Eric Norlin's Weblog: My running commentary on Kim's exposition

November 17, 2004

My running commentary on Kim's exposition

Kim's posting about the "laws of identity" -- using a scenario i sent him to tease them out. So, in true redactive fashion, I thought it only right for me to post a running commentary on his laws (since I provided the original text ;-).

Law 1 (The "owner decides" law of identity): Technical identity systems MUST only reveal information identifying a user with the user's consent.

On the content of the law, I absolutely agree -- kinda.

an employer (like Kim's) maintains data about the user that they use to log the user onto various corporate applications that they run (i'd be that kim did this today) -- in that case, the employee has given implicit consent by collecting a paycheck and the employer is NOT encumbered with giving the user consent priveleges. Bottom line: getting paid is consent.

So not *every* technical identity system must only reveal info with the user's consent. However, clearly, in any "consumer" (i use that word only to send doc flying off into a rage ;-) facing scenario, Kim's law #1 is true.

So, why is it not *always* true? I would argue because identity information is not about "ownership" -- and making it so confuses the issue.

Properly speaking, identity info is about control. The end user should be given *control* over their information -- because there is a ton of identity information about me that I simply cannot, in any practical sense, *own*.

If control is the measure, AND it is understood that being employed means implicitly giving up control of certain information, then Kim's Law 1 could hold.

Therefore, Law #1 should be:

Identity Law #1 (the law of control): Technical Identity systems must only reveal information identifying a user with the user's implicit or explicit consent; where implicit consent may be granted under the terms of a relationship agreement (i.e., employment).

12:59 PM | Permalink

Verify your Comment

Previewing your Comment

Posted by: |

This is only a preview. Your comment has not yet been posted.

Your comment could not be posted. Error type:

Your comment has been posted. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Eric Norlin's Weblog

Recent Posts

Archives

Blogroll

Important Links

November 17, 2004

My running commentary on Kim's exposition

Comments

Verify your Comment

Previewing your Comment

Post a comment