Identity in the Browser-IIW-East

From IIW
Jump to: navigation, search

Identity in the Browser (F2C)

Convener: Paul Trevithick Notes-taker(s): Charles Andres attendees: Phil Windley
Jay Unger
Barbara Trufia
David Wolsey
Phil Wolff
Austin Fath
Rainer
8 others

Tags for the session - technology discussed/ideas considered:


Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

set of ID solns with lots of real world analogies to anonymous wallet
- credentials
- digital cash 
etc.
necessary part of constellation:
- addressy
-money
- group affil

how to shift th max power to the control of the indiv.

zero knowledge proof tech
vapor trail
cookie trail

active client
smarter browser
endless digital baptism

form fillng
password

openID
SAML
ICF
- dif challenges - RP site - pick from 
NASCAR popups

Dave Recordon of FBook
- tests state that if advice that some popup would release info, open to FB?
FB level of consumer trust in the cecision is fairly low. 
a statement by your browser is highly trusted...

takeaway: role of infastructure that completely control
browser is the agent for the user

FB: consider the source.

selecors: AIR, etc.
popups - use notice of consent tranpsarenc

2 windows become annoyance.

a barier with what we are trying to do.

the UX must become much more sophisticated.

credit card analogy -- compelling
a 4 party agreement
lots of protection are happening behind your back

we were naive how people interact with computer systems

you don't think about airbag technology

signals have to be simple
uptake in EV signals because it is simple.
green bar; 
simple signal, simple behavior.

radio button, checkbox is beyond simple signals and simple behavior.
Google also has similar studies -- UN/PW is as complex as people can deal with.

Browser, tc. is a great place to make simple secure private work.

how to do this in an inclusive way?
it has to embrace every protocol with traction
the consumer don't care
prtocols must disappear

How does a human login to a website across protocols?

pick an IdP.
design can't be implemented tech doesn't exist.

browser is not on phones but there is a user agent

user agent determines look and feeluilt in standard response
don't do it with questionable javascript
identiriers are a kind of claim.
10 years ago browsers b

basic authentication came from IETF
little progress since then

could start with ID Commons, but need to connect with IETF
and how about W3C 
the ID space is so balkanized. but if there were one place --html, browsers, & ID

Jay: aftarid of constitutional monarchy

IETF more like a 

if std and practice appear perhaps the IE logjam can be broken.

health care -- lot of info going into this 45K per doctor, $22B

could gov + healthcare drive this?

Federate authentication would help-

Dont forget your role as a procurement

$20M invested in ID space 
real customer
real use case
real money

best bet = Mozilla
size of Firefox and IE are huge
tag candy was even worse.

 can we put info in the communication stack?
- smaller certifable trustable 

should we fix https at the same time?

tinest change in the broswer; do the service elsewhere.

similar to STSou what Dale did for Mac for i-cards
running process in theuser space has security probs.
Windiows did it outside user space
or in the hardware.

yyou canif't experss simple signals without chagnig user interaction.

if the production comes from depths of comm stack, its a lot harder to screw up
anti-virus software - keep me safe, don't talk to me about it.

M$, Androic, Firefox
- devolving to open components

always have the issue of dumb environment, kiosk, school computer, etc. 
gotta get in and do something.

another mistake: work in a non modified airport kiosk.

red laser id scan???

openID knew a tiny bit of broswers (and tell the  RP) 
set the home page to the iGoogle page, and login.