Spectrum of Identity
Convener: Rick Smith/Kailya
Notes-taker: Rick Smith, Jeff Vander Clute
Tags: Sock puppets, anonyminity, pseudonymity, verified identity, socially verified identity, reputation, social versus technical mechanisms, boundaries, privacy, expunging records, under age
Discussion notes:
Kaliya proposes a range of four types of identities
- Anonymity –
- Pseudyminity – Gamers, visitors to govt sites that aren’t performing actions on personal legal things
- Single site pseudonymity
- “Linked” pseudonymity – using a persona in multiple locations
- Socially verified – Facebook, twitter
- Verified – tied to one person via checking "official" documents
US govt is looking at OpenID and such because there are sites that do NOT want to explicitly identify their users, but wants to provide a customized experience, which in turn relies on an authenticated identity.
“Limited liability persona” – spin off personas that are linked back to you but don’t really pass liability back to you.
Two separate worlds of identity – I buy something on craigslist, I want to see flickr photos, but I don’t need to see the birth certificate.
“There are lots of people who push for assurance in identity want to push for the “verified” range of identity, and that somehow that makes it all work right. But problems persist.
Some people say that ideal identity is tied heavily to the physical person.
Credit card companies used to care about identity. Today they really don’t care that much. Credit card companies find that it’s not worthwhile to focus on it. Instead they only care about transaction integrity.
Sites are one of the boundaries people create – each site provides a boundary within which people create identities. These may or may not relate to identities on other sites.
Google is a terrific platform for traffic analysis – people would ego-surf and find peoples’ blogs who talk about them, rag about them, and produce unexpected and undesired results.
Identity as aggregated reputation - your personal events get posted on the Internet, some disappear and others stay on line forever.
A problem today is that we have no process to expunge information about people before they were of legal age. Your youthful indiscretions may follow you and you might not have a way to recover.
France does not have Yahoo groups. Two laws: hosting child porn is illegal, and if the word ‘private’ appears in a site, then the host company is legally forbidden from looking at the group’s contents. The two interact in a bad way: the sites can’t host ANY groups because there’s no way for them to police possibly illegal groups. Ditto for Nazi things.
There isn’t really a “Real” identity, it’s lots of things. It’s a set of transactions and doings that have the same origin in agency. “On your behalf”
“How do I know that I’m chatting with Joe?” There’s no real way to know. At most you might be able to know that you’re chatting with Joe’s agent.
You have this bundle of things that are your agents (user identities) and bundle of transactions with others, which becomes your reputation.
Yahoo Identities are the toilet paper of the Internet – you use it once and then throw it away.
People and social structures tend to protect their kids effectively. It’s almost impossible to implement these things technically. Yahoo was trying to establish mechanisms for kids to interact with the site with parents’ permission. The parents’ actions tended to produce the right result and the mechanized solutions tended to get complicated and counterproductive.
More NOtes
Notes from spectrum of identity session
Subjective: The importance of having multiple personas.
Laws of Identity - should be required reading
Limited Liability Personal
Kaliya's proposed spectrum, for the purposes of stimulating a dialogue:
- Anonymity - used once
- Pseudonymity - association is opaque (gamer world, handle reality); gov't LOA 1. We don't want to know who you are and we're not going to let you tell us. Types:
- directed pseudonymity, only works on 1 site, directed OpenId, can't use same pseudonym on multiple sites
- linked pseudonymity, portable to multiple websites, regular OpenId
- Socially verified - Facebook (real), Twitter (persona)
- Verified
- Verified anonymity: e.g. +18 but NPI
IIW long ago stopped debating the philosophical concept of identity and instead chose to focus on Internet identifiers and how they relate to people.
No one wants an identity, but wants what an identity enables.
Like the Heisenberg Uncertainty Principle: The more precisely you know an identity, the less that person is willing to do, so the system loses important forms of value / interactions. Balancing level of identity on the proposed spectrum against desired forms of interaction.
Twitter is a much easier context to understand because everything's public (unless you protect your tweets) except for DMs.
Tests to determine limits of identity, e.g. Does it continue after you die?
Two different worldviews:
- Verify using social means, get the vibe (e.g. Flickr photos)
- Verify using birth certificates
Boo to "Identity assurance". All forms of identification can be gamed when large transactions are in play. So credit companies care about transaction validity not the person.
Shifting boundaries in public-private conversations... not reflected by the technology.
Sites are boundaries that people create.
"The politician and the chess player." "Bill Gates on Quake."
Separation today formed by separate sites, but most people don't realize that pseudonyms are public.
Problem: Not having visibility of the boundaries.
The brain is built to forget things over time. But the Internet is a permanent archive.
Internet identity as aggregated reputation. The history of all you've done online defines your identity.
We don't even have a discussion going about how to expunge. Crimes committed by minors can be expunged from the record, but not online.
Current evil: Graph analysis that collapses identities, which get sold to marketers.
In France there is no Yahoo Groups because of 2 laws: 1) hosting child porn is illegal (of course) and 2) if private appears on the site anywhere by definition the company is not allowed to look at the content for any purpose. Bad interaction between the two laws. Can't monitor for child porn for the purposes of removal.
Cliff: Flaw is to think about identity as a thing. You have lots of identities. The flaw in the frame is that id is not an entity but a set of transactions, actions, and doings that have the same origin in agency (you or your agents that work for you on your behalf). => identity as history. Also things people say about you.
Identity = capabilities + history. Don't just focus on the capability bundles.
The problem with Yahoo ids: Logins, email addresses, and display name are all the same. You should be able to log in with a Google id. Don't deplete the Yahoo name space when only a unique id is needed. 99% of Yahoo ids don't receive (legitimate) email. Display names but not unique ids on the site.
Back to identity vs. identifier. Sometimes I want to use capabilities without providing an identity.
Proposal: Change the spectrum to classify types of activities?
At Yahoo, we found you got more protection with less verification. We want to hide the email address and IM name, but lawyers were opposed. The verified Yahoo id has too much capability attached to it. The better thing for the kid is the social identifier, but not the verified legal identifier. (We fixed the insanity.)
Rules will never substitute for parents protecting their children.
