Day: February 7, 2005

In presenting the Sixth Law I talked about new emerging identity attacks that are like phishing but don't require the user to respond to an email. Now eWeek tells us that Scott Chasin, CTO at MX Logic, has started calling these attacks “pharming.” Great word.

Chasin expects this first-generation phishing to move toward pharming, which involves Trojans, worms, or other technology that attack the browser address bar. Thus, when users type in a “valid” URL they are redirected to the criminals’ Web sites.

Another way to accomplish the same thing is to attack the DNS system rather than individual machines. Do this and conceivably everyone who enters what seems like a valid URL—the one that worked properly moments before—will instead be taken to the scammer's site.

Scott sent writer David Coursey a list of pharming-like attacks that have already taken place.

These include an incident last November, when Google and Amazon users were sent to “Med Network,” an online pharmacy. The Troj Banker A/j worm, seen last November and December, watched for users to visit specific banking sites and then grabbed the personal information entered there for use by the criminal pharmers.

Depending on how you look at it, a less-criminal incident involved the March 2003 hijacking of the Al-Jazeera site by the “Freedom Cyber Force Militia” using DNS poisoning. The message viewers received: “God bless our troops.”

In talking about the inevitability of this type of attack, I have said:

Of course our usual immediate reaction to this type of problem is to find the most expedient single thing we can do to fix it. In the example just given, the response might be to write a new “safe address bar”. And who am I to criticise this, except that in the end, the proliferation of address bars makes things worse. By inventing one, we have unintentionally made possible the new exploit of getting people to install an address bar with evil intent built right into it. Further, who now can tell which address bar is evil and which one is not?

So we shouldn't be surprised that David's article concludes:

There are remedies for the pharming problem. A simple solution that works in some cases is a browser plug-in from Netcraft that displays information about the site being visited, such as its geographic location. If you notice that your mortgage company's site is being served from somewhere in the former Soviet Union, you can safely assume the worst.

But for those following the conversation here, who are attempting to understand how identity can work predictably across the entire internet, it is clear that threats like pharming and phishing must fundamentally shape the contours of the system, as expressed in the sixth and seventh laws of identity.

Cool Don Box has called the Laws a Gestalt: a structure, arrangement, or pattern of physical, biological, or psychological phenomena so integrated as to constitute a functional unit with properties not derivable by summation of its parts. An interesting observation as usual.

Many participants in this discussion have talked about how “identity is contextual”. The extreme argument is made by Scott C. Lemon, who posits in his second axiom that “identity does not exist outside the context of a community”. And Jamie Lewis has said “Context is Everything” when rapping on the Fourth Law (er Principle) of Identity. He gives some good examples, too:

I’m an audio/video enthusiast (my wife would say freak), so I’m a member of the Audio Visual Sciences Forum. I self-asserted my identity when I signed up, and that’s fine for the AVSForum. As long as I play by the forum’s rules, the folks that run the forum are fine with me being around using whatever identity I’ve established for myself. The reputation system inherent in the AVSForum takes care of many governance problems. The forum’s moderators and administrators step in with full authority when they have to.

But will self-assertion alone work for my bank? Hopefully not (or I need to change banks). Yes, the AVS Forum could rely on the identity my bank issues, but I might not want to use such an unambiguous (and valuable) identity in that social context. And why should AVSForum do that anyway? The cost could well outweigh any benefits it may gain. Once you get past registration, you get to the differences in policies (credential type and strength), attributes, and the management systems necessary to propagate and use identity in each of these very different contexts. In large part, these things must be need-driven, and one size will not fit all…

In other words, identity is the most contextual element you can possibly imagine; in fact, all social interaction is highly contextual, especially online. Who we choose to be, what of ourselves we choose to share, what faces we choose to show, depend entirely on the context in which we’re operating.

It stands to reason, then, that domains of activity will emerge, and they will have their own identity mechanisms, probably their own identifier, which will be unique and appropriate within the context of that given domain.

Several of the Laws of Identity capture the objective constraints implied by these observations. The Third Law talks about limiting the disclosure of identifying information to “parties having a necessary and justifiable place in a given identity relationship.” That relationship is clearly a context. The Fourth Law explains why a metasystem should be able to support “unidirectional identitifiers” for use in private relationships, which again are specific contexts. And the Fifth Law states the need for a pluralistic metasystem in which different technical systems run by different parties must coexist, again for use in appropriate contexts.

But now let's get a bit more concrete. Let's project ourselves into a future where we have a bunch of contextual identities. I'll carry on where Jamie left off and pick an arbitrary set of identities that seems pretty convenient:

• browsing: a self-asserted identity for exploring the web (giving away no real data)
• personal: a self-asserted identity for sites with which I want an ongoing but private relationship (including my name and a long-term email address)
• community: a public identity for collaborating with others and bloggling (includes my community name and its long-term email address)
• professional: a public identity for collaborating issued by my employer
• credit card: an identity issued by my bank
• citizen: an identity issued by my government

Things might be pretty simple if everyone chose the same set of identities that I use. But of course they don't. Jamie doesn't use a self-asserted personal identity. My brother's employer doesn't issue professional identities. Marc hasn't applied for a citizen identity, and doesn't plan to. So we have a mishmash of possibilities for identifying ourselves.

Now, you are not going to believe this, but this mishmash is good. It is in accordance with our diversity. We don't need to freak out about it. We need to accept it.

How do you deal with diversity?

Let's begin by assuming that diversity does not present a technical problem. I know this will be a stretch at first, but bear with me until “tomorrow”: let's look at the other issues.

The answer to which types of identity are acceptable then lies in the hands of each “relying party”. In other words, each given web site decides what kind of identities it will accept. Again, some examples will help, so I'll ofer some.

Let's start with “Kim Cameron's Identity Weblog”. What kind of identities will Kim's weblog accept? You name it – I'll accept it. Anything that works for you is fine with me – I want to get a discussion going.

On the other hand, let's say you go to a site like eBay. It may allow you to use any identity (or no identity) to window shop. But it will likely expect to see a credit card identity when you make a purchase. And if you want to post things for sale, the site may well expect you to present a community identity, something to which a reputation is attached.

We could give the example of using a citizen identity to access information about your social security contributions. Or of using a professional identity to get into a professional conference.

So two things become clear.

1. A single relying party will often want to accept more than one kind of identity; and
2. A user will want to understand his or her options and select the best identity for the context

Now it is necessary to consider the Sixth Law – the Law of Human Integration. This means that the request, the selection and the proffering of identity information must be done such that the channel between the relying party (e.g. the web site) and the user who is releasing information (in accordance with the First and Second Laws) is safe – and that the options are consistent and clear. Taking all of these constraints into account simultaneously (the head almost explodes) we are faced with the Seventh Law:

The Law of Harmonious Contextual Autonomy

The unifying identity metasystem MUST facilitate negotiation between relying party and user of the specific identity and its associated encoding such that the unifying system presents a harmonious technical and human interface while permitting the autonomy of identity in different contexts.

Does this sound too hard? It's hard, but I think, as you will see in upcoming postings, that our industry has the tools we need to do this. Meanwhile the cost of not having a unifying identity metasystem will continue to grow exponentially.

It was probably eight years ago now that Doc Searls took a deep look at my work on metadirectory, which I was having trouble explaining (you can see that little changes), and said:

“Kim. It's simple. We have multiple identities on multiple systems but there's no way for us to integrate them. If this were happening in the physical world, we'd have multiple personality disorder. The internet is still psychotic.”

A thought like this never leaves you. Certainly I am convinced that as users, we need to see our various identities as part of an integrated world which none the less respects our need for independent contexts.

Not long ago, Jamie Lewis suggested a course correction regarding our use of the word “universal”:

When anyone talks about a “universal identity system,” my first instinct is to put my money in my shoe.

Jamie went on to point out that when I have used the term “universal identity system,” I have meant:

“… universal” in the sense of a widely accepted, highly scalable approach, applicable and usable across the diverse and wide-ranging Internet. He’s talking about enabling a truly distributed system that can bind many different applications, use cases, and identity systems into a more meaningful (but logical) whole…

Because it is so crucial, I’m concerned that some folks will interpret “universal” to mean “uber,” as in one single identity system operating on a single standard, in spite of Kim’s intention. That’s precisely what X.500, X.509, and other attempts to solve this problem are and were about. And there are some folks who just seem genetically pre-disposed to approach the problem from a top-down, if-we-can-all-just-agree-on-one-single-identifier perspective.

And sure enough, as Jamie predicted, some good people have already been thrown off by the ‘U‘ word.

Here's a comment I received from Martin Taylor. Martin is a knowledgeable thinker who says:

I am curious… as to why there is nothing in the laws that really considers the motivation (or de-motivation) to an individual or to an organisation to make use of an identity system – to the collective point where the system could reasonably be said to be universal.

The need for identity mechanisms is clear. The need for a universal identity system is not.

The point at which a given identity system is able to grow sufficiently for it to be deemed universal has to show some benefit somewhere. If participation is expected to be voluntary (i.e. assuming that there will not be a single government able to mandate identity upon enough individuals for it to be deemed universal) then, the individuals involved must perceive a net benefit to themselves.

Where: net benefit = total benefit perceived – perceived disbenefit (from difficulty of use, perceived trust in providers, etc.)

This net benefit then is a limiting factor to the size/growth of the system.

I like the simplicity of Martin's “net benefit” equation. Yet the sentence beginning “If participation is expected…”, makes me fear he is taking the word ‘universal’ in precisely the way Jamie predicted would happen… And this unfortunately and unnecessarily complicates what is otherwise an interesting discussion.

Let's try substituting the word “unifying” and see if things get any better. Martin would then be saying:

The need for identity mechanisms is clear. The need for a unifying identity system is not.

That might not lead him to the same worries about bullying national or supernational governments…

Martin's equation is a proposition which applies to almost any computer system. But it certainly provides the framework for judging the success of systems designed according to the laws of identity.

Now let's look at how a unifying identity system would provide net benefit… Which takes us to the Seventh Law.