Back to the Internet identity problem; or how we solve to solve the problem of letting users safely and easily reveal personal information, as well as the problem of how that interacts with various authoritative entities.

In the real world we reveal substantial amounts of information casually – hair color, language, approximate age, various fashion statements. We adjust that revealing dynamically. We wear different clothing in different contexts. For better or worse the folks around us use this revealed information to assemble a model of who we are. They create a model of our identity. The revealing is feeds into a dialog about their model of us. That model then feeds into our relationship the one between us.

In a commercial context we might call those relationships “accounts.” In the marketing literature they even talk about relationship marketing. Doc. Searls makes the point that as the Internet shifts the balance between them and us markets become conversations. Solving the identity problem is all about finding a way to enable that conversation to proceed in a practical, useful, and safe manner.

In the Internet no standard methods exist to help users begin the conversation. When I walk into Amazon, or eBay, or a mailing list I am naked. Actually it’s worse than that. I’m actually so thin a presence that I don’t even have a place to hang a few rags that might help me to project a persona.

That didn’t happen by chance. Fixing the identity problem demands that we tackle two very hard problems (revealing and authorities). These are so hard we have kept pushing the problem outward. At each round in the design game it has been easier to just minimize the revealing and push the authority problem out to the network’s edges. That approach has its benefits. Nobody knows you’re a dog, America is all about second chances, etc. etc..

But I want to be wearing clothes when I go out. So today’s puzzle is to look at what a revealing mechanism might look like, from 40 thousand feet.

I find it amusing to say that what’s needed is a “self-server.” A place we can refer others to. Want to learn about me, go here. This place enables them to have a dialog about who I am.

Let’s look at a scenario.

I visit a Wiki. I want to contribute some fresh content. The server running the Wiki wants to check out my reputation before it lets that happen without moderation. So it turns around and via some Rube Goldberg device it manages to get access to my self-server and using that it asks about my reputation as a contributor of reasonable content. Since Mr. Wiki doesn’t trust me, of course, it’s pleased when the self-server recommends an authority that the Mr. Wiki can trust. Ask them Mr. Trusty says. Of course when asked Mr. Trusty (a reputation authority) says very nice things about me! Happy day, Wiki server let’s me post.

Clearly a lot of details are getting glossed over here. But notice that at no point was anything revealed about me except my reputation as a contributor of open content. The Wiki didn’t learn my name, or my social security number, or the name of my dog. Presumably before I’d allow my self-server to do that I’d have to grant permission.

If this were 1980s the self-server would be documented with an RFC and a simple protocol. In the 90s we might have used a web page, and if we wanted to encourage a dialog it would have included a CGI script. These days we call it a web services listener. “Whatevvver.” We modern guys so we can assume lots of encryption and opaque identity tokens etc. etc.

In the Liberty Alliance design this thing I’ve called a “self-server” is a set of web services spread out all over the Internet. That allows, in our example, lots of posting reputation services. It allows many many authorities of varying kinds and seriousness. Your bank, your house, your hairdresser, your clubs can all play a role. That’s as it should be. We certainly don’t want to create one grand central authority.

The only “central authority” they need to rendezvous with is the standard protocols. Those protocols break out into two layers. One is generalized glue that helps you find various kinds of services. The second is a suite of services. Once you get the first layer right then any number of members can pile onto the suite of services. If you want to have service that helps users reveal their fashion preferences then have at it.

Well actually there are three layers of protocols because we also need to design the Rube Goldberg device that helps you find the self-server-directory starting from what ever is available in the legacy protocols.