You’ve Got Ismail!

Report from IIW…

December 17th, 2007

I’ve finally uploaded some photos from Phil Windley’s not-to-miss 2007 Internet Identity Workshop a few days ago. It was a great event and yielded some awesome discussions.

I moderated a session titled “Which IDPs can you trust”. After some discussion, the title became “How do you know at what level to trust an IDP?”. That yielded two other problem areas (1: a common way of describing levels of trust, and 2: how to convey that to relying parties).

The session was mostly around the problem of phished Identity Providers (IDPs), which is structural in nature. Basically, a Relying Party (RP) sends a user off to authenticate their OpenID and what happens if that third party is compromised?

A user signs into a website (aka Relying Party), which authenticates that ID with an IDP before continuing to a transaction. There are two classes of problems:
1 – phishing, or 2 – bad IDPs… after some discussion, we agreed that a phished IDP is essentially a bad actor, so a bad IDP became the real problem.

We then listed different possible methods of solving the authentication problem
- black lists
- white lists
- closed circles
- authentication certificates
- reputations (using a scoring mechanism)
- trust networks

Here, we listed some use cases and various authentication implementations (note the cool use of the equal sign An interesting outcome evolved. Basically, for ‘lite’ authentication, OpenID sufficed, but for any important transaction involving more than just email authentication, a higher order solution is required.

ID USAGE SOLUTION
=blogging OpenID
=email or internet OpenID
=Social Networking OPenID
=e-government Cardspace, SAML, PKI or custom sol’n
=e-commerce same as above
=financial mgmt same as above
=medical transaction same as above

The bad news is that the space is still nascent and very much risks descending into the hell that email and ISPs have become (e.g. blacklisting of ISPs on a per domain basis). The good news is that the use cases are getting clearer and different technical solutions are being implemented. OpenID is rapidly becoming the authentication mechanism of choice for basic internet usage.

Entry Filed under: Internet & Technology