ID Topics

Digital Identity -> Sculpture

Kaliya Young · August 13, 2009 · Leave a Comment

My friend Cameron Hunt sent me a link to this AMAZING site this morning.

IDENTITÄT: the »Gestalt « of digital identity

From the far end of the Concept page:

The goal of the project was not to create a readable data sculpture of someone’s digital life, but to express how an analogue snapshot of complex digital identities can be presented. Based on four defined criteria all sculptures had to be comparable in their form, size and expression. After generating those sculptures based upon the particles only, we added time as an underlying factor. The particle system, which represents a persons interests, spreads in space until it is balanced. The speed of this expansion, the thickness of the created hull and the starting point of the drawing process is connected to the factors age, activity and communication behavior.

This system leads to an embodiment for the final ~Gestalt of digital identity. A still life of an ongoing process about redefining and decorating. This dynamic process of digital »day life« is captured in our personal interpretation of the digital identity as an amorphous sculpture.
The Process Page says more about how they did it.

Missing: Privileged Account Management for the Social Web.

Kaliya Young · July 27, 2009 · 3 Comments

This year at SXSW I moderated a panel about OpenID, OAuth and data portability in the Enterprise. We had a community lunch after the panel, and walking back to the convention center, I had an insight about a key missing piece of software – Privileged Account Management (PAM) for the Social Web – how are companies managing multiple employees logging in to their official Twitter, Facebook and YouTube accounts?

I thought I should also explain some key things to help understand conventional PAM then get to social web PAM in this post covering:

regular identity management in the enterprise,
regular Privileged Account Management in the enterprise
Privileged Account Management for the Social Web.

1) IdM (Identity Management) in the Enterprise

There are two words you need to know to get IdM and the enterprise: “provisioning” and “termination“.

a) An employee is hired by a company. In order to login to the company’s computer systems to do their work (assuming they are a knowledge worker), they need to be provisioned with an “identity” that they can use to log in to the company systems.

b) When an employee leaves (retires, quits, laid off, fired), the company must terminate this identity in the computer systems so that the employee no longer has access to these systems.

The next thing to understand is logs.

So, an employee uses the company identity to do their work and the company keeps logs of what they do on company systems. This kind of logging is particularly important for things like accounting systems – it is used to audit and check that things are being accurately recorded, and who did what in these systems is monitored, thus addressing fraud with strong accountability.

I will write more about other key words to understand about IdM in the enterprise (authentication, authorization, roles, directories) but I will save these for another post.

2) Ok, so what is Privileged Account Management in the Enterprise?

A privileged account is an “über”-account that has special privileges. It is the root account on a UNIX system, a Windows Administrator account, the owner of a database or router access. These kinds of accounts are required for the systems to function, are used for day-to-day maintenance of systems and can be vital in emergency access scenarios.

They are not “owned” by one person, but are instead co-managed by several administrators. Failure to control access to privileged accounts, knowing who is using the account and when, has led to some of the massive frauds that have occurred in financial systems. Because of this, the auditing of logs of these accounts are now part of compliance mandates in

Sarbanes-Oxley
the Payment Card Industry Data Security Standard (PCI DSS),
the Federal Energy Regulatory Commission (FERC),
HIPAA.

Privileged Account Management (PAM) tools help enterprises keep track of who is logged into a privileged account at any given time and produce access logs. One way this software works is: an administrator logs in to the PAM software, and it then logs in to the privileged account they want access to. The privileged account management product grants privileged user access to privileged accounts [1].

Links to articles on PAM, [1] Burton Group Identity and Privacy Blog, KuppingerCole, Information Security Magazine.

3) Privileged Account Management on the Social Web.

Increasingly companies have privileged accounts on the social web. Dell computers has several for different purposes. Virgin America, (they link to the account from their website – thus “validating” that this is their real account), JetBlue, Southwest Airlines, Zappos CEO, (employees who twitter), Comcast Cares (Frank Eliason) (interestingly comcast on twitter is blank).

Twitter is just the tip of the iceberg – there are also “fan pages” on Facebook for brands. Coca-Cola, Zappos, NYTimes, Redbull, Southwest, YouTube Channels, Dunkin’ Donuts, etc, etc. on thousands of other platforms and yet-to-be-invented services.

These are very powerful accounts – they are managed and maintained by many employees around the clock and are the public voices of companies.

I have yet to see or hear of any software tools to enable enterprises to manage Social Web privileged accounts. How are companies managing access by multiple employees to these accounts?

Is there software that does this yet?

Is anyone working on these kinds of tools?

Leave your comments here or tweet with me @identitywoman

"anonymous" sperm donation…not so anonymous any more

Kaliya Young · July 26, 2009 · Leave a Comment

I found this via retweets from Tim O’Reilly on Bio-Medicine.

The boy tracked down his father from his Y chromosome, which is passed from father to son unchanged. The gene variant patterns it carries can help trace the concerned paternal line, according to a report in New Scientist. All that it cost the boy to trace his father was $289 paid to FamilyTreeDNA.com for the service. In fact, his genetic father had never supplied his DNA to the site. For investigation, the site needed someone in the same paternal line to be on file. After nine months of waiting and making his contact details available to other clients, the boy was contacted by two men with Y chromosomes closely matching his own. These two were strangers, but the similarity between their Y chromosomes suggested there was a 50 per cent chance that all three had the same father, grandfather or great-grandfather.

Though the boy’s genetic father was anonymous, his mother knew the donor’s date and place of birth and his college degree. Using another online service, Omnitrace.com, he bought the names of all who had been born in the same place on the same day. Only one man had the surname he was looking for, and within 10 days he had made contact.

Legal Haze for Social networks. Identity and Freedom of Expression.

Kaliya Young · July 9, 2009 · 2 Comments

The picture pretty much sums the conundrum up.

Is it ok for individuals to promote pot on these social networking services?

Should social networks allow marijuana dispensaries to have organizational presences?

(from an e-mail from Fast Company promoting this article)

The question is, whose laws do social networks have to follow? The Web may seem borderless, but as companies like Google and Yahoo have found in China and, more recently, Twitter and Facebook found in Iran, virtual boundaries do exist. So what’s a company like Facebook or Twitter to do? It will be interesting to see how Silicon Valley finesses this one, particularly because the companies are based in California where the dispensaries are considered legitimate enterprises (at least in the eyes of the law).

I poked around on twitter and found a whole Marijuana movement
along with the Stoner Nation Facebook page and Stoner Nation Twitter and on Blogger and their own site.
Interestingly I searched in Facebook to find the stoner nation page and it was not listed when typed as two words but was when I typed it the way their name is listed as one word – StonerNation .
It is not a surprise to see seems there are many fans of Stoner Nation who are using Facebook accounts without their real names. Like Oregon Slacker , Stoner Stuff, and Drink Moxie.
I think this liminal space between the legal and illegal (at least this is factually the case in california) is quiet interesting. The freedom to express oneself and organize around change is something that is important to maintain on the web – clearly these three people have chosen to weave a line – expressing their opinion and support and involvement around marijuana online and not releasing their “real names” on facebook or twitter where they are expressing support and involvement in movement organizing but making the choice that saying who they are may negatively affect them in their ‘daily life’ – whether it be a small town where they live that would be unaccepting or a profession they hold that would not be understanding. I think these rights and issues go beyond “just” drug use but also extend to sexual and other minorities. The marijuana community is activating right now because there is a ballot initiative here in 2010 to legalize pot and tax it (potentially generating 1.2 billion dollars in revenue annually for the state).
I think a question we all have in building the evolving open and social web is how do we support citizens having the freedom to express themselves online and in social contexts. What are the particulars of online identity that enable this as a possibility and don’t rule the fundamental right of freedom of expression out? I am specifically thinking about the equivalent to anonymously joining a social movement march in the physical world.

SSN's can be guessed

Kaliya Young · July 6, 2009 · Leave a Comment

This just in from slashdot:

“The nation’s Social Security numbering scheme has left millions of citizens vulnerable to privacy breaches, according to researchers at Carnegie Mellon University, who for the first time have used statistical techniques to predict Social Security numbers solely from an individual’s date and location of birth. The researchers used the information they gleaned to predict, in one try, the first five digits of a person’s Social Security number 44 percent of the time for 160,000 people born between 1989 and 2003.

This is from the Wired coverage:

By analyzing a public data set called the “Death Master File,” which contains SSNs and birth information for people who have died, computer scientists from Carnegie Mellon University discovered distinct patterns in how the numbers are assigned. In many cases, knowing the date and state of an individual’s birth was enough to predict a person’s SSN.

“We didn’t break any secret code or hack into an undisclosed data set,” said privacy expert Alessandro Acquisti, co-author of the study published Monday in the journal Proceedings of the National Academy of Sciences. “We used only publicly available information, and that’s why our result is of value. It shows that you can take personal information that’s not sensitive, like birth date, and combine it with other publicly available data to come up with something very sensitive and confidential.”

Basically it means we shouldn’t be honest about our date of birth and home town on Facebook (or any other social network) or we are making ourselves vulnerable to discernment of our SSN’s. I wonder if they can figure out mine? I received my as an adult when I was attending college in California.

I decided to poke around and see what Facebook had up about Identity Theft. I did find a link to this study that created a profile by “Freddi Stauer,” an anagram for “ID Fraudster,”.

Out of the 200 friend requests, Sophos received 82 responses, with 72 percent of those respondents divulging one or more e-mail address; 84 percent listing their full date of birth; 87 percent providing details about education or work; 78 percent listing their current address or location; 23 percent giving their phone number; and 26 percent providing their instant messaging screen name.

Sophos says in most cases, Freddi also got access to respondents’ photos of friends and family, plus a lot of information about personal likes and dislikes, and even details about employers.

Facebook users were all too willing to disclose the names of spouses and partners, with some even sending complete resumes. One facebook user divulging his mother’s maiden name—the old standard used by many financial and other Web sites to get access to account information.

Most people wouldn’t give this kind of information out to people on the street but their guard sometimes seems to drop in the context of a friend request on the Facebook site, O’Brien says.

According to Sophos, the results of what it calls its Facebook ID Probe has significance for the workplace as well as personal life because businesses need to be aware that this type of social-networking site may pose a threat to corporate security.

I have tried to search the Facebook blog to see what they have to say about identity theft and apparently they haven’t mentioned it.

Facebook Changing Privacy Settings

Kaliya Young · July 3, 2009 · Leave a Comment

This past month has been interesting for Facebook – they hired Timothy Sparapani as their lobbyist in Washington:

As a prominent privacy advocate, Timothy Sparapani, former senior legislative counsel for the American Civil Liberties Union, argued that Internet companies have too much control over consumers’ data. The self-described “privacy zealot” didn’t join Facebook until seven months ago because he was uneasy about revealing personal information on the site.

He joins 24-year-old Adam Coner for the last year who has had as his main job “educat[ing] members of Congress and Capitol Hill staffers about leveraging Facebook to reach constituents.”
The current Chief Privacy officer Chris Kelly will be going on a leave of absence in September to focus on running for Attorney General of California.
EPIC has a very detailed page about Facebook Privacy. It is an impressive page that will give you pause. It outlines all the major features of the service it has concerns about. It has a list of all the EPIC Actions related to Facebook too.
This week Facebook is taking some steps to improve privacy from its website:

The power to share is the cornerstone of Facebook. Privacy and the tools for tailoring what information is shared with whom are at the heart of trust. Over the past five years, Facebook has learned that effective privacy is grounded in three basic principles:

Control. When people can easily control the audience for their information and content, they share more and they’re able to better connect with the people who matter in their lives.

Simplicity. When tools are simple, people are more likely to use them and understand them.

Connection. With effective tools, people can successfully balance their desire to control access to information with their desire to connect – to discover and be discovered by those they care about.

That’s why in the coming days, we’ll be improving privacy on Facebook by launching a series of tests that guide people to new, simpler tools of control and connection.

I wrote about some of the issues I have with Facebook when I heard Dave Morin talk at SXSW “Am I to “old” to get Facebook – or do they not get it?”. I highlighted 3 different issues:

What Blane Cook describes as “being in a room with everyone you ever met all the time”: all my friends from different contexts of my life get all the same ‘status’ updates and I don’t use them cause I feel like it is social spam to speak to them with the same voice and same frequency. I also don’t like that it broadcasts everything I “do” in the network to everyone.

“Real Names” vs. handles online – their belief they have “everyone’s real name in facebook”

The difference that women experience in online space and how they manage and protect their identity and what information is online.

Here is what they are saying about how to address this issue:
They are introducing a Publisher Privacy Control so that on a per-post basis users can control who sees each post. Friends, Friends and Family etc. On the other end of the spectrum, you can also share with “everyone” now.
They are simplifying their privacy settings. Hopefully this will make it more usable.
They are figuring out how to gracefully help people transition between the old settings and the new way.
They are asking everyone to revisit their settings…because:

We think Facebook is most useful when people can find and connect with each other, which is why this tool will enable you to make available those parts of your profile that you feel comfortable sharing in order to facilitate better connection. You will have the choice of being as open or as limited in the sharing of this information as you want.

The byline on the post is cute:

Chris Kelly, Facebook’s chief privacy officer, is glad to be offering you more control.

Read Write Web goes into their understanding of the announcement and user experience. This is a long, good piece.

FU – The Monday After, Facebook Usernames and Your Domain on the Web

Kaliya Young · June 15, 2009 · 1 Comment

Last week it was announced that on on Friday Night at 9pm Pacific Facebook had a name space land rush. Everyone was free to pick for themselves their username that would appear in their URL. facebook.com/username

I actually found this a bit surprising – remember the big debate on the Social Web TV I had with Josh Elman about “real names.” He was against handles completely and felt that the big value facebook brought was “real names”. I argued for handles and the freedom to choose one’s “identity” on the web. I made the point that free society – having the ability freedom to have the option to have and use handles on the web NOT linked to our given/ in real life names. Another thing is that handles help us navigate namespace clash from regular names. Max from MySpace is 8bitkid not some other Max in a sea of Max’s.

I ran into Josh Elman at the Building43 party and we agreed I kinda won the debate with this latest development. It seems that having peoples pages rank higher in google is helped by having readable URL’s.

They of course “strongly encouraged” people to just pick a URL with one’s real name and did so by “suggesting” names that were derivatives of one’s name. You could override this and type in your own name choice (however defaults matter so most people will end up with names similar to their real name – rather then being asked to think up one). They give users an addressable identity.

Max Engel of MySpace became /8BitKid – his handle “everywhere”

David Recordon surprisingly didn’t go with DaveMan692 – his handle most places – he is /DavidRecordon

My friend Jennifer became /dangerangel as she had originally signed up for in Facebook but they disallowed her to have it.

I just became /Kaliya (I am hoping I can get enough fans to claim /identitywoman for that persona)

What is particularly interesting is the layers of identity in Facebook.

With a Facebook URLFacebook has the one’s username is not one’s e-mail address as it is with Google profiles and one also has a common name (or as they say “real name”) that is presented to throughout the system.

Google ironically enough they ask if you want a “contact” me button on your page that does not give away your e-mail address when the profile URL gives away your e-mail address.

Twitter has /usernames AND another display name of your choosing that is changeable (the /usernames are not). However most twitter clients display one or the other. If you are used to seeing the display name and then are on your phone that is only showing @handle /username then you don’t know who is talking.

Facebook usernames is another example Twitter feature adoption by Facebook others being activity streams becoming much more like twitter streams.

I said when I first “got” twitter about 18 months ago – a big part of the value it provided was its namespace. It gave me a cool anchor on the web that allowed communication between me and others via the web.

So how is it going so far? Inside facebook reports that over the weekend 6 million folks – 3% of their userbase gut URLs. 500,000 in the first 15 min, 1,000,000 in the first hour and 3 million in the first 14 hours.

There were several examples of FaceSquating. Mike Pence took Obiefernadez’s name.

Anil Dash has the funniest post ever about the whole thing. Highlight the point that users don’t need facebook URL’s they can just get their own domain name. He repeats this throughout the post about what these services are not telling you:

None of these posts mention that you can also register a real domain name that you can own, instead of just having another URL on Facebook.

I completely agree with him – he also misses a key point the usability of facebook is vastly higher then the usability of domain name registration, cpanel management and other things involved in getting ones own personal web presence going. DiSo isn’t hear yet so we can’t link to our friends without linking capability that a facebook provides. I suppose Chi.mp was trying to

He links to a post of his from December 2002 called privacy and identity control.

I own my name. I am the first, and definitive, source of information on me.

One of the biggest benefits of that reality is that I now have control. The information I choose to reveal on my site sets the biggest boundaries for my privacy on the web. Granted, I’ll never have total control. But look at most people, especially novice Internet users, who are concerned with privacy. They’re fighting a losing battle, trying to prevent their personal information from being available on the web at all. If you recognize that it’s going to happen, your best bet is to choose how, when, and where it shows up.

That’s the future. Own your name. Buy the domain name, get yourself linked to, and put up a page. Make it a blank page, if you want. Fill it with disinformation or gibberish. Plug in other random people’s names into Googlism and paste their realities into your own. Or, just reveal the parts of your life that you feel represent you most effectively on the web. Publish things that advance your career or your love life or that document your travels around the world. But if you care about your privacy, and you care about your identity, take the steps to control it now.

In a few years, it won’t be as critical. There will be a reasonably trustworthy system of identity and authorship verification. Finding a person’s words and thoughts across different media and time periods will be relatively easy.

What people don’t quite get is that if they anchor their whole online life around someone else’s domain they are locked in. When I first started paying attention to user-centric identity online this was one of the meta-long term issues that the first identity commons folks (Drummond Reed, Fen Lebalm, Owen Davis, Andrew Nelson, Eugene Kim, Jim Fournier, Marc Le Maitre, Bill Barnhill, Nikolaj Nyholm, etc).

A few of them wrote a paper about it all – THE SOCIAL WEB – Creating an Open Social Network with XDI.

They liked the XRI/i-names architecture because it addressed the URL recycling problem with a layer of abstraction. All i-names also have linked to them a conical identifier – an i-number. This number is never reassigned in the global registry. However one could “sell” one’s i-name (mine is =kaliya) and that new person could use it but it would have a different i-number assigned to it for that person.

This past week at the Online Community Unconference we were talking about the issue of conversation tracking around blog conversations. How an one watch/track the conversation about one’s work if it is cross posted on 10 different sites OR if it is just posted in one place and one is distributing a link through 10 different channels? We never did get to an answer – I chimed in that the web was missing an abstraction layer – that if one could have a canonical identifier for a post that was up in 10 different places this would make it easier to track/see conversations about that post. What we do have now that we didn’t have 3 years ago for helping track conversations across multiple contexts is OpenID at least so you can see if someone commenting in one place is the same as someone commenting in another.

There is an additional layer of abstraction in the XRI architecture that supports several things are key to helping people integrate themselves and information about themselves on thew web.

One is cross referencing – so I could have have two different (URI) addresses for the same information (in the identifier – not just mapped over one another leaving me with one address OR the other) and also have one version of my profile be the one I controlled and a different be a version that appeared in a certain social context.

There is also a concept of much finer grained data addressability and control – so I could have my home address in one place and instead of entering this into each website/services/company portal that I want to have this information – just hand them a link to the canonical copy I manage and then I don’t have to change it everywhere. This is of course where the VRM folks are going with their architectures and services.

We shall see how it all evolves. That is what we do at the Internet Identity Workshop is keeping on working on figuring this all out.

Surfacing back into Cyberspace at Building 43 today

Kaliya Young · June 11, 2009 · 1 Comment

Basically this post is to say I am “back” – I have a bit more time on my hands this summer to pay attention to Cyberspace and want to give attention to expressing my thoughts and ideas in text online again. I am inspired by this mention by Scoble around the launch of Building 43 that is happening today. I thought it was an actual physical space when I got the invitation. Turns out it is a website that Robert Scoble is leading. It is focused on what he calls the 2010 web and others call Web 3.0.

Here’s another way to put it. When you look at Techmeme and see all the tech bloggers yammering on about the latest cool things, the way they were this week about Facebook’s new URLs that are coming out tomorrow, or Apple’s new iPhone, do they look backward and think about the average businessperson? Not in my experience. We don’t have an industry conversation about how to actually use all this cool stuff to improve lives, make businesses stronger and closer to their customers, and have some fun.
A few people here and there are trying. I watch what Chris Messina, David Recordon, Marc Canter, Joseph Smarr, Kaliya Hamlin, and a group of others are trying to do by pushing a more open web. Those are the kinds of efforts that inspire me and are inspiring Building43. Can we build on what they are trying to do and take it to main street?

This actually impresses me cause I thought Scoble had just become an internet micro-celebrety for its own sake. I look forward to contributing to the conversation about the future of what is becoming a very social web where peoples identity online matters deeply.
Here is where I have been since my last post.
Since Social Web Foo Camp and posting the 80% complete article about communities context and online life. I haven’t blogged. I have been very busy though.
Immediately following I attended the “identity day” at RSA on Monday April 20th – talks were given from the front of the room for a day. Liberty Alliance put the day together along with the Information Card Foundation- The Kantara Initiative was “launched”. I am not clear that the format of the day actually provided greater understanding by those outside our community that are confused by all the activity.
The exciting thing that happened leading up to this day was the launch of the new Information Card Foundation Website – I gave some feedback that was included in the core language and messaging. It has great Flash animation explaining the cards along with featured projects including the GSA Demo.
RSA was fun – I didn’t spend to much time in sessions mostly talking to people in the community. I led a peer-to-peer session on Business Models for Claims Based Identity. A good group attended however the room layout was cold and stale. (I will be writing about it on my unconference blog shortly).
Penguin Day followed on April 25th. This is a super fun day facilitated by Allen Gunn focused on Non-Profits and Open Source. I learned more about TikiWiki as a content management system (I am considering it as the platform for She’s Geeky). I also was impressed by how much CiviCRM had improved. I also talked to a college registrar very interested in how information card technology might play a roll in getting them out of paper based management of student records and certification.
The Nonprofit Technology Conference followed – they had a large exhibit hall and I talked to many of the vendors there about OpenID and Information Cards – about 1/2 had heard about OpenID and almost none about Information Cards. It was great to talk to my friends in the industry (I have been attending this conference since 2004). Social Actions is progressing and is creating a way to aggregate action information for social good.
I flew to NYC to facilitate the Creative Unconference on May 7-8 put on by the One Club for Art and Copy collaborating with the Society for Digital Agencies. This was during Creative Week. The One Club gives out bronze, sliver and gold pencil’s – some of the most prestigious awards in the advertising business. They attended their interactive awards on Friday night – I brought Robert Tolmach along as a guest and he told me about his new project – Class Wish.
I went to DC and spent the day at the Sex 2.0 conference at the intersection of social media, feminism and sexuality. I was particularly interested in how this community was thinking thinking about and dealing identity online and off. Many people had names they went by within the community that were different from their “every day” names. Several presenters talked about having two facebook profiles (one for their sex life and one for regular life) I pointed out that this against facebook policy and they were surprised – it seemed very natural to have two persona’s. Other presenters talked about being fully “out” completely linking their sex life.
I attended the Anita Borg Institute for Women in Technology Women of Vision Awards. It was a very inspiring evening. Padmashree Warrior the CTO of Cisco was the key note speaker – she was super inspiring and gave ideas about how to connect to the community 2.0 audience.
I spoke at Community 2.0 about identity technologies. I covered OpenID, OAuth and Information Cards and at the end mentioned project VRM for those who were very forward looking. It was a relatively small conference and I spent a lot of time preparing for the talk with my speech coach. My issue has been having to much to say – I can talk about identity for hours and in great detail. Lura helped me figure out what to say. I did a good job clearly communicating and had several people say they enjoyed my talk and it gave them some practical information not just social media guru hype.
I went to the first day of the VRM workshop and was totally impressed by the quality of projects and companies working in the space. Several attendees didn’t know about IIW and a few signed up to attend.
The Internet Identity Workshop was AMAZING. We had the same number of attendees as we usually do. I am going to write some more posts about the event soon. The next IIW is November 3-5 in Mountain View.
I went to the Maker Faire on Sunday the 31st of May – it was fun to see all the stuff people are making. I also got a LiveScribe Pen. I will be using it for diagrams on this blog in the coming months.
June 1 was CommunityOne where i saw Jono Bacon talk about Community there were 10 people to see him speak in an auditorium that held 1000.
I flew to Boston and met with Fabio Carara of the Venice Project Center and Venice 2.0 – they are considering how to leverage 20 years worth of geo-data. We are discussing building a community including a few unconferences.
I had dinner with Mary Ruddy and we continued progress on Identity Commons infrastructure – particularly our new blog/website.
I facilitated the Mass Technology Leadership Council Spring Meeting that asked the question “What is the future of Software and the Internet” I lead a session on identity – they asked good questions and were impressed by all the activity in the space.
I flew to San Francisco – to make it back for the 2nd Scala Lift Off. Scala is a programming language – some describe as Java++, Lift is a web framework. This is a great programming language community with an healthy online community life. I work supporting them in community building when the meet face-to-face.
Yesterday I was working with Forum One facilitating the 4th Online Community Unconference. This is a great community of online community managers (the folks who moderate online community), platform providers (software providers) and hosts (companies that have online communities). I presented a session about OpenID, OAuth and Information Cards – I even got a bottle of wine during the closing from one of the attendees thanking me for the quality of information that I shared.
Today it is the Building 43 party at Tech Crunch and next week is SemWeb in San Jose – I will likely make it to the Personal Democracy Forum. The next “identity” event is Burton Group Catalyst at the end of July in San Diego.
I look forward engaging in this medium again with a post every few days.

Getting OpenID to work – when oh when?

Kaliya Young · March 23, 2009 · 2 Comments

Joseph Boyle who came to our identity panel at sxsw and then joined us for lunch has been sharing with me some of his OpenID challenges. These happen all the time – ALL THE TIME. Thing is – he is a tech guy and he still can’t get any of this to work. I asked him to document his challenges so I could share them with you – he sent this to me and O’Reilly tech folks (that was where he was trying to login)… I am hoping that these UI issues can be resolved soon.

I was going to sign up at:
https://en.oreilly.com/webexsf2009/user/account/signup/attendee#
and saw a Sign up with an OpenID option. Since I’m interested in OpenID, I thought I’d try to use an OpenID associated with one of my Yahoo or Google accounts, but this is proving more difficult than I expected.
I did manage to find Yahoo’s page for turning on OpenID support for my Yahoo account and did this, getting response:

Feeling geeky?

When you log in to a website that supports OpenID login we’ll send your OpenID identifier to the website so it can identify you.

To make things easy, we have generated this identifier for you:

https://me.yahoo.com/a/T_HpXDQkssQpI_sR……………………..

You don’t need to save this identifier. While logging in to websites, you can simply look for a Yahoo! button or typeyahoo.com in the OpenID text field. You can also choose additional custom identifiers for your Yahoo! account below.

Not geeky enough, apparently, as pasting the Yahoo-provided identifiers into your OpenID box gives errors:
Unable to find OpenID server for ‘https://me.yahoo.com/a/T_HpXDQkssQpI_sR…………………….’Unable to find OpenID server for ‘http://www.flickr.com/photos/josephboyle’
Help! What am I doing wrong? Thanks, Joseph Boyle

Identity Panel & Lunch at SXSW

Kaliya Young · March 11, 2009 · Leave a Comment

I am really excited to be heading to Austin tomorrow for SXSW Interactive. After attending for 2 years in a row I didn’t attend last year and watched as all the tweets went by – wishing I was there.
I am facilitating a panel on Sunday morning 11:30 – it should be a lively one. OpenID, Oauth, Data Portability and the Enterprise.
It will be moderated by me, Identity Woman and include these find panelists, Bob Blakely The Burton Group, Danny Kolke Etelos, Inc., Joseph Smarr Chief Platform Architect, Plaxo Inc

The debate over identity, data and authentication is gaining ground in the social networking world. The more difficult discussion regarding enterprises and Web 2.0 has yet to start. Businesses realize that they must protect the data of their company, employees and customers. Join brave leaders from several Web Application companies that are beginning the discussion, “Are OpenID and OAuth good for the enterprise?”

Following there will be a Lunch for all those who want to continue the conversation – you can RSVP here.
There is a Project VRM Breakfast on Saturday morning (we figured that at least that morning people would be able/willing to get up early).
Monday for lunch I am inviting women interested in learning more about She’s Geeky to get together.
I will be tweeting away – and this is a good way to find me while I am there just DM me.
I will do some schedule browsing and post sessions related to identity tomorrow.

Parents and Technology

Kaliya Young · January 18, 2009 · Leave a Comment

I just found this article on Yahoo! News.
It is quite disturbing
There are two companies offering a service to parents WQN and Aegis Mobility – there is software and then a monthly fee. Then services track the kids and turn of their phones in certain locations.

WQN’s surveillance service promises more than just disabling the phone in cars. It can monitor a person’s whereabouts, notifying parents by text messaging when their children step out of designated zones or return home. It also can turn off a cell phone at school, preventing cheating by text messaging during classroom tests, based on a reading of the school’s location.
The question parents would have to ask themselves is whether they’d want to prohibit their children’s activities this way. That kid you’re trying to control might not be driving, but rather sitting on a train or a city bus or in the passenger seat of a buddy’s car.

It seems a whole set of technology tools that are part of enabling over parenting. sigh.

OpenID Momentum continues

Kaliya Young · January 16, 2009 · 3 Comments

Dave posted today on the OpenID.net blog articulating the accomplishments of the past year.
I think it is important to acknowledge the significant progress OpenID as an Open Standard for persistent digital identity across the web has made. It is amazing to think how far it has come in 2.5 years since IIW1.
Recently I was talking with a person knowledgeable about the identity community and OpenID in particular – they mentioned that some of the conversations amongst those running for the board didn’t help the community look “good”. I said to them you know a lot of communities have elections and there is 6 board seats open and 6 people running for them – so there really isn’t a dialogue, public conversation that has texture (a different word for conflicting points of view). I celebrate a community that can dive in and engage with a range of points of view and really have a meaty dialogue. This is to be celebrated – the pains of growing up.
Wired just did a detailed article on OpenID’s and Blog commenting. It closed with this… NB: Before you race to point out the irony that this particular blog doesn’t support OpenID logins for comments, I can assure you — we’re working on it.
It also said this:

It’s easier for blogs, which don’t need a lot of demographic information about a user, to let people jump in and start participating socially without filling out a registration form. Major media properties and newspaper websites, on the other hand, want age and income data they can use to sell more targeted ads. OpenID and its companion technologies have mechanisms for sites to collect that data from their users, but those mechanisms are largely left out of the blog commenting systems.

It makes me sad to see this. I was just signing up for a topica list – it asked me for my gender the year I was born and my zip code. It is trying to figure out who I am. What I don’t think is well understood is how information sharing happens over time. Asking people to give away PII (personally identifying information) to look at a newspaper is bad practice and encourages lying.

Online Eviction – a new challenge in this recession?

Kaliya Young · January 3, 2009 · 2 Comments

This post was on slashdot today
Protection From Online Eviction?
from the our-data-our-selves dept.

AOL has been shutting down its free Web services, in some cases with little or no notice to users, and they are not the only ones. This blog post on the coming “datapocalypse” makes the case that those who host Web content should be required to provide notice and access to data for a year, and be held strictly accountable the way landlords are before they can evict a tenant. Some commenters on the post argue that you get what you pay for with free Web services, and that users should be backing up their data anyway. What do you think, should there be required notice and access before online hosts take user data offline for good?

Here are some interesting comments from it.
http://tech.slashdot.org/comments.pl?sid=1079453&cid=26315101

Among Fast Company Influencers

Kaliya Young · November 7, 2008 · 1 Comment

I am writing this post for all of you coming here after reading the Fast Company article listing the (13) Most Influential Women in Web 2.0. Here is my slide in the deck where you can see the picture Bob took in full glory.
Just to be clear I am part of more then the OpenID community 🙂
I facilitate The Internet Identity Workshop that I co-founded and co-produce with Phil Windley and Doc Searls. It has an amazing range of technologies participating – see below for the list.
I am involved with the whole community working on the identity layer of the web that works for people. OpenID is simply the most visible part in relation to “web 2.0” right now. I am very optimistic about the future of information card technology and the potential for claims based identity to really transform the web.
I am actively involved in Identity Commons (where I got started in Identity in 2004) and it is where you can find a bunch of groups working on a range of social legal and technical issues in this field. Let me know if you want to get involved.
The Internet Identity Workshop is actually happening NEXT WEEK in Mountain View and there is still room – so feel free to sign up if you want to dive in.
Things covered at the Internet Identity Workshop….
Open Standards
* OpenID
* SAML
* Liberty Alliance ID-WSF
* WS-Trust
* OAuth
* OASIS XRI
* OASIS XDI
* XRDS-Simple
* Open Social
* Portable Contacts
Standards Interop
* OSIS
* Concordia
Major Information Card Projects
* CardSpace
* Higgins Project
* Bandit
* The Pamela Project Relying Party Code
* The first Java Information Card library Relying Party Code and Security Token Server code
Browser Based Card Selectors
* Higgins Project (offers both browser-based and native card selectors)
* openinfocard
Multi-Protocol Open Source Projects
* Higgins Project (supports Information Cards, OpenID, SAML, XRI, XDI)
* Shibboleth
* CAS (supports OpenID, SAML, prototype Information Card support)
* Bandit
* OpenSSO (supports SAML, Liberty ID-FF/ID-WSF, WS-Federation, Information Cards, OpenID)
Industry Consortia
* Identity Commons
* Liberty Alliance
* OASIS ID Trust
* ITU-T Focus Group on IdM and subsequent activity.
Groups Addressing Legal/Social/Business Issues
* PPEG Privacy Summits Liberty
* Project VRM
* Liberty Alliance Identity Assurance Framework
* Liberty Alliance Identity Governance Framework

Nov 13th Kids Online: Balancing Safety and Fun – (un)confernece about the issues and best practices

Kaliya Young · September 24, 2008 · 1 Comment

I am working with Joi Podgorny and Denise Tayloe on this day following the Internet Identity Workshop Nov 10-12 in Mountain View, CA. You can register here on Event Brite. We are bringing together a range of practitioners and experts to work collaboratively for a day together.
Our goal is to leave the day with greater clarity around some core best practices and have next steps as an industry to help kids being safer online.
All of the attendees will make up the agenda together at the event itself. We do welcome ideas and suggestions for topics you hope get discussed the day of the event.
This is a day to dive in and work collaboratively on these kinds issues around kids online:

Who and what are we trying to protect digital kids from?
Are there standards and norms in practice that we can leverage to formalize best practices for industry?
Kids fake their ages to gain access to online content, do we as an industry care? If so, then?
How do we create best practices that are flexible based on age range, content and willingness for parental involvement by industry or the child?
How can we create cyber spaces that balance interesting and fun with safety?
What is the role of government in either defining or supporting best practices?

Who this (un) conference is for:

Online Community/Virtual World Managers
Policy officers and Security Officers at large companies
Consultants in the kids online space
Identity technologists
State Attorney Generals
Legislative Staffers
Parents and Kids
Academics in the field
Bloggers

Adult attendees of the conference are welcome to bring their children ages 10-25 to particiapte in the conversations. There will not be child care, this is about talking about the issues with the constituents we are talking about present.
(Kid’s Online is an Identity Commons Action Group)
This week the Internet Safety Task Force had a meeting this past week. dana boyd has a post about it happening here.
Here are some reports from the blogosphere worth reading:
Harry Lewis – More on Internet Safety
I was pretty shaken by the end of the first day of the Internet Safety Technical Task Force yesterday. I had a meeting right afterwards, which I entered by yelping a primal scream.

Benlog – Children vs. Anonymity
The day started with a few words from Connecticut Attorney General Richard Blumenthal….I think the only statement I agree with is that parents should be empowered.
Surveill@nce St@te – State AGs Push Online Child Safety Snake Oil
Won’t someone think of the children?
Given the intense political pressure to do something about child safety online, and a complete lack of proven, peer-reviewed, and abuse-resistant technologies available on the market, a number of private companies have stepped in to fill the void…
Braden Cox – The Safety Chase
Discussions focused mostly on what technical solutions exist for addressing the perceived lack of online safety on social networking websites. But overall there’s still a need to connect the most important dot—do proposed solutions actually make children safer?
Jim Kertetter – Help line in the works for cyberbullying victims
Perhaps the biggest reason for that is students’ behavior: A recent survey of high school students done by the Teenangels found 70 percent of the kids surveyed share passwords with other people. The reasons are often innocuous, such as asking someone to check their e-mail for them, or to find a homework assignment for them. Often, teens in relationships will share passwords to assure one another they’re being faithful.

The Venn of Identity is published

Kaliya Young · April 13, 2008 · 2 Comments

This is a great article and I have been talking about it for several months when presenting about digital identity. It was written by Drummond Reed and Eve Maler and I read it in December.(I am doing this more and more now). It has finally been published here is the abstract but it actually costs $19 – uggg.

Digital identities can be associated with everything from people to software applications to entire companies, but human digital identities prove the most interesting and challenging. Human digital identities can simplify network usage and enable new classes of applications, but they also introduce security and privacy risks. Federated identity management addresses scenarios in both enterprise and consumer contexts by defining how to dynamically distribute identity information and delegate identity tasks across security domains. This article explains federated identity’s components, discusses security and privacy risks and architectural challenges, surveys the SAML, OpenID, and InfoCard protocols, and reviews new developments in federated identity management.

RSA pr3: OSIS Interop

Kaliya Young · April 12, 2008 · Leave a Comment

The OSIS interop was happened in a little room in the same hallway as the speaker lounge – but there was no signage to point people there 🙁
On Monday evening there was a OSIS steering committee meeting. The last one of these I sat in on was at Burton Group Catalyst. It was a good meeting – they talked about the European Identity Conference coming up in a few weeks where they will be again setting up and having interop demo’s based on the I3 work. Some of the European participants will be there. The agreement was that Interop4 would happen at Burton Group Catalyst continuing the work of I3 because it was not complete yet.
Roger Sullivan in his position as representing Liberty Alliance where he is President attended (he is also the Vice President of Business Development for Oracle Identity Management). I found it interesting that Roger said the word user when reffering to entities like Boeing and General Motors. I piped up and said that I felt that the use-cases and needs of ‘end-users’ were different then the needs of massive multi-national entities. He said that the ‘issues’ were all the same. I guess in one way that is true – in the end it is people at the end of the computer terminals. In another way it is different to log into an ‘enterprise environment’ (intense permissioning, lots of legal regulation etc) then it is to manage your personal shopping online. Out of this exchange came the differentiation between these two kinds of users – the larger being ‘deployers’ and the smaller being ‘users.’
As a community we had a good chance to talk about issues. The message that Roger did bring forward was that enterprise customers wanted less confusion in the market – because until it was clearer there would not be purchase of product. There will be more insight into this in the forth coming post about the the conversation I had with other executives at Oracle over a ‘blogger lunch’ on Thursday.
Major ISSUE – there was ‘apparently’ two competing interop events at the same conference. One was backed by a large and well funded organization with a PR staff to promote itself the other was a fabulous grassroots effort – doing huge amounts with very little. It was agreed that next time Concordia and OSIS would collaborate and have an interop in the same place and have one press release (or at least two press releases with mutual quoting) although with different use-case focuses. This is my drawing of the picture that became clear through the meeting.

OpenID Foundation and OSIS is a community group (there is serious consideration of changing our current description from “Working Groups” to “Community Groups”) of Identity Commons, the i-card foundation that is proposed would also be (there are some interesting questions about it).
I worked hard on Tuesday morning before the OSIS interop on some signage for Identity Commons. We had the new diagram that is on the front page of the wiki along with a this sentence that i think goes a long way to describe who we are.

We are a community of groups working on addressing the social, legal and technical issues that arise with the emerging, identity, data and social layer of the internet.

Johannes pointed out that after that some articulation of the issues we are tackling could be listed. This is a list I recently wrote up and shared with a reporter (and she actually said it was ‘clear’). I will put the high level questions we are trying to answer in the context of the ‘clear’ articulation I sent her.
Since the Web was built around “pages”, no tools or standards were created to control how the information about you was collected or used. We all agree that we need some kind of “open identity layer” for the Internet, but we don’t know exactly what that means or what it looks like. Our community has come together around some shared understanding of this and we continue to ’struggle’ with what it means and how it should work.
We are working as a Community, on the development of the next layer of the web—for people and their information—the social-data layer. It’s going to take time to figure out, and lots of people have already been working hard for several years and have made significant progress.
These are the questions we’re striving to answer:

What are the open standards to make it work? (identity and semantic)
What are technical implementations of those standards?How do different standards and technical implementations interoperate?
What are the new social norms and legal constructs needed to make it work?
What are the businesses cases / models that drive all this?

Identity Commons is the collection of groups where these conversations are happening.
All this takes time, and yes, interest is growing and movement is happening, but there is not ‘one answer’ or ‘one blueprint.’ As Doc Searls, one of the ‘grandfathers’ of this movement is fond of saying, it is a “market conversation.”
We need a broad and diverse range of participants. This layer once implemented will be as world changing as the World Wide Web of documents was for the Internet.
I also think it is important to remember and emphasize that we are in a phase where there is a lot to get figured out and there is not ‘one answer.’ I think we as a community can tell a clear compelling story to the market AND continue to foster a lively and diverse conversation about the issues that are arising (technical, legal, social). It is some times is hard to remember how unclear things were 2 years ago but they were very vague then – if we continue to progress I am confident a market can develop for these tools. Both the peer-to-peer sessions on this topic were interesting and had a range of enterprise folks looking at these tools (a blog post about those will also follow in this series).
Here is a photo of the interop in progress – next post – interop videos – coming tomorrow.

Over the next week I will work on the the 20 other posts that I have outlined this morning. – ok off to the airport now.

RSA pt2: Concordia Interop

Kaliya Young · April 12, 2008 · Leave a Comment

Day One seems so long ago. I moved all my stuff over from the east bay on Sunday night – Pam was nice enough to let me room with her to save the 1 hour commute each way to home for the week.
I got up early and headed to the Concordia Interop – I got their early enough to see the OpenID logo on the sign. OpenID has not been actively participating in these Liberty lead efforts for a while now and asked that their logo be removed from the website etc. Shortly afterwards a guy with white tape came and covered it up.

This slide explained their current focus and next focus.

Eve handed the podium over to Mike Jones and he introduced the day and explained the three scenario’s they were demonstrating interoperability for. SAML and WS stuff with an emphasis on the enterprise use case.

They shifted into demo’s at the back of the room and presentations at the front.
Lena from FuGen presented this slide.

It presented the complexity of federation and the different shapes that it has. The same policy between a range of partners, different policies with different partners and
There was about 300 people in the introduction and this faded out.

Interopping times 2 at RSA

Kaliya Young · March 22, 2008 · Leave a Comment

OSIS Interoperability Demonstrations
TUESDAY April 8th 11:00 AM – 6:00 PM
Moscone South, Mezzanine Level Purple Room 220
To be able to see this you need to get an expo pass. See below on how to get one.

OSIS User centric identity network interoperability between identity providers, card selectors, browsers and websites demonstrates how users can ‘click-in’ to sites via self-issued and managed information cards, or i-cards. Open ID, Higgins Identity Framework, Microsoft CardSpace, SAML, WSTrust, Kerberos and X.509 components interoperate within an identity layer from open-source parts.

I am really excited about this 3rd Interop – for one it is ALL Day not just an evening – I also heard they are going to have comfy chairs. To be able to see this you need to get an expo pass – one way to get it is to attend the other Interop Event.
This one is also exciting – put on by the Concordia project at RSA on Monday April 7th from 9am-12:30pm.

Registration is free of charge, and you must register for the workshop in order to attend the Concordia event, whether you’re an interop demo participant or not! Register for the workshop on the RSA registration site. Use the registration code 148CON. This will also give you a free expo pass that you can use to attend the tradeshow portion of the Conference Tuesday through Friday.

I will be attending both and I encourage everyone interested in the topic and tracking the evolving state of the technology to do so.

Sir Tim on Tracking

Kaliya Young · March 18, 2008 · Leave a Comment

Sir Tim said he did not want his ISP to track which websites he visited.