Identity Woman

Independent Advocate for the Rights and Dignity of our Digital Selves

ID Technology

I did it! SSO is really here and some cool identity links

· · Leave a Comment

I of all people should have done this before but I was waiting for OpenID 2.0 to be out there and working so I could use my i-name. I went to Ma.gnolia today and it just worked. They have a great way to integrate an OpenID with an existing account. I hope that I can pull over my delicious bookmarks. I joined the Identity 2.0 bookmark group.
I found some interesting sites

Wikidentity is a Flash client that shows you any hCards in a page you are browsing, and allows you to search for hCards that other users have helped index. You can also export hCards that you’ve discovered to use in a variety of applications, such as Address Book.

hCards are nice but I am not about to post mine on the web for anyone to scrape.
Unit Structures latest recommendation to Social Network Designers:

In the past, I’ve done a good deal of writing explaining how to design better and more relevant SNS. Today I offer designers of social network sites my single most valuable piece of advice: Adopt OpenID.
The walled gardens will stay with us, but walled gardens in social network sites need to be a thing of the past. Imagine the pitch – you can add friends from any OpenID network to your SNS. This has huge, democratic possibilities. This feels natural for SNS – walled gardens don’t. If you’d like to find out more about OpenID, you can refer to this primer I wrote about it on the ClaimID blog, or you can email me and I can help put you in touch with folks who will be able to help you. Once you grasp OpenID, and see how naturally it works with SNS, you’ll see what a valuable direction it is to take your product.
OpenID is coming – the tipping point grows closer each day. This is a tremendous opportunity – and I do hope you’ll consider it seriously. This is the way of the future.

The thing I don’t like so far is that it doesn’t make recommendations the way Delicious does. Maybe this is a forthcoming feature.
I found this article by David Kerns on reputation and trust that points to Clippinger’s blog. He has not posted since 2005. According to the social physics site he has a book coming out next year. Interesting. I wonder if Doc can convince him that blogging ideas and parts of the book and sharing with them the community might be a good idea. It seems that if markets are conversations books certainly are. As Kim learned with the Laws of Identity getting community input was a good idea for everyone.
The importance of Annonymity being baked into our systems is highlighted by Ben Laurie:

Firstly, when I say anonymity should be the substrate I am not just talking about the behaviour of identity management systems, I also mean that the network itself must support anonymity. For example, currently, wherever you go you reveal your IP address. Any information you give away can be correlated via that address. People sometimes argue that this isn’t true where you have a dynamic address, but in practice that isn’t the case: most dynamic addresses change rarely, if ever – certainly they tend not to change unless you go offline, and the rise of always-on broadband makes this increasingly unusual. Even if the address does change occasionally, you only need to reveal enough information in the two sessions to link them together and then you are back to being correlated again.
Secondly, people seem to think that privacy is an adeqaute substitute for anonymity. I don’t believe this: privacy is all about voluntarily not linking stuff you could link. Anonymity is about making such linking impossible. Microsoft’s Cardspace claims to provide anonymity where, in fact, it is providing privacy. Stefan Brands comes close with his selective disclosure certificates, but they are still linkable, sadly. These systems only provide privacy if people agree to not make the links they could make. Anonymity provides privacy regardless of people’s attempts to undermine it. That’s why you need to have anonymity as your bottom layer, on which you build whatever level of privacy you can sustain; remember that until physical onion routing becomes commonplace you give the game away as soon as you order physical goods online, and there are many other ways to make yourself linkable.

I do sense that this is not being thought about enough. I hope that Stefan can participate more actively in the community so that we will address it more fully.
I found this post by Bokardo a social web designer. He has a post on Domain as Identity and the services behind it. I totally agree and I can’t wait for him and others to discover the cool things they can do with XRI and XRDS. The TOTH (Thrill of the Hack) experimentation has just begun 🙂
I would encourage you guys to join Ma.gnonlia – for two reasons one it is OpenID2 enabled AND it has cool group bookmark sharing features.

Tricorder information

· · Leave a Comment

So we thought we had problems with RFID chips floating around. Well just wait until these little gadgets can start scanning us. This is coming up now I am going through my notes from the past 6 months in my little black book and finding out about all sorts of little things. I took this note down while at OSCON talking to people about the cool things from the prior year’s FooCamp. This was what Susan Crawford had to say about it.

Scott Gray (ex-LearningLab) has a couple of things to talk about. (I’m sure he has many things to talk about — he’s irrepressible and superlative by nature.) First, he wants to tell us about what he thinks is the BEST TECHNOLOGY EVER.
What is it? It’s using spectrum that we have trouble generating (terahertz gap spectrum, between microwave and infra red) that can bounce through materials safely and tell us what’s inside. He’s telling us that organic materials resonate at these frequencies. So you can point a reader (a tricorder) at yourself and see whether you have cancer, or a virus, or you can point at a road and see whether there’s a bomb buried there. The detector technology for this spectrum is very advanced, but it’s expensive and difficult (right now) to generate the waves. There’s a company that is working hard on this, and Scott thinks there’s a huge future here.
He notes that Star Trek gave us the communicator, and Get Smart the slamming doors — this will be a Star Trek device that we’ll carry around.
Then he switches gears and talks about online education. He’s into training people how to program by putting a lot of effort into technology (so they have a live terminal view of their environment) and not that much into teachers. Teachers can be coaches, answering queued-up questions. Students can be exploring, education can be cheap, and it can all be constructive. No simulations, no self-grading, and lots of interaction between teacher and student. No one-sided lectures (he got some reaction here from people who pointed out that we got interested in his first topic because he told us about the Star Trek link; context and scaffolding helps). He’s working hard on how to educate asynchronously.

UX and OpenID the hickups are beginning

· · Leave a Comment

The weather that Tom brings us on OpenID is mixed but good in the long run. He says that community is what counts 🙂

Here’s what I learned enabling the sites with OpenID:The Good: OpenID registration is a beautiful thing. The legacy registration page on Stuffopolis can be scrapped. Once that happens, validating email addresses, requiring passwords and lost password security questions for new members will be forever outsourced to the OpenID providers (those that your website trusts).

The Bad: When introducing OpenID, it is a breeze for new members coming to the site, but it can be a little confusing for existing members who registered with the legacy credentials. When those existing members find out about the OpenID option, instead of logging in with the legacy credentials to add the OpenID to their account, they often log in with their new OpenID instead. This log-in will attempt to create a new account by fetching simple registration data from their identity provider. If their email address (sent by their identity provider) matches the one already registered with their legacy account, they can be given some instructions, but sometimes it doesn’t match and now we have a problem because if they go back and log in with the legacy credentials, they can’t associate their new OpenID to it because another account (the one they accidentally created) now has that OpenID.
Update 12/17: What I need to do is when a member goes to his profile page and attempts to modify his OpenID, after a successful OpenID authentication, if the site detects that there is another account with the same OpenID, then the site will ask the member to confirm that he wants the other account deleted, making sure there is only one account with that OpenID.
The Ugly: Now that some popular open source packages (wordpress, mediawiki, phpBB) support OpenID, the software should honor each other’s OpenID sessions so that someone who logs into mediawiki with his OpenID doesn’t get presented with an OpenID login form when he visits phpBB, for instance. Although this isn’t a huge problem, it is a little ugly and it seems it will require a standard way of registering OpenID apps on a system so that an OpenID session state change in one app will inform the others.
In a nutshell: OpenID is still immature, but it has an extraordinarily committed community behind it and when it comes to software, that’s what counts.

Sneaker Tracking

· · Leave a Comment

From Bruce Schneier:

However, it turns out that the transmitter in your sneaker can be read up to 60 feet away. And because it broadcasts a unique ID, you can be tracked by it. In the demonstration, the researchers built a surveillance device (at a cost of about $250) and interfaced their surveillance system with Google Maps. Details are in the paper. Very scary.

Cool new wiki feature

· · Leave a Comment

I went through TechCrunch today as I do on a weekly basis to check out what is new in web2 land. Lots of kids building interesting things but I kind of think mmmm…to a lot of them. Also lots of acquisition rumors. By the end of it I wondered why me? Why this industry almost completely devoid of meaning in a particular way.
The one cool ting that I did find was a new feature called “UnPlug” for SocialText Wiki’s so you can get a section of a wiki you want to edit on your computer and work on it ofline (say on a plane ride) and then when you plug back in it is uploaded. VERY COOL.

O'Reilly on Who 2.0

· · Leave a Comment

Tim O’Reilly From eitb24:

Certain kinds of databases are going to become really big and really useful. we are just in the early stages where for example digital identity doesn’t really work yet but that world start to coalesce, where all these different sources of identity will start to be resolved and connect to each other. And we’ll have a rich identity system you could call Who 2.0.
Just like you are starting to see Where 2.0 in the way that mapping is starting together…so you think about the various dimensions of the data that we interact with who, where what, when, why and how are a little bit harder but the more pragmatic dimensions will be come part of this new data oriented operating system that we are building.

An argument for i-names & XRI

· · Leave a Comment

I found this while using Snap too. I have to say it is way more entertaining then Google. As you toggle down the suggested site. I will be back to try it out more regularly.
From Fishbowl on Oct 25th 2005….

“I’ve noticed that whenever I have a photo on Flickr that I want to embed in my blog, I make a local copy and link to that. Flickr may well out-last the Fishbowl, but at least the continuing availability of my webserver is something that I have a say in.” — Me, a few minutes ago.
I registered the pastiche.org domain back in 1997. Since then I’ve been through a half dozen or more ISPs and hosting services, but I’ve done so secure in the knowledge that so long as I keep paying my domain renewal fees, my email address, website and whatever other Internet perks I feel like having will follow me wherever I go.
(There are disadvantages, of course. Even for a non-entity such as myself, eight years of being careless with the one email address leads to a lot of spam.)
I had this conversation with a friend, and they told me not to worry: Gmail is likely to survive longer than I’m going to need an email address anyway. But that’s not the point. In five years, Gmail is going to be what Hotmail is today, and there will be another service that’s cooler and more capable that people will rather be keeping their email in.
“Letting somebody else own your name means that they own your destiny on the Internet…. As soon as you realize you’re serious about blogging, move it away from a domain name that’s controlled by somebody else. The longer you delay, the more pain you’ll feel when you finally make the move.” — Jakob Nielsen’s Weblog Usability mistakes, #10.
Recently, Australian politician Malcolm Turnbull proposed that the government give each citizen a lifetime email address. There were obvious flaws: the proposed address scheme — first name, surname, date of birth — consists of two pieces of data that can change, and one that people often want to conceal. Regardless, the underlying concept of a permanent ‘digital identity’ is an important one. After all, cool URIs don’t change.
If there’s a Web 3.0, it’s not going to be about giving you cool sites to put your stuff on “out there”, but about giving you the tools to build that cool stuff on top of your own persistent, personal space on the net… in a way that when the services change, the technology advances and the trends turn, the stuff stays where it is.

The Open Phone a platform for User-centric ID apps?

· · 1 Comment

Reading SlashDot I found this article about the Open Phone coming out with a Linux operating system. The left lots of room for folks to write apps to run on top of it. It sounds like a great platform for some identity applications and UI experimentation. Maybe we can have a session at IIW regarding its potential.
On another note I went to ‘digg’ it and it asked me to login….I don’t want another name and password thankyou!

Web 2.0 – at WITI they forgot that means WIFI in the conference rooms.

· · Leave a Comment

Robin Raskin ‘the internet mom’ has a site called Raising Digital Kids and blogs for Yahoo! Tech. She lead the ‘What is web 2.0?’ panel. She did a great job of helping orient the mostly ‘I work in large corporate IT’ folks. The woman who worked for Microsoft highlighted that it was a way of thinking in response to the people who wanted to ‘get the tools.’
Apparently it is a way of thinking the folks at WITI (Women in Technology International) have not picked up on yet. There is no wifi here except for ‘in the lobby’ that you have to pay $10 for and it has no outgoing SMTP [Why do you pay $10 and still not have working outgoing email tell me that tmoblie].
I knew the sessions here would be marginally interesting to me but that I would have a fine day listening while I kept up with e-mail, blogged and did my every day stuff. I also sort of naively thought their might be opportunities to interact with and connect to the women here but it seems to be all talking heads panels (it makes me long for an unconference). I will get my fix of those in the next two weeks as I facilitate both Startup Camp and Ruby on Rails Camp. Johannes and I are going to lead a session at Startup Camp on Identity on Friday morning in the second session.
During the session:
NO one has a computer open….
and No one cares there is no internet
These were the statistics for usage of the following tools in a room of 100.

  • Digg(5),
  • Flickr (3),
  • Wikipedia (3) 1/2 use it to look stuff up
  • Del.icio.us (6)

Anyways. This group has a ways to go to get hip with the latest in technology. I just spoke with Robin Raskin and she said the audience is 1/2 corporate types and 1/2 independent both of which need to know about the lastest stuff because it is changing everything rapidly.

What is a Barrier to Entry – OpenID

· · Leave a Comment

This comment was posted by Vivek Puri at the bottom of Ramana’s post (quoted above).

OpenID is great idea, but adds another layer of complexity for early adopters. This might not go down well with the startups who can end up loosing important initial users. Also bigger companies like Google will offer Single Sign-on only for their own apps which becomes another point of disconnect. In my case I use Writely for document editing, Editgrid for spreadsheet, and del.icio.us for bookmarks which is a pain to manage.
As for offline usage, that is a very much required feature. Especially Writely should be able to implement that part easily since they have already cracked the algorithm for multi-user data edit and sync. Groove networks does offer that feature but is not for individual.

I guess there is some miscommunication in what OpenID is and how it actually lowers the barrier to entry to try new Office 2.0 applications.
This is how I see it.
I have my blog URL that is openID enabled or I have an i-name. I now can go to any one of the new groovy Office 2.0 applications and instead of getting yet another login and password. I just use my OpenID. I don’t have to put it into that spreadsheet of all my names and passwords or just use the same one I use everywhere that is totally insecure. Instead I bring my identity to the site. I save time. If I am an early adopter type I will likely get an OpenID relatively quickly and it will be a handy fast way for me to try these things out. Of course Office 2.0 applications should not force people to have OpenID’s those who want yet another user name and password can have one.
I know personally I avoide signing up for anything new that requires yet another login. I would be more inclined to tryout an Office 2.0 application that has OpenID as a login option.
I think all these office 2.0 copmanies can collectively compete with the big silo’s by offering SSO amongst themselves.

OpenID on the 'edge of greatness"

· · Leave a Comment

Here are some of the great quotes about OpenID this week –
Tom in Austin says:
I’m a big fan of OpenID and I think it’s on the edge of greatness.
Norman Walsh:
Next time you build a web application that needs a login, consider OpenID.
btbytes:
Perhaps in future, sign-up fatigue will keep people away from signing up to new services. Providing OpenID option is very welcome.
Amblin:
You can now sign in with an OpenID when you leave comments on the blog. Why did I added this? To do my little part to try and break some of the ID silos.

Paul how does SAML help exactly?

· · Leave a Comment

I thought you could clarify how you think SAML will help with this.

While multiple screen names can be tracked at home, the company is working on a tool to associate different screen names across school and home to notify parents.

Isn’t the whole point of the Laws of Identity that people should not have there identifiers aggregated across contexts without their knowledge.

e-passports cloned…

· · Leave a Comment

This was on Wired yesterday (posted on Slashdot). I think it highlights the importance of thinking deeply about how these proposed identity systems work. The other security flaw is the ‘integrity’ of the databases that the passport system is built on.

A German computer security consultant has shown that he can clone the electronic passports that the United States and other countries are beginning to distribute this year.
The controversial e-passports contain radio frequency ID, or RFID, chips that the U.S. State Department and others say will help thwart document forgery.
“The whole passport design is totally brain damaged,” Grunwald says. “From my point of view all of these RFID passports are a huge waste of money. They’re not increasing security at all.”
Grunwald plans to demonstrate the cloning technique Thursday at the Black Hat security conference in Las Vegas.
The United States has led the charge for global e-passports because authorities say the chip, which is digitally signed by the issuing country, will help them distinguish between official documents and forged ones. The United States plans to begin issuing e-passports to U.S. citizens beginning in October.
Although countries have talked about encrypting data that’s stored on passport chips, this would require that a complicated infrastructure be built first, so currently the data is not encrypted.
“And of course if you can read the data, you can clone the data and put it in a new tag,” Grunwald says.
The cloning news is confirmation for many e-passport critics that RFID chips won’t make the documents more secure.
“Either this guy is incredible or this technology is unbelievably stupid,” says Gus Hosein, a visiting fellow in information systems at the London School of Economics and Political Science and senior fellow at Privacy International, a U.K.-based group that opposes the use of RFID chips in passports.

Open Standards have interesting consequences…anyone can use them… it also highlights the need to have ‘social’ fabric underlying any identifier system/network.

Grunwald says it took him only two weeks to figure out how to clone the passport chip. Most of that time he spent reading the standards for e-passports that are posted on a website for the International Civil Aviation Organization, a United Nations body that developed the standard. He tested the attack on a new European Union German passport, but the method would work on any country’s e-passport, since all of them will be adhering to the same ICAO standard.

How did he do it?

  1. Grunwald then prepared a sample blank passport page embedded with an RFID tag by placing it on the reader — which can also act as a writer — and burning in the ICAO layout, so that the basic structure of the chip matched that of an official passport.
  2. As the final step, he used a program that he and a partner designed two years ago, called RFDump, to program the new chip with the copied information.
  3. The result was a blank document that looks, to electronic passport readers, like the original passport.He obtained the reader by ordering it from the maker — Walluf, Germany-based ACG Identification Technologies — but says someone could easily make their own for about $200 just by adding an antenna to a standard RFID reader.

Why it is a security failure…

The demonstration means a terrorist whose name is on a watch list could carry a passport with his real name and photo printed on the pages, but with an RFID chip that contains different information cloned from someone else’s passport. Any border-screening computers that rely on the electronic information — instead of what’s printed on the passport — would wind up checking the wrong name.

Identity Open Space – Sept 11, Santa Clara

· · Leave a Comment

So we have had a fabulous series of open space events since May’s Internet Identity Workshop . The Identity Mashup at Berkman 3rd Day Open Space Post Liberty Alliance Identity Open Space specifically but also as major themes at Mashup Camp that had 5 sessions on identity and at OSCON and OSCamp.
I think one the reason things have been developing rapidly is because of the open opportunities to address critical issues and reflect as a community on next steps. So there is another one coming up before the next Internet Identity Workshop in December.
The Monday of Digital Identity World’s start we are hosting an Identity Open Space at the Santa Clara Convention Center. It will begin at 9am with agenda creation with sessions starting at 9:30 going until 3 when DIDW officially starts.
The cost is $25 just to cover lunch – so we can eat on site. Please sign up here… and add your name to the wiki and post suggested topics you bring to the conversation.
You also get a discount on attending Digital Identity World if you come to the Identity Open Space.
I know it is a bit of a challenge to travel on Sunday but I hope those of you from out of town will choose to do that. Hopefully we can get lost of folks working on new web tools who might be able to actually use – user-centric identity. Besides who wants to get on a plane on September 11th.

Technorati Tags:

New Newsreader Needed -Help

· · Leave a Comment

I have been using NetNewsWire since I began reading blogs. The trouble is that it is WAY SLOW. Does anyone have a not slow client side mac RSS reader they like?
I can’t stand what I have now it takes like 5 seconds to move from one post to the next. I know I have a lot of posts – cause I am keeping way more posts then I actually read. I do this cause so far there are not good engines that let me search small slices of the blogosphere well. So saving them on my computer seems like the way through.

MyAPI we need it now

· · Leave a Comment

So, right now they only way to verify that I own an account online “that I am who I am” is giving a third party the login to my account.
I want myAPI a secondary login for making assertions of ownership of an account as well as access to data in that account – like the books that I have bought, my linked in contacts, my budy list etc..
We need standard ways to access (via MyAPI) and share this information (putting information in standards formats (xri perhaps?) so that it can be integrated and aggregated by me and services that I want to use).
MyAPI has a different password then my ‘primary’ account and perhaps there are a few different levels of privileges.

Technorati Tags: , , , ,

A few emerging techs at emerging tech

· · 1 Comment

The first full day of ‘conference’ opened with the best ’emerging tech’ we were to see all day. It was a late addition to the program and happened because Tim saw him at TED. (so much for the submission process). Jeffery Han shared the touch table interface for the computer. This is actually sexy technology – sensual and very embodied.
We had Artificial Artificial Intelligence with Amazon’s Mechanical Turk – basically it is micro-outsourcing to india (as far as I can tell) and yesturday R0ml in keeping with presentation as performance art said what they were up to at Root was Artificial artificial artificial intelligence.
IBM presented the enterprise mashup Wiki that looked cool. (apparently in the article I linked to Mashosphere is now a word)
Clay had Hobbs and Rousseau argue about Dave Winer to articulate the need to develop a pattern language for moderation. This is to address the Freedom to Annoyingness curve of online community space. This is vital to supporting the encoding bargain we are making with social tools about freedom of speech.
There was Playsh that was like MUD text searching on the web (I think)
Yesturday for keynotes you had two talks that were way to short. The Real Nature of the Attention Economy and George Dyson’s history lesson on the visions of web 2.0 that go back 160 years.
Mary Hodder presented on itags followed by Dana Boyde on Glocalization and what happens we we mash global and local together. It was a great articulation of some anthro and ethnography for the geeks to get what online community is about. (i will post details later)
The best study people do something cool application has to be Reep’s Trampoline Collaboration Platform. From his research of on one of the scilly island’s St Agnes. They have only 80 residents.
Last night they had a mini-maker faire it was really fun. Glowing clothing, roomba cock fights, “new” attari games,

Technorati Tags: ,

Meet space technology improvement for etech and other 'traditional' conferences

· · 1 Comment

Ao the physical space situation here at etech is horrible. The rooms are too small – it is not only sold out but over sold. We are sitting in the isles and standing 2 deep at the back of the room. Here is a summary of the current issues and some potential solutions.
Venues – flexible support for interaction:
It seems there is a real market for innovative collaborative community meet space. With the emergence of camps and unconferences what are the space that can support these events. The space where we meet – like the nowhere store was.
Accommodations – We need integrated diversity:
I am staying the youth hostel (it is the nicest one I have ever been in). Because for this event I want a nice bed to sleep in and I don’t care if I need to share with others. I am paying $72 for three nights (they make $96 if they sell out my 4 bed room). Some want the kind of accommodations that cost $300-$500 a night. How can you have those market nees and everything in between near by.
Food – good food reasonable cost:
How can you feed people good food for low cost. I think most coming to a conference would be able to afford about $10 a meal. Presentation doesn’t matter really the food does. This is what we paid for food at the internet identity workshop – people loved both lunches.
Hotels are making a lot of money right now off conferences – charging a lot per day for people to attend an event and be fed.
Carpooling – How do we get there?:
There are some sides that do this like space share but it is not totally easy to do yet and you have to re-enter a profile all the time. How do I put out a carpool request on my blog that will get circulated to the people who are also traveling from my area and might be driving. How can this be managed in ways that don’t overwhelm everyone with my request but just those who might help.
Process – What are the processes we use when we gather?:
The submit, committee select, present model is a bit stale. I have gone to three talks this afternoon and keep thinking tell me something I don’t know yet. If you are going to present get to the point. I am a big believer in the short presentation – we use them at planetwork 5-10 min. Go through your concepts faster cause I get what you are saying.
Some things deserve the full attention of the whole group but only about 1/10th of what they make us give our full attention to.
Examples of this would be Bruce’s talk last night but – give him a lot of time because he has a reputation of killer talks that are engaging. Folks were not doing their e-mail during it they were listening. This morning it was the light table interaction demo (it was super amazing) the there was no typing. As well Linda Stone’s insightful talk about what was coming next after Continuous Partial Attention. Basically she said ‘analogue’ is the new ‘digital’ as jair would say.
There is open space technology, speed geeking, appreciative inquiry lots of different change processes [see Change Handbook]
Ambient Findablity of people:
(I am writing this post in the Ambient Findability presentation)
Help me find the people in this stack of 1,300+ folks that I want to meet and talk to. Who has identity problems that I can help people find the resources in our community? Who is working on socially good tech stuff that would love to know about Planetwork? Can applications like attendr and Hallway help? Can we get investment in these open source tools – if you want you can use the something like $10,000 + $10 a head intronetworks (that I get to use it for PCForum.) That is not accessible.

Technorati Tags: , , ,