User-centric = Independent

Two days ago, Dick Hardt of Sxip posted What is User-Centeric Identity on his Identity 2.0 blog. His key thoughts were these:

• The user is in the middle of a data transaction. This does not mean the user has to approve every transaction, but that the data always flows through the user’s identity agent. This does have user control and consent advantages that others point out, but I think more importantly, it provides huge scale advantages as the Identity Provider does not have to have any prior knowledge of the Service Provider. The network of sites can build up ad-hoc, just like SMTP servers do today.
• The user has a consistent user experience. That does not mean that all users have the same user experience, but that a specific user is using the same identity agent over and over for each identity transaction, similar to the interfaces we all see for saving and printing files regardless of the application. Currently each SP provides its own user interface which means the user is learning a new interface, sometime for onetime use (eg. site registration) By separating the identity component from the rest of the application, the user also has more certainty on who the SP is which helps resolve phishing.

He also pointed to the piece and vetted the same thoughts with the Identity Gang mailing list.

I posted a response. Several dozen other responses were also posted. The only response to my post came off-list, from Tom Maddox, in this post here. Sez Tom,

As so often, Doc's on the mark here. The details of almost all identity management proposals verge on the mysterious, but the intention behind all of them if they're serious about being user-centric should be to address the needs of all our "autonomous and independent" selves.

He excerpts a bit of my post. But I thought it would be best to surface the whole thing. So here ya go...

To me, and therefore (by ego-orginated projection) to every other non-technical person in the world, user-centric identity centers around the first person possessive pronoun: my.

It's my identity. It is not one conferred upon me by an organization outside myself. It is not a representation of me in a context other than my autonomous and independent self, operating in the larger world we call the marketplace. This is the identity we hope to more fully empower by our various projects.

Andre Durand originally described this as Tier 1 (T1) Assumed (Personal) / Agent Only (device/program)

Specifically,

T1 identities are both timeless & unconditional. They are your true personal digital identity and are owned and controlled entirely by you, for your sole benefit. T1 identities exist for people as well as for devices & programs, with the exception that a device or program T1 operates in AGENT mode only, meaning, it is controlled entirely by another Personal T1.

Tier 2 is Assigned (Corporate): one given to you by some silo. Every card in our wallets, other than our business cards, are these.

Tier 3 is Abstracted (Marketing) and applies to those conditions where some company knows, say, your name and address, but nothing besides that, which doesn't stop them from spamming you with junk mail.

Some visuals.

Relations between T1 and T2 involve more than transaction. They also involve what we might generally call conversation and relationsiip.

(Disclosure: I'm on the advisory board for Ping Identity.)

At the Identity Mashup I suggested that it's handy to look at markets in terms of those three activities:

• Relationship
• Conversation
• Transaction

Transaction is a base condition without which we wouldn't have markets. But more happens in markets than transactions -- both economically and culturally. Understanding these other activities is essential to communicating the new experiences of identity we hope to provide customers in the markets that will grow around our goods and services.

In the absence of providing and communicating the immediate and tangible benefits of user-centrism, we'll continue getting the kind of reaction my wife has had from the beginning of my sojourn into this space: "I don't want more identity. I want less."

Less, that is, of what she gets on the Web today, which is the same MSO (Multiple Sign On) hell everybody else experiences.

The one adjective that appeals to her, out of all we've been using to describe the user-centric identity experience, is independence. That's why I've been talking about "independent identity" since I wrote about it last October for Linux Journal.

I know we need to talk about identity agents and solutions and providers and relying parties and assertions and tokens and certificates and the rest of what it will take to build out the first customer-centric marketplaces in the history of the industrialized world, but...

We have to keep the empowering real-world experiences we wish to support in mind.

And, frankly, we don't have those yet. Worse, customers can barely imagine them. Hence, there is no demand for them. Yet.

So we need some demo-sells here.

I believe, along with Conor and others on this list, that our solutions cannot be limited to what happens in browsers or on computer screens. At the very least cell phones and (credit-shaped) cards are also required. This is why I insisted to Roger Desai of Rave Wireless that he attend at least some of the Identity Mashup (which he did). Rodger and Rave Wireless are themselves independent of carrier and equipment provider silos, which puts them in an ideal position to apply the relevant solutions we're building.

(Disclosure: I consult Rave Wireless. And one reason I do is that I'm involved in the Identity Gang.)

Finally, there is the matter of intention. Specifically, supporting what the independent customer intends to do in a given marketplace. Supporting customer intentions in useful ways is what will get all of us the traction we want.

I unpack some of this stuff here. And here:

In the first of those, I suggested (as I also did on a panel at the Identity Mashup) that, in the absence of broad business support for customer independence, we do not yet have a real commons in the Networked world. We may talk about one, but we don't have one.

I mean, it's quite possible to care about the customer, and to be "centric" around the customer without the customer ever feeling independent of the all-silo markets we built in the Industrial Age, and which still stand.

So I would like us to think about what a real commons comprises, and the roles that independent identities will play in reifying what is still only an idealized construct.