There is a gripping identity Battle of the Titans going on between Stefan Brandt (from Credentica and McGill) and SuperPat (Pat Patterson of Sun Microsystems) on their respective blogs. It is really a good and fascinating discussion.
There are too many pieces going back and forth for me to get this completely right, but as far as I can tell Stefan started the canon ball rolling with a piece he wrote just after the release of the preliminary report by the London School of Economics on the British ID Card initiative (my piece on the initiative is here). SuperPat added a comment asking why Stefan thought Liberty was related, and Stefan obliged with a piece where he went further, describing Liberty as being, in some of its underlying protocol design, potentially “panoptical” (a reference to Jeremy Bentham's prison observation system).
SuperPat responded that while the underlying SAML protocols could be misued, the very specialization of the identity provider role will lead to providers whose business is dependent on being trusted and protecting private infomation. He argues that use of a well-chosen trusted third party identity provider has benefits which compensate for any ensuing loss of privacy.
That leads to another piece by Stefan which drills down even further into how it is possible to avoid some of these problems by introducing new protocols and cryptographic technologies. So there is a subterranean “policy versus technology enforcement” theme here.
(Trying to write about this debate left me feeling like someone who has taken an engine apart and ended up with screws left over after putting it back together. Somehow, Stefan also posted this – and Peter Davis added a comment here.)
It's my view that anyone who follows this debate will find it fascinating. This is “the real thing”. I think Liberty marks a big step forward towards deployable intercorporate identity systems. I think Stefan offers important ideas that we must be able to plug into the emerging identity metasystem. I think his reactions warn us to be careful of overstating the privacy and other benefits of the systems we do put in place. I think Pat Patterson deserves an award for his serenity in face of the word “genuine”. And I think we can work all of these issues out as we go forward.
