In the past few years there have been many times when people have told me that they really want simplification and convergence in digital identity systems. Their requests can take many forms. Sometimes it’s that they want just one way of identifying themselves — one username and password or one smart card that’s good everywhere. Sometimes they want to know which system will ‘win’, i.e. which vendor’s product or which identity system protocol is going to be adopted to the exclusion of other protocols. I’m sure I don’t want what they say they want. I also don’t think they actually want those things.
I do want simplification and convergence in digital identity systems — to a point. Managing all my identity data, and especially a gazillion usernames and passwords, is a pain. Too many passwords make me unsecure and insecure. I’m all for making the whole thing simpler and more manageable. But I don’t want convergence to a single identity information source, or a single authentication method, or a single identity information exchange protocol. My identity data is too valuable for that.
My identity information is valuable, like money. In fact, if someone can assume my identity they have a good chance of getting all my money, so the two are connected. Perhaps I can illustrate why I don’t want too much convergence in identity systems by way of an analogy with financial systems. I’m going to make an analogy that involves several accounts and systems for handling financial transactions, and correspond them to Internet identity systems. Please keep in mind that it’s just an analogy that seems to fit my current perceptions of the intent of some systems. Please don’t try to take the analogy beyond that intent; I do not intend to extol or bash the technical merit of any system, though I will give some of my preferences.
In the financial world, I don’t want to keep all my money in one account. If something happens to one account — it’s compromised in some way such as I lose the credit card or check book — I have other accounts to finance my attempts to repair the situation. Similarly, I don’t want a single way to access those accounts. Right now I commonly use credit/debit cards, but I also still use checks and scheduled withdrawals by linked accounts — three distinct access mechanisms, each with their own mechanisms to control access my money. They each have their own advantages and disadvantages. They are all useful, but I also appreciate that they are all different.
Checks are very easy to understand. They are like a paper promise that can be easily accepted by many individuals and businesses. The promise is to be paid with money withdrawn from the account identified on the check. There is very low cost for businesses to accept checks. But checks are not very secure for some purposes. Some problems with checks can be reduced by combining a them with another system, such as an identification or credit card.
Linked accounts are also quite useful for some purposes. By linked accounts, I mean a system in which I fill out a form that authorizes one business to take money from one of my accounts when a charge has been incurred. For example, I authorize my dentist to charge my insurance account. Linked accounts are a little heavy on the paperwork side. I have to set up everything and make sure both entities know their role. It’s easier when I can present a card, like my insurance card, to set up the initial link. I generally don’t like linked accounts because I prefer knowing when the money is going to leave my account. But there are times I use them and don’t know a better way to handle some situations, like the dentist.
Credit and debit cards are personally what I use the most for financial transactions. I tend to like them because they are both convenient and a point of control for me to authorize money taken from one account and given to a business. Credit cards are more burdensome for businesses than checks, but more secure. Credit cards are less burdensome for businesses than establishing a link to each customers bank. I also like that I can easily have multiple cards for multiple purposes. I can even easily keep track of purchases from a single business when I am in different roles by using my work card vs. my personal card. I’m sure I could do that with the other systems as well, but I don’t. It seems more natural with cards.
Furthermore, I don’t expect my financial world to be limited to these systems. If I lose all my cards and checks, I still want to be able to walk into the bank and authenticate in person to gain access to my account. And there may be new systems in the future.
So how does this correspond to identity systems? Just like my finances, I want multiple accounts for my identity information, and I want identity systems to co-exist peacefully and work well together (and that’s what the Bandit project is working towards). I personally think the information card metaphor will be the most common way to access my identity information, but I also find OpenID and federated accounts to be useful. And in some cases I actually want access via username and password to remain supported.
The only thing that I want to be able to correspond my accounts and access mechanisms — the thing that is in the center — is me, not an external identity information store. You might even say that my account correlation preferences are user-centric (for some definitions of user centric).
So why do multiple systems reduce my risk and still end up being more manageable?
It’s a matter of convenience, points of control, and manageability. In my current financial world I have less than 10 accounts; I commonly use less than 10 cards; I rarely write checks; I rarely link accounts, and even more rarely go into the bank to access my account in person, but I generally manage to keep my accounts current. In the online world I have hundreds of accounts and passwords. Incorrect information abounds because I can’t keep track of it all. My online world is more easily compromised in the sense that someone could get into my accounts without my knowledge. It’s harder to keep track of it all due to the sheer volume of accounts. If I can get to an online world that uses a combination of information cards, OpenID, and federated accounts, but in which I have less than 10 accounts to manage, that will be much better than what I have now and I would still be able to divide up the risk.
So that’s my analogy. It’s not a perfect analogy, but I think it fits how this space feels to me. It even has some other interesting illustrative points.
For example, it’s not surprising that a specialist in electronic funds transfers would scoff at paper checks. It’s also likely that a professor of economics would think checks, electronic funds transfers, and credit cards all have their place.
We can also see that there is value is some integration points between systems. There are a number of cases that I get cash with a card from an ATM (a financial token service as opposed to a security token service), or use a card in combination with other systems. But I don’t want them too enmeshed either. In my financial systems, I want integration at key points, but not complete convergence. Same with my identity systems.
What makes the overall financial system work is an underlying conceptual framework built on this rather vague notion called money. There are common concepts and principles that underly all the systems, even though they are often abstract and not well understood by everyone that uses the system. Sounds like identity systems to me.
So what is the One True Identity System that I want? It’s diversity of access mechanisms and sources of identity information built around a common conceptual foundation of identity, authentication, authorization, delegation, auditing, etc. Sounds complicated, but we do it all the time with money.
Please note that in this whole post I didn’t use any word that started with ‘meta‘ … yet. But if I was going to discuss anything meta-ish I would start with Bob‘s discussion of a meta-identity system and the identity oracle, and I would use this photo. The question is, which box is more like the meta-identity system oracle?
Last Friday, Andy quietly posted the 