![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
[Crossposted to Google+, LiveJournal and Art of Conversation. That, in and of itself, illustrates some of the points I'm making.]
I've posted a lot (mainly on Google+) about the problems with the way Google is handling identity, and the various dangers of it. The just-linked article describes neatly why Google wants to mess up the identity architecture. But it's worth spelling out the alternative, and how it should work to be best for the users.
I've been meaning to do a long writeup for months now, but keep getting distracted, so here's the back-of-the-napkin summary. Consider it a sort of technical manifesto.
(Yes, this is the short version. It's a quick and dirty writeup, just the spark for a lot more discussion. And most of it isn't that novel: others have talked about it, but haven't gotten far enough yet.)
There are, in principle, four principal layers in a well-constructed Internet identity architecture. I'm not going to go into the fine details, because from this viewpoint they don't matter as much -- what really matters is how they relate to each other. Suffice it to say, none of this is easy, but it's all technically feasible if folks collectively want it enough.
All of these should be talking to each other through *open* protocols, with no back doors. That's extremely important: the point of the exercise is that the individual should be able to control each of these layers him or herself. Even more importantly, no single company should be able to lock you into their stack: if you really value your privacy highly, you should get each of these from separate companies.
(I can't overstate the importance of this. The success of the Internet has largely been due to its embrace of open protocols like IP, TCP, HTTP and so on. It is a travesty that the social network space has festered without them like this.)
( The Details )
I've posted a lot (mainly on Google+) about the problems with the way Google is handling identity, and the various dangers of it. The just-linked article describes neatly why Google wants to mess up the identity architecture. But it's worth spelling out the alternative, and how it should work to be best for the users.
I've been meaning to do a long writeup for months now, but keep getting distracted, so here's the back-of-the-napkin summary. Consider it a sort of technical manifesto.
(Yes, this is the short version. It's a quick and dirty writeup, just the spark for a lot more discussion. And most of it isn't that novel: others have talked about it, but haven't gotten far enough yet.)
There are, in principle, four principal layers in a well-constructed Internet identity architecture. I'm not going to go into the fine details, because from this viewpoint they don't matter as much -- what really matters is how they relate to each other. Suffice it to say, none of this is easy, but it's all technically feasible if folks collectively want it enough.
All of these should be talking to each other through *open* protocols, with no back doors. That's extremely important: the point of the exercise is that the individual should be able to control each of these layers him or herself. Even more importantly, no single company should be able to lock you into their stack: if you really value your privacy highly, you should get each of these from separate companies.
(I can't overstate the importance of this. The success of the Internet has largely been due to its embrace of open protocols like IP, TCP, HTTP and so on. It is a travesty that the social network space has festered without them like this.)
( The Details )