I’ll note that much as one can use an SMS infrastructure to assert that a person has at least temporary control of a mobile phone you could use the existing notary system.    A service provider prepares a document instructs the user to print it, have notarized, and return to the service provider.

I wonder if that could be done in a manner that avoids revealing to the service provider any information other than the information contained in the document.  For example, could you keep the user’s name out of the service provider’s hands.

Here’s a principle that I think the internet identity community needs to come to grips with.  Sites are going to talk about users behind their backs.  They are going to exchange information about users without the users explicit permission.  While strictly speaking the users permission for these exchanges may have been acquired the user will not fully comprehend that the he gave permission.

In any case I think it is dangerously nieve to attempt to design systems that take as their primary goal minimizing the amount of information about users that flows between the sites.  Not because it wouldn’t be wonderful to minimize those flows but because those flows take place already and they are not about to stop.

For example all the advertising networks (i.e. double click, google, etc) collect tremendous amounts of information about users.  Should we presume they don’t sell that information back to sites in one form or another?  The catalog, financial, medical, and insurance industries all pool customer data in ways that are analagous to what the advertising networks are doing.  Should we presume they don’t traffic in that information?
These pools of customer data are the elephant in room.  Some of them are held by consortium, like the health records, while the newer ones are held by single firms.  What Google knows about me, oh lord!  The majority of participants in the internet identity dialog appear to be ignoring that it is the legal responsibility of the owners of this data to milk the maximum value out of them.

So here’s a thought.  Maybe we shouldn’t be struggling quite so hard to minimize data flows.  Maybe we should be struggling to make the data flows more transparent.  If it’s necessary to accept that then it has consequences.

Any standard that is going to be widely adopted by sites must provide sufficient value to pay for the cost of adoption.  Today if a site wishes to know more about it’s users it can do that by paying for that information from the current operators of an existing data pool.  Any standard that hopes to displace these dominate players in the internet identity market will have to provide good value for reasonable adoption cost.  Designs the emphasis user privacy over other attributes are unlikely to strike the right balance to get the network effect to happen of both user adoption and site adoption.

I’m not sure I entirely like where this line of thinking is going; but I do know where it came from.

In my web logs most incoming visitor’s browsers politely tell me who reffered them to me.  I got to wondering if I ought to be thanking those nice sites that sent me these nice visitors.  Which lead to realizing that I have what the autistic b-school types call “a relationship” with those other sites.  Let’s call these other sites my partners.  When one of these visitors gets referred to me why can’t I discuss him with my partners?  Why is there no protocol for that?  Me: “Yo, partner, who is this dude?”  Partner: “Him? Don’t know much about him, but he’s got an account here; and it says his private information broker is .”

Of course that conversation appears pretty privacy invading.  So sites that want to do that are forced to go through a gossip broker.  I.e. their advertising network.  Which only leads to extremely strong network effects for one advertising network to dominate the others; because they accumulate a better model of these visitors.

Pretending that these data pooling gossip brokers are not part of the ecology isn’t working to their advantage.

Nothing legitimizes a standard like usage.    What makes Microsoft Window’s a standard is those billions of transistors all over the planet are chewing way on it’s code.  What makes Google search a standard is that all those of searches are taking place.
In that sense of legitimate OpenID continues to struggle.  While usage remains the final arbiter there are other ways to achieve a bit-o-legitimacy.  Getting the blessing of the king is always good.  You can get a law passed; that worked for making curb cuts standard but it didn’t work for lowering the speed limit to 55mph.  You can get a large standards body to promulgate your standard.  That one is surprisingly ineffective. You can solicit players with large market share to give you the nod.

Each of those three (civil authorities, professionals authorities, market leaders) is legitimate because some legitimate process gave them their king like nature. Their blessings are market signals.  Other players in the market use them to manage the risks of adoption.  Interpretation of these signals is up for negotiation.  Consider a few of the big standards bodies – for example ANSI, EMCA IEEE, IETF, OASIS, W3, WS – each one has very different governance model.  That model affects the meaning of their blessing.

In the standards battle over internet indentity the Project Liberty folks ended up tainted by the way their governance, and hence their legitimacy, was weighted toward the account holders rather than the users.    I was involved in Liberty, and the governance was weighted toward account holders; the design emphasis wasn’t but that’s not my point today.

Microsoft and AOL’s recent signals of support for OpenID signal one thing.  That OpenID is good for them.  That does not mean good for you.  OpenID is very good for very large existing account holders, because those players are the most likely to hand out the vile globally unique identifiers around which the OpenID design based.

I tend to think that OpenID is going to capture a very large market share.  These signals of support reinforce that.    Not so much because they actually signal a change in that most important source of legitimacy, i.e. usage, but because they illustrate that at least one side (i.e. account holding institution) are starting to see that the design is good for them.  The other side (i.e. account holders) remain on the sidelines.

The question of what makes this standard’s bandwagon legitimate should remain open for negotiation.  The OpenID bandwagon looks to me like it’s in great shape.  That users haven’t climbed on board remains a challenge, but not an intractable one.  I continue to see this bandwagon as pretty illegitimate from a governance point of view.  Claiming to speak for users is damn sight easier to say than do.

Another addition to my collection of examples were members of a group sport something that reveals what others might tend to think of as private information. In this forum the members decorate their postings with information about their credit scores. Not unlike the folks that do the same thing with their due date or their weight loss progress

Here are three examples (at reduced size) of their badges.

Some people show a chart of how each of the credit tracking firms is summarizing their credit.

Some of them are using this service that provides them with a score card.

Others are using the same progress bar scheme seen on weight loss and event (wedding, pregnancy, etc.) forums.

Why can’t I feed my real time IQ into my IM status; or what my current credit card debt is?

Consider this statement: “Alice says that Bob is lazy.” Is it better to summarize this as: “…Bob is lazy” or “Alice … is lazy”? The 2nd is very often better. Speakers mentions traits which reveal their own traits. What you say reveals your internal dialog.

So it’s with great amusement that I stumbled upon this paper. Trait Transference: Communicators take on the Qualities They Describe in Others. This paper makes a very similar argument, but the other way around. It argues that the dialog about others lays down the patterns that become the behaviors you yourself take on.

Who knows? Hard to run that controlled experiment! It’s a chicken and egg problem.

In either case, say nice things about other people – it will make you, or possible indicate you already are, a nicer person.

Meanwhile let me just say that you are very sexy!