{"id":806,"date":"2007-06-18T14:43:54","date_gmt":"2007-06-18T22:43:54","guid":{"rendered":"\/?p=806"},"modified":"2007-07-17T20:38:45","modified_gmt":"2007-07-18T04:38:45","slug":"no-masks-in-the-grocery-store","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=806","title":{"rendered":"No masks in the grocery store"},"content":{"rendered":"

Dave Kearns discusses <\/a>the first part of my examination of the relation between identity technologies and linking, beginning with a reference to Paul Madsen:<\/p>\n

Paul Madsen comments<\/font><\/a> on Kim Cameron's first post<\/font><\/a> in a series he's about to do on privacy and collusion in on-line identity-based transactions. He notes:<\/p>\n

“A meaningful distinction for RP\/RP collusion that Kim omits (at least in the diagram and in his discussion of X.509) is ‘temporal self-correlation’, i.e. that in which the same RP is able to correlate the same user's visits occurring over time.<\/span>“<\/p>\n

and concludes:<\/p>\n

“Not to say that designing identity systems to inhibit correlation isn't important & valuable for privacy, just that there is little point in deploying such a system without addressing the other vulnerabilities (like a masked bank robber writing his ‘hand over the money’ note on a monogrammed pad).<\/span>“<\/p>\n

Paul makes some good points.  Rereading my post I tweaked it slightly to make it somewhat clearer that correlating the same user's visits occuring over time is one possible aspect of linking. <\/p>\n

But I have to admit that I have not personally been that interested in the use case of presenting “managed assertions” to amnesiac web sites.  In other words, I think the cases where you would want a managed identity provider for completely amnesiac interactions are fairly few and far between.  (If someone wants to turn me around me in this regard I'm wide open.)  To me the interesting use cases have been those of pseudonymous identity – sites that respond to you over time, but are not linked to a natural person.  This isn't to say that whatever architecture we come out with can simply ignore use cases people think are important.<\/p>\n

Dave continues:<\/p>\n

I'd like to add that Kim's posting seems to fall into what I call on-line fallacy #1 – the on-line experience must be better in some way than the “real world” experience, as defined by some non-consumer “expert”. This first surfaced for me in discussions about electronic voting (see Rock the Net Vote<\/font><\/a>), where I concluded “The bottom line is that computerized voting machines – even those running Microsoft operating systems [Dave, mais vous \u00c3\u00aa<\/span>tes trop m\u00c3\u00a9<\/span>chant! – Kim<\/em>]- are more secure and more reliable than any other ‘secret ballot’ vote tabulation method we've used in the past.”<\/p>\n

When I re-visit a store, I expect to be recognized. I hope that the clerk will remember me and my preferences (and not have to ask “plastic or paper?” every single blasted time!). Customers like to be recognized when they return to the store. We appreciate it when we go to the saloon where “everybody knows your name” and the bartender presents you with a glass of “the usual” without you having to ask. And there is nothing wrong with that! It's what most people want. Fallacy #2 is that most Jeremiahs (those weeping, wailing, and tooth-gnashing doomsayers who wish to stop technology in it's tracks) think that what they<\/span> want is what everyone should<\/span> want, and would<\/span> want if the hoi-polloi were only educated enough. (and people think I'm elitist! \ud83d\ude42<\/p>\n

I do wish that all those “anonymity advocates” would start trying to anonymize themselves in the physical world, too. So here's a test – next time you need to visit your bank, wear a mask. Be anonymous. But tell your lawyer to stand by the phone…<\/p>\n

Dave, I think you are really bringing up an important issue here.  But beyond the following brief comment, I would like to refrain from the discussion until I finish the technical exploration.  I ask you to go with me on the idea that there are cases where you want to be treated like you are in your local pub, and there are cases where you don't.  The whole world is not a pub – as much as that might have some advantages, like beer.<\/p>\n

In the physical world we do leave impressions of the kind you describe.  But in the digital world they can all be assembled and integrated automatically and communicated intercontinentally to forces unknown to you in a way that is just impossible in the physical world.  There is absolutely no precedent for digital physics.<\/em>  We need to temper your proposed fallacies with this reality.<\/p>\n

I'm trying to do a dispassionate examination of how the different identity technologies relate to linking, without making value judgements about use cases.<\/p>\n

That done, let's see if we can agree on some of the digital physics versus physical reality issues.<\/p>\n","protected":false},"excerpt":{"rendered":"

Dave rejects the idea that the on-line experience must be better in some way than the “real world” experience. But is he dealing with the realities of digital physics?<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,17,47,11],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/806"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=806"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/806\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=806"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=806"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=806"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}