I just came across this – shows how swamped I was in December. What a fascinating post. I know my “fascination” must appear simply narcissitic to someone just popping their head in to the discussion. But Scott thought through so many issues when he was working on Digital Me (and since). It is significant that in the light of such a different set of experiences he comes to many of the same conclusions.
I agree completely with Kim's Third Law.
The Fewest Parties Law of Identity
Technical identity systems MUST be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.
This is, IMHO, the same thing that caused the failure of Novell's digitalMe project … after it was taken over by others in the company. It's funny how some people at Novell really thought that Novell was somehow going to become the de facto source of identity information in the world.
I kept hearing these funny internal pitches about “billion user directories” … and silly me I just kept thinking “I would rather sell hundreds of millions of personal directories, then a couple of ‘billion user’ directories!” How many “billion user” communities are there on earth?
I think of a different theory on why these grand schemes fail. Kim touches on this also. If you try to build the “one big thing in the sky”, and there is a second group of people that don't like you or trust you, then they'll build their own version. Which means there will be two. If there are two, then there will be three or more … and then things start to go in all directions. It's funny to see this even occurring in the Open Source world. People have disagreements and fork a project … and then it get's forked again. I'm not saying this is bad at all … it's the natural progression. So build to embrace this!
The original digitalMe team was after building community platforms, and then providing methods to federate … however much of what we were pursuing was “client-side federation” … allowing the user to be the federation point, since they exist at the intersection of all of the communities that they belong to. We figured that we would allow anyone to create a community … and allow people to choose the communities that they wanted to belong to, and which ones they would trust.
Part of the reason that I strongly believe in the Third Law is that this is how the “philosophical” views fall also. When I participate in an identity transaction, I can choose to limit the parties involved if I trust the other party or if the information being exchanged is not too valuable. On the other hand, I might have to bring in a third or fourth party if we both want to feel secure about who the other party is, or I want to authenticate the identity information being exchanged.
In the end … I like Kim's thoughts …
