Curiouser and Curiouser! on identity-management http://matt.blogs.it/ RSS feed for topic identity-management Copyright 2006 Matt Mower Squib/0.1 self@mattmower.com self@mattmower.com en-gb The 7 laws of securely identifed people Thu, 12 May 2005 10:41:27 +0100 <p>Via <a href="http://marc.blogs.it/archives/2005/05/id_gang.html">Marc</a> I see Digital ID world has lots of <a href="http://cis-berkman.editme.com/IGAgenda">interesting things</a> going on. For me in particular the <a href="http://marc.blogs.it/archives/2005/05/id_gang.html">ID Gang</a> meeting with, amongst others, <a href="http://www.identityblog.com/">Kim Cameron</a>. The work <a href="http://www.paoga.com/">PAOGA</a> is doing is totaly congruent with 6 out of 7 of <a href="http://www.identityblog.com/stories/2004/12/09/thelaws.html">Kim's 7 laws</a> of identity: <blockquote> <ol> <li>The Law of Control: Technical identity systems MUST only reveal information identifying a user with the user's consent.</li> <li>The Law of Minimal Disclosure: The solution which discloses the least identifying information is the most stable, long-term solution. </li> <li>The Law of Fewest Parties: Technical identity systems MUST be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.</li> <li>The Law of Directed Identity: A universal identity system MUST support both "omnidirectional" identifiers for use by public entities and "unidirectional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.</li> <li>The Law of Pluralism: A universal identity system MUST channel and enable the interworking of multiple identity technologies run by multiple identity providers.</li> <li>The Law of Human Integration: The universal identity system MUST define the human user to be a component of the distributed system, integrated through unambiguous human-machine communications mechanisms offering protection against identity attacks.</li> <li>The Law of Contexts: The unifying identity metasystem MUST facilitate negotiation between a relying party and user of a specific identity - presenting a harmonious human and technical interface while permitting the autonomy of identity in different contexts.</li> </ol> </blockquote> We've taken a pragmatic approach to #5 'pluralism'. Right now we don't integrate with other identity platforms. But as identity management services gain ground it will become a key issue for users. I forsee us adopting #5 in due course.</p> http://matt.blogs.it/entries/00002580.html A pretty poor band-aid Fri, 01 Jul 2005 16:16:11 +0100 <p>I've just received a spam phone call from a company called <em>Direct Telecom</em> who are an authorized Orange reseller who receive a datadump of about 20,000 phone numbers every couple of weeks and then spam them with offers of Orange upgrades. I tried to find out where they get the numbers from but they hung up on me.</p> <p>Just to be on the safe side I have registered my mobile phone number with the <a href="http://www.tpsonline.org.uk/tps/">Telephone Preference Service</a>. I know I had already registered my home number, I thought I had registered my mobile number as well. This time I can be sure because I've blogged it here.</p> <p>Registering with the TPS reveals a problem with their service. They say:<blockquote>You should reflect on the fact that registering may well prevent you from receiving information which you would really like to have - thereby cutting you off from relevant and worthwhile opportunities. For charities, telemarketing is an economical way to raise awareness and much needed support.</blockquote>This is a fair point. I am a subscriber to a number of charities and whilst the only calls I have ever had from them have been attempts to raise the amount I give, I guess I would probably not block them if that was an option. How do the TPS address this?<blockquote>If you are happy to receive telemarketing calls from some companies but not others, contact the companies who you do not wish to hear from and ask them to remove your details from their call lists.</blockquote>So, no solution at all. If I want to allow any calls I have to allow all calls and then put up with being hounded? No thank you.</p> <p>The real problem is that I am not in control of my information. I have to rely on other people to play fair and the TPS is a pretty poor band-aid for this wound.</p> http://matt.blogs.it/entries/00002700.html