My representation in remote systems, the present

Warning: rant ahead....


I, the one represented, allow you, the receiver of information about me, needed to fulfill a service for me, to acquire and store indefinitely, some attributes describing me as an individual, in the hope you will record them accurately and use them solely for the purpose as intended in our agreed initial context.

From there on, I have no control over the system you use to store these records, describing me. Any subsequent change which I wish to effect (an act of self expression, creating my self representation) can only be realized with your consent. Any error or conscious mis-representation is not noticed by me directly. You can alter data representing me at will, thereby doing dishonor to my intentions, without me even knowing it happened. I am not consulted or notified if such change should occur.

I am powerless to express myself unless my intentions are reflected in your records. Once acquired, you value the recorded version, supposed to be representing me, above my subsequent direct communication of my intentions (as in, 'no sir, our computer says here bla bla bla'), even though I should be considered the ultimate authority in describing myself.

Even when it were entirely feasible and economical to consult me each and every time you need to acquire some information of me, you prefer to use the version in your system as it was recorded once in the past. That may be out of date, or not reflecting my current intentions in some way, but you don't really care. You don't verify or check at regular intervals with me. I can try and fix your records (which, for you, are the truth about me, but for me, they are not), but you might not let me, or you are incapable because of "call-center issues".

To make things worse, I have this issue with 200 different organizations, each treating me the same way as you did above, thus leaving me practically powerless to express my intentions across them all. (even a single one is hard, let alone 200). Such is the way I am reflected in society, through the eyes of the many organizations that deal with me: Disparate views, often not consistent, and not governed by my intentions. I am most incapable of expressing my desired representation in a consistent manner, such that it reflects the way I wish to be known. Where is the justice in that?

Oh and by the way, could you take more care with my data?

On the OpenID attribute exchange protocol

Image via WikipediaThe process for new attribute creation (a 5 point list, proposed by D. Hardt) is broken. It assumes central control (or at least some barrier for me) over what can be postulated about me. My position on this is explained in The Profile Problem.

I would rather not see the openID initiative which is applauded for its decentralizing effects on Identity, become a centralized point for attribute definitions.

Luckily, (apart from the openID attribute namespace) anyone can define attributes as they see fit. But when everyone starts defining attributes, how do we make sure this still results in a usable system of exchange (where usable means no centralization of any kind is needed to take off).

Off course the openID namespace attributes will mostly be identifying attributes, which are attributes whose values are supposed to be unique for one person. However the non-identifying remainder of the set all possible attributes is much larger and possibly much more interesting in the lives of most people. So this is where most of the action will take place, between common folk.

Let's suppose that everyone gets his own namespace (or comparable mechanism) for creating whatever attributes to describe him or her self; This way, no central authority on 'official attributes' stands in the way of full self expression of the individuals describing themselves.

In order to exchange attributes meaningfully, the two parties must agree on the semantics (they must agree that the attributes, although maybe called differently by both parties, actually are one and the same thing). But if attributes can be dreamed up by anyone, how do we do that?

Basically there are two options. The first is that both parties decide that their attributes to be exchanged both conform to an externally known (official) attribute definition. The other option is to create an ad-hoc attribute just for the pairing of the two personally defined attributes, and use that as the underlying definition to agree upon. A new attribute definition will be instantiated, specifically for this one-on-one mapping. Both parties designate their attributes to be one of that kind.

It would not be unreasonable to expect well defined attribute collections for general use to
appear soon. If both parties designate their (personally defined) attributes as a known external uri, semantic matching is automatic. If not, human intervention is needed to decide, but that's nothing too dramatic. A simple instant message "Hey, your sending me this http://..../foobar property, it has value 14. What is it?" If an understanding is reached, both parties will have semantic agreement, and both attributes will be defined as being of a (newly created) special attribute which is defined purely for this one-on-one purpose.

The key point here is that all attributes that I create are in my private namespace, and that semantic matching occurs on a different layer, between each of the 2 identities involved.

In the end, each person would still have his own idiosyncratic world view defined by the attributes he makes up. These describe himself as well as other people he knows. Hidden from view are the mappings based on semantic agreements (the underlying attributes) via well known or ad-hoc attributes.

The result is decentralized attribute collections (they are personal, but allow for consensus via intermediate maps or via plain old human consensus).

Let's fast forward from here.

I can imagine that certain groups of people (say, project team members) might want to share some pretty interesting attribute sets, which are not 'standard' by any other means. The support of this kind of creativity is essential.

Quick creation of special-purpose attribute sets, and proposing those sets to others is where protocol thought should be focussed now. If I can quickly create, send out, and receive values of, self-defined attribute sets, all in a fully decentralized way, then we finally have a reason to ditch Lotus Notes forever (for which I should win the Nobel Peace Prize).

How (not) to make friends

Image by Chewbacka via FlickrRegarding the social web and linking of 'friends', the currently available implementations such as Facebook etc. take the following approach:

First you identify who is your 'friend' (within the same network or application), this in turn determines which attributes they are allowed to see. Other classes of relationships like 'acquaintance', 'co-worker' 'school-mate' 'best friend' are now being proposed on the Data Portability forums to manage this.

This not only smells like bad design, but it appears to me to be an inversion of what happens in reality.

It is not the appointing of a 'friend' class to someone which determines who can see which of your attributes. It's the other way around: by allowing different identities to see different subsets of your attributes (gradually and over time), you define your relationship with these other identities. In other words, someone might become a friend after you decide he may see some of your attributes.

You don't have to decide on the relationship type upfront if you could granularly disclose attributes to various other identities (and maybe have the favor returned to you).

Off course people don't want to be bothered continuously with such fine-grained control over their individual attributes. As usual, software programs can ease the burden and help with common tasks.

Not many people currently craft their HTML documents and HTTP requests by hand to publish or read on the world-wide web. Still, inter-operability of all the different software is possible, thanks to the underlying standards. Sadly, we don't have these for identities and their attributes yet.