This newsletter brings all the previous newsletters together in one place – Identity in a nutshell, so to speak.  I think it appropriate to summarize the basics of Identity before, in following newsletters, going more in-depth, critiquing different approaches, and suggesting what the future will look like.

So here it is – Identity as well as I know it; based on my experience and documented in my previous eight newsletters.  The process of summarizing these eight newsletters suggested some revisions and these have been made to this summary edition.

Subscribe now

Identity is important for Society

The starting point is Identity’s importance for society.  Consider the list of activities and entities below.

Clearly, a number of the activities involve identifying ourselves, and many of our relationships with the entities shown are based on identity.  We identify ourselves regularly in many situations that require security, and we want such services to be easy-to-use and convenient.  Identity is not a nice-to-have – it is part of the very fabric of our society and our legal system.  Identity is important!

Identity-based Transactions

I use the term transaction in an everyday manner “to carry on or conduct business… to a conclusion”.  That is, a transaction is a sequence of actions with a specific form and time period. Of course, not all transactions involve identity as shown in the picture below.

Transactions split into anonymous transactions and identity-based transactions.  Examples of anonymous transactions are buying a ticket for a movie or buying an ice cream.  At no time are you identified and you are anonymous (this is not to say that you cannot be traced, but that is another story…).

These newsletters are all about the identity-based transactions (in the red circle above).  In these transactions, the person’s identity is important.  These transactions are for a specific individual.

I differentiate identity-based transactions into named and nameless.  Most transactions are named, meaning that the recipient of the information wants to know who you are – they want to know your name.  In the alternative, nameless transactions, the recipient does not know your name.  This is how a covid-passport should operate – the recipient knows you are covid-free but does not know your name – you are nameless. 

Identity Processes

There are two basic identity processes that occur within identity-based transactions.

The first process, identification and authentication, is obvious and very important.  An identity-based transaction needs an identification and authentication process appropriate to the risk of the transaction.  Buying a house needs more security than taking a book out of the library. Identification and authentication is the hard, stressful bit, hence the red colour.

And every transaction has a purpose beyond identification and authentication, and this purpose is achieved either through the use of some personal data or the sharing of personal data.  An example of use of data is checking that a person has the required permission for entry, while an example of data sharing is opening a new account.  This is more about growth, hence the green colour.

Both processes are important.  Without appropriate identification and authentication, fraud can occur.  Without data use or data sharing the transaction cannot achieve its purpose. 

The ‘Real Context’: Parties and Environments

I write ‘real context’, because the number of parties and the environment are where Identity ‘really happens’. 

The diagram above shows the inescapable two dimensions of Identity: the parties who are involved, and the place where they transact.  They are inescapable because this is how our world is organized.

For parties, there are 2-party and 3-party identity-based transactions.  2-party transactions are simply a person and an organization, while 3-party transactions involve a person, an organization that knows the person, and an organization that does not know the person.  3-party is the difficult situation of proving to someone, who has never met you, that you are who you claim to be.

The places are the obvious ones: the physical environment, communicating on the telephone, and the on-line world.  While these are obvious, each environment has quite different communication possibilities and, when combined with both 2-party and 3-party transactions, there is a lot of variety and complexity.

So, parties and place are the real context of Identity, and it is not a simple context.

Identity Performance

Given the context above, how well does Identity do?  Well, it’s not great.  In the diagram below, performance is shown using traffic light colours: green = good, orange = ok, red = bad.

The judgements above are mine.  I find that the only redeeming feature of identity is the availability of 2-party solutions.  If I think about ease of use for 2-party transactions, I find cards in a physical environment mostly good, answering 20 questions to identify myself on the telephone as painful, and the online experience as being excruciating, with check codes and the like varying service by service and, it seems, by the time of the day!  3-party ease of use is worse, and security and cost just do not look good anywhere.

Identity is not easy to use, Identity is not secure, and Identity is not cheap.  This is not good news.

Current Status of Markets and Technologies

So what is behind and in front of all this poor performance?

Well, we have established market segments of Identity (the top half of the above diagram), but these are somewhat eclectic having evolved in a series of near accidents.  For example, Know Your Customer only exists because of Anti-Money Laundering / Countering the Financing of Terrorism legislation.  These segments do not share common origins or common strengths, but do share common problems.

Notwithstanding the eclectic nature of the market, there are several enabling and developing Identity technologies that have strengths and potentials (the bottom part of the diagram above).  Not of all these will be successful, but one cannot doubt the power of such technologies as biometrics.  But, so far, they have not delivered a significant change in the performance of Identity. 

Identity Paradigms

It is relatively clear that Identity is used widely and is important, that Identity has a complex context, that Identity has performance issues, that the market is underdeveloped, and that many enabling and developing technologies are trying to solve the problem.

But to take the conversation forward, I need to both generalize and conceptualize.

My approach to conceptualizing Identity is the series of paradigms above.  Briefly, “knowledge” is simply knowing a secret, “documentation” is having some proof of identity, “technology” is our current malaise, “networking” utilizes the power of current identity hubs and current communications, and “decentralization” is an envisaged future technology-based Identity.

These paradigms do not occur in a strict sequence and they vary by country, industry and organization.  But they have evolved over time, so in a sense the world is adding more paradigms as it moves from left to right in the diagram above.

I see most of the planet firmly located in Identity 2 Technology.  We have been here a while and we do not seem to be moving anywhere fast.  Technology has ‘improved’ but, for the consumer, ease of use is going backwards.

The Challenge

The challenge is ‘what to do next?’.  Shall we grin and bear Identity 2?  No, that cannot be countenanced in an age of metaverse and web 3 - we must progress.  The challenge, as it is generally understood in the Identity world, is how to get from Identity 2 to Identity 3.  My position differs – Identity 3 cannot be achieved for a decade or two, so Identity 2.5 is the only way forward!  I’ll describe my reasons for such an outlandish statement in my next newsletter.

Regards

Alan

This is a bit late. Why - because I rewrote it twice. It is important so I hope it worked out!

The title of this newsletter is Identity Paradigms.  The aim is to indicate both where we are now and future possibilities.  This is not a roadmap, it is a list of paradigms.

But what is a paradigm? The word, made famous by Thomas Kuhn in 1962 in The Structure of Scientific Revolutions, depicts a theoretical movement or a way of working with a common basis. The best example are three paradigms from physics: Newtonian physics, relativity, and quantum mechanics. In these three paradigms of physics, the underlying theoretical basis changes hugely.

Identity is more practically focused, so the Identity paradigms are based on the underlying technology-basis.  This is the prime driver of Identity and supersedes any ideological or theoretical considerations.

Please note that:

1. These are generalized paradigms, not rigorous definitions. Use them to have efficient discussions. Do not treat them as defining principles.

2. The horizontal axis generally indicates progress through time, but it is clearly not linear and it varies by sector/industry/country.

3. The vertical axis is more reliable as it reflects how technology develops over time.

4. Each paradigm may include the use of other paradigms. There is no exclusivity in Identity! For example, many solutions/sectors currently in Identity 2 utilize components of Identity 0.

Identity 0 – Knowledge includes the oldest recorded use of an Identity technique when Odysseus returned from the Trojan War, over 3,000 years ago, and was identified by remembering a secret only he could know.  A more generalized knowledge technique is passwords and, as we all know, this age-old technique is alive and well today (well, maybe just alive).

Identity 1 – Documentation is also centuries old and has gone through numerous changes, from the use of seals, to watermarks, and now sophisticated technologies such as holograms.  However, with modern counterfeiting becoming more sophisticated and available to all, documents are no longer as secure as they once were.

Identity 2 – Technology is currently where most sectors are.  There are many varieties of technologies including hardware devices and software apps, techniques such as biometrics, full blown solutions such as behavioral analytics, and methods such as MFA (multi-factor authentication).  This is a lot to bundle into one Identity paradigm, but I do so because all these technologies have a common aim of mitigating Identity risk, especially in the on-line world.  Mitigation is the current arms race to keep ahead of the criminals.

It is worth noting the recent trend of Identity companies evolving to become ‘orchestration players’ often through mergers and acquisitions. These new entities combine multiple techniques, as they find that there is no single solution to the Identity problem (examples are Trulioo, Mitek, and Jumio).

Identity 2.5 – Networking doesn’t get its own whole number as it is essentially an extension of current Identity capabilities, but uses network effects.  The highest profile implementations are National Identity Systems in Scandinavia and Estonia which have one highly secure authentication method which is then networked out to other applications and processes.  They leverage high-quality databases, such as banks’ customer data, to raise the veracity of the total system, but a key component is the presence of a national identity number scheme that simplify integration challenges.

Identity 3 – Decentralization is a major technology step-change that would see Identity being based in decentralized assets held in the Internet and which would remove the reliance on centralized assets.  Blockchain has been seen as a major contributor to this effort, and there are significant standard associations, such as W3C, leading the decentralized push.  Decentralization has a certain ideological tinge to it, as it finds ‘big business’ to be as much the problem as the criminals who are trying to break down Identity.  While Decentralization promises much, it has yet to deliver any significant solutions.

Insights

• In Identity 2 Technology, the challenges of Identity are being met by ‘adding more’.  This is both by making specific methods more sophisticated and by combining methods.  The strategy can be summarized as ‘more complexity = more security’,  While this may mitigate security risk, it comes at the cost of more complexity for the user, as many of us experience every day. So this can be restated as ‘more complexity = poor customer experience = more security’. Who won out of that?

• Identity 2.5 Networking essentially uses current networking capabilities and current assets to achieve a more widespread adoption of some standard approaches to Identity.  The major success stories have been in codified law countries where intrenched use of national identifiers makes implementing solutions relatively straight-forward.  However, this does not mean that this paradigm cannot be implemented in common law countries.

• Identity 3 Decentralization promises to be a totally new beginning and to revolutionize identity.  If and when successful, it will be a revolution for not just Identity, but for Information Technology in general.  However the question is still ‘if’, and the lack of any identifiable solutions suggests that the promise may be beyond current capabilities.

What does this all mean?  Well, technology matters and technology is undecided: the performance of Identity 2 is a problem, the potential of Identity 2.5 is not well understood, and the viability of Identity 3 is uncertain.

The name of my newsletter, Identity 2.5, gives away which paradigm I think we should be aiming for.  In my next newsletter, the last in this initial series, I’ll elaborate on why Identity 2.5 is the future.

A final thought

As I reflect on this newsletter, it seems as though this is all somewhat self-evident. I hope you feel the same way and I have been able to create a simple set of paradigms that are intuitively obvious and that facilitate better conversations.

All the best

Alan

At last, in newsletter 7, we have arrived at technology. Most commentators start with technology because they hope it will be the answer - I started with defining the question in my early newsletters. Now, I am looking at the context of identity, which includes this newsletter’s technology building blocks for Identity. In the next newsletter I will look at possible futures, that is, at possible answers.

This newsletter’s title, Current & Developing Identity Technologies, states the obvious – we have both:

1. current technologies that enable Identity solutions (on the left in the diagram above)

2. developing technologies which promise to be ‘the answer’ to Identity (on the right in the diagram above)

In this newsletter I summarise each technology area and what it means for Identity.  But to start with, I will discuss the one technology that is fundamental to so much Identity: cryptography.

Cryptography

Symmetric and asymmetric cryptography (also called private key and public key cryptography) are core to Identity.  They are the basis of PINs on cards, secure communications, blockchain, decentralization, and many hardware solutions. Cryptography is how to keep things secret, and it is important, full of jargon, and complex.  If you want to develop a deep understand of Identity, you need to understand cryptography! But beware, it is a deep rabbit hole.

Current Technologies

Physical Identity

This is where so much identity has started.  Documents include passports and birth certificates.  Clearly passports have evolved significantly to include a chip.  Cards include driver’s licenses, student identity, club identity, and corporate identity.  These all have evolved with different uses of watermarks and tamperproof coatings.

Customer Databases

CRMs and their predecessors, accounts receivable systems, are a fundamental part of the Identity solution - they are where Personal Identity Information is stored!  

Hardware Tokens

There are a variety of devices such as dongles, challenge-response devices, and code-generating devices that operate in the on-line environment by connecting through a USB port. They can also generate codes for other environments.  They have obvious security benefits but suffer from the need to both distribute and maintain the devices, and from the challenge of interfacing with multiple platforms.

SSL

SSL, or Secure Sockets Layer, is something we all use on a daily basis.  And for good reason – it is the most important security protocol invented.  Based upon asymmetric and symmetric cryptography, it enables secure point to point on-line communications.  Without it, on-line Identity, and the internet itself, would be very compromised.

Messaging

The advent of multi-factor authentication (MFA) requires the customer to have something, often a smartphone.  The confirmation that the customer owns the smartphone or device is achieved normally through the entry of a code delivered through some messaging service, such as SMS or email.  Messaging is now an established technology used for Identity.

Biometrics

Biometrics has been with us for decades and is now becoming ubiquitous, due to face imaging and finger print readers on laptops/ PCs and smartphones.  It is now hard to imagine a world without biometrics. But it is far from complete, with developing standards, and threats from such things as AI generated deep-fakes. This is a technology that will be very important in the future, especially if it can be securely implemented.

New Technologies

Behavioural Analytics

Behavioral analytics is a development from big data that uses AI like techniques of data analysis.  It has utility for general analysis processes such as providing a credit rating for a future borrower, and for predicting if a payment is fraudulent.  For Identity, measures of physical behaviour (e.g. the pattern of typing) through to more long-term contextual events can be analysed by behavioural analytics to add an extra dimension to an Identity Authentication process. The question is: ‘is it worth it?’ Perhaps if we cannot develop good authentication we need such a backup solution, but it seems like a lot of technology to solve a simple problem.

FIDO Passkey

FIDO has long been based upon a Hardware Token, but on 5 May 2023 it announced with Microsoft, Google, and Apple an initiative to create a passkey to replace passwords.  This is based upon asymmetric cryptography and will potentially eradicate passwords, and thus password stuffing attacks.  It may also make customers dependent on a centralized passkey register run by you know who: Microsoft, Google, and Apple.  It all feels a bit centralized and big tech to me.  This will be the subject of a newsletter quite soon (as will all of these new technologies).

Digital Wallets

Some pundits think Digital Wallets will answer all our problems.  If they are secure, there is much potential to go beyond basic payment wallets such as Apple Pay and Google Pay, to a functional Identity Wallet.  The EU’s approach is to legislate an EU Identity Wallet into existence. Such an approach is risky, as it does not consider technical feasibility and indeed, one of the initial proposals, now taken down, did recognize the possible need for ‘hardware security’.  That little question of security on a consumer digital device is an important one and one that will come often.

Blockchain

Once the answer to all things digital, Blockchain still is a significant industry and cannot be counted out as at least part of an Identity solution.  The biggest challenge is that blockchain is a open, distributed ledger and such an approach is the antithesis of what Identity is trying to do – keep things private.  There are, of course, smart people who can find ways to make blockchain work differently, but why bother? If blockchain is not designed for privacy, why try to make it support privacy applications?

Decentralisation

Self-Sovereign Identity (SSI) was all the rage for a few years and the World Wide Web Consortium (W3C) has done a lot of work promoting decentralized standards.  The initial push from W3C was to create Decentralized Identifiers (DIDs) and the push is now to utilize Verified Credentials (VCs).  DIDs do not appear to have taken off, possibly due to that little problem of security on a consumer digital device.  If one was sceptical, one might suggest that the decentralization guys have given up on DIDs, and are now pursing the 2nd prize of VCs.  If so, fair enough, but while VCs are a proven technology, the practical use of them may cause more issues than the problems they solve.

Insights

There are multiple insights into technology:

• There are many diverse technologies – this is not a simple or a consistent field.  There are many diverse technologies that support Identity processes.

• Current technologies are enablers of poorly performing Identity - current technologies enable current Identity solutions, but as previously discussed in newsletters 4 and 5, current solutions perform poorly.

• Biometrics, a current technology, will develop further and will be important - intrinsically, because of its uniqueness-based authentication power, biometrics is a key part of the future of Identity.

• Developing technologies are technology driven, not functionality driven - there is nothing inherently wrong in a new technology approach of seeking new applications for a technology. But at some point in time, the technology’s suitability and practicality need to be questioned. In many of these developing technologies, such questions have not yet been raised.

• Many developing technologies are unproven - the inherent insecurity of a customer digital device has yet to be solved in a comprehensive manner.

So, there it is for current and developing technologies. Lots has happened and lots is happening, and some of it is good, and none of it is comprehensive, and some of it may not work at all.

Summary

This and the previous newsletter considered the broader context of Identity:

Together, Market Segments and Current & Developing Technologies show:

• a muddle of a market and

• technologies that under perform or are unproven.

I feel that we are in the uncomfortable stage of an evolution, a bit like the lyrics from a Stealers Wheel song: “Clowns to the left of me, Jokers to the right, here I am stuck in the middle with you”.

Regards

Alan

In the next two newsletters I’ll describe the overall landscape of Identity. Firstly, this newsletter considers the market segments of Identity. Then, the next newsletter considers enabling and developing Identity technologies.  I go into more detail here because there are many market segments – I hope you find the contextual knowledge useful.

Before I start, I want to mention the only other topology that I can find: Liminal’s comprehensive description of ‘everything identity’ – their Digital Identity Landscape (https://liminal.co/liminal-landscape-honeycomb/).  The people at Liminal have some great IP they willingly share and have been maintaining their Digital Identity Landscape for five years.  While their landscape is very comprehensive, it is much more than I am looking for, hence I have taken a much simpler approach:

Analysis

Identity and Access Management (IAM) is the solution for corporates to enable their employees to access corporate systems.  I use the term IAM to include two other popular segments: Identity Governance Administration (IGA) and Privileged Access Management (PAM).

The need for a corporate single sign-on has been with us for decades and was initially supported, to varying degrees, by the bigger IT providers such as Microsoft, IBM, and CA (now Broadcom). It is now supported by a new breed of providers, including cloud platforms such as AWS and Azure, and a series of pure plays including Okta, One Identity, One Login, and three entities acquired by private equity firm, Thoma Bravo, in 2022: SailPoint, Ping, and ForgeRock.  Okta, before the acquisitions, was the largest player and has a current valuation of $US 12b.

It is worth noting that IAM focuses on on-line Identity, that it is highly specialized, that it is a mix of old and new, and there is a lot of money involved!

Social Media Identity (SMI) is a sector that includes both the social media platforms (Facebook, Instagram, TikTok, Twitter etc), but also the identity hubs that can be used to log onto ‘other’ social media (Google, Apple, Facebook, Twitter, Microsoft).  This is a form of federated Identity and it is enabled through protocols such as OAuth, OpenID Connect, and SAML (note that these protocols may also be used in IAM).

Social Media Identity works in the on-line world only, has 4.7 billion users, and the most special aspect of it is that most of the identities are unverified.  It is quite astounding!  The biggest databases of identities on the planet are totally unverified!

Obviously Eion Musk found this problematic, and I certainly was very keen to understand how he was going to verify all Twitter tweeters!  Unfortunately that seems to be no longer the case!  Where this all ends is anyone’s guess, but suffice to say Social Media Identity, with an estimated 4.7 billion users, is large and hence cannot be ignored.

Know Your Customer (KYC) probably would not exist if it were not for Osama Bin Laden and 9/11.  Most countries now have Anti-Money Laundering laws that require organizations to perform KYC due diligence.  KYC tends to be an on-line service that is based on document proofing and some form of liveness detection.

In Aotearoa New Zealand, we have seven such players that specialize in the local market, while major international operations exist, such as Acuant, Jumio, Trulioo, Onfido, and Prove.  The KYC sector may have the opportunity to evolve to into Identity hubs, but as yet, none has made that claim.  Perhaps they all prefer to repeat the KYC exercise, and gain revenue, rather than to attempt to create a cheaper reusable solution.

I include Identity Hubs (IHs) because they exist after a fashion.  Normally based around a smartphone wallet, they aim to create a database with a critical mass of voluntary customers and then exploit this by inviting third parties to join their party and have easy access to customers’ Personal Identity Information (always with the consent of the customer).  One of the highest profile players is a UK-based firm called Yoti.  I say they exist after a fashion because building a critical mass of users is not easy and is yet to be achieved in a significant fashion. Thus IH has not become an established sector in the way KYC has, but it is active and may be a major sector in the future.

It is easy to forget Government Issued Documents (GIDs), but they are still a fundamental element in every country’s management of Identity.  Where would we be without our passports and driver’s licenses? 

Most countries now have some form of Government On-line Services (GOSs).  These have varying degrees of functionality and quality, and often identity exists in silos.  A major initiative for many governments has been to consolidate all the departmental silos into a single signon for government.

For Aotearoa New Zealand, this is an identity service called RealMe that uses a basic username/password identity process, and that has had limited success due to limited take up by government departments and a complex onboarding process.

The UK launched GOV.UK Verify in 2016 and after spending a couple of hundred million pounds on it, are turning it off in December 2023.  I hope their proposed One Login for Government solution goes better!  GOS is not at all easy to achieve, as experience has shown.

National Identity Schemes (NISs) operate most easily in countries with national identity numbers, notably the Scandinavian countries and Estonia.  These countries have long histories using these solutions, with the Scandinavian countries utilizing the inherent security in their banking systems to create the BankID solution, and Estonia having a more bespoke solution.

These provide secure identification and authentication of a user, and they can be federated, with a variety of solutions including Government On-line Services and corporate solutions.

International Passports (IPs) is, of course, our one true international identity scheme.  It has evolved from being a paper-document based solution to being chip-based using specific hardware in specific locations.  No doubt it will evolve further in the future.

Customer Identity Solutions (CISs).  CIS solutions are probably the most numerous and most varied of all Identity solutions.  From legacy solutions to modern e-commerce businesses, there are a myriad of technologies that save and maintain identity information.  The functionality is similar to, but also different from that required for IAM.  However, the IAM vendors see the opportunity and are now promoting Customer IAM (CIAM).  However, given that CIAM is associated with a group of IAM vendors, I call this sector CIS as this is more general and reflects that many CISs are bespoke solutions.    

Insights

So, what insights do we have into the landscape I pictured above and repeat here?

Well, there are some structural insights:

• Corporate Identity and General Identity are different. While there are crossovers, IAM has a very specific focus on protecting and providing employee access to online corporate solutions, whereas General Identity is much broader.

• Identity is about individuals, not organizations – in most, if not all countries, individuals and organizations are legal identities. But Identity focuses on the person, not the organization.  In order to represent organizations, individuals have credentials allowing them to do so.

And, more importantly, there are strategic insights:

• Identity has many varieties – there are multiple colours used above for a reason - these solutions are very different. We do not have common solutions, such as are found in Payments. Do you remember my definition of Identity being Identification / Authentication and Date Use / Data Sharing?  I expect that the lack of common solutions is because the variety of Data Use/Data Sharing uses has led to multiple solution types, even though the basics of Identification / Authentication are common. In other words, because we lack a common approach to Data Use / Data Sharing we have developed many types of industry solutions.

• Identity has simply evolved. Without a dominating technology or design, Identity has just simply evolved.  Compared to Payments which has evolved along technology lines, Identity development has been driven by other external factors (e.g. KYC with AML).

So, that’s it. A bit of a muddle in a puddle really.

Regards

Alan

In the previous newsletter I discussed 2-party Identity, the top row of the matrix below:

In this newsletter, I look at 3-party Identity, the bottom row of the matrix above.

The 3-party challenge

The really hard thing to do in 3-party Identity is identifying yourself to an organization that does not know you.  You, the first party, have an identity held by a second party and you want to provide that identify to a third party who has no idea who you are.

Ponder for a moment how unusual this is in the world of ICT. How often are we designing processes for something we cannot directly verify?

This is challenging, so it is not surprising that we do not have many solutions. So this newsletter simply highlights a few of the solutions, however secure or insecure, that are currently identifiable.

The example above for in-person is the use of Verifiable Credentials like Aotearoa New Zealand’s Covid passport.  The individual (first party) shows their Covid status (provided by the second party, the Health Department) to the café (the third party). This solution served a useful purpose: ensuring some compliance with Covid regulations. But it is not secure, so it is highly unlikely to be a long-term solution (more on that in a later newsletter).

In-person was initially based on and is still largely based on documents.  The best known, and the one that works, is the closed system of passports.  Other photo IDs, like driver’s licenses, sort of work sort too! But they also promote a counterfeit card industry!

On-telephone 3-party Identity processes do not exist!  At least, I have not identified any Identity process through which I can identify myself on the telephone to an organization who does not know me.  If you know of any, please let me know.

Due to the inherent insecurity of On-line Identity there are few examples. The most noteworthy is the nascent know your customer (KYC) industry, where individuals present a number of credentials and biometric information which are proofed to establish identity.  The driver for KYC, Anti-Money Laundering legislation, is a legal requirement, so ease of use is not a high priority and a low cost is not essential.

There are other on-line solutions that I know of.  In New Zealand Aotearoa, we have a Direct Debit payment capability.  When set up, a payment request is generated on the customer’s behalf by the third party – it works quite well, but the setup is totally insecure.  A second example is creating a connection between a bank and the Xero accounting platform by tunnelling – while secure, this is a very specific solution for a very specific problem.

I want to make three observations that reveal a lot about 3-party identity:

1. 3-party is underdeveloped.  While there are some very important uses, three party identity just has not advanced.  The furthest we have got is automating the checking of documents, which is not actually very far.

2. 3-party is hard.  This should come as no surprise – identifying yourself to an organization who does not know you is just not that easy when we do not have any general capabilities for Identity.  Note that this is not necessarily true for Scandinavian countries!  Hmmn, something to ponder there.

3. 3-party may become very important.  You might suggest that 3-party is not that important, otherwise we would have developed solutions.  I take a contrary view and suggest that 3-party Identity is fundamental now, and that future developments, such as open banking and Customer Data Right, will rely heavily in 3-party Identity.  I think that has already been borne out by the need for enduring consent, a form of Identity, that has been key to the development, or lack of development, of open banking in Aotearoa New Zealand.

3-party performance

I’ve added a similar analysis for 3-party performance as I did for 2-party performance (note that for on-telephone,, with no solutions there are measures of three of the performance measures): 

The opinions below are based on very few examples but it is difficult to find any 3-party solution that gets a green light!

1. We have few available solutions.

2. Ease of use is poor.  Few solutions we have are easy to use, other than those that lack security or are supported by closed systems.

3. Security is generally poor.

4. Costs are high.

Summarizing

So, in the last two newsletters I have covered 2-party and 3-party Identity processes in three environments. It shows lots of different methods:

My objective has been to measure the overall performance of Identity and my reading of the situation in the previous newsletter and in this newsletter is:

This is primarily a sea of red - performance is poor.

And so what? Well, given that Identity is a significant societal process, surely this is something we should be focused on!

Societies’ investment deficits in public infrastructure are now observable in broken water supplies, inadequate flood protections, road inadequacies etc. Deficits in Identity investment is harder to observe but it is equally real and just as important.

In the next few newsletters I’ll start looking at our options to turn this around.

Regards

Alan

I present my answer to the “how good is the performance of Identity” question in the next two newsletters. Each newsletter corresponds to a separate row in the 2x3 matrix below:

The above matrix is based on the two fundamental dimensions, parties and place, introduced in the previous newsletter. This newsletter considers the first row, 2-party performance, and the next newsletter will consider the second row, 3-party performance.

Remember two points from the previous newsletter

• 2-party transactions are 99% of all Identity processes performed

• 3-party transactions are only 1% and they are the hard bit we are yet to solve

So this newsletter is about the performance of every-day 2-party Identity processes within the three environments.

I’m giving you a large amount of information, but as Identity has so many levels of complexity this is unavoidable. Please stick with it - the conclusions are worth noting.

Examples and Observations

You will all know lots of examples of 2-party transactions.  These transactions are between you (the first party) and an organization that knows you (the second party).  I go to the library to borrow a book and I identify myself with a library card, I ring an energy retailer to check how much power I am using and first identify myself by answering a series of credential and account questions, and lastly I use on-line banking to transfer funds once I have signed in using a username and password. 

These are absolutely straightforward and you will know many different varieties of using a plastic card in-person, answering questions on-telephone, and signing in on-line.  Some observations:

• In-Person transactions often utilise plastic cards and have been around a long time.  Do you remember the times when you signed up for some service, and almost immediately a card arrived in the mail?  I’m not sure if they were anything more than a marketing device, and we see less of them now as on-line becomes the communication channel of choice.  But they still have utility (I use my golf club card at both my club and other clubs), to show identity but often they lack authentication capabilities.

• For On-telephone I dread the 20 questions I get asked when talking to a person.  I think the person dreads it too.  Frustration leads to fear and then to anger: “how do you expect me to remember my last transaction?”  While the fraud levels for on-telephone are hard to gauge, it cannot be cheap to continually train staff to execute such a process.  No wonder so many corporates want to hide their contact details!

• On-line, on-line, on-line.  Oh dear, oh dear, oh dear.  Please, please, please somebody invent something that works better than this.  I assume I am not the only one regularly told by Google that all my passwords need to be changed.  I assume I am not the only one who is forced to become an expert in the different ways that programmers code identity interfaces.  Please, please, please make it better.

I want to make two observations that reveal a lot about 2-party identity:

1. Each environment - in-person, on-telephone, on-line - has its own method.  This is important for multiple reasons.  Maintainability and cost are obvious issues - having to support 3 methods is not fun!  But it is not fun for the customer either, having to remember three methods!

2. Within each environment, there are many varying implementations of each method.  Poor us!  Compared to payments, which is relatively simple, Identity is a minefield.  And I have been around for a while – I have grey hair, really, truthfully.  And it drives me crazy, so what is it like for the technologically-challenged person?  Can we just agree a password standard, please?

Think about it - compare Identity to payments. 

2-Party Performance

I am going to give you my unashamedly opinionated view of 2-party Identity performance. I have not done, nor is it possible or practical to do, a survey of all 2-party Identity processes! Appalling, I know, in a world that lives off statistics (however dubious and concocted). I’ll stick to my personal judgment and I ask you to make your own judgements too.

I split performance into four questions:

1. Availability - is there an identity process?

2. Ease of Use - can we use it?

3. Security - is it secure?

4. Cost - how much does it cost to run?

The diagram above summarises my opinion. Specifically:

• We have a lot of available solutions - a tick there!

• In-person works ok and we know maintaining card bases is expensive

• On-telephone works in a fashion but is unlikely to be full secure or cheap

• Online is a dogs breakfast, a cot case…

• Ease of use is highly variable.  Cards work ok, 20 questions is painful, and on-line can be agonizing.

• Security is not great.  It is hard to defend the record of current 2-party Identity with all the reports of Identity fraud.

• Costs are high. No rocket science required here - multiple methods and continual enhancements to keep up with the arms race cannot be cheap.

2-party Performance Summary

There is little good 2-party identity news - just questions of quality, security, and cost!

2-party Identity looks a bit like the Neanderthals – evolution has not been kind to it! 

What do you think?

In the next newsletter, I’ll consider the much rarer 3-party Identity processes, before then moving on to some interesting futures.

Regards

Alan

Identity discussions require agreed fundamental terms.  We lack such fundamentals, so currently we lack coherent discussion.  I mean it – we lack the very basic concepts and hence this is why this newsletter is required.

We have a lot of esoteric generalizations – does anyone want to discuss ‘trust’ or ‘consent’ for a week or month or year… Such scenarios are not uncommon in the ICT industry that often sells vapourware.

So in these newsletter I aim to redress this problem and my starting point is real-world situations of the parties involved in Identity and the places of Identity.  Now this might not appear to be radical, but I promise you that my straightforward approach is not the norm! 

But first, read this

Organizations own our identity profiles. And the privacy laws, that most countries have, give the individual rights over that information and the holders obligations of care.

QED. That is how it is.

Decades of human rights development has morphed into individual rights which has help drive a preoccupation in the Identity world with something called self sovereignty. This is a noble concept but it is not the current reality of Identity.

Organizations own identity, individuals have rights over identity, and organizations have obligations for identity. This will become important in the next paragraph!

Parties

The parties to Identity processes are:

• people – individuals like you and me

• organizations – companies, government departments, clubs etc

For an Identity process to be meaningful, the number of parties must be two or more.  I consider 2-party and 3-party transactions only.  While transactions may exist with 4 or more parties, they are rare and adequately covered by considering 3-party transactions.

2-party transactions

2-party transactions involve a person and an organization.  Here are two examples:

An individual has an account with a bank and an individual has a relationship with a theatre. In the first, a person does a transaction, such as check balance. In the second, a person creates and updates a profile that generates reminders to up-coming performances.

These 2-party transactions look mundane, and they are, and they are prevalent - we use 2-party transactions every day. They are likely to be 99% of all identity processes performed.

3-party transactions

3-party transactions involve a person and two entities. Here are two examples:

In the first, example, a person is using a credential from the Health Department to prove their Covid status to gain into a café. In the second, a customer of a co-operative is purchasing from a ‘participating merchant’ co-operative account.  In both examples, the third parties (the café and merchant) do not know the person.

And so?

Well please note two things. Firstly, these identity processes are inherently difficult! There is nothing easy about authenticating an individual who you do not know and have no information about.

Secondly, while 2-party transactions are prevalent, 3-party transactions may be quite important in the future.  The Covid example is clear. Other examples of 3-party transactions, such as ‘know your customer’ transactions are becoming ubiquitous. As we become more connected and develop more complex relationships, 3-party identity will become an essential transaction within society.

There is quite a lot in these simple diagrams.

Place

Not surprising, the place that transactions happen is fundamental to Identity, and requires some clear distinctions:

• environment - where parties transact (in-person, on-telephone, and on-line)

• channel - communication methods we use to interact (verbal, visual, and digital)

A transaction will occur in one environment, say on-line, and may use a number of channels such as a web-interface and a smartphone.

Environment is where it is all happening.  It is the primary medium for communication. It has three principle varieties, in-person, on-telephone, and on-line, and each has its own unique characteristics, limitations, and challenges.

This is important. Identity is used in three fundamentally different environments. It is not so surprising that identity is difficult and underdeveloped.

Payments, mentioned in a previous newsletter, has similar complexity to Identity in this respect, but the seemingly historical accident of credit card risk mitigation (i.e. someone pays extra) makes them useable in multiple environments.  Identity is not that lucky!

Summary

The two dimensions I have defined, number of parties and environments, are not the standard topics of discussion with the world of Digital Identity which has, naturally, an on-line bias. Given the planet’s history with Covid, this is surprising as in-person is clearly important!

What I am writing about in these newsletters is Identity in all its forms and if one is considering Identity holistically, you need some framework to consider all alternatives.

This is what I have created and I’ll use this framework in the next newsletter to show some examples of the Identity and to critique current implementations.  It should be relatively easy to guess what the answer is!

Regards

Alan

Not a very enticing title I know!  As my previous newsletter suggested, Identity is used in many ways in society and there is always an explicit purpose.  That is, you do a transaction for a reason.  And the reason will likely affect the type of Identity processes required.

So it makes sense to consider Identity as part of the bigger transaction picture and not to simply focus on Identity processes.  That is, solving Identity requires a holistic understanding of how Identity is part of transactions.  So here is my take on transactions themselves, and specifically Identity-based transactions.

Transactions

Firstly, transactions vary in ‘complexity’.  Transactions can be complex - buying a house or opening a bank account.  And transactions can be simple - buying an ice cream or buying a newspaper. 

Secondly, there is one primary distinction between anonymous transactions and identity-based transactions:

Anonymous transactions - these could also be called identity-less transactions.  This is when you never need to identify or authenticate yourself.  Often this is because you pay by cash when purchasing.  We have lots of these transactions because we are an open society in which we are not continually monitored.  I will not mention anonymous transactions again in these newsletters as they have no relevance for Identity.

Identity-based transactions - identity-processes occur within a transaction for reasons of utility and legal compliance.  I term such transactions as identity-based transactions, as the whole basis of the transaction relies on the resolution of identity processes.

Identity-Based Transactions

The above is relatively straightforward, but then comes some subtlety in the two varieties of identity-based transactions.

Named identity-based transactions – these transactions are done ‘in the name of’ a person.  Either a person accesses something associated with their name, or a recipient of the transactions learns who the person is.  Think of signing onto a banking website and applying for a driving license.  In these cases the person wants their personal information to be shared with the recipient.

Nameless identity-based transactions – in these transactions the recipient should never learn who the person is.  Think of proving your covid-status or age when entering a bar— the bar should never know who you are. 

Some commentators will use the term anonymous to indicate nameless identity-based transactions.  This is confusing as these transactions are anonymous with the recipient, but they pertain to a person and require authentication, hence I use the unambiguous term: “nameless identity-based transactions”.

What is important to remember is that both named and nameless identity-based transactions will require a person to be identified and authenticated.  It is key to remember that a nameless Identity-based transaction still requires Identity processes of identification and authentication.

Identity Processes

In the above brief discussion of transactions I introduced the two sides of identity processes (I use the term ‘process’ subserviently to the term ‘transaction’).

There are two sides of identity-based processes:

1. The left-hand side is the ‘proving who you are’ bit, achieved through identifying ourselves and authenticating ourselves. The quality of these steps will, of course, vary, but this is where Identity starts. And rarely, if ever, do we execute an Identity process without a purpose, which is where the right-hand side comes in.

2. The right-hand side is the ‘what we want to do’ bit, achieved through either Data Use or Data Sharing. Data Use is checking credentials for an authority to act, and Data Sharing is using data for such processes as opening an account. These two themes, of proving who you are and a follow-up action based on data, will run through these newsletters.

These two sides of identity processes are core to identity-based transactions.  They are configured in different ways to achieve different transactional objectives.

Looks trivial?  It’s not - believe me, there is a lot in the basic concepts above.

Is this definition important?

100% yes:

• Firstly, Identity is thoroughly underdeveloped at present (e.g. compared to Payments), so we need clear definitions, and the above is as about as unambiguous as it can be.

• Secondly, my definition is focused on the actual steps of identity processes, that is: it is pragmatic. There are no wishy-washy ideological statements here about trust and self-sovereignty - just some concepts that are easily understood and debated.

• And thirdly, the structure is a theme that goes through all my work.

In summary

In newsletter one, I established that Identity is important for society.  This newsletter, newsletter two, takes the first step in describing some basic terminology to help us discuss Identity.  This terminology includes Identity-based transactions (named and nameless) and identity processes (identification and authentication, data use or data sharing).  With this established, in the next newsletter, newsletter three - Identity Fundamentals, I describe further refinements of my view of identity processes.

All the best

Alan

Identity is really important. I mean REALLY important.  In this newsletter, I describe Identity in a ‘societal sense’ and analyse how identity processes exist within society.  And the answer is, of course, that Identity exists all over the place, that it is really important, and that at first glance, Identity is not great.

A warning – this analysis appears simplistic, and it is absolutely simple.  But the underlying ideas and concepts are not just simple; they have a degree of profundity that needs to be understood if Identity is to be approached at the right level and treated with appropriate concern.

My analysis has two dimensions, what we do and who we interact with, followed by a comparison of Identity with other processes.

What people do

My first dimension is simply to define a series of activities that people do.

I have simply gone through all the places I can image myself or others being, and listed all the gerunds that spring to mind.

Identity plays a big part in many of these activities.  Out of the house there is a need or an opportunity to identify ourselves when travelling, working, shopping, learning, and playing.  No matter where we are, we frequently need to identify ourselves when managing and conversing.  Identity is a widespread phenomenon.

I speculate that Identity is becoming and will become more widespread.  Covid has demonstrated, hopefully temporarily, the need for people to identify themselves when their activities are in a public space.  We can also see a societal tendency to digitize more of our daily lives which gives us the opportunity to identify ourselves more often, and also for others to impose an identity requirement on us.  Examples are age verification at a supermarket and ‘know your customer’ processes at a lawyer’s office.

Who we interact with

My second dimension, entities, is a diverse list and shows that Identity processes interact with a wide variety of parties:

Identity is more than accessing our bank – we use it with all sorts of entities.  

So Identity is really important

Give yourself a moment to consider the above two dimensions.

There is nothing radical in these dimensions, but they illuminate that the scope and variations within Identity are huge.  So, Identity, used in many activities and with many entities, is fundamental to society.  Identity really is important, and Identity is really important.

And Identity does not perform well

So, how well does this very important Identity do?  To make this judgement I compare Identity to other core societal processes:

Society has very efficient ordering, fulfilment, and payment processes, and an Identity process that is average at best (I’ll get into the detail in a later newsletter).  To illustrate the failings of Identity, I compare it to Payments (I capitalize both Identity and Payments when I am using the terms to mean the structures, industry, processes, and behaviours that we see coming under these general terms).

Payments is clearly successful and Payments is developed! Payments has existed for millennia and has evolved significantly in the last 50 years with the advent of various technology-supported payments methods such as cards, EMV chips, Eftpos, and overnight banking.  And Payments is a global phenomenon with global standards and is supported by a banking industry.

In comparison, Identity seems to have bred a mishmash of high-variety methods and implementations.  While there are many wannabee standards, in practice there are only a few operational standards supporting federated identity (0Auth etc), and there is no established Identity industry.  Whichever way you look at it, Identity is underdeveloped compared to Payments.

Wrapping up

It is a risk starting a series of newsletters with such a high-level view, but I did it because I want to stress that Identity is important for society and I wanted to establish early on that Identity is not doing so well just now.

In the next few newsletters I’ll establish frameworks to be able to analyse Identity in more detail, that is, to go beyond the high level-statements made in this newsletter.

All the best and thanks for reading so far.

Regards

Alan Mayo

An introduction to the topic

This initial series of ten newsletters establish a practical context of Identity.  The aim is to present ideas and concepts that align with current reality, and not to promote high-level daydreaming and techno mumbo-jumbo.

Unlike other ‘primers’ that present the status quo of Identity thinking, these newsletters are an advance.  They present a different and more sophisticated way of describing and analyzing Identity.  Hence, do not skim, but if you must, go to the final newsletter: Identity in a Nutshell.

In this initial series of newsletters, I’ll take you on a journey from the fundamentals of Identity to the failures of Identity, and to the options for Identity.  The latter is presented as a series of paradigms, one of which is Identity 2.5.

Following these initial ten newsletters, I present a series of more contentious newsletters in which I:

• justify why Identity 2.5 is the future,

• critique many Identity proposals and developments, and

• add more in-depth conceptual models of Identity.

This newsletter

In this introductory newsletter I describe:

• how I use the term Identity,

• the structure of my initial strategic analysis, and

• contextual issues that influence my approach.

So how do I use the term “Identity”?

One of the great talents of human beings is their ability to generalize.  These abilities enable advanced health care, technology, and space travel.  One of the great weaknesses of human beings is their ability to confuse each other through generalizations.  These weaknesses contribute to wars, extremism, nuclear threats and global warming.

And I will start with a generalization!  But I will define how I use it!

I use the capitalized term “Identity” in a general sense to represent ‘the whole gamut of things identity’: the industry, processes, concepts and designs, protocols, solutions, technologies, and uses.  I use the term Identity in a similar way that people talk about Payments.

I will use the word “identity” often, both as a noun as in ‘a person’s identity’ and as an adjective as in ‘an identity process’.

My initial strategic analysis in ten newsletters

That was short and sweet, but analyzing those very simply concepts will not be so easy. My initial strategic analysis of Identity is delivered in ten newsletters (0-9):

These ten newsletters will take us a long way, at least to a point where we agree or disagree on where Identity is, and where it might go.  The journey is worth the effort, I promise.

Read This First

Well not quite first, but there is some specific context about my approach to Identity that I want to make clear in the beginning.

1.     This is about Identity, not Digital Identity!  This is not technology!  This is not just about the Internet!  This is about Identity in all its forms based upon the premise that we need Identity for people, not Digital Identity for technologists. 

2.     My immediate context is Aotearoa New Zealand, which is a ‘common law’ country without a national identifier.  In that respect Aotearoa New Zealand is similar to Australia, Canada, the USA, the UK, and Ireland, so many of my insights will apply to those jurisdictions too.

3.     I will also draw on examples and knowledge from ‘codified law’ countries with national identifiers, especially the Scandinavian countries and Estonia (an Identity leader).  Having lived in Sweden for many years, I have some knowledge of how Identity works there, and even though such examples are not directly transferable to a common law country context, there is much to be learnt and appreciated from considering them.

So that’s the start, hope to see you again.

Regards

Alan