“Enough is enough! I have had it with these #@%!*$ AICs and their #@%!*$ panes” — Samuel H.S. “Hammer Stack” Jackson (with apologies to Neville Flynn)
The OpenID community is still wrestling with how to deliver a first-time login experience that is acceptable to mainstream users. Research indicates we need something less open-ended than typing into a blank URL field, but neither is it desirable to push users to choose from a few (or worse, many) pre-selected identity provider logos.
One approach for solving this problem is called (for lack of a better term) the Active Identity Client, or AIC (similar to what I previously called a Chamberlain). An AIC boostraps the identity selection process at a new website (aka Relying Party, or RP) by storing some amount of identity information on the user’s home computer. The AIC uses that identity to access a persistent record of the user’s interaction with multiple sites and identity providers (IdPs) to negotiate and streamline future such interactions. This (in theory) allows the user, rather than the RP, to prioritize which providers to use.
A number of such AICs were demonstrated at last week’s Internet Identity Workshop. Rather than attempting to standardize on a single AIC, a group of us discussed developing a common infrastructure that might enable a broad spectrum of AICs to innovate and compete. Specifically, we attempted to identity conventions, best practices, and extensions to existing standards that would support both “native” and “in-browser” AICs.
This article is my idiosyncratic attempt to synthesize what we discussed into a coherent vision for Active Identity Clients. It may not fully reflect the opinions of any given participant, and certainly does not represent the views of our respective employers. Rather, it is a subjective snapshot of a still-evolving problem space, and is intended to provide a concrete starting point for further discussion, critique, and clarification. (more…)
[Disclaimer: The following is a hypothesis I am exploring for the Nov 2009 Internet Identity Workshop. It may not even reflect my current thinking, and certainly doesn't represent any sort of official position of my employer.]
Most proposals for open identity management on the Internet use the wallet metaphor, where the user is expected to choose from amongst a variety of disjoint identities when accessing a given website. This either requires typing in a complex unique identifier (e.g., a URL) or selecting from one of several provider logos (aka the NASCAR Problem). Worse, this entire ecosystem typically exists in parallel with traditional username/password authentication, increasing the complexity of the choices users are expected to make.
I believe that the best way to solve these problems is to move to an entirely different metaphor. Rather than thinking of identity as something manually managed by the user (like cards in a wallet), I believe the vast majority of users want identity to be something that is managed *for* them — the way a chamberlain in a palace might keep keys to all the rooms, and control who was allowed to go where in accordance with royal policy.
From this perspective, the real challenge is understanding what kind of experience users want when using an identity system, and then building an architecture optimized for enabling that kind of experience. This “chamberlain” approach leads to very different questions and outcomes than the traditional model. Designing such a system will require making hard choices about what sort of security non-technical users truly need and want, as well as about the metadata necessary to support those choices. Moreoever, implementations would require significant client-side support, and create different winners and losers than existing systems — both of which could hinder broad adoption.
That said, the potential payoff is an architecture that would work reasonably well with the web as it is today, and scale cleanly to support more elegant mechanisms in the future. While my initial proposal below is unlikely to achieve all those goals, hopefully it will at least provoke others to come up with something even better.
(more…)
See more details at Radically Happy, and T-shirts at CafePress
![\left\{ \begin{array}{c} \frac{\partial{\mathit Jew}}{\partial {\mathit Christ}} + \frac{\partial{\mathit Greek}}{\partial {\mathit Christ}} \\[1ex] \frac{\pm\partial{\mathit circumcision}}{\partial {\mathit Christ}} \\[1ex] \frac{\partial{\mathit Scythian}}{\partial {\mathit Christ}} + \frac{\partial{\mathit Barbarian}}{\partial {\mathit Christ}} \\[1ex] \frac{\partial{\mathit slave}}{\partial {\mathit Christ}} + \frac{\partial{\mathit free}}{\partial {\mathit Christ}} \end{array} \right\} = 0](http://l.wordpress.com/latex.php?latex=%09%5Cleft%5C%7B+%5Cbegin%7Barray%7D%7Bc%7D%09%5Cfrac%7B%5Cpartial%7B%5Cmathit+Jew%7D%7D%7B%5Cpartial+%7B%5Cmathit+Christ%7D%7D+%2B%09%5Cfrac%7B%5Cpartial%7B%5Cmathit+Greek%7D%7D%7B%5Cpartial+%7B%5Cmathit+Christ%7D%7D+%5C%5C%5B1ex%5D%09%5Cfrac%7B%5Cpm%5Cpartial%7B%5Cmathit+circumcision%7D%7D%7B%5Cpartial+%7B%5Cmathit+Christ%7D%7D+%5C%5C%5B1ex%5D%09%5Cfrac%7B%5Cpartial%7B%5Cmathit+Scythian%7D%7D%7B%5Cpartial+%7B%5Cmathit+Christ%7D%7D+%2B%09%5Cfrac%7B%5Cpartial%7B%5Cmathit+Barbarian%7D%7D%7B%5Cpartial+%7B%5Cmathit+Christ%7D%7D+%5C%5C%5B1ex%5D%09%5Cfrac%7B%5Cpartial%7B%5Cmathit+slave%7D%7D%7B%5Cpartial+%7B%5Cmathit+Christ%7D%7D+%2B%09%5Cfrac%7B%5Cpartial%7B%5Cmathit+free%7D%7D%7B%5Cpartial+%7B%5Cmathit+Christ%7D%7D+%09%09%5Cend%7Barray%7D+%5Cright%5C%7D+%3D+0&bg=ffffff&fg=000000&s=0 "\left\{ \begin{array}{c} \frac{\partial{\mathit Jew}}{\partial {\mathit Christ}} + \frac{\partial{\mathit Greek}}{\partial {\mathit Christ}} \\[1ex] \frac{\pm\partial{\mathit circumcision}}{\partial {\mathit Christ}} \\[1ex] \frac{\partial{\mathit Scythian}}{\partial {\mathit Christ}} + \frac{\partial{\mathit Barbarian}}{\partial {\mathit Christ}} \\[1ex] \frac{\partial{\mathit slave}}{\partial {\mathit Christ}} + \frac{\partial{\mathit free}}{\partial {\mathit Christ}} \end{array} \right\} = 0")
For years I’ve used Steel.app from Gravity to manage all my passwords. Alas, as sometimes happens, they’ve decided to discontinue that product. 
To their credit, they’re offering a 20% discount on the User-Friendy-but-Ugly-Safari-Hack 1Password from Agile Web Solutions. Unfortunately, since Steel.app is freeform and 1Password is structured, they say you have to cut and paste everything manually.
Not true! If you (like me, and I suspect many others) used a consistent column scheme for storying your passwords, it is actually quite easy to migrate your data automatically. Find out how below…
Update: you can use a similar process to import from Steel.app into PasswordWallet, a simpler but less intrusive alternative to 1Password.
NUGI was the grandly named “NeXTSTEP User Groups International” — a last ditch effort by a bunch of NeXT fanatics to maintain interest in a mainstream operating system while NeXT the company was gravitating towards WebObjects and the enterprise. I as a grad student was President, some guy in Europe was Chairman, and that was pretty much all there was to it.
We didn’t succeed, but we built some close relationships with others equally as zany that continue to this day.
And at least we went out with a bang (below). Amazingly, the original post — including audio from the live performance Rohit and I did — is still available on xent.com!
It was January of 1997. Apple had just announced the acquisition of NeXT. The Macarena was the world’s most popular dance song. I was growing increasingly restless in my job as a management consultant.
It all came together here…
(apologies for the outdated links, but I wanted to preserve the historical record)
While cleaning up one of my old websites, I decided to move the technical-related articles to this blog. I’m starting with a document I wrote back in 1993 that was accepted on the USENIX newsgroup rec.humor.funny. This was all pre-Linux, so the whole concept of UNIX on a Personal Computer was itself something of a joke!
The humor is certainly a bit dated, but Google still finds over 5,000 copies (alas, mostly uncredited). Yes, I really did write this myself.
Much later, this also formed the basis for a surprisingly successful Apple Fool’s Day marketing request — but that’s another story. :-}
The following table summarizes key information from the various church website solutions I profiled yesterday. The top three (from my perspective) are:
