Kim Cameron

Microsoft acquired U-Prove-It way back in 2008 [1]. I wonder if there is any connection between the U-Prove-It approach and ION. The linked article is from Kim Cameron's blog, and if you are interested in identity I highly recommend following his content. [1] https://www.identityblog.com/?p=939

You're right. It's the poor man's identity federation. Before I start, let me make myself very clear - I think Dan did an awesome job with Foamicate. Seriously. One guy. The balls to put something out there that's innovative and seeks to solve a REAL problem. I'm impressed. And if I were in a position to, I'd ask Dan to work for me. That said, it's worth (IMO) considering what an identity system should provide - User Control and Consent: An identity system should only reveal information identifying a user with the user's consent. The Facebook/Google/OpenId model fails this one. Minimal Disclosure for a Constrained Use: The solution that discloses the least amount of identifying information and best limits its use is the most stable long-term solution. Again, OpenId falls short in that the identity provider knows where the user is going. Justifiable Parties: Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship. Microsoft Passport is a great example of why this's a bad idea. Directed Identity: A universal identity system must support both "omni-directional" identifiers for use by public entities and "unidirectional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles. My Facebook identity is public, but I can't and shouldn't use that to access a private resource like…

Note that this is my personal opinion. I think we should be trying to come up with new solutions - BrowserId/Persona some some identity problems, but nowhere near all. Have a read through Kim Cameron's post [1] to get a feel for how naive, if noble, Mozilla's efforts are. http://www.identityblog.com/?p=352

If you need any ammunition to get it looked at more intently, here: http://www.identityblog.com/?p=1201

Hey, what's the point of DuckDuckGo when you have the NOTORIOUS FACEBOOK TRACKING CRAP in the page http://duck.co/topic/duckduckgo-in-opera and the forums ? see http://nikcub.appspot.com/facebook-re-enables-controversial-tracking-c… and http://www.identityblog.com/?p=1201 http://europe-v-facebook.org/EN/en.html defeats the intent and reputation of DuckDuckGo.

> Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? Of course not. In fact, business models were only considered tangentially in most cases because the general goal was to create an ecosystem of federated identity providers transacting over open protocols. Differentiation would come from the relationship between customers and their providers - charging for background checks to add extra confidence to third-party claims, for example. Or, by selling enterprises more secure identity claim brokers for their employees. > One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I'd love to see the Digital Identity discussion revived, and between high-profile security breaches (Adobe, Target...) and the NSA, I think it might be time. I know you don't have or necessarily want a preconceived idea of what a 3rd-party account/identity provider should be, but I encourage you to look at what's been done & discussed before. Dick Hardt's keynote from the 2006 Identity 2.0 conference is entertaining and informative: https://www.youtube.com/watch?v=RrpajcAgR1E - it's also the talk that got me hooked on Vanilla Stoli for a couple of years. Kim Cameron's "Laws of…

A good backgrounder would be The Laws of Identity https://www.identityblog.com/stories/2005/05/13/TheLawsOfIdentity.pdf

I think if you look at Kim Cameron's Laws of Identity, it's clear that the research team at MS has had it right for at least a decade, it's just that none of their ideas have made it into production. http://www.identityblog.com/stories/2004/12/09/thelaws.html Ballmer had both the plans and source code for an identity product that would have been 10x more advanced than Facebook, but they decided to axe the project so they could make the Zune instead.

When two postal-code locations (e.g., day and night, home and work) are sufficient to specifically identify 90% of the population, and with Android devices being infested with location-tracking capabilities (above and beyond GPS), creating a pseudonymous account != hiding your identity from Google (or whomever else it shares data with, intentionally/willingly or otherwise). As I've noted previously (<https://news.ycombinator.com/item?id=30953159>), I recall but cannot find the 2-ZIP-code example, though a paper describing four location points IDing 95% of the population uniquely is here: <https://www.nature.com/articles/srep01376> ZIP + gender + date of birth is another highly-effective identifier, with 87% accuracy: "What Information is "Personally Identifiable"?", by Seth Schoen: <https://www.eff.org/deeplinks/2009/09/what-information-personally-iden… Latanya Sweeney, Computational Disclosure Control: A Primer on Data Privacy Protection (Thesis, 1977, Massachusetts Institute of Technology) <https://groups.csail.mit.edu/mac/classes/6.805/articles/privacy/sweene… "ZIP ruled personally identifying in California" (2011) <https://www.identityblog.com/?p=1168>