Posted on November 26, 2007 at 8:04 pm | 
By 
I picked up an interesting concept via Sam Sethi’s twitter today. It involves implementing white lists using OpenID and FOAF profiles to help resolve the issue with online identity.
I don’t wish to commentate on OpenID or FOAF. I do however, want to voice my concern over the misuse of the word ‘identity’ and how it is being associated with OpenID and other so-called solutions to solve identity.
OpenID , is a central register of user names and passwords. So, rather than having say, 10 different user names and passwords for 10 different Web sites, you create an OpenID account and associate it with the 10 user names. That is of course, assuming the 10 Web sites support OpenID by connecting to your account.
FOAF stands for Friend of a Friend. The FOAF project is creating a Web of machine-readable pages describing people, the links between them and the things they create and do.
According to Steve Ivy to which Sam refers in his twitter message
In less than a nutshell, the DIG is using the relationship data in their members’ FOAF files to build a whitelist of users (identified by their OpenID) who can comment on the site.
According to the image on Steve’s blog, which I think he borrowed from Tim Berners-Lee (looking at the file name when I save it)
OpenID Login proves identity
According to Dan Connolly from the W3C
As Simon Willison notes, OpenID solves the identity problem, not the trust problem.
I have to take issue with their use of the word ‘identity’.
OpenID does not prove identity. Identity has a universal meaning to just about everyone on the planet. So why is there so much confusion on the Web?
What is Identity?
When asked for ID by a car rental company for example, you know without fail, that they’re asking for either your passport or drivers license.
Why? Well, because before you were issued with a passport or drivers license, you had to prove ‘who’ you say you are. You did this by getting a trusted third party such as a solicitor or police officer who knows you, to verify your identity. Your identity as confirmed and documented by a trusted third party, was then sent to the appropriate authority for final processing.
Going back to OpenID, you can setup an account under any name and associate it with any number of profiles. None of this information is verified by anyone. Does this prove you are who you say you are? In other words, does it prove your identity? The answer is no. It does prove your identity if by that you mean something entirely different to what the vast majority of the population already believe identity to mean.
I have only witnessed one person articulate the same opinion as me and that’s Saul Klein. Saul understands identity, he co-founded TRUSTe which is the most widely recongnised Trustmark for privacy on the Internet. Saul articulated his opinion about identity after a Garlic presentation at Essential Web, where he was on the panel to whom Garlik pitched. I was on a different panel but was dying to quiz Garlik about their terminology.
How to solve the problem
Just like we do with passports and drivers licenses in the offline world, we can have our company and personal details verified by a trusted third party such as Experian or Equifax. I chose these companies because they already hold personal details and credit scores for most of us.
We could then associate that verified information with a technical solution such as Content Labels (known as POWDER by the W3C for political reasons), FOAF or some other kind of Certificate which can be recognized by a browser or other tool. Only then can you solve the ‘identity’ problem. By default, it would mean we’re half-way to resolving the trust issue at the same time.
If you consider the passport scenario… Experian and Equifax act as the solicitor or police officer who knows you. The Content Label/Certificate authority act as the passport office by issuing the proof of identity.
18 Comments
So far,
November 27, 2007 @ 
Steve Ivy
Hi Paul,
Thanks for the discussion. I wanted to touch on a couple of things:
1) The graphic is mine. Please don’t ascribe any misrepresentation by me of these concepts to Tim.
2) OpenID is not a “central register of user names and passwords”. OpenID is, in fact, explicitly decentralized:
Note the phrase “user-centric” - OpenID puts the control of who does/doesn’t have access to a user’s profile data in the user’s control, not a centralized third-party. While there may be a need/place for “trusted third parties” in online transactions, that’s not the problem OpenID is trying to solve. Per Simon Willison (to which post Dan Connoly was refering):
3) “OpenID does not prove identity”. No, OpenID creates a definition of identity - “the person or persons who can prove ownership of a URI” - A definition upon which a large contingent of web services have agreed. It’s up to other layers or other systems (ie, your trusted third parties) to establish the trustworthiness of a particular identity. The original OpenID home page does a good job at explaining some of this.
Cheers,
–Steve