We have come a long way since our first identity gang meetings. One of the things the design committee came up with was to do an inquiry into the questions we are no longer asking ourselves.
Johannes and I are working on pulling together the answers to this question. along with what are the current questions and what will be the future questions. You can answer on your own blog (link back to us or just e-mail us so we know you answered) OR you can fill out the survey. If you could do this before Friday that would be great.
Thinking back to the first Identity Gang meetings 3 years ago and the first IIW 2 years ago in Berkeley, IIW a year ago….
What are the questions we are no longer asking ourselves.
* maybe we figured out the answer,
* maybe we figured out we couldn’t answer it,
* maybe we figured out it was a question we asked to soon and will surface again.
– would anybody think this is useful? [question in the past, not any more]
What are the questions we are asking ourselves now?
– how do identity providers make money? [question now]
What will be be thinking about 6-18 months from now?
– how to aggregate claims from multiple identity sources? [question 12 months from now]
ID Topics
Data Interop: an open letter from the largest nonprofit vendor
Recently a report from a know tech publication was at a conference I was leading. She asked me
“what is interesting that is happening right now.”
I said “the nonprofit technology session.”
She said – “well I cover business issues.”
I shared with her that one of the largest vendor of nonprofit technology Kintera was a publicly traded company AND that there was big business opportunities for providing technology solutions in that sector. She looked at me surprised as if it had never occurred to her that you could make money in this sector. Recently the two other large vendors in the space merged – Get Active and Convio. They became just Convio and are now the largest vendor in the sector.
This month’s theme for NTEN’s Newsletter is Data Interoperability. This is the open Letter the published there.
Gene Austin, Chief Executive Officer, Convio and Tom Krackeler, VP, Product Management, Convio
It is incumbent on all software vendors serving the nonprofit sector to open opportunities for nonprofits to have greater choice and flexibility in pursuing their missions.
To meet the expectations of nonprofits today — and five years from now — software vendors need to facilitate interoperability between systems and enable integration between offline and online data and the new Web. And they should do so with one clear purpose in mind: to open the possibilities for nonprofits to find and engage constituents to support their missions.
The NTEN community has been leading the charge for openness. With Salesforce and Facebook, Convio has embraced openness as a way of doing business.
Software vendors should:
1. provide nonprofit organizations of all sizes and in any stage of Internet adoption the flexibility to integrate with other web or database applications to exchange constituent and campaign data.
2. make their Open APIs available to clients, partners, and a broad developer community.
3. expose Open APIs as part of their core product functionality.
4. proactively use APIs provided by other companies in additional to providing their own.
5. make their API documentation publicly available and provide a forum for sharing and discussing best practices and exchanging code examples.
6. publish a roadmap for their API development and encourage participation in the development of that roadmap.
7. make their APIs accessible to nonprofits at a level that does not require extensive technical expertise to leverage those APIs.
UK Data Loss
In case you are not paying attention this week in identity news – The UK lost massive amounts of PII for its citizens.
Here are two good articles – Christian Science Monitor:
Computer files on 7.25 million families – everyone with children under 16 – have been missing ever since they were sent on two compact discs through the domestic mail system a month ago by Her Majesty’s Revenue and Customs.
SFGate – SF Chronicle
This one is a summary of a range of coverage of the incident.
Kim calls it an Identity Chernobyl.
Kim Cameron that has more context about reports written earlier about the risks of centralizing information about children big databases.
Ben Laurie who lives in the UK has comments on the scans of correspondence by the National Audit Office about the lost data.
US government Official says 'no more anonymity'
Privacy no longer can mean anonymity, says Donald Kerr, a deputy director of national intelligence. Instead, it should mean that government and businesses properly safeguards people’s private communications and financial information. “Protecting anonymity isn’t a fight that can be won. Anyone that’s typed in their name on Google understands that,” said Kerr. Kurt Opsahl of the EFF said Kerr ignores the distinction between sacrificing protection from an intrusive government and voluntarily disclosing information in exchange for a service. “There is something fundamentally different from the government having information about you than private parties. We shouldn’t have to give people the choice between taking advantage of modern communication tools and sacrificing their privacy.” Kerr’s comments come as Congress is taking a second look at the Foreign Surveillance Intelligence Act, requiring a court order for surveillance on U.S. soil. The White House argued that the law was obstructing intelligence gathering.
bill to tie financial Aid to 'anti-piracy measures'
mm…big brother continues to creep into college.
“The MPAA is applauding top Democratic politicians for introducing an anti-piracy bill that threatens the nation’s colleges with the loss of a $100B a year in federal financial aid should they fail to have a technology plan to combat illegal file sharing. The proposal, which is embedded in a 747-page bill, has alarmed university officials. ‘Such an extraordinarily inappropriate and punitive outcome would result in all students on that campus losing their federal financial aid — including Pell grants and student loans that are essential to their ability to attend college, advance their education, and acquire the skills necessary to compete in the 21st-century economy,’ said university officials in a letter to Congress. ‘Lower-income students, those most in need of federal financial aid, would be harmed most under the entertainment industry’s proposal.'”
AT&T Whistle Blower on TV
If you want to see Mark Klein he was on Keith Oberman’s Show. More details about him and case are in this earlier post.
The Up's and Down of electronic surveillance litigation
Creapy Creapy from Slashdot:
The US government is seeking unprecedented access to private communications between citizens. ‘On October 8, 2007, the United States Court of Appeals for the Sixth Circuit in Cincinnati granted the government’s request for a full-panel hearing in United States v. Warshak case centering on the right of privacy for stored electronic communications. … the position that the United States government is taking if accepted, may mean that the government can read anybody’s email at any time without a warrant.
On the ‘up side’ from the Washington Post:
The AT&T whistle blower Mark Klein is
in Washington this week to share his story in the hope that it will persuade lawmakers not to grant legal immunity to telecommunications firms that helped the government in its anti-terrorism efforts.
“If they’ve done something massively illegal and unconstitutional — well, they should suffer the consequences,” Klein said. “It’s not my place to feel bad for them. They made their bed, they have to lie in it. The ones who did [anything wrong], you can be sure, are high up in the company. Not the average Joes, who I enjoyed working with.”
His story as articulated by the post is as follows:
The job entailed building a “secret room” in an AT&T office 10 blocks away, he said. By coincidence, in October 2003, Klein was transferred to that office and assigned to the Internet room. He asked a technician there about the secret room on the 6th floor, and the technician told him it was connected to the Internet room a floor above. The technician, who was about to retire, handed him some wiring diagrams.
“That was my ‘aha!’ moment,” Klein said. “They’re sending the entire Internet to the secret room.”
The diagram showed splitters, glass prisms that split signals from each network into two identical copies. One fed into the secret room, the other proceeded to its destination, he said.
“This splitter was sweeping up everything, vacuum-cleaner-style,” he said. “The NSA is getting everything. These are major pipes that carry not just AT&T’s customers but everybody’s.”
One of Klein’s documents listed links to 16 entities, including Global Crossing, a large provider of voice and data services in the United States and abroad; UUNet, a large Internet provider in Northern Virginia now owned by Verizon; Level 3 Communications, which provides local, long-distance and data transmission in the United States and overseas; and more familiar names such as Sprint and Qwest. It also included data exchanges MAE-West and PAIX, or Palo Alto Internet Exchange, facilities where telecom carriers hand off Internet traffic to each other.
“I flipped out,” he said. “They’re copying the whole Internet. There’s no selection going on here. Maybe they select out later, but at the point of handoff to the government, they get everything.”
Qwest has not been sued because of media reports last year that said the company declined to participate in an NSA program to build a database of domestic phone-call records out of concern about its legality. What the documents show, Klein contends, is that the NSA apparently was collecting several carriers’ communications, probably without their consent.
Another document showed that the NSA installed in the room a semantic traffic analyzer made by Narus, which Klein said indicated that the NSA was doing content analysis.
2257 Laws, Sex Workers and Privacy
Sex on the Internet, The Realities of Porn, Sexual Privacy, and How Search Affects Them All. Google Tech Talk by Violet Blue, October 12, 2007
This is an hour long presentation by Violet Blue. It is quite interesting covering a range of issues about sex and privacy online. The most interesting one directly related to identity was 2257 laws. Go to 32:30 in the video to see her discussion of this topic.
It mandates producers of pornography document the ages of those who perform in their films and that this documentation regularly is a photo of the performer with their ‘government issued ID and Social Security Card’ thus revealing basically all the information you need to steal their identities.
The 2257 legal requirements have the potential to become a business opportunity for some enterprising identity company to meet these requirements in a privacy protecting manner.
UPDATE:
Majority on partially divided three-judge Sixth Circuit panel strikes down as facially unconstitutional the recordkeeping requirements federal criminal law places on producers of images of “actual sexually explicit conduct” to verify the ages of those depicted in the images: Describing the federal statute at issue, the majority opinion explains, “The plain text, the purpose, and the legislative history of the statute make clear that Congress was concerned with all child pornography and considered recordkeeping important in battling all of it, without respect to the creator’s motivation.” The majority proceeds to hold the statute facially overbroad and then strikes down the law as unconstitutional.
Who is free to travel?
Peace Activist apparently are not.
Medea Benjamin founder of CODEPINK and retired Colonel and diplomat Ann Wright were both denied entry into Canada.
“The fact that the FBI has put us on this list. The National Crime Information Center Computerized Index is a form of political intimidation. The list is supposed to be for felony and serious misdemeanor offenses.
“We don’t qualify– it’s for sex offenders, foreign fugitives, gang violence and terrorist organizations, people who are on parole, a list of eight categories all together.
To be criminally rehabilitated, they would have to do a huge amount of paperwork and state that they were no longer going to commit the “crimes” they were convicted of.
Wright told OpEdNews “We were told (by the canadian border agents) if we tried to enter Canada again, we would be officially deported from the country, which is “big trouble. ‘We’ve warned you not to come back until we are criminally rehabilitated.’
Wright asserted, “We will never be criminally rehabilitated since we intend to continue to engage in non-violent peaceful protest of Bush administration policies, particular the war on Iraq and we intend to peacefully and nonviolently protest all of these until they end. They can lead to arrests for civil disobedience, like refusing to move from the fence in front of the whitehouse or standing up and speaking at congressional hearings.”
What does 'federally approved secure licenses" mean?
My Husband Brian who forwards me articles from the mainstream press about identity sent me this article Feds Strike ID Deal Over NY Licenses
Saturday’s agreement with the Homeland Security Department will create a three-tier license system in New York. It is the largest state to sign on so far to the government’s post-Sept. 11 effort to make identification cards more secure.
Why Can’t they Here Us? Identification Cards don’t make us m ore secure. They infringe on our rights.
Article continued…
Under the compromise, New York will produce an “enhanced driver’s license” that will be as secure as a passport. It is intended for people who soon will need to meet such ID requirements, even for a short drive to Canada.
A second version of the license will meet new federal standards of the Real ID Act. That law is designed to make it much harder for illegal immigrants or would-be terrorists to obtain licenses.
A third type of license will be available to undocumented immigrants. Spitzer has said this ID will make the state more secure by bringing those people “out of the shadows” and into American society, and will lower auto insurance rates.
Incomplete Identity: Auren on Identity at Stanford Law
I was invited by Auren Hoffman (Rapleaf Reputation 3861) to see him talk at Stanford Law school this afternoon. So I Trecked all the way down there. I had high hopes given the description . . . …
Portable Identities and Social Web Bill of Rights
The future world of portable identities, reputations, and social graphs has many pluses and concerns. These portable systems could make the benefits of personalization, once only relegated to science fiction, a reality. The Social Web Bill of Rights makes the claim that users have the right to portability. But there are privacy implications to take into account as well. We will discuss an opt-out vs. and opt-in approach on data collection, privacy, and portability.
———
but I was disapointed. I first met with Auren in a Starbucks before Rapleaf was launching many years ago (in internet time). I had not seen him since despite inviting him to every Internet Identity Workshop since then.
When opening the talk the Stanford student gave the the description given of Auren’s goal with rapleaf was this “Enabling people to look up the online reputation of others. Making it profitable to be ethical.”
He opened articulating the basic components of the ‘ Social Media Users Bill of Rights‘
You Own:
- Your information (basic info about you -address height etc – and preferences)
- Your Social Graph
- Your Activity Stream
The key things for this to work control over who accesses it and the freedom to grant persistent access
He also had a slide that mentioned that it be verifiable (???) I was confused by this and was not sure where it was drawn from and was not further articulated. As a side note one of the things that Bob Blakely (currently of the Burton Group previously blogging here) talks about Privacy is “the ability to lie about yourself and get away with it”.
Ok back to Auren’s talk.
Portable (identity, reputation and social graph).
Why is this important – because of the Tyranny of wasted time ‘refilling all those forms out’.
Portability of identity (in the way he used it) was articulated as – it is just information about you that basically is self asserted.
Social Graph portability was just briefly referenced about ‘the people you are linked to’. There was no discussion of one of the main concerns – a ‘social link’ is between two people and moving that information from one context to another should have the consent of the party that a link is asserted about. Update:Having completed the post and understanding their data-aggregation model that fits into their business model they explicitly mush peoples social graphs together from different sites to create an aggregate social graph that as far as I can tell is not visible to the user. Distinguishing and keeping separate context is not what they do.
He asked rhetorically “What is your identity” and then mushed claims and preferences together as if they were all the same kind of identity information (where you live, what you buy, what movies you like, your sexual preference).
He talked about why several efforts in the past have failed. He said that Passport failed because it was an ‘opt-in’ system that very sites would integrate.
I thought this was an interesting assertion. I guess it was opt-in on the part of the relying parties – but the reason the didn’t opt-in was because there was only one Identity Provider and they didn’t want to be locked into only getting identities from them. Individuals had no choice but to get their identities from Microsoft to use the system. This whole reasoning was not articulated for the students though.
The failure of Passport he said proved the difficulty with the opt-in way.
The ‘reformed Microsoft’ vision of an identity meta system and particularly the Laws of Identity that inform the whole current conversation of portable identity were never mentioned.
Reputation he said was (sort of) context dependent. My internal reaction was “SORT OF? it is completely context dependent”.
He talked about Credit scores (opt out) as a white list and captchas that prove you are not a robot. I didn’t quite get what Captchas had to do with portable identity – it seemed to be a leap that was mad in his logic that was not articulated – if you have white lists (like credit scores) that prove you are a ‘real person’ then you don’t need captcha’s. At least that is what it seemed to me he was saying.
He said that Whuffie was a social currency from doing nice things articulated in Down and Out in the Magic Kingdom.
This part was nice the chart articulated the Benifits and Challenges of Opt-In and Opt-Out systems.
| Opt-In | Opt-out | |
| Benefits | User Decides | Critical Mass High Adoption Rate |
| Challenges | Few Users No one wants to integrate |
Peoples Privacy |
He continued talking about the privacy implications of portability. He articulated that companies should show people all the data they collect about them. He raised the issue about cookies and how ‘freeked people out’ when first introduced but now are normal. He also said that technogrpahics and behavioral Ad networks should share data.
He said that more data collection is inevitable – but at least we can have control over this data. We are not going to stop them taking data about us. We should require to tell us what data collect about us.
He said that privacy is a Grey Area but not reference any of Solove’s work on the subject of identity and privacy, information systems and law.
He did not suggest any tools for doing this or how we would audit and check on their collection accuracy or honesty. Omitting these made it all seem the goals of the user-bill of rights were just dreams really far off. There was the
Datasharing Summit that spoke a lot about this – there is the Higgins framework (although in its infancy it has working demonstration code) that has some core tools to do this for people and the sites that have information.
At this point we had questions and I challenged – Auren on his assertion about the draw backs of Opt-In. I said that OpenID was challenging the argument that it could not be widely adopted. He said yes AND it was only available on a very small number of sites.
Questions about the ‘right to delete’ were raised by Lawrence Lessig. Apparently in Germany there are laws about publishing information about past criminal offenses of long ago. How these translate online is a good question.
Both during his talk and in the question and answer period he talked a lot about the potential for optical recognition to track us around in physical space. It was conflated with tracking us around the internet. These are two very different systemic processes that have some similarities but a lot of differences. They were conflated in his articulation of the subject.
Improving EULA’s was touched upon but no mention of Identity Rights Agreements work was mentioned – so I put if forward and invited those attending to come to the Internet Identity Workshop.
I will say it was nice to see Lauren Gelman. Last time I saw her was at Web 2.0 Expo speaking following my talk on Identity and Web 2.0 and she was very pregnant. Now she has a 4 month old.
At this point I didn’t really know what RapLeaf did – I was about to find out. I thought it was just a tool that people used to do reputation outside of e-Bay for buying and selling…not so. It got way creepier since I last had it articulated at Starbucks.
Joseph Smar drove me to the Stanford train station and he explained the RapLeaf business. Basically they go around the internet and collect information about people that is keyed to their e-mail address. They aggregate this information and then they know about you. They then sell this information to sites who want to know about their user base.
His system is Opt-Out. I am in it twice(Rapleaf score 5 and 4 respectively). This is how they claim to help you keep your privacy.
You know as a user I am forced to give ‘real’ e-mail addresses to get accounts on services. Two of the services listed in my profile I don’t use at all (Tribe and Hi5). I don’t even remember signing into Hi5. I know my social graph in Tribe, Flickr, LinkedIn and Facebook are different and not directly transferable between them. I don’t want to be connected to ‘everyone’ in all contexts.
Surfing around to learn more about them and the reaction in the blogosphere I found some interesting things.
Download squad:
When you hover over a Rapleaf attribute with the mouse pointer, Rapleaf will now show you where it got the information that makes up an element in your Rapleaf rating–whether it was gleaned from a social networking site such as MySpace or provided by a peer who claims to know you. Yeah, all these factors contribute to Rapleaf’s estimation of your reputation, and now you can tell where the info actually came from. Useful… especially if Rapleaf got some detail wrong about you!
There is quite a bit on this blog but just one highlightThe Bankwatch:
This smacks of blackmail to me. A while back I received an email from Rapleaf noting that someone had searched for my address. In that case I knew it was me searching myself, but why am I left feeling that they are snooping on me, despite the fact I think [?] they are trying to protect me.
Rapleaf.com, a people search engine that lets you retrieve the name, age and social-network affiliations of anyone, as long as you have his or her e-mail address; and Upscoop.com, a similar site to discover, en masse, which social networks to which the people in your contact list belong. To use Upscoop (proudly stating they have searched 400,000,000 profiles), you must first give the site the username and password of your e-mail account at Gmail, Hotmail, Yahoo or AOL.
By collecting these e-mail addresses, Rapleaf has already amassed a database of 50 million profiles, which might include a person’s age, birth date, physical address, alma mater, friends, favorite books and music, political affiliations, as well as how long that person has been online, which social networks he frequents, and what applications he’s downloaded.
All of this information could come in handy for Rapleaf’s third business, TrustFuse, which sells data (but not e-mail addresses) to marketers so they can better target customers, according to TrustFuse’s Web site. As of Friday afternoon, the sites of Rapleaf and Upscoop had no visible link to TrustFuse, but TrustFuse’s privacy policy mentions that the two companies are wholly owned subsidiaries of TrustFuse.
I suppose we should be happy to note that Rapleaf is not keeping track of our sexual orientation or the porn sites we visit.
They are using their information to help the political process though. (good thing I am Canadian and don’t participate in all that – not giving my e-mail address to political candidates).
From their website it articulates how you can ping their database of people to learn more about ‘your customers.’
Rapleaf’s TrustFuse product is an automated way of querying the Rapleaf system. Using Rapleaf or UpScoop is free and easy to use for consumers. If you are business, you can use Rapleaf’s TrustFuse system to learn about and serve millions of customers.
Work with Rapleaf by either:
1. Use our APIs to query your data real-time.
2. Upload the data in batch
Rapleaf’s TrustFuse product searches for information on your customers so you can provide them an enhanced user experience. You can use the API for up to 4,000 queries/day at no charge. After that, we charge a nominal amount per look-up.
So seems like campaigns are using TrustFuse from RapLeaf to figure out more about the voters that have signed up to get more information/participate in campaigns. I wonder exactly what they are finding out via the API’s.
Sigh.
His service is even more creepier then I imagined. It explains why he thinks that Opt-Out is the way to deal with these issues. Auren did say that if he couldn’t make it he would send someone to IIW in December. Hopefully we can have some fruitful face to face conversation.
Because she Owns Her Image
This is quite an interesting case and highlights a flaw that can occur when people who use Creative Commons work.
A Texas family has sued Creative Commons after their teenaged daughter’s photo was used in an ad campaign for Virgin Mobile Australia. The photo had been taken by the girl’s youth counselor, who put it on Flickr, and chose a CC Attribution license, which allows for commercial use. Virgin did, in fact, attribute the photo to the photographer, fulfilling the terms of the license, but the family is still suing Virgin Mobile Australia and Creative Commons.
The photographer can license the work under CC (for comercial or non-comercial purposes) but that does not mean that the person in the photo has licensed their image to be used.
They should not be suing CC but instead Virgin Mobile because they failed to get permission from her to use her image.
I actually had this happen to me. An image was taken of me at HollyHock and the next year I went to the site to check out their programs I found out I was their new poster girl. I would have given them permission to use my image had they asked but they didn’t.
In the Desert for a Week: Back after Labo(u)r Day.
I have been fairly quite here for a few weeks. Just toddling along at summer. I have spent the last few weeks getting ready for Burning Man. I made a sculpture about 3’x4′ that looks like this.
I am leaving within hours. It should be great – I will be at 9:00 and Jungle in Sustainabiliaville.
Thoughts on Community Engagement
A few days ago David sent me a link to his post responding to Stefan’s (very long) slam of OpenID. He did a great job articulating how many of those who have been critical of flaws in OpenID have been actively engaged with the community in finding solutions to the problems.
From Gnomedex one of the things I came away with was a deepened appreciation of the community that we have in technology generally and identity in particular. There are a lot of smart, good people working together despite our different personal world views, personal quirks technology backgrounds and visions for the future of the technology.
There are a lot of different perspectives in the social networking datasharing space. Marc Canter called the Data Sharing Summit to figure it out – face-to-face. (I raised my hand and said I would help facilitate). It is going to be Sept 7-8 in Richmond CA (Bay Area). Face-to-Face for a day can be like 6 months on a mailing list. It is invaluable and the text dialogue afterwards is improved in quality and effectiveness.
Ok back to Stefan:
Personally, I can’t be bothered much with a sign-on system for blog comments and social networks, but if it makes other people happy, great.
In fact social uses of persistent identity are actually interesting and just dismissing it as pithy isn’t really productive.
OpenID is a starter way to for websites to start using identity tools for people. Thousands of websites have adopted it – cause it is easy to do and it works. You could get up and praise OpenID for existing cause it is warming all those Relying Party sites to the idea there are identity tools and services they can offer to their user-bases. The challenge that Stefan and everyone else has with more complex visions of how things could/should work is how do you make it ‘easy’ – both for users and developers.
I think nuances that Stefan articulates are really important.
“selective disclosure, authenticated anonymity and pseudonymity (possibly with revocation capabilities), improve availability, enable privilege and entitlement management, and provide security against insider attacks originating from the Identity Provider,”
These need answers and they are not going to come from one company with one solution alone. Community engagement is needed – so I encourage all to put your solutions into the mix and lets see if we can figure this out.
It would be very worrisome to me, however, if a URL-based system (whether OpenID or a variant) would become the basis for “serious” identity and access management applications such as e-commerce, e-health, e-government, general credential systems, and so forth.
Your challenge is that people (consumers, business people, legislators) can readily comprehend identifier system that work like this. If you and others don’t want the world to work like this then it is up to you to figure out how you explain complex math in a way that doesn’t go into the detail but just explains it in a way that ‘makes sense.’ I have had the luxury of sitting down a few times and listening to you explain ‘how the math works’ and it still seems a bit ‘mind boggling’ but “I trust you” – basically it is where peoples trust lies…is it in ‘human’ trust (my openID provider isn’t going to take my password and log into places for me) or is it in ‘math trust’ (these really smart guys have these groovy algorithms that mean only “I” can access my stuff and I can share information with them without really telling them who I am). I hope the latter can work – that the systems can evolve and people will “get” them. However it is a communication challenge and an adoption challenge that is not easy.
I have encouraged Stefan to come to community events many times. . I do hope he takes up my invitation to come to the Internet Identity Workshop December 3-5. I hope you will all encourage him too.
Business 2.0 gets OpenID wrong
I read this in hard copy on the way to the plane just before heading home from BlogHer. I just about fell off my chair…
Tractis, its creators say, is no less than a comprehensive legal system for the Internet nation. “The biggest problem with online contracts now is enforcement,” says David Blanco, the Madrid-based CEO of Negonation. “If you reach an agreement with another person and something goes wrong, how do you enforce the contract and in which jurisdiction? How do you know the true identity of someone calling himself snake69@hotmail.com?”
To solve that kind of problem, Tractis will offer a comprehensive range of trust and verification systems – and take advantage of controversial national ID cards. There are already 600,000 of the cards issued in Spain; similar ones are compulsory in Belgium, Germany, and Portugal. The United Kingdom is set to roll them out in 2010. Insert your ID card into a smartcard reader and Tractis will instantly verify it with your country’s database.
That doesn’t mean citizens of countries without national ID cards, like the United States, are left out. Tractis can also authenticate online identity via OpenID, a security standard now supported by Microsoft Vista, Firefox, and AOL. The final agreement can carry a digital certificate that in most countries, including the United States, has the same legal weight as a handwritten signature.
I wonder how they got it so wrong? Was it Tractis that said these things and the reporter didn’t bother checking the facts? or we is it us…the OpenID community not communicating clearly enough?
I mean OpenID is great It does do ‘authentication‘ in the technical sense. It is not a replacement for National ID card, it is not a ‘security standard’, It does not do validation (checking that you are linked to a ‘real’ identity that is yours) or enrollment (getting you signed into a system).
Maybe Negonation (the company behind Tractis) has plans to have a validated OpenID service? Hopefully they are going to come to DIDW and IIW.
They certainly have ambitious aims in creating trust on the web..
Negonation is commited to create secure and trustworthy electronic commerce, above the legislative islands. We’re aware that the words “secure” and “trustworthy” are difficult to define, more a subjective sensation than a concrete objective. The solution does not rely on using a standard, technology, hardware process or concrete legislation. It is a combination of many things, with no magic formula. A user will feel secure using Tractis or not. They will trust the service or not. We believe that the formation and support of this forum is a step in the right direction.
They Quote Richard Stallman on the top of their blog…
For businesses to have special political influence means that democracy is ill. The purpose of democracy is to make sure that wealthy people cannot have influence proportional to their wealth. And if they do have more influence than you or I, that means democracy is failing. The laws that they obtain in this way have no moral authority, but they have the capability of doing harm.
Maybe they are going to be using Open Source software so we can trust their system?
Big Brother coming to NYC
NYC Real world Tracking one step closer:
New York City is seeking funding for a multi-million dollar surveillance system modeled on the one used in London. Police in the city already make use of the network of cameras in airports, banks, department stores and corporate offices — an arrangement used in cities across the country. This new project would augment that network with a city-wide grid. ‘The system has four components: license plate readers, surveillance cameras, a coordination center, and roadblocks that can swing into action when needed. The primary purpose of the system is deterrence, and then an investigative tool.’ But is it necessary? Steven Swain from the London Metropolitan Police states ‘I don’t know of a single incident where CCTV has actually been used to spot, apprehend or detain offenders in the act. Asked about their role in possibly stopping acts of terror, he said pointedly: “The presence of CCTV is irrelevant for those who want to sacrifice their lives to carry out a terrorist act.”
The implementation of the plan, called the Lower Manhattan Security Initiative, will require about $90 million, New York City Police Commissioner Ray Kelly said. It will cost about $8 million a year to maintain.
The city so far has raised about $25 million. Part of it has come from the Homeland Security Department and the rest from city coffers.
Donna Lieberman, the executive director of the New York Civil Liberties Union, said she was alarmed by the prospect of government and law enforcement officials having records of a person’s daily activities.
“It wasn’t that long ago that J. Edgar Hoover was up to his dirty tricks using government spying to interfere with lawful dissent, undermine critics and pursue an unlawful agenda,” she said.
However, police officials repeatedly note there is no expectation of privacy in a public area and it is not a constitutional right.
From the Web 2.0 World
I spent a lot of today looking through my ‘tech’ feeds (yes I have an RSS reader going again) and found some interesting posts….
You Departed – so you can leave messages for your family after you die from Tech Crunch
Identity Theft targets pedigree poodle from Boing Boing
Why Open Source Software is Social Media from James Governor’s Monkchips
Their has been an interesting conversation about the word and meaning of ‘USER” in the software world.
Thomas Vander Wal – Still Throwing Out the User
Tech Crunch – Long Live the User
Charlene Li – observations from the ‘user’ debate
The DHS secret list of buildings you can’t photograph from Boing Boing.
Blackberry vs iPhone on TechCrunch
OR
This really cute parody video
Community Organizer #1 Job of the Future by Seth Godin
House Cats and their Domestication History on Boing Boing.
Ikea opens hostel for shoppers in Norway on Boing Boing
Highlights from BlogHer
Ok. I will give you the IDENTITY highlights first…
I lead a session on OpenID at the unconference on sunday and the two of the four guys who were at the unconference came to the session (none of the women did). They wanted me to explain what it was because they had heard the ‘buzz’ about it and wondered.
I did get to explain OpenID to a feminist activist and photographer Laurie Toby Edison who was active in the 60’s she understood it. This was a good feeling. After years of explaining the idea (at first in theory and now in reality) of Identity on the web – I know I can explain it to just about anyone who has some computer/web literacy (it helped that she had been active blogger for over 2 years). I think this is our major challenge…expanding who is using it. I think there is a huge opportunity to get the women bloggers using OpenID – hopefully there will be some services that cater specifically to that audience.
I found a search engine that lets you link up you on the web – called Lijit. Basically you tell it your LinkedIn, Flickr, Twitter, Flickr, Blog addresses and…it can then search across them…it makes YOU and your content a resource. I said to Tara their evangelist “so it is like ClaimID but with Search” but she didn’t know about ClaimID. I am inviting her to DIDW so hopefully we can all get the scoop on Lijit. I have been thinking about the ‘non-google’ search engine space and what is out there that is better then google.
I ran into Hakia again. They are a semantic search company (this is going to be ‘the year of sematic search I think… (or as we sometimes like to joke there are 3 years in one year ‘internet time’) [reminder to self…blog about visit to the Sematic Technology conference this spring] I have not used their search engine yet – there does seem to be a fair number of ‘non-google’ search choices that look interesting…I hope they get together and collectively let us know more about other ways to access info on the web because I am getting board of google in a way. I am smarter now…it is like google is the typewriter and I want a wordprocesser.
The Experience Project – this is a place where you can go and tell your story…and they will connect you with a community of folks who have similar stories… these may be stories that are really personal and you have not shared with anyone. They keep you anonymous/psdonomoys – I asked if it was like Post Secret Interactive and they said – yeah kinda. I think the freedom that we have to be on the net and the ability to find community around issues and episodes in our past that we feel social shame and embarasment is a very good thing. I really want us to protect the freedom to be on the web without suvelance and tracking because it is a good thing.
Regular Highlights:
I had a good time at BlogHer this year. Last year was challenging…emotional regression to highschool times….the ‘popular’ girls all prancing around in their really fancy outfits…wearing makeup and fancy shoes…hanging in little cliques. The ‘unnofficial theme’ last year turned out to be “Revenge of the Mommy Bloggers” We had Baby bibs in our swag bags along with Condoms (the male kind but designed for “her pleasure.” (It turns out I did get a condom this year but it was the ‘business card’ for a blog called Motherhood uncencored.)
This year the ‘unofficial theme’ turned out to be a much more inoquous and fun one…”Crafters Take Over” and there was peace between “mommies and non-mommies.”
I went mainly because I helped them run the unconference on Sunday after the ‘official’ conference ended. Many who attended thought it was the best day of the conference.
After the unconference I had dinner with Jessee Engle who is launching a really cool service called Design My Room that does for design what open source does for software – they have top designers do rooms…and you can lift the looks and THEN design your own room – making tweeks and changes.
With the election coming up and women particularly ‘single women’ being seen as a powerful voting blog this was no surprise. I met Gina Cooper the ED of Yearly Kos, Dana Singiser Director of Women’s Outreach for the Hilary Campaign and Ramona Oliver Communications Director for Emily’s list. Granded none of these conversations was a very long but I am hoping that I can at least raise the possibility of OpenID adoption amongst campaign sites.
I met some new women Tech Friends that were really fun Gwen who just moved back from Japan and Tara who is the new evangelist for Ligit.
Why I don't trust telco's
This Horror story is why I don’t trust telco’s AT ALL. ($3000 bill for the iPhone) I am very willing to pay reasonable price for reasonable service. I am not sure why this is hard for them to GRASP but being raked over the coals.
THANK GOD FOR GOOGLE getting into the spectrum auction and forcing it to be for open usage.
From CNET:
The company is pushing the FCC to adopt rules in the upcoming 700-megahertz auction set to ensure that winners of certain spectrum licenses will have to adhere to four openness principles. These include guaranteeing that consumers can use any device or software on the network, as well as forcing winning bidders to offer spectrum at reasonable wholesale prices to ensure that small companies can get access to wireless capacity to build competitive wireless services.
From Slashdot: Most Scary to Least Scary
FBI datamining for more then just terrorists:
“Computerworld reports that the FBI is using data mining programs to track more than just terrorists. The program’s original focus was to identify potential terrorists, but additional patterns have been developed for identity theft rings, fraudulent housing transactions, Internet pharmacy fraud, automobile insurance fraud, and health-care-related fraud. From the article: ‘In a statement, Sen. Patrick Leahy (D-Vt.), chairman of the Senate Judiciary Committee, said the report [on the data mining] was four months late and raised more questions than it answered. The report “demonstrates just how dramatically the Bush administration has expanded the use of [data mining] technology, often in secret, to collect and sift through Americans’ most sensitive personal information,” he said. At the same time, the report provides an “important and all-too-rare ray of sunshine on the department’s data mining activities,” Leahy said. It would give Congress a way to conduct “meaningful oversight” he said.'”
from the just-forward-your-mail-to-homeland-security dept:
“You probably already knew that the FBI was data mining Americans in the “search” for potential terrorists, but did you know that they’re also supposed to be looking for people in the U.S. engaged in criminal activity that is not really supposed to be the province of the federal government? Now the feds are alleged to be data mining for insurance fraudsters, identity thieves, and questionable online pharmacists. That’s what they’re telling us now. What else could they be looking for that they are not telling us about?”
From the is-that-anything-like-the-lime-in-the-coconut dept:
“The kernel meets The Colonel in a just-published Microsoft patent application for an Advertising Services Architecture, which delivers targeted advertising as ‘part of the OS.’ Microsoft, who once teamed with law enforcement to protect consumers from unwanted advertising, goes on to boast that the invention can ‘take steps to verify ad consumption,’ be used to block ads from competitors, and even sneak a peek at ‘user document files, user e-mail files, user music files, downloaded podcasts, computer settings, [and] computer status messages’ to deliver more tightly targeted ads.”
From the how much can you remember department:
The research reveals that the average citizen has to remember five passwords, five pin numbers, two number plates, three security ID numbers and three bank account numbers just to get through day to day life.
Six out of ten people claimed that they suffer from “information overload,” stating that they need to write these numbers down in order to remember them.
However, more than half of the 3000 people surveyed admitted to using the same password across all accounts, leaving them at risk of potentially severe security breaches.
Professor Ian Robertson, a neuropsychology expert based at Trinity College Dublin who carried out the study, said: “People have more to remember these days, and they are relying on technology for their memory.
“But the less you use of your memory, the poorer it becomes. This may be reflected in the survey findings which show that the over 50s who grew up committing more to memory report better performance in many areas than those under 30 who are heavily reliant on technology to act as their day to day aide memoir.”
Who ownes that copy?:
‘Copyfraud is everywhere. False copyright notices appear on modern reprints of Shakespeare’s plays, Beethoven’s piano scores, greeting card versions of Monet’s Water Lilies, and even the US Constitution. Archives claim blanket copyright in everything in their collections. Vendors of microfilmed versions of historical newspapers assert copyright ownership. These false copyright claims, which are often accompanied by threatened litigation for reproducing a work without the owner’s permission, result in users seeking licenses and paying fees to reproduce works that are free for everyone to use…'”
Second Life – the real picture emerges:
The LA Times is running a story today saying that marketers are pulling out of Second Life, primarily because — surprise, surprise — the ‘more than 8 million residents’ figure on the game’s Web site is grossly inflated. Also, as it turns out, the virtual world’s regular visitors — at most 40,000 of them online at any time — are not only disinterested in in-world marketing, but actively hostile to it, staging attacks on corporate presences such as the Reebok and American Apparel stores.
THIS IS FUN:
RunBot Robot Walks:
“The basic walking steps of Runbot, which has been built by scientists co-operating across Europe, are controlled by reflex information received by peripheral sensors on the joints and feet of the robot, as well as an accelerometer which monitors the pitch of the machine. These sensors pass data on to local neural loops – the equivalent of local circuits – which analyse the information and make adjustments to the gait of the robot in real time.”
THIS IS GODO NEWS:
from the free-at-last dept:
“IBM is making it easier to utilize its patented intellectual property to implement nearly 200 standards in the SOA, Web services, security and other spaces. Under a pledge issued by the company Wednesday, IBM is granting universal and perpetual access to intellectual property that might be necessary to implement standards designed to make software interoperable. IBM will not assert any patent rights to its technologies featured in these standards. The company believes its move in this space is the largest of its kind.”
Interop was AMAZING!
The Interop Event last week at Burton Group Catalyst was a huge milestone. The event lived up to its name…
cat·a·lyst [kat-l-ist] -noun
A person or thing that precipitates an event or change.
The energy in the room was really high. Everyone was excited. People said there was interest from enterprises (the attendees at the conference who were not vendors) in the technology and how they could help them with identity management.
It was so inspiring after all these years to actually see the vision manifest so concretely. I was at my first ‘identity meeting’ in June of 2003 when Planetwork hosted an ‘extra day’ with Identity Commons (1). It was described this way by an attendee:
I attended the “extra” day of the conference today. I was in a session that could have been called: all digital identity, all day and all of the night.
So four years later it was really amazing. As Dick highlighted we are finally up to “the chasm“.
As I was there looking at the sign on the wall in the photo and feeling the energy and all the work I really wished that Owen Davis and Andrew Nelson were there to witness it all. Hopefully they can come to the Internet Identity Workshop this December (3-5). The social issues that this new technology raises was one of the main reasons they founded Identity Commons in 2001. These topics are just starting to become really important to deal with and working groups are beginning to emerge. The fact that Cryptographic trust does not equate to Social Trust was highlighted by Neuenschwander in his talk on the final day. (in googling cryptographic trust I came across Chris Allen’s essay on Progressive Trust). We still have lots to ‘talk about’ to get it all figured out (more shared language and understanding to be built – see the last three paragraphs of this post).