1 post tagged “authentication”

A bit of live blogging, excuse the lack of editing.

Before the talks I met up with Ivailo Jordanov from Zoomf who left Reed Business to start up his new property search company. The site is going well with rapidly growing traffic and they have plans for relaunch soon so watch this space. Also Peter Bond from Otodio who offer text to audio conversion for publishers into an XML format which can be accessed on smartphones, sounds interesting.

So here are the notes, and they are off….

Tom Ilube, CEO of Garlik. What do consumers think about digital identity and is there a business for consumers there? What will they be interested in within the next 3 years?

Segmentation is important ie the age gap, current university students grew up with the internet whereas older consumers are clueless. digital mainstream is 25 to 55 broadband users but not active bloggers or youtube users. There are 8.5 million growing to 15 million over the next few years. They have plenty of cash apparently, I must be outside the demographic. So here are the key findings from research:

1. Identity management means nothing to people – we should call it what? Digital identity, digital persona? Need to talk in terms of security use cases. What would an east enders storyline say about digital identity? What is the story?
2. 50% say they are concerned about their personal information online, but only 4% are doing anything about it. gap. We need the equivalent to an online shredder for your personal information, how do we shrink-wrap one?
3. It’s an emotional issue, people are scared, violated etc So it’s a very personal thing to people indeed, well it would be I guess as its their identity.
4. Trust – how much do we trust providers and with what for what purpose?
5. Motivation for identity management? fear, greed or sex apparently

Richard Baker from BT (shame he couldn’t have sorted out free wireless access from the BT centre…)

ID will become the central organising principal to what we will be doing in the whole 2.0 world. People have business and consumer identities and lots of different roles and personas that they will want to manage.

Identity management is a balance of convenience, cost effectiveness and risk and a trade off between them. Registration is a good starting place, how do I know that you are who you say you are? With the extension of open services (like free wi-fi!) How do we administer identity management? It will be managing communities and groups coming together.

Authentication will be invasive e.g. biometrics. How do we authenticate without being invasive?

Authorisation should be dynamic and context sensitive (I know what he means but please find some real world language for this stuff..) Establishing mutual trust blah, blah.

Final point (hooray!) unless there is risk we will not find the money, quite, enough already.

Comedy moment, they have given out the wireless password as the demo failed and we are online. Revolution…

Simon Wilison an OpenID consultant demonstrates Openid for decentralised central sign-up, or at least he will if the internet connection works.

Used by LiveJournal, Digg etc But it’s still very early days. So why offer it? Good for early adopters, they have concerns over managing the number of passwords that they have. It’s user friendly technology. People building applications can get sign-in / authentication without putting people off with a lengthy sign-in process.

OpenID is a unique global identifier. Use case – Friend import; copy your friends from one social network to another easily.

Identity projection from one service to another. So I can pull in my music preferences from LastFM and use it on another site.

Openid is not a replacement for full account sign up. It could be a bot, you may need some secondary authentication but does it matter since it’s easier?

OpenID rocks basically. Bring it on for the early adopter crowd, the 5^% of users who will create the content for the other 95% to use (for social sites). Digg referred traffic might be able to do some funky things on destination sites.

New people join the panel.

Luke Razzell, a blogger on identity – initiative called identity society an initiative to start a discussion and debate around the subject of identity. A hugely facted space spanning philosophy, business, online etc How do we collaborate to solve the issues.

Edgar Whitely – from London School of economics and working with the government on ID cards, must be great to be so popular. ID cards cant be segmented its got to be for everyone. Industry can ignore certain customers, governments cant.

Question: can we trust one ID provider? surely there should be a few

Edgar: If there are many we will need standards so that they can share, surely that means one?

Question: With multiple personas which part of my identity has value?

Luke: Identity has rich value which each person has, cant decide which bit has commercial value.

Tom: Fraudsters that we researched (seriously 1800 of them, how do you find one?) they say if they can get enough personal data ie name, address, DOB and mothers maiden name they can make on average £85,000 in the first year. Wow.

Edgar: Businesses should think about the benefits of storing personal data to improve personalisation etc
Tom: Who is accountable for personal information within a large company? Companies need to nominate someone and agree what their policy is and why.

Question to the audience: Who has been involved with identity theft? and who has lost money or time?

About 20% show of hands, but noone has lost any cash, just time sorting it all out.

Question: Will the government share our data with companies (we seem to have moved onto ID cards..)
Answer: Edgar: no, but they will confirm identity

Question: Openid allows people to own their identity and choose what I disclose, to who and with what we havent heard much on this

Answer: Simon: Openid will allow people to switch id providers that will keep providers on their feet. Tom:  The language  has not evolved yet, early days but we'll get there. Luke: Need to present use cases and solutions and not technologies

Question: Simon2 the time has come for OpenID, people are ready and understand it if its explained properly. 6 months to a year , won't most sites ask for OpenID wont this unite people around the topic of identity?

Answer: Simon 1 yes

Question: if OpenID has one username and password then if someone robs it surely I've really got problems

Answer: Simon 1 yes, but you have that problem anyway. Luke: there are opportunities and threats.

Question: How easy is OpenID to implement?

Answer: Simon 1, Pretty simple, if you deal with early adopters then you'll be fine.

Question:  OpenID should not be confused with indentity which is a much bigger subject

Question: Many businesses online depend on the anonimity of users (shady sites) people are worried that they can be tracked down. Is there a polar opposite of OpenID that is gaining ground?

Answer: Mailinator or spoof an OpenID. Edgar: The service provider should allow you to sign into a site without disclosing any information at all. Does anyone worry about their oyster card being linked to their credit card transactions - big show of hands of people that only pay in cash.

Last question / point: Openid is only about authentication between two websites, its other providers that build services on top. How do you provide ultimate proof that someone is who they say they are? You cant.

Well that just about wraps it up, I'll try a summary tomorrow. Phew...