Missing Code Challenge

Online identity management and single sign-on still doesn't work. Not well enough, anyway. OpenID is a good step forward. So are a bunch of other less familiar approaches. But we still haven't arrived.

For example, I've been a member of Blogger for the duration. That is, since long before Google bought the company. In the old days, making a comment on a Blogger blog was fairly easy. Now it's a lot more complicated. I'm sure that's mostly because comment spam is a gigantic problem, especially for a gigantic company like Google.

But still, from the human visitor's perspective, it's a mess. Here's a screen shot I took after failing for the Nth time to successfully post a comment on a Blogger blog:

For what it's (not) worth, I have a Blogger ID, a Google ID, several OpenIDs, some number of i-names, maybe some information cards (I'm not sure I actually have any yet, but I do think they're good to have), plus cookies from countless sites in my browser's jar, none of which seems to help with this.

I shouldn't complain, because I've been involved in the user-centric identity development community for many years, and have played an active role in helping various efforts (both competing and complementary) to move forward and get along with each other in the process.

But still, we ain't there. And I don't believe we'll get there until each of is known and/or trusted automatically by those with which (or whom) we have relationships. You know, like in the Real World.

For that to happen, we need to hack a way for the individual to drive the interaction. It isn't enough for identity to be "user-centric". In fact, it isn't enough to focus just on identity. After all, I don't need to identify myself when I walk into a grocery store and pay cash to buy stuff. In fact, the stores' "loyalty cards" are terrible systems that not only fail as identity cards, but require dual pricing for every item they "discount", while also slowing down the checkout line. It's as if some kind of digital identity disease has infected ordinary brick & mortar stores as well.

Real engagement needs to be user-driven. That means the individual should be fully empowered to engage with any person or service in the digital world on his or her own terms, in easy, consistent and well-understood ways that may or may not require identifying one's self.

We each need to be independent variables, not dependent ones. What makes me trustworthy to a service like Blogger shouldn't be code that lives entirely on Blogger's side, while all I've got is one among a zillion ID/password combinations, most of which I don't remember. I need to be trusted when I show up. Automatically.

Maybe the means for making this happen will live out in the cloud somewhere. Or in many places. (I can see a lot of potential business here, actually.) But none of it will work unless it starts with the individual. Each of us operating in the digital world needs tools for engagement that belong to us, are operated by us, and give us autonomy, capability and control.

If we get that, we can say goodbye to ugly stuff like the interface above — plus the massive market friction that comes from every vendor having its own silo'd ways of dealing with customers, including CRM (customer relationship management) systems that are controlling and inhuman beyond endurance.

Can we do that? Can we build tools that make individuals both independent of vendor control yet better able to engage with vendors? Can we fix the silo'd authentication problems that have plagued online markets from the beginning? I think we can. That's one reason why I started ProjectVRM at Harvard's Berkman Center.

But I don't know the answer yet, because we don't have the code. Some of us are working on it. You might see evidence by peeking through windows here, here, here, here, here and here — as well as in various corners of the identity community and via links in the blogroll here.

But it's still early. The challenge is still out there.

Is this an itch any of you programming folks feel like scratching — for your own good as well as the rest of the world's? If so, say so below. Or follow what we're doing at the VRM Workshop on Monday and Tuesday.

______________________

Doc Searls is Senior Editor of Linux Journal

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

There is no (reasonably

Steve the Passerby's picture

There is no (reasonably permanent) software solution to raising lousy human beings - i.e. the kind that make necessary the likes of passwords, spy/mal-ware detectors, encryption, spam-guards, etc., etc., etc. (not to mention locks, walls, barbed-wired, prisons, weapons, police, armies....)

Human interaction

Justin Yost's picture

Even in human interaction an automatic recgoniation doesn't occur. At the very least I must look at a person to identify who that person is. You always have to have a sort of sign-in or verification process to know who someone is or isn't. I just don't see that going away.

Passphrase

Grant Austin's picture

Why do I need anything more than a complex passphrase? Or perhaps I could have an application that I sign into on my computer that provides recognition services to websites that need to know about me?

Say I sign into this hypothetical program and I go to buy something from an e-commerce site that I don't have an account with. When I go to this site, it requests my name and basic demographic information from the program that resides on my computer and I can choose to allow or deny this. Then I spend some time choosing some things that I'd like to buy, and proceed to the checkout. When I click some button that finalizes my order (yes, I'm really sure I want that frobbitz) the site requests my billing and shipping information, again I can allow or deny this request.

Alternatively, some sites just want to make sure you're you so they know how to store the information you give them. For example, del.icio.us might just want a cookie loaded into your browser session. Del.icio.us could make a request to this program that it present certain information when visiting the site, minimizing the amount of pain they'd have to undergo to support this sort of program.

This really wouldn't be prohibitively difficult to build.

Webinar
One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Webinar
Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix