Thread by @Steve_Lockstep

@Jo_Plays @bhaines0 @IdentityHutch @WomeninID @dgwbirch @windley @IdentityWoman @Libra_ What makes digital identity (call it "ID" here) so hard?

1. There's a always been this strong drive to make ID reusable, to reduce on-boarding friction, reduce accounts & passwords, save cost, even make money. -/2

@Jo_Plays @bhaines0 @IdentityHutch @WomeninID @dgwbirch @windley @IdentityWoman @Libra_ 2. Most ID initiatives (especially Federated Identity) are based on something of a false intuition. We look in our purses and see dozens of identities that all seem the same. -/3

[I'm dropping all @'s now to avoid annoying people]

3. I have dozens of cards and accounts all labeled "Steve Wilson" and it seems redundant. Can't I boil them down to one? No, they're really not the same identity. Each is a different relationship. -/4

4. Digital Identity is highly context dependent. Steve Wilson at work is not the same Steve Wilson in hospital, or in social media, or in the tax system, or in any of my many bank accounts. -/5

5. My theory is that identities evolve in a literally Darwinian manner to fit different risk profiles, or *niches* in business / government / mercantile / services ecosystems. -/6

papers.ssrn.com/sol3/papers.cf…

6. Each identity is an ensemble of technologies, rules, form factors, interfaces etc. adapted and specialised, like species. Federating identity across domains (e.g. from banking into healthcare) is like taking a saltwater fish and dropping it into a fresh water pond. -/7

7. Federated Identity stalls because it fundamentally changes the way Relying Parties manage risk. No free market scheme has ever worked out liability when an "Identity Provider" has its assertions consumed in transactions it has no control over. -/8

8. No free-market Identity Federation (as attempted in the US, UK, AU, NZ) has ever succeeded at "LOA 3" or "LOA 4" without legislation. -/9

9. A bit of an exception is the Canadian Concierge system which works across Govt, Banks and Telcos. I am not sure however that it will continue to federate beyond the founding IdPs which retain control over the rules. As they should. -/10

10. So digital identity is not what it seems from looking simply at names. Each identity is the surface of a complex relationship, at the core of which is identification *done by the Relying Party* of the Subject. lockstep.com.au/blog/2012/08/2… -/11

11. Identity resists federation because the things that need to be known in detail about a Subject vary from one RP to another. The identification needs of all RPs cannot be standardized outside of narrowly defined spaces like banking KYC rules. -/12

12. Counter-intuitively, identity is really created by Relying Parties, for it is RPs that do the actual identification. There are no "IdPs" as imagined by conventional Digital Identity frameworks. Identity is just not a good that can be "provided". -/13
lockstep.com.au/blog/2015/10/2…

13/13. And finally @Jo_Plays, #blockchain changes none of that.