{"id":855,"date":"2007-09-10T20:58:56","date_gmt":"2007-09-11T04:58:56","guid":{"rendered":"\/?p=855"},"modified":"2007-09-11T08:16:09","modified_gmt":"2007-09-11T16:16:09","slug":"we-need-a-spectrum","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=855","title":{"rendered":"We need a spectrum"},"content":{"rendered":"

Stefan Brands<\/a> runs off in the wrong direction in his recent treatise on OpenID<\/a>.  Who really needs a \u00e2\u20ac\u0153shock and awe\u00e2\u20ac\u009d attempt to bonk the new OpenID “cryptographic primitives” back into the stone age?<\/p>\n

It's not that you shouldn't read the piece; even though subtlety is not its strong suit, it brings together a lot of information about a threat model for OpenID.<\/p>\n

The main problem is simply that it misses the whole point about why OpenID is of interest.
\n
\nStefan\u00e2\u20ac\u2122s second paragraph betrays what I fear are advanced symptoms of inventor\u00e2\u20ac\u2122s disease: loss of perspective and the illusion that one\u00e2\u20ac\u2122s own technology should be used for everything.<\/p>\n

Consider this:<\/p>\n

OpenID was designed as a lightweight solution for \u00e2\u20ac\u0153trivial\u00e2\u20ac\u009d use cases in identity management: its primary goal is to enable Internet surfers to replace self-generated<\/span><\/em> usernames and passwords by a single login credential, without needing more than their browser.   Concretely, OpenID aims to enable individuals to post blog comments and log into social networking sites without having to remember multiple passwords\u00e2\u20ac\u00a6<\/p>\n

“Beyond this, OpenID is pretty much useless…”<\/p><\/blockquote>\n

Rewind.  Isn't this a bit like saying, “Beyond being a food, rice is pretty much useless…”?  To be useful, rice doesn't have to be the single food<\/em> that solves all our cravings and nutritional needs, day and night.  It just needs to be good as, well, as rice.<\/em><\/p>\n

Moving beyond metaphor, we have to ask what “trivial”<\/em><\/strong> is supposed to mean…<\/p>\n

Oxford University Press comes to the rescue:  “Of little value or importance; concerned only with trifling or unimportant things.”<\/p>\n

Hmmm.  How did Stefan, by day the friendly cryptographer working to protect our privacy, suddenly become the arbitrer of what is trivial and worthwhile and what isn't?<\/p>\n

Suddenly, social networking is trivial.  Blogging is trivial.  Internet browsing is trivial.  In fact most of what most of us do on the internet is trivial.  (Could we be trivial too?)<\/p>\n

But then morning comes, and Stefan returns to his studied analysis and professorial stance as though no norms have been violated.  Even so, the fabric of his argument has been damaged.<\/p>\n

Daily life on the web is not<\/em> trivial<\/em>.  Getting identity right in the basic web social contexts would mean a lot to everyone.  In fact, I doubt anything would do more to bring an understanding of digital identity into our culture and society.<\/p>\n

So Stefan should shy away from dismissing these scenarios – even if they don\u00e2\u20ac\u2122t require his admittedly excellent crypto technology to address them.  <\/p>\n

In fact the suitability of lightweight technology to solving social networking problems leads Stefan to worry that it will be adopted for other more complex purposes:  banking, government identity, private relationships. <\/p>\n

Is this worry warranted?<\/p>\n

Has anyone seen any signs of banks and governments kneeling at the altar of OpenID? They all seem to have adult supervision, and experts who understand that their scenarios call for stronger protection, and involve risk.  I counsel Stefan not to worry that he is the only one to understand security threats. Security experts have admittedly been slow to pick up on privacy issues, and I understand why this irks Stefan \u00e2\u20ac\u201c in fact I empathize \u00e2\u20ac\u201c but let\u00e2\u20ac\u2122s not exaggerate: the security community does get the notion of threat analysis.<\/p>\n

Popping up a level, we need a spectrum of solutions to identity problems.  Ergo, the identity metasystem.<\/p>\n

We need identity solutions like OpenID that lend themselves to easy, rapid, widespread deployment in contexts where the cost of concerted professional attacks would not be warranted.  This can help us get the ball rolling by providing a common denominator for our public persona.<\/p>\n

We also need technologies for commercial web interactions that are honed for privacy, for safety,for the life of the digital citizen and knowledge worker. <\/p>\n

I wrote about these issues while documenting the Fifth Law of Identity:  the requirements of different use cases are in many cases contradictory. The lesson driven home since then by our friends at OpenID is that the lightweight end of this spectrum can enable lots of good scenarios, and unleash interest in new technologies that resolve the problems posed by the more complicated use cases. <\/p>\n

The spectrum of technologies comprising the identity metasystem would benefit from a suggestion made recently by Bob Blakley of the Burton Group. <\/a>He argues that the OpenID specification should include an articulation of the constraints on what it is attempting to achieve.<\/p>\n

I agree, with the proviso that other protocols, like SAML 2.0 and WS-Federation, should do the same.  All these protocols are good in different ways and subject to attacks of various kinds – and seem to have proponents who argue they should be used everywhere for everything – constraints be damned!<\/p>\n

Bob proposes the following as the relevant questions:<\/p>\n

1. What are the assets a given system is meant to protect?<\/p>\n

2. What are the services offered?<\/p>\n

3. What quality of protection is claimed for these services?<\/p>\n

4. What is the threat model?<\/p>\n

5. What is the trust model?<\/p>\n

There needs to be one more question, along the lines of \u00e2\u20ac\u0153What factors constrain the deployment of this technology for internet activities?\u00e2\u20ac\u009d I can believe this is some kind of refinement of question #1.<\/p>\n

In other words:  it is important that we grasp both the heaviness and the lightness of being.<\/p>\n","protected":false},"excerpt":{"rendered":"

The problem with a recent piece by Stefan Brands is that it misses the whole point about why OpenID is of interest.<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,17,8,3,22],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/855"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=855"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/855\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}