{"id":1166,"date":"2011-02-22T13:08:55","date_gmt":"2011-02-22T21:08:55","guid":{"rendered":"\/?p=1166"},"modified":"2011-02-27T09:56:54","modified_gmt":"2011-02-27T17:56:54","slug":"a-change-in-user-behavior","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=1166","title":{"rendered":"A “change in user behavior”"},"content":{"rendered":"

Farhang Kassaei is lead architect for platform and systems at eBay Inc and blogs at Software For All Seasons<\/a>.\u00a0 He makes\u00a0a great point\u00a0<\/a>about\u00a0one key factor\u00a0that blocked CardSpace deployment:<\/p>\n

Having worked on a authentication concept with MSFT for eBay sellers, I had mixed feelings about this [Microsoft's decision not to ship CardSpace 2.0 – Kim]. On one hand I was on the record not<\/strong> supporting the use of CardSpace for eBay sellers (or buyer). On the other hand I am concerned that technical community discounts the significance of Claim Based identity altogether and concludes that “FaceBook Conncet” is all we'll ever need.<\/p>\n

There is a good reflection (from an insider's point of view) on Card Space here.<\/span><\/a> (courtesy Gunnar Peterson<\/span><\/a>)\u00a0\u00a0 My personal view (and the reason I didn't support the adoption of Card Space at eBay) though centers around the challenges of “Change of Behavior” required by Card Space.<\/p>\n

Basically, CardSpace failed b\/c it requied uses to change their behavior. See, the “User name and password” protocol (a simple challenge and response) IS a protocol, one where a human being (a normal user) is a participant in. It has taken about 20-30 years (depending on how you count) to train users what to do when they see a “login panel” , the “login panel” contract is so widely understood that despite all of its short coming is the most viable remote authentication protocol we have today. It is flawed, it is costly, it is not secure, but it is a widely understood by users on the other end of the protocol. CardSpace, despite all its advantages, was not understood, would (and did) make people confused, they did not know what to do when the CardSpace screen popped up … a technology whose adoption depends on change of a strongly learned behavior is unlikely to succeed (or at least I didn't think eBay sellers – not the early adopters of technology – would learn and accept it).<\/p>\n

It also didn't help that a lot of browsers didn't support it (installing a plug-in does not count), and the fact that developers didn't know how to issue cards (or validate, update or revoke them).<\/p>\n

Having said that, I did like the idea of decentralized identity provider and not having any one identity provider to be THE identity provider that everyone else had to rely on (putting user in control of their own identity). Compare this with a world where one identity provider (be it facebook or Google or twitter or anyone else) is the dominant identity provider because it is easy for RPs to embed a simple button\u00a0 and for users to click on it.<\/p>\n

Reading Farhang's post, here's what I find most interesting.\u00a0 It was never that users decided they didn't want\u00a0“a change of behavior”\u00a0around passwords.\u00a0 Instead it was web properties like eBay (and a thousand others) who\u00a0came to this conclusion.\u00a0\u00a0Many of the people designing those properties worried\u00a0that\u00a0providing users the option<\/em> of changing their behavior was too dangerous – especially since it was not essential…\u00a0<\/p>\n

In the history of computing there have actually\u00a0been plenty of cases where users DID change their behavior – even though at first only a few people could understand or use the new alternatives.\u00a0 But those “early adopters”\u00a0were able to\u00a0try\u00a0the new inventions\u00a0on their own.<\/em>\u00a0 They didn't need anyone else to approve something or decide they would like it first.\u00a0 Once convinced, they could show\u00a0the new\u00a0ideas\u00a0to others.<\/p>\n

When\u00a0Visicalc appeared, I don't know how many people in IT would have bet that every accountant in the world would soon be throwing out his pencils and starting to\u00a0use spreadsheets for things no one can even now\u00a0believe\u00a0are possible!\u00a0\u00a0The same is true\u00a0for a thousand other\u00a0applications\u00a0people came to love.\u00a0<\/p>\n

But because authentication doesn't stand on its own, users\u00a0never got\u00a0the chance\u00a0to start using Information Cards “just because they felt like it”.\u00a0 They needed web sites to make\u00a0the same bet they did\u00a0by implementing Information Card support\u00a0as an option.\u00a0\u00a0<\/p>\n

Web sites didn't want to bet.\u00a0 They wanted to keep to “the matter at hand” and prevent their users from getting lost or distracted.\u00a0\u00a0The result:\u00a0a preemptive chill settled over the technology, and we never really got to see what users would make of it.<\/p>\n

My conclusion:\u00a0\u00a0regardless of what new features they support, user centric identity solutions need to be built so they work with as many existing\u00a0web sites\u00a0as possible.\u00a0\u00a0They can't require\u00a0buy-in from\u00a0the all the big web sites\u00a0in order to be useful.\u00a0<\/p>\n

I think we should have included a way for Information Cards to support password-based sites.\u00a0 It was possible.\u00a0 I personally avoided it because I was worried it would be unreliable and not work at all sites.<\/p>\n

Yet a\u00a0lot of password managers do this, and Dick Hardt's SXIP system\u00a0<\/a>combined this approach with support for new protocols.\u00a0 I think\u00a0that aspect of his work was probably right.<\/p>\n

\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

Regardless of what new features they support, future user centric identity solutions need to be built so they work with existing web sites too.<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[16,7,41],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1166"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1166"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1166\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}