Re: [arch-d] Proposed IAB program on Wholistic Human-Oriented Discussions on Identity Systems (WHODIS)

[Rifaat Shekh-Yusef <[e-mail]>]

On Wed, Jun 28, 2023 at 4:19 PM Dick Hardt <[e-mail]> wrote:

> First off, I love the WHODIS title. :)
>
> Having worked on "identity" for a couple decades now, I have found the
> term to cause significant confusion. "identity" is like the elephant being
> described by the blind men. The elephant's leg and trunk are similar in
> many ways -- but they are not the same thing -- but people will each be
> using the term "identity" to describe what they are talking about. They are
> both right in that the leg and trunk are part of an elephant, but "leg" and
> "trunk" would be better terms.
>
> For example, in marketing parlance, the term identity is how a person or
> firm presents themselves. For example https://identity.coop is about
> projecting your cooperative identity.
>
> In the proposed program, "identities" is being used instead of identifiers
> when discussing email addresses etc. "Identities built on OAuth" does not
> make sense to me as a phrase (an RFC I am very familiar with). The lack of
> precision in the terms used in the proposal is alarming to me.
>

I agree that there is a lack of precision here, which was also pointed out
by Ekr.
In fact, one of the motivations for this effort is to address these gaps in
the understanding of these basic identity concepts in the wider community.

Regards,
 Rifaat





>
> The IETF has a storied history with respect to working on identity. The
> OpenID Foundation would not have been created if the IETF would have
> engaged in identity back when OpenID was proposed to be worked on in the
> IETF.
>
> In this thread, a major functional hole is touched on -- the lack of
> reusable digital claims -- IE how do we share a claim made by a trusted
> issuer to a relying party. This of course is only part of what makes up a
> person's identity, but it is a foundational function IRL that is not widely
> available online. One set of claims where this has been mostly standardized
> and deployed are claims made by an enterprise about employees. SAML / OIDC
> / SCIM allow a user to present a claim that they work at a specific
> company, that they have recently authenticated, and that they belong to
> certain groups, have certain roles, or entitlements. The problem space for
> citizens and consumers is much more complex, and is a many to many
> relationship.
>
> While this is a problem, there are numerous standards that could be used
> to solve it. While it is possible that we don't yet have the right
> standard, the challenge is around alignment and adoption, and it is not
> clear to me what role the IETF could or should play to address that
> challenge.
>
> Having said that and rambled on somewhat, I think it would be very
> valuable for the IETF to have a lay of the land of identity and get a sense
> for which parts are in scope for IETF, and which parts are out of scope and
> that others are working on that IETF can coordinate with. Will this be a
> scheduled meeting in SF?
>
> There is significant existing work from the identity community for the
> IETF to build upon. Off the top of my head are:
>
> The late Kim Cameron's Laws of Identity (2005)
> https://www.identityblog.com/?p=352
> My Identity 2.0 talk (2006) https://youtu.be/JzuCE7lDYrM -- popularized
> the concept of user centric identity as well as high slide count
> presentations
>
> /Dick
>
>
>
>
>
>
>
>
>
>
>
>
>
> People will use "auth" as a shorthand for authentication, not realizing it
> could also be short for authorization, or intentionally cnflating the two.
>
>
> On Wed, Jun 28, 2023 at 11:58 AM Toerless Eckert <[e-mail]> wrote:
>
>> +1. Well said.
>>
>> IMHO, such credentials solution are not only a challenge butalso an
>> opportunity for work in IETF. Such as for anonymized authorizations.
>>
>> E.g.: Imagine instead of having to show a drivers license when buying
>> alcohol and
>> worst case the drivers license is scanned and abused for identity fraud.
>> Instead you perform
>> an anonymous authorization that you are over 18 by NFC via your cell
>> phone.
>>
>> Not too difficult to imagine how to do this technically, but certainly
>> hard to believe that
>> current business and government entities would design such solution that
>> your
>> privacy / anonymity is maximized.
>>
>> Obviously this is likely also where there might be a commercial interest
>> of sponsors
>> of IETF participants to develop standardized solutions for exactly this
>> type of use cases,
>> but really making sure that those solutions will then still protect your
>> privacy against
>> those commercial entities that contributed to the IETF effort, that is
>> our IETF challenge -
>> or limitation.
>>
>> Cheers
>>     Toerless
>>
>> On Wed, Jun 28, 2023 at 11:25:35AM -0700, Christian Huitema wrote:
>> >
>> >
>> > On 6/28/2023 6:17 AM, Pieter Kasselman wrote:
>> > > Martin, I read the "Human Oriented Discussion" part of the title as a
>> statement about making the discussion accessible to humans (all of us who
>> are not identity experts), not excluding machines (devices and workloads).
>> The proposed program text clearly calls those out as being in scope.
>> > >
>> > > Authorization decisions (part of an identity system) needs to take
>> into account all identities (human and machine) acting on a resource. There
>> are also examples of machine identities accessing sensitive data, even when
>> there is no user present (batch processes for example).
>> > >
>> > > Given the rapid growth of machine identities, the shortage of
>> expertise in the identity field, the rising need for
>> multi-cloud/multi-platform systems (and managing identities in those
>> environments), the move towards least privilege systems and the changing
>> threat landscape (a compromised device identity may be far more impactful
>> than a compromised human identity), this may well be one of the most useful
>> areas of exploration.
>> >
>> > I am worried about "human oriented" for another reason. As EKR said, a
>> lot
>> > of what we handle are "credentials", such as authorizations to use a
>> > particular resource on the Internet. There is of course a lot of work
>> to be
>> > done to properly manage credentials, but moving from "credentials" to
>> "human
>> > oriented identity" implies something else: that a set of credentials is
>> > linked to the identity of a particular human person. And that makes me
>> > shudder, because this ties directly to tracking people activities
>> around the
>> > Internet.
>> >
>> > Separating "credentials" from "human identity" is a pretty important
>> tool
>> > for privacy. It allows people to compartment their activities, so that
>> for
>> > example your activities in a church, in a sport club or in a work place
>> are
>> > not linked. It also allow credentials to be shared by groups of people,
>> so
>> > that outsiders cannot easily track which person in the group engaged in
>> a
>> > specific activity.
>> >
>> > I can see how governments and businesses would like linking credentials
>> to a
>> > specific human person. Advertisements would be so much more relevant!
>> Laws
>> > about viewing ages would be so easier to enforce! The police would be so
>> > much more efficient! Cheating spouses would be so easy to find out! But
>> > then, these very reasons are why "unique Internet identity" is so
>> > controversial.
>> >
>> > If the IAB does proceed with this Human-Oriented Identity program, I
>> sure
>> > hope that treating privacy issues and providing privacy guarantees will
>> be
>> > the number one priority.
>> >
>> > -- Christian Huitema
>> >
>> >
>> > _______________________________________________
>> > Architecture-discuss mailing list
>> > [e-mail]
>> > https://www.ietf.org/mailman/listinfo/architecture-discuss
>>
>> --
>> ---
>> [e-mail]
>>
>> _______________________________________________
>> Architecture-discuss mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/architecture-discuss
>>
> _______________________________________________
> Architecture-discuss mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/architecture-discuss
>