Re: [arch-d] Proposed IAB program on Wholistic Human-Oriented Discussions on Identity Systems (WHODIS)

[Eric Rescorla <[e-mail]>]

On Mon, Jul 17, 2023 at 9:02 AM Christopher Wood <[e-mail]>
wrote:

>
> > Second, I think that you should probably try to focus on some subset
> > of the landscape, which, as you say, is vast. As a super-rough
> categorization,
> > you might think of identity being broken down into:
> >
> > - Primary authentication via public keys, passwords, passkeys, etc.
> > - Secondary (often called federated) identity systems like FedCM,
> >   Google Auth, Facebook Connect (or whatever it's called now), etc.
> >
> > These seem superficially similar, and of course RPs will often accept
> > both (e.g., log in with your password or Google Auth), but technically
> > they are quite different. I would focus on the second category and
> > eschew the first.
>
> This is an interesting take. Is your suggestion to focus on the second due
> to the well-defined nature of the first group?
>

Yes, and that there is already very active standards work in that area.

-Ekr


> >
> >   In working towards these goals, the program could collect important
> >   use cases addressed by existing identity mechanisms, discuss
> >   functional requirements (e.g., trust model, access control, support
> >   for roles, etc.) essential for these use cases, and showcase how
> >   existing identity mechanisms meet or exceed these requirements.
> >
> > This seems to expand the scope quite a bit beyond identity. I would
> > try to hit just identity first.
>
> I think you’re right that the surface area with this list is enormous. Our
> thinking was that these adjacent topics provide context for the credential
> (and identity) mechanisms used in practice, and that context may be helpful
> in practice. Given that it’s optional work, I wouldn’t consider this a hard
> requirement for the program. It’s merely a suggestion.
>
> Best,
> Chris