Identity Commons is based on an implementation of two new OASIS standards:

XRI – a new identity addressing scheme fully compatible with URIs
XDI – specifies link contracts for shared use of data across the Internet

For more technical information see: http://xrixdi.idcommons.net

Once implemented, the Identity Commons infrastructure will:

Give individuals, organizations, and even ad-hoc groups persistent addresses (digital identities) that can be used in many ways. Each party can decide what their own address links to, and who can follow the links.
Provide single sign-on, enabling individuals to connect to multiple sites without having to provide a login and password to each.
Empower user/citizens to manage their own consolidated profiles, which will be likely to stay up to date as everyone maintains only their own master copy.
Generate network maps that enable communities to more efficiently understand their own membership, make connections, recognize patterns, filter messages, and self-organize around new topics and functions.
Provide collaborative filtering services based on knowledge and reputation databases where contributors can also control their own level of anonymity.
Enable group formation around common interests and affinities with reputation attributes for trusted communication, which could be the key to eliminate spam.

How is this different from what is already happening in the private sector?

Currently every web site has a privacy policy, but they vary widely, are rarely read, are only good until they are changed and are thus effectively useless.

The Identity Commons (IC) solves this by (1) replacing thousands of privacy policies with a single institutional membership agreement that simplifies the user experience. Every Identity Commons member site is party to a legally binding commitment that can only be changed by amending the IC membership agreement – which is governed by all IC members. And (2) by using electronic contracts to grant, record, and enforce data sharing across boundaries.

Ultimately there can only be one fully interoperable social network; just as email can travel anywhere on the Internet, your profile must also be able to do so. Microsoft would love to make this possible, and fully control it – their Passport system was designed to do just that. By hosting identity data for nearly everyone who has a computer Microsoft hopes to put themselves in the middle of every transaction they can.

In response to this, a group of large companies formed the Liberty Alliance which developed protocols that will allow institutions to “federate” data across company boundaries. Federation is an improvement over the Microsoft Passport model, however, both of these approaches treat individuals solely as consumers, and neither provide support for civil society, citizen collaboration or for individual citizens to control their own identity data.

The Identity Commons agreement and technical infrastructure is a way to correct this imbalance of power, allowing the Internet to fulfill its great potential as a “commons” in which individual citizens can interact freely and as equals everywhere on Earth.

————- end Identity Commons description from Planetwork’s 2004 site ———

Writing this document was the first work that I did as an evangelist for the proposed open standards for distributed digital identity to enable open distributed social networks.
I wrote it based on reading through all their work and listening to their vision of the founders of Identity Commons and those working together for 2+ years hoped for in the adoption of the open standards they were working on. These protocols are now all ratified in OASIS (one of three standards bodies for the internet the other two being IETF and W3C) – XRI, XDI along with XRD/XRD that spun out of XRI as it became incorporated in OpenIDv2 as a key part of what makes it work.

Identity that is user owned, controlled managed – and this includes the preferences, attention data, uterances, 1/2 of transaction data – is at the heart of what one needs to make this vision of distributed social networking work. I think until recently it has been misunderstood as esoteric and just talk – amazing progress has been made since the early days of the identity gang that community has grown and developed many of the conceptual understandings and protocols that are taken as givens.

Folks from what the identity community (and perhaps should consider “updating” its name to the identity and social web community).…invented – as in used for the first time these two words together Social and Web – SOCIAL WEB – (according to wikipedia)

With the title of this paper: The Social Web: Creating An Open Social Network with XDI

This paper was preceeded by the Augmented Social Network: Building and Trust into the Next Generation Internet

Like the Web or email, the ASN would be available to anyone. It would become a common part of the Internet infrastructure – a person-centered and group-centered service of the net. It will be implemented through the widespread adoption of technical protocols; any online community infrastructure could choose to be part of the ASN by implementing them. Central to its design are fundamental principles of openness, inclusivity, and decentralization — which are necessary for a thriving democracy. At the same time, the ASN would support the highest available forms of security to protect privacy.

The Identity Gang began talking/meeting in the later part 2004 and has continued to meet in the Internet Identity Workshop.

There is much wisdom that these communities have developed that can be useful in moving / re-articulating the vision… to be sure lessons are to be learned from understanding more about why certain approaches/standards/proposed ways of doing things didn’t happen (yet).

I think the market wasn’t ready for what the identity community was saying. As someone who has been evangelizing about this set of issues practically full time since 2004. In the first few years I would talk in a range of communities and at conferences about all these issues, user control, open standards the danger of the potential emergence of large silo’s that locked users in and people just “didn’t get” it was an issue or that there was even a need for these kinds of standards. Now the market is finally ready.

The 9th Internet Identity Workshop is this November – and REGISTRATION IS OPEN!

There is a whole conversation on the DiSo list where I highlighted this context/history. There might be a beer meetup in Berkeley this evening at Triple Rock at 7:30.

Missing: Privileged Account Management for the Social Web.

Kaliya Young · July 27, 2009 · 3 Comments

This year at SXSW I moderated a panel about OpenID, OAuth and data portability in the Enterprise. We had a community lunch after the panel, and walking back to the convention center, I had an insight about a key missing piece of software – Privileged Account Management (PAM) for the Social Web – how are companies managing multiple employees logging in to their official Twitter, Facebook and YouTube accounts?

I thought I should also explain some key things to help understand conventional PAM then get to social web PAM in this post covering:

regular identity management in the enterprise,
regular Privileged Account Management in the enterprise
Privileged Account Management for the Social Web.

1) IdM (Identity Management) in the Enterprise

There are two words you need to know to get IdM and the enterprise: “provisioning” and “termination“.

a) An employee is hired by a company. In order to login to the company’s computer systems to do their work (assuming they are a knowledge worker), they need to be provisioned with an “identity” that they can use to log in to the company systems.

b) When an employee leaves (retires, quits, laid off, fired), the company must terminate this identity in the computer systems so that the employee no longer has access to these systems.

The next thing to understand is logs.

So, an employee uses the company identity to do their work and the company keeps logs of what they do on company systems. This kind of logging is particularly important for things like accounting systems – it is used to audit and check that things are being accurately recorded, and who did what in these systems is monitored, thus addressing fraud with strong accountability.

I will write more about other key words to understand about IdM in the enterprise (authentication, authorization, roles, directories) but I will save these for another post.

2) Ok, so what is Privileged Account Management in the Enterprise?

A privileged account is an “über”-account that has special privileges. It is the root account on a UNIX system, a Windows Administrator account, the owner of a database or router access. These kinds of accounts are required for the systems to function, are used for day-to-day maintenance of systems and can be vital in emergency access scenarios.

They are not “owned” by one person, but are instead co-managed by several administrators. Failure to control access to privileged accounts, knowing who is using the account and when, has led to some of the massive frauds that have occurred in financial systems. Because of this, the auditing of logs of these accounts are now part of compliance mandates in

Sarbanes-Oxley
the Payment Card Industry Data Security Standard (PCI DSS),
the Federal Energy Regulatory Commission (FERC),
HIPAA.

Privileged Account Management (PAM) tools help enterprises keep track of who is logged into a privileged account at any given time and produce access logs. One way this software works is: an administrator logs in to the PAM software, and it then logs in to the privileged account they want access to. The privileged account management product grants privileged user access to privileged accounts [1].

Links to articles on PAM, [1] Burton Group Identity and Privacy Blog, KuppingerCole, Information Security Magazine.

3) Privileged Account Management on the Social Web.

Increasingly companies have privileged accounts on the social web. Dell computers has several for different purposes. Virgin America, (they link to the account from their website – thus “validating” that this is their real account), JetBlue, Southwest Airlines, Zappos CEO, (employees who twitter), Comcast Cares (Frank Eliason) (interestingly comcast on twitter is blank).

Twitter is just the tip of the iceberg – there are also “fan pages” on Facebook for brands. Coca-Cola, Zappos, NYTimes, Redbull, Southwest, YouTube Channels, Dunkin’ Donuts, etc, etc. on thousands of other platforms and yet-to-be-invented services.

These are very powerful accounts – they are managed and maintained by many employees around the clock and are the public voices of companies.

I have yet to see or hear of any software tools to enable enterprises to manage Social Web privileged accounts. How are companies managing access by multiple employees to these accounts?

Is there software that does this yet?

Is anyone working on these kinds of tools?

Leave your comments here or tweet with me @identitywoman

Surfacing back into Cyberspace at Building 43 today

Kaliya Young · June 11, 2009 · 1 Comment

Basically this post is to say I am “back” – I have a bit more time on my hands this summer to pay attention to Cyberspace and want to give attention to expressing my thoughts and ideas in text online again. I am inspired by this mention by Scoble around the launch of Building 43 that is happening today. I thought it was an actual physical space when I got the invitation. Turns out it is a website that Robert Scoble is leading. It is focused on what he calls the 2010 web and others call Web 3.0.

Here’s another way to put it. When you look at Techmeme and see all the tech bloggers yammering on about the latest cool things, the way they were this week about Facebook’s new URLs that are coming out tomorrow, or Apple’s new iPhone, do they look backward and think about the average businessperson? Not in my experience. We don’t have an industry conversation about how to actually use all this cool stuff to improve lives, make businesses stronger and closer to their customers, and have some fun.
A few people here and there are trying. I watch what Chris Messina, David Recordon, Marc Canter, Joseph Smarr, Kaliya Hamlin, and a group of others are trying to do by pushing a more open web. Those are the kinds of efforts that inspire me and are inspiring Building43. Can we build on what they are trying to do and take it to main street?

This actually impresses me cause I thought Scoble had just become an internet micro-celebrety for its own sake. I look forward to contributing to the conversation about the future of what is becoming a very social web where peoples identity online matters deeply.
Here is where I have been since my last post.
Since Social Web Foo Camp and posting the 80% complete article about communities context and online life. I haven’t blogged. I have been very busy though.
Immediately following I attended the “identity day” at RSA on Monday April 20th – talks were given from the front of the room for a day. Liberty Alliance put the day together along with the Information Card Foundation- The Kantara Initiative was “launched”. I am not clear that the format of the day actually provided greater understanding by those outside our community that are confused by all the activity.
The exciting thing that happened leading up to this day was the launch of the new Information Card Foundation Website – I gave some feedback that was included in the core language and messaging. It has great Flash animation explaining the cards along with featured projects including the GSA Demo.
RSA was fun – I didn’t spend to much time in sessions mostly talking to people in the community. I led a peer-to-peer session on Business Models for Claims Based Identity. A good group attended however the room layout was cold and stale. (I will be writing about it on my unconference blog shortly).
Penguin Day followed on April 25th. This is a super fun day facilitated by Allen Gunn focused on Non-Profits and Open Source. I learned more about TikiWiki as a content management system (I am considering it as the platform for She’s Geeky). I also was impressed by how much CiviCRM had improved. I also talked to a college registrar very interested in how information card technology might play a roll in getting them out of paper based management of student records and certification.
The Nonprofit Technology Conference followed – they had a large exhibit hall and I talked to many of the vendors there about OpenID and Information Cards – about 1/2 had heard about OpenID and almost none about Information Cards. It was great to talk to my friends in the industry (I have been attending this conference since 2004). Social Actions is progressing and is creating a way to aggregate action information for social good.
I flew to NYC to facilitate the Creative Unconference on May 7-8 put on by the One Club for Art and Copy collaborating with the Society for Digital Agencies. This was during Creative Week. The One Club gives out bronze, sliver and gold pencil’s – some of the most prestigious awards in the advertising business. They attended their interactive awards on Friday night – I brought Robert Tolmach along as a guest and he told me about his new project – Class Wish.
I went to DC and spent the day at the Sex 2.0 conference at the intersection of social media, feminism and sexuality. I was particularly interested in how this community was thinking thinking about and dealing identity online and off. Many people had names they went by within the community that were different from their “every day” names. Several presenters talked about having two facebook profiles (one for their sex life and one for regular life) I pointed out that this against facebook policy and they were surprised – it seemed very natural to have two persona’s. Other presenters talked about being fully “out” completely linking their sex life.
I attended the Anita Borg Institute for Women in Technology Women of Vision Awards. It was a very inspiring evening. Padmashree Warrior the CTO of Cisco was the key note speaker – she was super inspiring and gave ideas about how to connect to the community 2.0 audience.
I spoke at Community 2.0 about identity technologies. I covered OpenID, OAuth and Information Cards and at the end mentioned project VRM for those who were very forward looking. It was a relatively small conference and I spent a lot of time preparing for the talk with my speech coach. My issue has been having to much to say – I can talk about identity for hours and in great detail. Lura helped me figure out what to say. I did a good job clearly communicating and had several people say they enjoyed my talk and it gave them some practical information not just social media guru hype.
I went to the first day of the VRM workshop and was totally impressed by the quality of projects and companies working in the space. Several attendees didn’t know about IIW and a few signed up to attend.
The Internet Identity Workshop was AMAZING. We had the same number of attendees as we usually do. I am going to write some more posts about the event soon. The next IIW is November 3-5 in Mountain View.
I went to the Maker Faire on Sunday the 31st of May – it was fun to see all the stuff people are making. I also got a LiveScribe Pen. I will be using it for diagrams on this blog in the coming months.
June 1 was CommunityOne where i saw Jono Bacon talk about Community there were 10 people to see him speak in an auditorium that held 1000.
I flew to Boston and met with Fabio Carara of the Venice Project Center and Venice 2.0 – they are considering how to leverage 20 years worth of geo-data. We are discussing building a community including a few unconferences.
I had dinner with Mary Ruddy and we continued progress on Identity Commons infrastructure – particularly our new blog/website.
I facilitated the Mass Technology Leadership Council Spring Meeting that asked the question “What is the future of Software and the Internet” I lead a session on identity – they asked good questions and were impressed by all the activity in the space.
I flew to San Francisco – to make it back for the 2nd Scala Lift Off. Scala is a programming language – some describe as Java++, Lift is a web framework. This is a great programming language community with an healthy online community life. I work supporting them in community building when the meet face-to-face.
Yesterday I was working with Forum One facilitating the 4th Online Community Unconference. This is a great community of online community managers (the folks who moderate online community), platform providers (software providers) and hosts (companies that have online communities). I presented a session about OpenID, OAuth and Information Cards – I even got a bottle of wine during the closing from one of the attendees thanking me for the quality of information that I shared.
Today it is the Building 43 party at Tech Crunch and next week is SemWeb in San Jose – I will likely make it to the Personal Democracy Forum. The next “identity” event is Burton Group Catalyst at the end of July in San Diego.
I look forward engaging in this medium again with a post every few days.

Getting OpenID to work – when oh when?

Kaliya Young · March 23, 2009 · 2 Comments

Joseph Boyle who came to our identity panel at sxsw and then joined us for lunch has been sharing with me some of his OpenID challenges. These happen all the time – ALL THE TIME. Thing is – he is a tech guy and he still can’t get any of this to work. I asked him to document his challenges so I could share them with you – he sent this to me and O’Reilly tech folks (that was where he was trying to login)… I am hoping that these UI issues can be resolved soon.

I was going to sign up at:
https://en.oreilly.com/webexsf2009/user/account/signup/attendee#
and saw a Sign up with an OpenID option. Since I’m interested in OpenID, I thought I’d try to use an OpenID associated with one of my Yahoo or Google accounts, but this is proving more difficult than I expected.
I did manage to find Yahoo’s page for turning on OpenID support for my Yahoo account and did this, getting response:

Feeling geeky?

When you log in to a website that supports OpenID login we’ll send your OpenID identifier to the website so it can identify you.

To make things easy, we have generated this identifier for you:

https://me.yahoo.com/a/T_HpXDQkssQpI_sR……………………..

You don’t need to save this identifier. While logging in to websites, you can simply look for a Yahoo! button or typeyahoo.com in the OpenID text field. You can also choose additional custom identifiers for your Yahoo! account below.

Not geeky enough, apparently, as pasting the Yahoo-provided identifiers into your OpenID box gives errors:
Unable to find OpenID server for ‘https://me.yahoo.com/a/T_HpXDQkssQpI_sR…………………….’Unable to find OpenID server for ‘http://www.flickr.com/photos/josephboyle’
Help! What am I doing wrong? Thanks, Joseph Boyle

Identity Panel & Lunch at SXSW

Kaliya Young · March 11, 2009 · Leave a Comment

I am really excited to be heading to Austin tomorrow for SXSW Interactive. After attending for 2 years in a row I didn’t attend last year and watched as all the tweets went by – wishing I was there.
I am facilitating a panel on Sunday morning 11:30 – it should be a lively one. OpenID, Oauth, Data Portability and the Enterprise.
It will be moderated by me, Identity Woman and include these find panelists, Bob Blakely The Burton Group, Danny Kolke Etelos, Inc., Joseph Smarr Chief Platform Architect, Plaxo Inc

The debate over identity, data and authentication is gaining ground in the social networking world. The more difficult discussion regarding enterprises and Web 2.0 has yet to start. Businesses realize that they must protect the data of their company, employees and customers. Join brave leaders from several Web Application companies that are beginning the discussion, “Are OpenID and OAuth good for the enterprise?”

Following there will be a Lunch for all those who want to continue the conversation – you can RSVP here.
There is a Project VRM Breakfast on Saturday morning (we figured that at least that morning people would be able/willing to get up early).
Monday for lunch I am inviting women interested in learning more about She’s Geeky to get together.
I will be tweeting away – and this is a good way to find me while I am there just DM me.
I will do some schedule browsing and post sessions related to identity tomorrow.

on Women talking at technology conferences

Kaliya Young · February 27, 2009 · 2 Comments

Chris Messina has a good post up about women and the Future of Web applications (the conference and the tools).

As far as I’m concerned, one of the greatest opportunities to seize the future of web apps is to cement the necessity of diversity in our processes and in our thinking, not for the sake of diversity alone (deserving though it is) but because the technology that we produce is better for it, being more robust, more versatile and flexible, and ultimately, more humane.
The future of web apps — and the conferences that tell their stories — should not be gender-neutral or gender-blind — but gender-balanced. Today, as it was two years ago, we suffer from a severe imbalance. It is my hope that, in raising the specter of consequences of the lack of women in technology, we begin to make as much progress in stitching diversity into the fabric of our society as we are making in producing source code.

I actually invited participants at Gnomedex 2006 when I was the “MVP” (that is – i didn’t have a schedulled speaking slot but the audience “voted” me on stage to fill a 15 min void for the MVP audience member) to think about these things.
I said that the app builders in the audience should get out of their boxes and start thinking about apps that socar mom’s, and churches and other realms of social civic engagement that could really use some good apps. Places that are not brimming with white guys under the age of 30 (in San Francisco). The audience wasn’t so sure about this idea.
I personally have been asked to speak at one conference this season – Community 2.0 in May. I am working with my speach coach on the talk and very much looking forward to redeeming myself. I worked with her on the last talk I gave at Net Squared in June that went ‘ok’ and I was thankful for that.
I think my story might be helpful in addressing this issue – which is why I am sharing it.
I was tapped by O’Reilly folks to speak at eTel and Web 2.0 in 2006. I didn’t do that great at eTel – I had never given a 10 min speech. I didn’t get any outside voice to help me and I should have but it didn’t even occur to me that one might hire someone to help one in such a situation. I thought I had to do it all on my own.
After the talk they suggested I talk to a speech coach for my upcoming talk at Web 2.0 Expo that they had tapped me to do (that is I didn’t go through the submission process they just asked me) that some of their own hosts of conferences had used – I figured this was a good recommendation. I listened to his advice but it actually failed me – he was not available to help (health issues) but was not clear about how limited his ability to help would be until to late. O’Reilly conferences were not clear with me what the composition of the audience would be (it was a CMP audience not an O’Reilly audience) so I gave the wrong kind of talk.
I was very nervous about the speech – didn’t prep well for (speech coach sort of 1/2 helping (when if I had just been on my own it would have been better) he also encouraged me to push beyond what I had originally said I would cover in the talk – I didn’t sleep that much the night before. I was visionary but that didn’t match what was in the program. 1/2 the audience walked out and I was shaken to the core – basically had stage fright for a year. (here is my blog post following it). There was no talk with O’Reilly folks about what had gone wrong, what could have been better – just silence and never an invite back.
I was “on my own” it was “my responsibility” but I was also in a vacuum. YES it is up to women to take responsibility but if the whole industry is serious about changing who is “always on stage” it also takes a village of – encouragement, good advice, and support.
Women don’t self-promote like the alpha dog’s in the industry do. Sorry it is just true. Ask women in leadership hiring in the software industry. Men over promote their skill set by double when seeking employment (generally) and Women under promote their skill set by 1/2.
I am am getting much better as a speaker. I certainly know what I am talking about in the realm of user-centric digital identity having facilitated over 15 events in the field in the past 3.5 years, doing technical and non-technical evangelism and working on the subject matter for 5 years now. I don’t run around telling conference organizers that I should be speaking at their conferences either. I did apply to RSA to be a Peer-to-peer discussion leader and was chosen to do so for the second year in a row. I also was tapped to facilitate a panel on OpenID, Oauth and the enterprise at SXSW. That is all the speaking I am doing so far this season.
I organized She’s Geeky as a way to address the challenges that we face – both being small minorities at conferences and not many of the faces on stage. She’s Geeky is the most diverse technology conference I have ever been to – it has the most non-white faces I have ever seen at a technology event. Please don’t get me wrong like the woman on stage at FOWA – I love dudes. I don’t think you last long in this industry if you don’t like men, enjoy working with them and can get along in their culture. I also wish there was more women and have decided once in a while to have a women’s only space to geek out in would be a fun thing to support.
I think it is also important to mention something else. As a woman putting yourself out there is risky. I watched what happened to Kathy Sierra – it was kinda freaky. I talked to a friend of mine – another prominent women in tech that week saying how deepy what happened to Kathy had shaken me. She said – well that is what happens if you become prominent enough – you get hate speech and death threats – basically this is what you signed up for if you chose this career path. It is another reason just go about doing my business – working on facilitating the identity community rather then “raising my profile” so conference organizers might tap me. I have had a mild case of a stalker around my work as identity woman a few years ago and I really don’t want another one. Not something guys think about really when they do their day jobs in technology. The latent misogyny is apparently REAL in some corners of this community. We need to know that we have the support of community behind us and won’t be attacked for speaking out against hate speech.
The issues are complex. I hope that as an industry we can continue to address them.

On the Fast Company List of Influential Women in Tech

Kaliya Young · January 26, 2009 · 5 Comments

Fast Company Image
This morning I got a ping via facebook from Bernard Moon:

hey, congrats on making the Fast Company list. you didn’t even post about it on your blog. don’t be humble! 🙂

It is an amazing list. It was sparked in part by the “heated conversation” that erupted after they posted The Most Influential Women in Web 2.0. They divide the list into these 7 categories and resisted the temptation to “number” us from “most influential to less influential” – thank goodness cause that would have been a very alpha-dog thing to do.

I am in the list of evangelists that includes, Mitchell Baker, danah boyd, Red Burns, Susan Crawford, Esther Dyson, Tara Hunt, Charlene Li and Mary Meeker.
This is a quote from their introduction and reflects the same reasons why I helped get She’s Geeky started. That is the unconference for women in tech that is happening for the third time next weekend
women in tech remain at a distinct disadvantage by any metric: average salary, top-management representation, board memberships. Silicon Valley, in particular, remains largely a boys’ club. In May 2007, Women in Technology International published a survey of 2,000 working women, about half of whom reported gender-based workplace inequality or said their opinions were less respected or sought out than those of male counterparts.
Several of the women who are on the list wrote blog posts for Fast company. Later today they are publishing a post that I did about the other women who work in digital identity.
The only tech sector that I know of that has gender parity is the non-profit technology sector. Beth Kanter who I met at the first BlogHer – has a great post about other amazing women in her sector.
Rashmi Sinha from Slide Share has a post up listing A Daily Dose of Blogs for the Tech Entrepreneur.
Tara Hunt co-founder of Citizen Agency has a post on 7 ways to increase your Whuffie Factor.

Parents and Technology

Kaliya Young · January 18, 2009 · Leave a Comment

I just found this article on Yahoo! News.
It is quite disturbing
There are two companies offering a service to parents WQN and Aegis Mobility – there is software and then a monthly fee. Then services track the kids and turn of their phones in certain locations.

WQN’s surveillance service promises more than just disabling the phone in cars. It can monitor a person’s whereabouts, notifying parents by text messaging when their children step out of designated zones or return home. It also can turn off a cell phone at school, preventing cheating by text messaging during classroom tests, based on a reading of the school’s location.
The question parents would have to ask themselves is whether they’d want to prohibit their children’s activities this way. That kid you’re trying to control might not be driving, but rather sitting on a train or a city bus or in the passenger seat of a buddy’s car.

It seems a whole set of technology tools that are part of enabling over parenting. sigh.

OpenID Momentum continues

Kaliya Young · January 16, 2009 · 3 Comments

Dave posted today on the OpenID.net blog articulating the accomplishments of the past year.
I think it is important to acknowledge the significant progress OpenID as an Open Standard for persistent digital identity across the web has made. It is amazing to think how far it has come in 2.5 years since IIW1.
Recently I was talking with a person knowledgeable about the identity community and OpenID in particular – they mentioned that some of the conversations amongst those running for the board didn’t help the community look “good”. I said to them you know a lot of communities have elections and there is 6 board seats open and 6 people running for them – so there really isn’t a dialogue, public conversation that has texture (a different word for conflicting points of view). I celebrate a community that can dive in and engage with a range of points of view and really have a meaty dialogue. This is to be celebrated – the pains of growing up.
Wired just did a detailed article on OpenID’s and Blog commenting. It closed with this… NB: Before you race to point out the irony that this particular blog doesn’t support OpenID logins for comments, I can assure you — we’re working on it.
It also said this:

It’s easier for blogs, which don’t need a lot of demographic information about a user, to let people jump in and start participating socially without filling out a registration form. Major media properties and newspaper websites, on the other hand, want age and income data they can use to sell more targeted ads. OpenID and its companion technologies have mechanisms for sites to collect that data from their users, but those mechanisms are largely left out of the blog commenting systems.

It makes me sad to see this. I was just signing up for a topica list – it asked me for my gender the year I was born and my zip code. It is trying to figure out who I am. What I don’t think is well understood is how information sharing happens over time. Asking people to give away PII (personally identifying information) to look at a newspaper is bad practice and encourages lying.

Among Fast Company Influencers

Kaliya Young · November 7, 2008 · 1 Comment

I am writing this post for all of you coming here after reading the Fast Company article listing the (13) Most Influential Women in Web 2.0. Here is my slide in the deck where you can see the picture Bob took in full glory.
Just to be clear I am part of more then the OpenID community 🙂
I facilitate The Internet Identity Workshop that I co-founded and co-produce with Phil Windley and Doc Searls. It has an amazing range of technologies participating – see below for the list.
I am involved with the whole community working on the identity layer of the web that works for people. OpenID is simply the most visible part in relation to “web 2.0” right now. I am very optimistic about the future of information card technology and the potential for claims based identity to really transform the web.
I am actively involved in Identity Commons (where I got started in Identity in 2004) and it is where you can find a bunch of groups working on a range of social legal and technical issues in this field. Let me know if you want to get involved.
The Internet Identity Workshop is actually happening NEXT WEEK in Mountain View and there is still room – so feel free to sign up if you want to dive in.
Things covered at the Internet Identity Workshop….
Open Standards
* OpenID
* SAML
* Liberty Alliance ID-WSF
* WS-Trust
* OAuth
* OASIS XRI
* OASIS XDI
* XRDS-Simple
* Open Social
* Portable Contacts
Standards Interop
* OSIS
* Concordia
Major Information Card Projects
* CardSpace
* Higgins Project
* Bandit
* The Pamela Project Relying Party Code
* The first Java Information Card library Relying Party Code and Security Token Server code
Browser Based Card Selectors
* Higgins Project (offers both browser-based and native card selectors)
* openinfocard
Multi-Protocol Open Source Projects
* Higgins Project (supports Information Cards, OpenID, SAML, XRI, XDI)
* Shibboleth
* CAS (supports OpenID, SAML, prototype Information Card support)
* Bandit
* OpenSSO (supports SAML, Liberty ID-FF/ID-WSF, WS-Federation, Information Cards, OpenID)
Industry Consortia
* Identity Commons
* Liberty Alliance
* OASIS ID Trust
* ITU-T Focus Group on IdM and subsequent activity.
Groups Addressing Legal/Social/Business Issues
* PPEG Privacy Summits Liberty
* Project VRM
* Liberty Alliance Identity Assurance Framework
* Liberty Alliance Identity Governance Framework

Big Annoucement: Information Card Foundation

Kaliya Young · June 24, 2008 · 16 Comments

This is the Information Card Foundation website. Charles Andres the ED of the foundation has been working hard getting it ready.
This announcement is really big news on several levels.
There are major internet players on board committed to cooperating together on this technology – as the founding corporate board members Novell, Oracle, Microsoft, Google, PayPal, Equifax. There are quite a few companies that are also launch members:
Arcot Systems,
Aristotle,
A.T.E. Software,
BackgroundChecks.com,
CORISECIO,
FuGen Solutions,
Fun Communications,
Gemalto,
IDology,
IPcommerce,
ooTao,
Parity Communications,
Ping Identity,
Privo,
Wave Systems,
WSO2;
associate members
Fraunhofer Institute
Liberty Alliance;
The people in this community on the board are also really great and have met an talked with most of them myself.
Paul Trevithick,
Kim Cameron, (as a community member not MSFT’s rep)
Mary Ruddy,
Ben Laurie
Pamela Dingle
Patrick Harding
Drummond Reed
Andrew Hodgkinson (I haven’t met)
Axel Nenker (I haven’t met)
Mike Jones (as the MSFT board member)
This includes PayPal and Equifax who have been publicly involved with the user-centric identity efforts until now.
One of the issues with information cards will end-users actually adopt the client side code they need to make this work? And who will issue managed information cards.
PayPal has the ability to really drive client side adoption of card selectors and to be a managed card issuer.
It got coverage in the NYTimes. (Yhey spell Bob Blakley’s name wrong in it)
I found it frustrating they said these technologies were “like a drivers license”
The community has worked so hard on the Laws of Identity and the OECD paper with the Principles of Identity. Drivers Licenses seem like the wrong analogy to explain the technology and make people safe or excited about it. I don’t like being asked for my drivers license everywhere – it often gives away to much information. Oh well. I guess there is more explaining to do about how these systems can and should work to improve on how we do identity in the real world with drivers licenses.

Sir Tim on Tracking

Kaliya Young · March 18, 2008 · Leave a Comment

Sir Tim said he did not want his ISP to track which websites he visited.

Does OpenID meet P___/Activist test yet?

Kaliya Young · March 14, 2008 · 1 Comment

Beth Kanter one of my favorite nonprofit tech friends Twittered this article The Cute Cat Theory Talk at eTech.
It puts forward an interesting hypothesis:

Based on my Tripod experience, I’d offer the hypothesis that any sufficiently advanced read/write technology will get used for two purposes: pornography and activism. Porn is a weak test for the success of participatory media – it’s like tapping a mike and asking, “Is it on?” If you’re not getting porn in your system, it doesn’t work. Activism is a stronger test – if activists are using your tools, it’s a pretty good indication that your tools are useful and usable.

The article goes continues summarizing a half dozen or more examples of how tools on the web have been used for activist purposes. It is an amazing list and worth the read.
I guess I am wondering if OpenID has been used for activism yet? I know that I have been evangelizing the concept in the NPTech community for longer then anywhere else – beginning at NTEN’s Nonprofit Technology Conference (NTC) in 2004. I am still not sure that it has sunk in or that they have figured out how to use it. Unfortunately I will not be at the NTC this year to find out.
Sorry – I am really trying to get openID to work on this hoster (well my tech person Lucy is) there is still something not working. So if you want to comment either link to this blog post and say it on your own site or send me e-mail kaliya (at) mac (dot) com. If any of you OpenID tech folks want to see if you can help her solve the problem let me know I will put you in touch.

Australian – ID Plan Srapped…

Kaliya Young · December 27, 2007 · Leave a Comment

This just off slashdot today:

“The proposed Australian ‘Access Card’, a universal ID that would be required for any Australian wishing to use Medicare, Centrelink, the Child Support Agency, or Veterans’ Affairs, has been scrapped by the incoming Rudd Labor Government. The card would have contained an RFID tag with the person’s name, date of birth, gender, address, signature, card number, card expiration date, and Medicare number, but there were also provisions to add more personal data later on. It seems that Rudd Labor is not eager to copy the American REAL ID Act.“

From the Ars Technica article:

Encrypted information contained within the card’s RFID chip would have included a person’s legal name, date of birth, gender, address, signature, card number, card expiration date, and Medicare number. Provisions were also included that would allow additional information deemed to be necessary for either “the administration or purposes of the Act.”

The Australian Privacy Foundation was one of the main groups behind the opposition to the plan.

Data Interop: an open letter from the largest nonprofit vendor

Kaliya Young · November 27, 2007 · Leave a Comment

Recently a report from a know tech publication was at a conference I was leading. She asked me
“what is interesting that is happening right now.”
I said “the nonprofit technology session.”
She said – “well I cover business issues.”
I shared with her that one of the largest vendor of nonprofit technology Kintera was a publicly traded company AND that there was big business opportunities for providing technology solutions in that sector. She looked at me surprised as if it had never occurred to her that you could make money in this sector. Recently the two other large vendors in the space merged – Get Active and Convio. They became just Convio and are now the largest vendor in the sector.
This month’s theme for NTEN’s Newsletter is Data Interoperability. This is the open Letter the published there.

Gene Austin, Chief Executive Officer, Convio and Tom Krackeler, VP, Product Management, Convio
It is incumbent on all software vendors serving the nonprofit sector to open opportunities for nonprofits to have greater choice and flexibility in pursuing their missions.
To meet the expectations of nonprofits today — and five years from now — software vendors need to facilitate interoperability between systems and enable integration between offline and online data and the new Web. And they should do so with one clear purpose in mind: to open the possibilities for nonprofits to find and engage constituents to support their missions.
The NTEN community has been leading the charge for openness. With Salesforce and Facebook, Convio has embraced openness as a way of doing business.
Software vendors should:
1. provide nonprofit organizations of all sizes and in any stage of Internet adoption the flexibility to integrate with other web or database applications to exchange constituent and campaign data.
2. make their Open APIs available to clients, partners, and a broad developer community.
3. expose Open APIs as part of their core product functionality.
4. proactively use APIs provided by other companies in additional to providing their own.
5. make their API documentation publicly available and provide a forum for sharing and discussing best practices and exchanging code examples.
6. publish a roadmap for their API development and encourage participation in the development of that roadmap.
7. make their APIs accessible to nonprofits at a level that does not require extensive technical expertise to leverage those APIs.

The Up's and Down of electronic surveillance litigation

Kaliya Young · November 7, 2007 · 1 Comment

Creapy Creapy from Slashdot:

The US government is seeking unprecedented access to private communications between citizens. ‘On October 8, 2007, the United States Court of Appeals for the Sixth Circuit in Cincinnati granted the government’s request for a full-panel hearing in United States v. Warshak case centering on the right of privacy for stored electronic communications. … the position that the United States government is taking if accepted, may mean that the government can read anybody’s email at any time without a warrant.

On the ‘up side’ from the Washington Post:
The AT&T whistle blower Mark Klein is

in Washington this week to share his story in the hope that it will persuade lawmakers not to grant legal immunity to telecommunications firms that helped the government in its anti-terrorism efforts.
“If they’ve done something massively illegal and unconstitutional — well, they should suffer the consequences,” Klein said. “It’s not my place to feel bad for them. They made their bed, they have to lie in it. The ones who did [anything wrong], you can be sure, are high up in the company. Not the average Joes, who I enjoyed working with.”

His story as articulated by the post is as follows:

The job entailed building a “secret room” in an AT&T office 10 blocks away, he said. By coincidence, in October 2003, Klein was transferred to that office and assigned to the Internet room. He asked a technician there about the secret room on the 6th floor, and the technician told him it was connected to the Internet room a floor above. The technician, who was about to retire, handed him some wiring diagrams.
“That was my ‘aha!’ moment,” Klein said. “They’re sending the entire Internet to the secret room.”
The diagram showed splitters, glass prisms that split signals from each network into two identical copies. One fed into the secret room, the other proceeded to its destination, he said.
“This splitter was sweeping up everything, vacuum-cleaner-style,” he said. “The NSA is getting everything. These are major pipes that carry not just AT&T’s customers but everybody’s.”
One of Klein’s documents listed links to 16 entities, including Global Crossing, a large provider of voice and data services in the United States and abroad; UUNet, a large Internet provider in Northern Virginia now owned by Verizon; Level 3 Communications, which provides local, long-distance and data transmission in the United States and overseas; and more familiar names such as Sprint and Qwest. It also included data exchanges MAE-West and PAIX, or Palo Alto Internet Exchange, facilities where telecom carriers hand off Internet traffic to each other.
“I flipped out,” he said. “They’re copying the whole Internet. There’s no selection going on here. Maybe they select out later, but at the point of handoff to the government, they get everything.”
Qwest has not been sued because of media reports last year that said the company declined to participate in an NSA program to build a database of domestic phone-call records out of concern about its legality. What the documents show, Klein contends, is that the NSA apparently was collecting several carriers’ communications, probably without their consent.
Another document showed that the NSA installed in the room a semantic traffic analyzer made by Narus, which Klein said indicated that the NSA was doing content analysis.

AT&T has programming language for surveillance

Kaliya Young · October 30, 2007 · Leave a Comment

on the WIRED Blgo Network

From the company that brought you the C programming language comes Hancock, a C variant developed by AT&T researchers to mine gigabytes of the company’s telephone and internet records for surveillance purposes.
An AT&T research paper published in 2001 and unearthed today by Andrew Appel at Freedom to Tinker shows how the phone company uses Hancock-coded software to crunch through tens of millions of long distance phone records a night to draw up what AT&T calls “communities of interest” — i.e., calling circles that show who is talking to whom.
The system was built in the late 1990s to develop marketing leads, and as a security tool to see if new customers called the same numbers as previously cut-off fraudsters — something the paper refers to as “guilt by association.”