1. Biden and Trump to Meet at the White House: Live Updates  The New York Times
2. Biden, Trump Set For White House Meeting After Harris Election Loss  NDTV
3. Biden-Trump White House meeting revives presidential tradition skipped 4 years ago  Fox News
4. Trump and Biden to meet at White House as Senate GOP holds leadership election  CNN

1. Trump names Fox News host Pete Hegseth as defence secretary pick  BBC.com
2. Trump's defense choice stuns the Pentagon and raises questions about the Fox News host's experience  The Associated Press
3. Trump Puts Allies on Alert by Handing Pentagon to Fox News Host Hegseth  Bloomberg
4. How Pete Hegseth went from Fox News host to Trump’s Defense Secretary pick  CNN

Texting is a fantastic way to connect with a guy that you're into, especially if you're nervous about talking in person. Sure, you can text whenever you want, but there are some key guidelines to follow so you don't overwhelm him or look desperate. Check out the following texting tips so you communicate with confidence.

Do you remember how to find the circumference of a circle? What about the capital of New Jersey? We’re about to quiz you game-show style with a variety of elementary school trivia questions, from math and science to history, geography, and language arts. Answer these 12 “Are You Smarter Than a 5th Grader?” questions to test your knowledge and see if you come out on top!

Data gathered from several consulting firms by HT Digital indicated that Bengaluru has maintained its position as the top option for non-resident Indians wishing to invest in India’s residential real estate market, particularly those seeking affordable and mid-segment homes.  The … Continue reading →

In Delhi, Dwarka is a possibility for investors who want to earn a lot of money from their investments but can’t find the perfect neighborhood. Its abundance of residential options attracts tenants and end users, and it is supported by … Continue reading →

This year’s budget, which sets up the housing sector, will not only help the one crore urban poor and middle-class families who lack a place to reside.  It will also boost the real estate market and open new doors for … Continue reading →

The real estate industry warned that eliminating indexation benefits for long-term capital gains would stunt its expansion, negatively affecting property owners and potentially increasing taxes. While experts thought low returns could still be a problem, authorities disagreed, citing high real … Continue reading →

Approximately 32 kilometers from the Goa International Airport in Dabolim, the opulent project will have 62 villas atop Reis Mago, a hill in Goa.  In the second half of the 2024-2025 fiscal year, 62 ultra-luxury villas in Goa, priced between … Continue reading →

Before purchasing, buyers should confirm that a property is free from legal issues. They must comprehend ideas from the Code of Civil Procedure (CPC), such as “Attachment of Property,” to do this. Attachment is the legal term for taking possession … Continue reading →

Godrej Properties Ltd has announced the acquisition of a roughly 46-acre land parcel in Indore. According to the company’s July 31 regulatory filing, the development on this land will mostly consist of plotted residential units and offer an estimated saleable … Continue reading →

The Delhi-Alwar Regional Rapid Transit System (RRTS) is currently under construction and will link Delhi with the outlying satellite towns of Manesar, Rewari, and Alwwar. It will also link Delhi Metro’s four lines. Ten kilometers of the route are currently … Continue reading →

However, the Delhi Development Authority (DDA) is making a groundbreaking shift in how it handles property documentation. Starting in September 2024, buyers will receive their flat documents in a sophisticated, customized folder. This change comes after concerns raised by Lieutenant … Continue reading →

University of Florida researchers develop AI system that detects pain in goats through facial expressions, marking significant advance in animal care with potential human applications.

Try these 12 incredible iPhone tips and tricks for 2024 that will change the way you use your iPhone! From a hidden sleep timer in the Clock app to bypassing annoying ads in Safari WITHOUT an ad blocker, these hacks will save you time and headaches!

Doors are usually mundane, but these 16 different doors all hide terrible secrets behind them. Or do they?

The 2005 U.S. federal budget includes just $5 million for the eGov fund. The amount requested for the year was $45 million. Last year the fund received just $3 million, which means over the last two years just $8 of...

Someone came to the site looking for a Felony Offender registry. As far as I can tell the only state that has an online registry of felony offender is Tennessee. Here are two lists of links to official Megan's Law...

A federal judge in Washington yesterday ordered the Interior Department to shut down most of its employees' Internet access and some of its public Web sites after concluding that the agency has failed to fix computer security problems that threaten...

Summary: The overhead of performing even simple tasks online is getting larger and larger. I question the security of almost all these supposedly "secure" messaging systems. And I'm tired of the 'Utopia of Rules' mindset pervasive in every organization. It's exhausting how they expect customers to constantly adapt to their needs.

I don't know if you recall the game Kerplunk. It's a classic children's game that has been around for decades. I remember playing it with my sister. The basic setup involves a transparent plastic tube, a number of sticks, and marbles. The sticks are threaded through the tube to form a web or nest at the bottom on which the marbles rest. We'd take turns removing a stick at a time, trying not to let any marbles fall through the web and out of the tube. At some point, the remaining sticks can't hold the marbles and everything falls down.

The modern web reminds me more and more of a big Kerplunk game and I think the marbles are about to fall. What started out as an easier way to do things like shop, bank, and get health care information has become increasingly complex over time. More and more of the email I receive seems to be simply directing me to log into some bespoke system to retrieve a message or engage in some workflow. And even with a password manager, the act of logging in is often a chore with different user interfaces, custom MFA requirements, and weird rules for passwords. Once you're on the system, session time-outs induce their own form of anxiety since stepping away for a few minutes to attend to something else might require going through the whole Kafkaesque process all over again. The modern web has turned into a dystopian theater of the absurd where even reading a simple appointment reminder from your doctor requires several minutes of stress-inducing interaction with baroque systems and processes.

And it's not just doctors, of course, banks, government agencies, hospitals, ecommerce sites, and customer service systems all adopt these special purpose messaging systems. If you ask these organizations why they use bespoke messaging systems, they'll list things like "timely and improved communication," "convenience," and "privacy and security." But the real reason is that it's more convenient for them because these systems are integrated with their backends and make their processes more manageable. There's certainly nothing about them that's more convenient, timely, or better than email for their customers¹.

I also question the privacy and security premise. Email can be insecure. And your email provider can see the contents of your emails. But the messaging system run by your doctor or bank is likely less secure than the email systems run by Apple, Google, and the others. And achieving privacy by making everything incompatible so that you have to use a different system for each correspondent is like chopping off your finger to prevent hangnails.

How did we get here? Bureaucracy. Not just government bureaucracy, but bureaucracy of all kinds. In Utopia of Rules², David Graeber talks about how power imbalances force the less powerful group to perform what he calls interpretive labor, the work of understanding and implementing what's better or more convenient for the more powerful partner. People are not equal participants in online interactions. We don't have the tools to be fully embodied online³. Because of this we are forced to play by the rules organizations online who are digitally embodied with servers, identity systems, customer management systems, and so on. And part of that is being forced to use their inconvenient and anemic messaging systems.

What's the answer? People need tools. I think digital wallets (a bad name for an important tool), autonomic (peer) identifiers with strong cryptography, and verifiable credentials are a huge step forward. These tools provide the means for people to be peers online rather that mere ghosts in someone else's machine. That's why I insist on using the term self-sovereign rather than decentralized to describe these systems. Cogito Ergo Sum.

Notes

1. For a deeper dive into why one-off messaging systems are never as good as email, see Rich Sharing and Personal Channels. Email and other useful messaging systems exhibit a property called rich sharing that makes them much more robust that the simple idea of "sharing a message" would bring to mind.
2. If you're interested in power imbalances and how they come about, I can't recommend Graeber's book highly enough. He had such a keen understanding of this problem and wrote about it in a way that's both informative and entertaining.
3. I talk about this in more detail in Chapter 17 of Learning Digital Identity when I discuss authentic digital relationships.

Photo Credit: Playing Kerplunk from DALL-E (public domain) Prompt: Draw a picture of a boy and girl playing kerplunk that's 1200x500 pixels

Tags: web identity authentication authorization verifiable+credentials

Summary: This spring's IIW was full of interesting people and interesting discussions with people from around the globe.

We recently completed the 38th edition of the Internet Identity Workshop. We had 330 people from around the world who called 169 sessions. As usual there was lots of energy and thousands of side conversations. IIW is a place to get things done and it showed in the energy and the comments people made to me about how much they enjoyed it.

As you can see by the pins in the map at the top of this post, there were attendees from all over the world. Not surprisingly, most of the attendees were from the US (241), followed by Canada (11). Germany, India, and Switzerland rounded out the top five with 9, 8, and 7 attendees respectively. Attendees from India (5), Thailand (3), and Korea (3) showed IIW's diversity with attendees from APAC. And there were 4 attendees from South America this time. Sadly, there were no attendees from Africa again. Please remember we offer scholarships for people from underrepresented areas, so if you'd like to come to IIW39, please let us know. If you're working on identity, we want you there.

For states and provinces, California was first with 122. Washington (16), Utah (10), Texas (10) and New York (10) rounded out the top five. San Francisco (14) Oakland (13), San Jose (12), Seattle (11), and New York (9) were the top cities.

In addition to sessions, we have a demo hour on Wednesday that is a little like speed dating. There were 20 different projects highlighted. There's always more than one session that I want to attend in any given time slot and choosing is hard. That's a common refrain. Luckily we have sessions notes that we publish in a Book of Proceedings.

Here's pictures from all three days courtesy of Doc Searls

You belong at IIW! IIW is where you will meet people to help you solve problems and move your ideas forward. Please come! IIW 39 will be held October 29-31, 2024 at the Computer History Museum. We'll have tickets available soon.

Tags: identity iiw

Summary: We know that LLMs hallucinate. And we know that we can overcome some of that problem with better prompts. But can LLMs provide references for their work? I conducted an experiment.

Recently my friend Scott Mace asked this on X in response to a post about the evolution of software and how LLMs will likely follow that same trajectory:

Yes, but how trustworthy will it be? Can I at least see the links it used to create its response?

From X
Referenced 2024-05-21T18:09:06-0400

The short answer is "no", but the real answer is a bit more nuanced because of how LLMs like ChatGPT work. First the short answer: LLMs don't understand what they're saying so they can't reference the material that it used to create a response. They don't work like that. They don't go out, do a bunch of research and then create a response. Instead lots (and I mean LOTS) of material is fed into the program that creates the model, a multi-dimensional matrix of word orders. Then when you ask a question ("give it prompt" in LLM-speak), it processes the question and generates text based on the probabilities of words in its model¹. There's no way it can satisfy Scott directly because the model doesn't—can't, as far as I know—include the references that it used to create the text because it's generating it on the fly from material that has been thoroughly blended together.

But, in fairness, that's not what people do most of the time either. If you asked me over lunch or at the end of a tech presentation to describe zero trust and its pros and cons, I'd start talking. I wouldn't start looking up things on the web and somehow weave them into text complete with references. I'd go look for references if you asked me to back up something I said. So, let's try that with ChatGPT 4o. I gave it the following prompt:

You are a writer for a website focusing on technology. Your specialty is security. Write a 150 word explanation of zero trust with three pros and three cons.

ChaptGPT answered with this text:

Zero Trust is a security model based on the principle of "never trust, always verify." Unlike traditional security models that assume everything inside the network is safe, Zero Trust assumes that threats can exist both inside and outside the network. It requires strict identity verification for every user and device attempting to access resources, regardless of their location.

Pros:

1. Enhanced Security: By continuously verifying users and devices, Zero Trust reduces the risk of breaches and unauthorized access.
2. Minimized Attack Surface: It limits access to only what is necessary, reducing potential entry points for attackers.
3. Improved Compliance: Helps meet regulatory requirements by ensuring strict access controls and logging all access attempts.

Cons:

1. Complex Implementation: Deploying Zero Trust can be complex and time-consuming, requiring a significant overhaul of existing systems and processes.
2. Increased Costs: The initial investment in technology and training can be high.
3. User Experience Impact: Continuous verification can lead to friction and inconvenience for users if not implemented smoothly.

Zero Trust is essential for modern cybersecurity, but it requires careful planning and resources to implement effectively.

That's pretty good. But what if we need some references to other material to back up the pros and cons? I asked ChatGPT to supply them:

Now repeat that task, but this time include references as hyperlinks to back up each pro and con.

ChaptGPT answered with this text:

Zero Trust is a security model based on the principle of "never trust, always verify." Unlike traditional security models that assume everything inside the network is safe, Zero Trust assumes that threats can exist both inside and outside the network. It requires strict identity verification for every user and device attempting to access resources, regardless of their location.

Pros:

1. Enhanced Security: By continuously verifying users and devices, Zero Trust reduces the risk of breaches and unauthorized access (CSO Online).
2. Minimized Attack Surface: It limits access to only what is necessary, reducing potential entry points for attackers (NIST).
3. Improved Compliance: Helps meet regulatory requirements by ensuring strict access controls and logging all access attempts (Gartner).

Cons:

1. Complex Implementation: Deploying Zero Trust can be complex and time-consuming, requiring a significant overhaul of existing systems and processes (Forrester).
2. Increased Costs: The initial investment in technology and training can be high (ZDNet).
3. User Experience Impact: Continuous verification can lead to friction and inconvenience for users if not implemented smoothly (TechRepublic).

Zero Trust is essential for modern cybersecurity, but it requires careful planning and resources to implement effectively.

That looks great! Nice references for each bullet. There's just one problem. All the links, except the NIST reference, are dead. I don't know if they're wrong, made up, or stale. I tried finding content on a few of the sites by searching and came up dry. As I heard Johannes Ernst say once, ChatGPT is a "large language model" not a "large fact model" and this bears that out.

Still, asking for references or evidence for statements is something people are going to want. So, I tried a different tack. This time I asked this:

Why do you say complex implementation is a problem for zero trust? Can you give me a few references on that I can read myself?

ChatGPT responded with this:

Implementing a Zero Trust security model can be challenging for several reasons:

1. Overall Complexity: Zero Trust requires a comprehensive understanding of your network's intricacies, including users, devices, applications, and data. This can involve significant changes to existing infrastructure, which can be disruptive and costly. Organizations need to be prepared for the extensive planning and resources required for successful implementation​ (Help Net Security)​​ (Enterprise Networking Planet​).
2. Legacy Systems: Many organizations have legacy systems that are not designed to operate within a Zero Trust framework. These systems might require different security measures or even complete replacement, adding to the complexity and cost (Help Net Security)​​ (Enterprise Networking Planet​)
3. Cultural Shift: Zero Trust is not just a technological shift but also a cultural one. It requires continuous verification and strict access controls, which can lead to user frustration and resistance if not managed properly. Ensuring user buy-in and minimizing disruption to workflows through training and communication is essential (Deloitte United States)​​ (Guidehouse).
4. Resource Intensive: Implementing and maintaining Zero Trust can put a strain on IT resources due to the need for continuous monitoring and management. The need for advanced security tools and ongoing updates further adds to the resource demands (Help Net Security)​​ (Enterprise Networking Planet​).
5. Stakeholder Alignment: Achieving buy-in from all stakeholders and aligning them with the Zero Trust principles is critical. This requires a coordinated effort to educate stakeholders, prioritize gaps, and ensure consistent understanding and application of Zero Trust principles across the organization (Deloitte United States)​​ (Guidehouse).

These challenges highlight the importance of a phased and well-planned approach to Zero Trust implementation, considering both technological and human factors. For more detailed insights, you can refer to articles from Help Net Security and Guidehouse.

Much better. The links in the bullets all work, but the ones at the end don't. The articles it references aren’t very detailed, so I wouldn’t say they’re stellar references, but at least there’s a pointer to outside material that discusses similar challenges. So, partial success.

I've found that when you're using ChatGPT to do research, treating it like a librarian and asking questions that follow up are the best way to gain confidence that the material is correct and find the supporting material, just as I did above. I'm sure you could wrap additional helper functions around an LLM to make getting references easier. But for now interrogation through chat is the best way to get comfortable with the results.

Notes

1. Yeah, this is really simplified and thus wrong, but it's directionally correct. For a better explanation, see What Is ChatGPT Doing … and Why Does It Work?.

Photo Credit: Older Man Talking to Robot Librarian from DALL-E (public domain) Prompt: draw me a rectangular picture of an older man talking with a robot librarian. Use earth tones.

Tags: genai llm chatgpt prompt+engineering

Summary: In session after session, attendees at EIC are hearing the message that decentralized identity is the answer to their identity problems.

I'm at European Identity Conference (EIC) this week. I haven't been for several years. One thing that has struck me is how much of the conversation is about decentralized identity and verifiable credentials. I can remember when the whole idea of decentralized identity was anathema here. The opening keynote, by Martin Kuppinger is Vision 2030: Rethinking Digital Identity in the Era of AI and Decentralization. And all he's talking about is decentralized identity and how it's at the core of solving long standing identity problems. Another data point: Steve McCown and Kim Hamilton-Duffy ran a session this morning called Decentralized Identity Technical Mastery which was a hands-on workshop. The rather large room was packed—standing room only.

I attended a couple of sessions on decentralized identity where I didn't know the companies, the speakers, or the specific platforms they were using. The space is too big to keep track of anymore. Identity professionals who were ignoring, or talking down, decentralized identity a few years ago are now promoting it.

This truly feels like a tipping point to me. At IIW, it's identity geeks talking with other identity geeks, so it's no surprise to see lots of discussion about new things. EIC is a different kind of conference. There are about 1000 people here I'd guess. Most of them aren't working on new standards or open source projects. Instead they're the folks from companies who come to conferences like EIC to learn how to solve the problems their organization is facing.

In the keynotes and in numerous sessions, the message that they're hearing is "decentralized identity will solve your problems." Martin closed his talk with the proclamation that "decentralized identity is the new paradigm for identity."

Photo Credit: Credential Tipping Point by DALL-E (public domain) Prompt: Draw a rectangular picture that shows a credential at a tipping point. Make the credential look like a lifelike credential, include cartoon picture, and some writing. Use bright friendly colors.

Tags: identity ssi decentralized+identity verifiable+credentials

Summary: What is decentralized identity and why is it important? My attempt at a simple explanation.

In Yeah, yeah, yeah, yeah, yeah, nah, Alan Mayo references my recent blog post, Decentralized Identity Comes of Age, and says:

My challenge to the decentralization community is for them (someone) to explain how it works in relatively simple and reasonable terms. I say relative because identity is not simple, so we should not expect simple solutions.

This post is my attempt to do that for Alan and others.

Identity is how we recognize, remember, react to, and interact with other people, organizations, and services. Put another way, identity is about relationships. Online we suffer from a proximity problem. Since we're not near the parties we want to have relationships with, our natural means of recognizing, remembering, and interacting with others can't be used. Digital identity systems are meant to provide us with the means of creating online relationships.

Traditional identity systems have not served us well because they are owned and controlled by companies who build them for their own purposes. The relationships they support are anemic and transactional. We can't use them for any purpose except what their owner's allow.

Decentralized identity systems¹ on the other hand allow you to create online relationships with any person, organization, or service you choose and give you the tools to manage and use those relationships. They help you recognize, remember, react to, and interact with them. The most important tool is a decentralized identity wallet. The world of decentralized identity wallets is still young, but organizations like the Linux Foundation's Open Wallet Foundation give me hope that useful, interoperable wallets are a tool we'll all be able to use soon. They are as foundational to decentralized identity as a browser is to the web.

Besides helping you manage peer-to-peer relationships with others online, wallets hold verifiable credentials, the digital analog to the credentials and cards you carry in a physical wallet. One of the most important aspects of digital relationships is providing information about yourself to those you interact with. Sometimes that information can come from you—it's self-asserted—but many times the other party wants to reliably know what others say about you. For example, if you establish a banking relationship, the bank is legally obligated to verify things like your name and address independent of what you say. Decentralized identity wallets allow you to prove things about yourself using credentials others provide to you. At the same time, they protect your privacy by limiting the information disclosed and forgoing the need for the party you're interacting with to directly contact others to verify the information you provide.

In summary, decentralized identity systems allow you to create digital relationships with other parties independently, without relying on any other organization or service. These relationships are direct, private, and secure. They also provide the means for you to prove things about yourself inside these relationships so that even though you're operating at a distance, you and the other party can have confidence in the relationship's authenticity.

How Does It Work

The preceding paragraphs say what decentralized identity is, and provide its benefits, but don't say how it works. Alan and others will likely want a few more details. Everything I describe below is handled by the wallet. The person using the wallet doesn't need to have any more knowledge of how they work than the operator of a browser needs to understand HTTP and HTML.

The foundation of a peer-to-peer, decentralized online relationship is an autonomic identifier like a peer DID. Identifiers are handles that someone else can use to identify someone or something else online. Peer DIDs can be created by a wallet at will, they're free, and they're self-certifying (i.e., there's no need for a third party). A relationship is created when two identity wallets create and exchange peer DIDs with each other on behalf of their owners. Peer DIDs allow the parties to the relationship to exchange private, secure messages.

There are four primary interaction patterns that wallets undertake when exchanging messages:

1. DID Authentication which uses the DIDs to allow each party to authenticate the other
2. Single-Party Credential Authorization where the same party issues and verifies the credential.
3. Multi-Party Authorization where the credential issuer and verifier are different parties.
4. Generalized Trustworthy Data Transfer which uses a collection of credentials to aid the wallet owner in completing online workflows.

Verifiable credentials make heavy use of cryptography to provide not only security and privacy, but also confidence that the credential data is authentic. This confidence is based on four properties a properly designed credential presentation protocol provides:

1. The identifier of the credential issuer
2. Proof that the credential is being presented by the party is was issued to
3. Proof that the credential has not been tampered with
4. The revocation status of the credential

The credential presentation can do all this while only disclosing the information needed for the interaction and without the verifier having to contact the credential issuer. Not having to contact the issuer ensures the credential can be used in situations with poor connectivity, that the issuer needn't be online, and preserves the credential subject's privacy about where the credential is being used.

A properly designed credential exchange protocol has four important properties:

1. The system is decentralized and contextual. There is no central authority for all credentials. Every party can be an issuer, an owner, and a verifier. The system can be adapted to any country, any industry, any community, any set of credentials, any set of trust relationships.
2. Issuers are free to determine what credentials to issue and whether or not to revoke them.
3. Wallet owners are free to choose which credentials to carry and where and when they get shared. While some verifiers require a specific credential—such as a customs agent requiring a passport—others will accept a range of credentials. Therefore owners can decide which credentials to carry in their wallet based on the verifiers with whom they interact.
4. Verifiers make their own decisions about which credentials to accept. For example, a bar you are trying to enter may accept any credential you have about your date of birth. This means some credentials (e.g., passports, driving licenses, birth certificates) may be much more useful than just for the original purpose for which they were issued.

These properties make a decentralized identity system self sovereign.

Why is Decentralized Identity Important?

Decentralized identity systems are designed to provide people with control, security, and privacy while enhancing the confidence we have in our online relationships. Some time ago, I wrote the following. I think it's an apt way to close any discussion of decentralized identity because unless we keep our eyes on the goal, we'll likely take shortcuts in implementation that fail to live up to their promise.

Presently, people don't have operational relationships anywhere online.² We have plenty of online relationships, but they are not operational because we are prevented from acting by their anemic natures. Our helplessness is the result of the power imbalance that is inherent in bureaucratic relationships. The solution to the anemic relationships created by administrative identity systems is to provide people with the tools they need to operationalize their self-sovereign authority and act as peers with others online. Peer-to-peer relationships are the norm in the physical world. When we dine at a restaurant or shop at a store in the physical world, we do not do so under the control of some administrative system. Rather, we act as embodied agents and operationalize our relationships, whether they be long-lived or nascent, by acting for ourselves. Any properly designed decentralized identity system must provide people with the tools they need to be "embodied" in the digital world and act autonomously.

Time and again, various people have tried to create decentralized marketplaces or social networks only to fail to gain traction. These systems fail because they are not based on a firm foundation that allows people to act in relationships with sovereign authority in systems mediated through protocol rather than by the whims of companies. We have a fine example of a protocol mediated system in the internet, but we've failed to take up the daunting task of building the same kind of system for identity. Consequently, when we act, we do so without firm footing or sufficient leverage.

Ironically, the internet broke down the walled gardens of CompuServe and Prodigy with a protocol-mediated metasystem, but surveillance capitalism has rebuilt them on the web. No one could live an effective life in an amusement park. Similarly, we cannot function as fully embodied agents in the digital sphere within the administrative systems of surveillance capitalists, despite their attractions. The emergence of self-sovereign identity, agreements on protocols, and the creation of metasystems to operationalize them promises a digital world where decentralized interactions create life-like online experiences. The richer relationships that result from properly designed decentralized identity systems promise an online future that gives people the opportunity to act for themselves as autonomous human beings and supports their dignity so that they can live an effective online life.

Notes

1. I prefer the term self-sovereign to decentralized because it describes the goal rather than the implementation, but I'll stick with decentralized here. All self-sovereign identity systems are decentralized. Not all decentralized identity systems are self-sovereign.
2. The one exception I can think of to this is email. People act through email all the time in ways that aren't intermediated by their email provider. Again, it's a result of the architecture of email, set up over four decades ago and the culture that architecture supports.

Photo Credit: Young Woman Using a Wallet from DALL-E (public domain) Prompt: draw a rectangular picture of a young woman using a wallet.

Tags: identity ssi decentralized+identity verifiable+credentials

Summary: Until we value freedom and independence in the digital world, we will yield up control of our digital lives to others who will act in their own interests, not ours.

In response to a post on X about China's social credit system, Paul Conlon said:

Digital ID is ultimately about access control where those who impose the system are the ones determining what you are required to be and do.

Provision of resources and liberties become conditional upon the whims of the affluent. Doesn't sound safe or convenient to me.

From X
Referenced 2024-08-28T08:10:31-0400

How Paul said this struck me because I've been thinking a lot about access control lately. I believe that we build identity systems to manage relationships, but, as Paul points out, in many cases the ultimately utility of identity systems is access control.

This isn't, by itself, a bad thing. I'm glad that Google controls access to my GMail account so that only I can use it. But it doesn't stop there. If I use my Google account to log into other things, then Google ultimately controls my access to everything I've used it for. This is federation's original sin¹.

Paul's comment points out the primary problem with how we build identity systems today: when access control is centralized, it inherently shifts power towards those who manage the system. This dynamic can lead to a situation where individuals must conform to the expectations or demands of those in control, just to maintain their access to essential services or resources. While we often accept this trade-off for convenience—like using Google to manage multiple logins—the broader implications are troubling.

The more we rely on federated identity systems, with their tendency to centralization, the more we risk ceding control over our digital lives, reducing our autonomy, and increasing our dependence on entities whose goals may not align with our own. This is why the principles of self-sovereign identity (SSI) are so compelling. SSI proposes a model where individuals maintain control over their own identity, reducing the risks associated with centralized access control and enhancing personal freedom in the digital realm.

Critics of SSI will claim that giving people control over their identity means we have to accept their self assertions. Nothing could be further from the truth. When someone wants me to prove I'm over 18, I use a driver's license. The state is asserting my age, not me. But I'm in control of who I show that to and where. Sovereignty is about borders and imposes a system of relationships.

Now, China could use decentralized identity technology to build their social credit system. One credential, controlled by the state, that is used to access everything. Technology alone can't solve this problem. As a society, we have to want a digital world, modeled on the physical one, where individuals are the locus of control and use information and assertions from a variety of credentials to build and interact in authentic peer-to-peer relationships. Until we value freedom and independence in the digital world, we will yield up control of our digital lives to others who will act in their own interests, not ours.

Notes

1. For similar reasons, I think federated social media systems are a bad idea too, but that's another blog post.

Photo Credit: Papers Please from DALL-E (public domain). Prompt: Draw a rectangular picture of police checking identity papers of people on the street

Tags: identity access+control ssi

Summary: We held the 39th edition of Internet Identity Workshop last week. Like always, it was a great week.

The 39th edition of the Internet Identity Workshop wrapped up last week. We have 364 attendees from around the world who called 178 sessions. I can't begin to describe the energy of the identity community when they all get together to discuss their favorite topics. If you like identity, or simply want to be part of an enthusiastic technical community, you should come to IIW.

As you can see by the pins in the map at the top of this post, there were attendees from all over the world. Not surprisingly, most of the attendees were from the US (251), followed by Canada (18) and France (14). Germany, Japan, and Australia rounded out the top six with 12, 9, and 7 attendees respectively. Attendees from India (5), Columbia (3), and Chile (2) show IIW's geographic diversity. Sadly, there were no attendees from Africa again. Please remember we offer scholarships for people from underrepresented areas, so if you'd like to come to IIW40, please let us know. If you're working on identity, we want you there.

For states and provinces, California was first with 131 attendees. Washington (19), Utah (14), New York (9), and Massachusetts (9) made up the rest of the top 5. San Jose (20), San Francisco (16), Paris (12), Oakland (11), and Seattle (9) were the top five cities.

We'll have the book of proceedings out in a month or so with notes from the different sessions and descriptions of the 20 demos given during demo hour. Past proceedings are available here.

The next IIW takes place April 8-10, 2025 at the Computer History Museum. This will be IIW XL, number 40! We'll have registration open the first part of December. If you're interested in sponsoring, send me a note.

Tags: iiw identity

Kyra Wilson, Aylin Caliskan, Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, Nov 13, 2024

The topic of AI-based recruitment and hiring has been discussed here before and research continues apace. This item (13 page PDF), despite the characterization in GeekWire, is a fairly narrow study. It looks at three text-embedding models based on Mistral-7B-v0.1, and tests for gender and racial bias on applications containing name and position only, and name and position and some content (the paper discusses removing the name but does do it). The interesting bit is that intersectional bias (ie., combining gender and race) is not merely a combination of the separate biases; while separate biases exaggerated the discrimination, "intersectional results, on the other hand, do correspond more strongly to real-world discrimination in resume screening." Via Lisa Marie Blaschke, who in turn credits Audrey Watters.

Roberto J. Rodriguez, et al., Office of Educational Technology, Nov 13, 2024

This is a longish (79 page PDF) resource from the U.S. government's Office of Educational Technology. "The Department heard educators say that AI is here to stay, AI will keep changing, and safely integrating AI in educational settings will require informed leadership at multiple levels across the education system." The toolkit is divided into three sections: migitating risks, strategy for AI integration, and guiding its use. The risks considered include privacy and data security, student civil rights, accessibility, and digital equity. The second section is weaker, focusing on the 'instructional core' (credited to Elmore, but basically Moore (1989)), with a corresponding focus on instruction. The third section begins with a discussion of AI literacy (limited to "includes the knowledge, skills, and attitudes needed to engage with AI safely") and promotion of "responsible use". 

Vinay K. Chaudhri, The Hechinger Report, Nov 13, 2024

This is an idea straight from the 50s but expect to see more of the same as companies wrestle with how to make their publications relevant in the age of AI. Vinay K. Chaudhri beghins with a reaffirmation of the importance of textbooks (as "a carefully curated body of knowledge... nearly 100 percent accurate... (and) the view of an expert educator"). Needed now, though, is "authoring textbooks so that their concepts can be read as computer code." How? Back to the 50s - a controlled vocabulary. "Textbooks, using the discipline of knowledge engineering, can support the curation, preservation and learning of all forms of human knowledge." Next up? I guess it would have to be the unification of the sciences.

Lisa Janicke Hinchliffe, The Scholarly Kitchen, Nov 13, 2024

We expect The Scholarly Kitchen to represent the publishers' point of view, since that is its intent, but in this case it ventures into the realm of pure propaganda. No open access charges subscription fees to readers. In 'Gold' open access, publishers charge authors 'article publication fees', while in 'Green' open access no such fees are charged. So how is there a "cost" to readers? According to this article, it's in the time and effort it takes to find the 'version of record' of an article as compared to what is found in typical 'green' venues such as preprint repositories. This argument, of course, assumes readers want to find the 'version of record', and the author is ready with a 'fear, uncertainty, doubt (FUD)' argument. The author also argues that green versions are hard to find, compared to gold versions, ignoring such services as Unpaywall that index open access articles.

Six Apart released Movable Type v. 2.661 this week as a stopgap to help administrators deal with comment flooding spam before they release comment registration in Movable Type 3.0.

A federal interagency committee on government information has drafted "Requirements for Enabling the Identification, Categorization, and Consistent Retrieval of Government Information." This document has insights of value for those in government engaged in making information more accessible through portals and search engines.

Missouri Governor Bob Holden this week awarded a Governor's Award for Quality and Productivity to the State Portal Newsfeed Development Team. This annual award that recognizes excellence in service, efficiency and innovation went to employees from 17 different state agencies who developed a system for state agencies to share the state's news feed portal at little or no cost to the agency. This system currently publishes the news from 18 government agencies, offices and organizations at the top of each hour on the state homepage, in addition to providing continuous newsfeed to web sites in the public sector.

Read to the end for a tiny yet extremely majestic lion. In today’s edition: The truth behind the classic “average person eats 3 spiders per year” factoid. Tips that’ll make organizing your taxonomies a little less, uh… taxing. America’s finest news source, The Onion, is now powered by our old friend WP. Hot Off The […]

No in-house dev team? No problem. With our newest On Demand Development Service Add-On, our expert team of WordPress developers will be on hand to help you with anything you need, from simple CSS issues to building custom functionality. Need help with expanding the capabilities of the Forminator plugin so it caters to your specific […]

Great news for agencies, developers and freelancers! We’ve heard that while many of you love our Webmail service, the 5GB storage limit is getting tight. That’s why we’re introducing our new range of expanded Webmail plans to help take your email capabilities to the next level. More Space, More Flexibility, More Power We’re expanding our […]

As I sit at my computer tapping out this article, the sun is shining in beautiful Brisbane, capital of Queensland, Australia. We are moving into summer and the sun is up long before I am. When I awake, the house battery is filling up and charging the car. Soon, the ... [continued]

The post Renewables Gallop Ahead Down Under — A Queensland Sample appeared first on CleanTechnica.

Florida is famous for “Florida Man” news stories and memes, for the extreme heat frying people’s brains, and for more and more extreme Republicans taking over the state. When I was younger, it was a swing state in national elections— one of the key swing states. It seems that it’s ... [continued]

The post Should Democrats Abandon Florida? appeared first on CleanTechnica.

Many citizens in Paris were caught off-guard on November 5 when a new ban on motorists in the first four arrondissements of central Paris came into effect. As they looked around their city neighborhoods, residents could see nearly forty signs for the ‘Zone à Trafic Limité’ (ZTL) — or “limited ... [continued]

The post The City Center In Paris Is Now Designated A Limited Traffic Zone appeared first on CleanTechnica.

Both Cadillac and Mercedes plan to expand their electric car offerings to the SUV market segment in the near future.

The post Large Electric SUV Models Coming From Cadillac & Mercedes appeared first on CleanTechnica.