The Internet was built without a way to know who and what you are connecting to. This limits what we can do with it and exposes us to growing dangers. If we do nothing, we will face rapidly proliferating episodes of theft and deception that will cumulatively erode public trust in the Internet.
We have undertaken a project to develop a formal understanding of the dynamics causing digital identity systems to succeed or fail in various contexts, expressed as the Laws of Identity. Taken together, these laws define a unifying identity metasystem that can offer the Internet the identity layer it so obviously requires. They also provide a way for people new to the identity discussion to understand its central issues. This lets them actively join in, rather than everyone having to restart the whole discussion from scratch.
Those of us who work on or with identity systems need to obey the Laws of Identity. Otherwise, we create a wake of reinforcing side-effects that eventually undermine all resulting technology. The result is similar to what would happen if civil engineers were to flaunt the law of gravity. By following them we can build a unifying identity metasystem that is widely accepted and enduring.
The Laws of Identity are available in five formats:
Browser version . Printable PDF. Word. DIDW powerpoint. The laws in point form.
The ideas presented here were refined here in the Blogosphere in a wide-ranging conversation that crossed many of the conventional faultlines of the computer industry, as well as in various private communications. In particular I would like to thank Arun Nanda, Andre Durand, Bill Barnes, Carl Ellison, Caspar Bowden, Craig Burton, Dan Blum, Dave Kearns, Dave Winer, Dick Hardt, Doc Searls, Drummond Reed, Ellen McDermott, Eric Norlin, Esther Dyson, Fen Labalme, Identity Woman Kaliya, JC Cannon, James Kobielus, James Governor, Jamie Lewis, John Shewchuk, Luke Razzell, Marc Canter, Mark Wahl, Martin Taylor, Mike Jones, Phil Becker, Radovan Janocek, Ravi Pandya, Robert Scoble, Scott C. Lemon, Simon Davies, Stefan Brands, Stuart Kwan and William Heath.
The discussion of the laws continues and our documents will be updated periodically to reflect this.
[...] This perspective (creating a common user identity experience) led Kim Cameron to develop his laws of identity from the user’s viewpoint, and then conceptualize the development of an open identity metasystem, which would allow his user interface to connect with and manage a user’s information interoperably with nearly any kind of identity infrastructure that exists or might come to exist in the future. [...]
[...] I’ve known the Opinity guys for a while now, but they have very much solidified their thinking and really thought hard about how to make their system accord with the Seven Laws. I think it’s one of the more forward-thinking social computing initatives I’ve seen. They have great ideas for delivering new experiences without screwing up on the privacy front. Last week, Ted Cho and Bill Washburn, two of the head guys at Opinity, had a talk with Kim Cameron, Microsoft’s identity guy (which you probably knew already). This was a continuation of a discussion that goes back to last summer. As a result of these talks and our own ongoing focus, Opinity will implement Microsoft’s InfoCard into Opinity 2.0. [...]
[...] One of the people who has thought most deeply about the Laws of Identity is Aldo F. Castaneda. He studies Law and Business Administration at Suffolk University Law School. His blog is the home of his legal thesis, which grapples with intellectual property issues in the emerging digital identity space. He is also doing what must be the definitive series of interviews with people working on identity, called The Story of Digital Identity. He’s currently up to Episode 16 (!), an interview with Identity Woman and Marc Canter. [...]
[...] And yesterday I found Sxip Identity a company that’s building a simple, secure, and open Identity solutions for the Web. A must see on this subject is this presentation about what Identity is. And the weblog on the same subject. an other interesting weblog on the same topic is the identity blog by Kim Camereron and his paper about the laws of (online) identity which is also one of the foundations of on the Microsoft Infocard system. [...]
[...] Blog of interest is Identityblog one of the co-writers of laws of (online) identity the research report where Infocards is being developed on. [...]
[...] Blogs Identityblog ToRead laws of (online) identity [...]
[...] Mike Jones from Microsoft was given the task of introducing the Laws of Identity and InfoCard. As a way of introducing InfoCard, Mike talks about claims and credentials in the physical world and how we use them. Mike spent a good deal of time talking about the laws. I think that was time well spent—they form a good basis for many of the conversations we want to have at IIW. [...]
[...] Sorry, but firing people is not going to fix this problem. Instead, maybe GWB could increase his popularity by adopting Pete Lindstrom’s modest plan to Eliminate the SSN Facade. And while we are at it, why not write the Laws of Identity into the Constitution? Ok, maybe not on that last one, but how about we use the Laws in the systems we build? [...]
[...] Centralization of any data suffers from reliability and performance problems at scale, requiring significant "brute force" to overcome. But when identity data is centralized a huge number of side effects occur that will ultimately undermine the success of the endeavor - even if the technical aspects are successfully worked out. Perhaps the most visible example of this was the Microsoft Passport project. Microsoft demonstrated that the technical problems of an internet scale centralized identity system could be solved. They also pretty well demonstrated that the side effects were so numerous and undesirable that a successfully implemented centralized identity data system wouldn’t be accepted by the marketplace. This experience was a major factor in Microsoft’s Identity Architect Kim Cameron formulating his Laws of Identity which attempt to describe the attributes an internet scale identity system must have to achieve marketplace acceptance. [...]
[...] Centralization of any data suffers from reliability and performance problems at scale, requiring significant “brute force” to overcome. But when identity data is centralized a huge number of side effects occur that will ultimately undermine the success of the endeavor - even if the technical aspects are successfully worked out. Perhaps the most visible example of this was the Microsoft Passport project. Microsoft demonstrated that the technical problems of an internet scale centralized identity system could be solved. They also pretty well demonstrated that the side effects were so numerous and undesirable that a successfully implemented centralized identity data system wouldn’t be accepted by the marketplace. This experience was a major factor in Microsoft’s Identity Architect Kim Cameron formulating his Laws of Identity which attempt to describe the attributes an internet scale identity system must have to achieve marketplace acceptance. [...]
[...] Pete Rowley has spoken on user-centric identity, which is to say “people are in the protocol.” In other words: When I say protocol I mean it in its broadest sense, in the sense that showing my driving license to a cop at a traffic stop and the cop returning it to me is a protocol. In that transaction I am in possession of the information, I have full knowledge of what information I would pass along to the cop, and I also have the choice of saying no - even if that might result in bad things happening. So people in the protocol means that … [they are] a conduit for all identity decisions in an environment of informed consent. This necessarily means that the protocol must pass through the user, or in other words appear on the screen and be approved by the user. That is an architectural philosophy that results from Kim Cameron’s laws of identity and it is a necessary one in order to gain user buy in. It is also just the right thing to do. [...]
[...] When I say protocol I mean it in its broadest sense, in the sense that showing my driving license to a cop at a traffic stop and the cop returning it to me is a protocol. In that transaction I am in possession of the information, I have full knowledge of what information I would pass along to the cop, and I also have the choice of saying no - even if that might result in bad things happening. So people in the protocol means that rather than being an end node that may begin a transaction and perhaps be the recipient of the end results but with only vague or even no information about the information passed in the transaction, they are rather a conduit for all identity decisions in an environment of informed consent. This necessarily means that the protocol must pass through the user, or in other words appear on the screen and be approved by the user. That is an architectural philosophy that results from Kim Cameron’s laws of identity and it is a necessary one in order to gain user buy in. It is also just the right thing to do. [...]
[...] Ruddy: Microsoft is working hard to make the right things happen. Kim Cameron, with his blog and his Seven Laws of Identity have been setting a vision for the characteristics that identity systems need to have to be adopted and successful. What we’re demoing is a browser extension that works with Firefox but we will be doing Internet Explorer. [...]
[...] He speaks exclusively to Ideal Government about the UK’s ID developments in the context of state-of-the-art industry developments such as the Laws of Identity, Information Cards and the imminent ID big bang. Note from administrator: (This was a 40 minute interview - the key sections are linked to the text below. [...]
[...] When I say protocol I mean it in its broadest sense, in the sense that showing my driving license to a cop at a traffic stop and the cop returning it to me is a protocol. In that transaction I am in possession of the information, I have full knowledge of what information I would pass along to the cop, and I also have the choice of saying no - even if that might result in bad things happening. So people in the protocol means that rather than being an end node that may begin a transaction and perhaps be the recipient of the end results but with only vague or even no information about the information passed in the transaction, they are rather a conduit for all identity decisions in an environment of informed consent. This necessarily means that the protocol must pass through the user, or in other words appear on the screen and be approved by the user. That is an architectural philosophy that results from Kim Cameron’s laws of identity and it is a necessary one in order to gain user buy in. It is also just the right thing to do. [...]
[...] As always, the key here is “User Control and Consent”.  Citizens have to want to use the system.  Close behind are ”Minimal Disclosure” and “Directed Identifiers” and all the other Laws of Identity.  Any successful ID card will have to be more attractive than the status quo - proving it is a step forward, not backward, and winning support. [...]
[...] Kim Cameron’s laws of identity provide an excellent roadmap for building solutions that can address the identity infrastructure needs. Based on some of the laws, there are a number of solutions in the market waiting to mature and provide solutions to some of the problems listed above. A few of the solutions/approaches are SXIP identity, OpenID, Inforcard (Microsoft) etc. While there solutions and laws are important in addressing the glaring needs of identity infrastructure, they might not apply to all layers of identity. [...]
[...] Kim blogs at the Identity Blog and came up with the 7 Laws of Identity - which are a litmus for quality and honesty in the world of Identity. [...]
[...] Kim blogs at the Identity Blog and came up with the 7 Laws of Identity - which are a litmus for quality and honesty in the world of Identity. [...]
[...] Readers new to this discussion should take a look at the Laws of Identity, which provide the larger context for this discussion from a technology point of view. [...]
[...] Kim Cameron’s laws of identity provide an excellent roadmap for building solutions that can address the identity infrastructure needs. Based on some of the laws, there are a number of solutions in the market waiting to mature and provide solutions to some of the problems listed above. A few of these solutions/approaches are SXIP identity, OpenID, Inforcard (Microsoft) etc. While there solutions and laws are important in addressing the glaring needs of identity infrastructure, they might not apply to all layers of identity. [...]
[...] Consistent with the “Seven Laws of Identity” that were first espoused by Microsoft’s Kim Cameron (7 Laws of Identity), the new models for user-centric identity also enable user-control over what information is shared in any given context. Companies, website owners, and web application providers will now be faced with the structural choice of whether to respect the individual’s preference to share only the information that is necessary for a given transaction. While the technologies used by service providers to implement this change may not be as readily apparent to the end-user or consumer, it will soon be clear whether the service provider respects the user control or not. [...]
[...] The use of an identifier in our first example breaks the second Law of Identity (Data Minimization - release no more data than necessary). It breaks the third Law too (Fewest Parties - since it discloses use of information to a central database unnecessary to the transaction).   Finally, it breaks the Fourth Law (using an omnidirectional identifier when none is required). [...]
[...] Cameron’s Laws of Identity have received a lot of attention, and for good reason; these laws encode properties that are very [...]
[...] en bepaalt aan wie hij deze identiteit beschikbaar stelt.  Belangrijke richtlijn hierbij zijn de 7 wetten van identiteit, zoals Kim Cameron deze heeft [...]
[...] those caught up in child fingerprinting have broken the first four laws of identity all in one go.  This will come back to haunt them - and much worse, may stalk some of their [...]
[...] setting up federated trusts; and secondly, users and service providers should become aware of the Laws of Identity and Identity 2.0 and what it means and provides them. Technology Evangelists should also take note [...]
[...] .NET titled “Implementing CardSpace in your website” where I’ll be going over the Laws of Identity, the architecture and implementation of CardSpace to authenticate users on an ASP.NET and [...]
[...] Kim provides a good springboard to the pool of conversations taking place in this respect. His Introduction to the Laws of Identity is a must-read. And if you really haven’t delved into this subject at all, you must must must [...]
[...] Whitepaper: Laws of Identity (Link). [...]
[...] listed privacy protecting identity management systems, which he broadly defined as those following Kim’s seven laws. The list was short, just PRIME and Credentica … note the absence of CardSpace. So, I just [...]
[...] from Microsoft, and no, no, no, it’s not “Passportâ€. It is expressed in two seminal papers: The Laws of Identity and The Identity Metasystem, both by Kim [...]
[...] doing all we can to break this pattern. We were the first (through Kim) to espouse the principles of the 7 laws and articulate the need for and design of an Identity Metasystem. We were the first to release [...]
[...] provider. How does it compare to others such as Google, Microsoft, Yahoo, when measured against the laws of identity developed by Microsoft’s identity architect Kim Cameron, for [...]
[...] Laws of Identity [...]