Phishing is a problem improved ‘experience’ needed

This article on Network world highlights how even those alert phishing are fooled. It speaks to the need that a better ceremonial experience to sign into sites and do mutual authentication that Kim Cameron has proposed become standard.

A new study by reseachers at Harvard and Berkeley showed that 90% of participants were fooled by a clever phish — and this was while the participants were actively on alert for phishes.

By simply changing the spelling of Bank of the West from www.bankofthewest to www.bankofthevvest, people were fooled into thinking they were on a real site. The researchers say Web site designers need to come up with a better way to help customers determine when a site is a phish.

Kim Cameron’s Panel about Identity @ SD Forum

This is from the SD Forum on Interoperability January 31, 2006.

Prateek Mishra – Oracle
What is the identity problem?
It is stuck in a few places at employwer, bank and you want to
how does your identity get from your identity provider – the places were you have defined your identity to all these business processes and services.

We want to do this across the internet. There is the protocol piece – we know how to transmit identity from point a to point b this is solved…

Governence models how to transfer identity in trusted ways from point a to point b. Folks like Liberty Alliance have white papers and frameworks for this. This is a non-trivial problem. How you maintain and create governance?

How do you have normal folks sitting at their computers manage their identities in intuitive ways. How do they have a tool

Identity is stuck it wants to be free.
Protocol – Token Representaiton – solved
Governence and Infrastructure – somewhat solved
How does a person leverage these multiple identities?

Kim Cameron – fan of SAML and Liberty
As we move to more interconnected set of systems we need an identity layer. When you have an architectural whole of this magnitude you have a huge number of kludges.

Meta System

Users have no way of predicting how they should work – knowing when they are in danger.

old days fighting over token rings vs. ethernet – we got TCP/IP that encapsulated both.

We need a metasystem (I got a tiny bit distracted here, sorry. So the transcription is not perfect)

Karen Wendel, Identrus
Metasystem – single interface from an identity perspective.
Everyone has a visa card – that folks each having a card for each store. The industry would be stuck without interoperable.
Rules used consistently throughout the world.
VISA would take responsibility for legal, technical and policy issues.

Identrus was owned by the banks. Your identity will be given to you. It takes responsibility around the policy stuff. Legal aspects of your identity – dispute resolution. Liability of relying party who maintains it and lifecycle. We run this network and commonality on global basis.

(from there website) Identrus provides the global standard for identity authentication.
As communications expand and the world shrinks, knowing who’s who in the electronic universe becomes vital.
Identrus offers a full range of technology and services that support every aspect of safe eTransactions.

Rena Mears, Deloitte
Access – from a privacy point of view is different from access from a security point of view
Assertions and Claims are different

Kim Cameron..
Claims are assertions which are in doubt
everything being claimed has to be doubted so we can establish trust.

They considered using Claims but it would have become SCML (scammel)

It is to the benefit to the SAML make things secure in the browser. Shibboleth the hardest thing is home site discovery – infocards visual representation and

pick one of the 5000 higher education institutions…
or pick ‘your’ university identity.

Identrus: This is what we would call an identity provider.

Kim:
SAML is the transport language
SAML is used between a portal and services to the portal.

I propose we have new ways of the user authenticating to the portal.
The systems still exist.

Karen:
What constitutes and identity and the needs for security.
How does language play in this space – there are a lot of different models – identity is not the same as authentication or security.

problem blending identity and security – PKI
you get these people

Kim:
anyone who works with a protocol they get infected by the protocol and their vision blurs and and narrows.
We need more fanatics about protocols

Identrus:
one of the challenges for us as a community – identity does more then authenticate – sign things and create legal contracts – engage in business transactions, incur liability and regulatory transactions.

you can’t look at the papers and not see an inherent relationship between identity and security.

Rena:
Who has stepped up to be the binder of identity to the individual.

Prateek:
there is not such thing as single monlithic identity
there are multiple notions of identity useful for different contexts
Shibolith context higher education
Identrus is a context and a governance model

We like Infocards if we could use it when we get to the line in the spec it says Identity provider discovery – out of band
authentication is out of band for SAML

Karen:
everyone is bound by
the bank that issues the identity to the person
the bank binds to the person – labile to up to 10 million dollars
issued within all the legal requirements

there all these pockets of identity – the level of binding – between issuer and relying party – it does not transfer through the bridge structure.

A lot of the federated model you don’t have that level of binding between the parties.

We will work with the bridges and it is a different element.

Kim:
The government – thinking of itself as the ‘binding’ authority – reasons for relative autonomy.

Belgium a national identity card – but no card readers
One group was the association of mayors – they were now being asked to sign their legal documents with their individual citizen identity – they used to sign their documents with a stamp of their office – we must think of roles.

Kim:
The issue is PRIVACY.
the characteristics that really respects privacy are the characteristics of a system that really is difficult to penetrate.

All of the identity issues – any initiative that takes this forward we should all applaud.

Canadians in Identity – Canadian’s Identity: The Essay Series Begins

Burton Group‘s Catalyst Conference was great for several reasons. One of them included the fact they actually had a BOF (Birds of a Feather) session for Canadians.
Last time I was in Seattle over at Kim Cameron and Adel’s house enjoying a glass of wine before dinner with Paul Trevithick, Drummond myself. Drummond was the only non-Canadian there and we got to talking about why there was so many Canadians working in this niche of the industry. I think part of the reason is because of the Canadian cultural obsession with identity. I have found what I hope will be a series of essays that good job of explaining this.

The first is the middle section of an essay by Bruce Mau a Canadian Designer entitled the United States of Switzerland.

If you have other articles that help explain this let me know and I will grow the collection.

Catalyst: Logic of Identity – Bob Blakley Chief Scientist IBM

This is a summary of Bob Blakley’s talk at Burton Catalyst:

Opening – Sermon on Laws

Laws of Planetary Motion
Kim’s Laws what happens to Identity if you make stupid or subtle mistakes
Newtons Law – gravity
Why things happen
Introduction – Looking Back Digital Signatures

A while back we decided we needed non-repudiation and did digital signatures by issuing certificates.
We forgot to figure out why do signatures work in the real world.
So, we got how they worked wrong in the technical world.
Having signatures not work is bad looking forward having privacy not work is bad.
Body of Talk
Definition:
Identity is a collection of attributes by which a person or thing is generally recognized or known
Identity Relativity
The Identity of X according to Y: The set of attributes believed by Y to be true of X.
Axiom: Utility
An identity attribute has value if and only if knowing that attribute reduces risk for some party
Reducing one party’s risk often creates risks for other parties.
Consequence: Identification is Power
Identity allocates risk.The ability to create or eliminate a risk for another confers power over the other.

Axiom: Contention
Because identity claims allocate risks, they will be disputed.
Identity Attributes

  • Commercial Interest – Convenience
  • Government Interest – Security
  • Individual interest – Privacy

Definition
Privacy: is the ability to lie about yourself and get away with it.

Axiom: Subjectivity
People disagree about one anothers identity attributes
In general, there’s now easy way to tell who’s right and who’s wrong
Axiom: Temporality
The name that can be named is not enduring and unchanging name. All identity attributes change over time.

  • Prince -> symbol
  • Michael Jackson Black -> Plastified

Axiom: Obscurity
Identity attributes can be

  • what you know – you can lie
  • what you have – loose / leave
  • what you are – alter disguise

Axiom: Publicity
Identity attributes cannot be secret
By definition attributes aren’t observable can’t be used to use attributes
Axiom: Contextually
Identity is inherently subject to effect of scale.
Brandon Mayfield – guy who did not blow up trains
His finger print matched one at Madrid Bombing (it was not an accurate assertion)
Large databases -> not completely reliable
To scale identity information one needs to collect — more information

Consequence: Powerlessness
Identity is in they eye of the beholder – subjectivity.

  • You can’t control what other people think or say about you.
  • You can’t even know who knows what about you.
  • Can control what you tell people but not what people find out

Consequence: Privacy Erosion
Scale requires distinguishing between lots of individuals which requires lots of information.
In a sufficiently large population the commonly agreed to be public attributes will not distinguishing individuals well enough.
So information about sensitive attributes will be collected.

In the UK they are look at putting in scanners (QinetiQ) while entering the subway to detect knives but what about creep in the use of other things identifying tatoos?
People push back against government identification.

Consequence: Due Process
Because identity is subjective, contextually, contention and obscurity and temporality.

IDENTIFICATION REQUIRES DUE PROCESS

But due process undermines the business case for identity. Due process requires transparency. Transparency reveals how identity attributes are collected and synthesized to make judgment. Collection and Synthesis are the only sources of completive value.

They do it because they like costumer intimacy.

Supply and Demand mismatch between favorable and unfavorable information.
Favorable information is easy to get.
The subject is happy to give it to you and the subject is happy to help you authenticate it. Therefore the supply is large and the value is low. But it’s worse: Demand is also low! Because favorable information is less likely to reduce another party’s risk. Especially the case when the other party has lots of potential customers.

The business case fore identity service provider infringes privacy.

The business of identity service providers is risk reduction withholding adverse information decrease the value of business.
Collecting more adverse information makes more.

Identity and Privacy are Incompatible.
Adverse information has positive identity value but negative privacy value.
Favorable information has zero identity value and zero privacy value.

Fable about MARIA

Recent guatemalan immigration
she has AIDS and she doesn’t want anyone to know. The health insurance company wants to know this information because it is a $180,000 not to know this.

Chris hasn’t blogged either

I don’t feel so bad now…I see that Chris Cepi has not blogged since DIDW either. His last post highlights such as:

Best Semantic Transformation: Kim Cameron swapping “reify” for “thingify”

Most Predictable Vendor Behavior: Awkwardly inserting the recent Identity Theft instances into product and company pitches – for products and companies that do not provide technology that would have prevented any of the examples cited.

I missed Chris’ presentation cause I just was over tired and couldn’t find a plug at the back of the room. I promise I will make it to the next one.

I noticed visiting his blog that Thomas Barnett is in his blog roll – rad thinking our the state of our world related to connected and disconnectedness.