Tracking the tools that decentralize the media. tools process ideas resources eventsav

unmediated

 

May 06, 2005

The creation of authentication systems is a major industry. Stephen Downes argues in his paper on 'Authentication and Identification' that we we don't need authentication, that authentication won't work, and that people don't want it.

Though the development of authentication systems will no doubt continue to be a source of considerable churn and considerable investment in the near future, Downes states that it should be evident that authentication is (a) not necessary, (b) won't work, and (c) is not desired and raises the questions What will work? What do people want? Stephen pleads for 'the need of a mechanism for self-identification, where clear and unambiguous control is placed in the user's hands, a mechanism that enables the user to declare to every site (or none, if that's their choice), "I am me!" And a way to do this automatically, unambiguously, with as little effort as possible'.

Authentication won't work because no system of authentication provides any more security than a system of self-identification. Authentication will not work at all unless it is tied to a proxy, the identity of which can be established online, which means that the security of the authentication is no greater than the value of the proxy to the user. With cheap computation, computers on a USB (reference is out there somewhere), disposable telephones, e-paper, and more just beyond the horizon, it seems clear than the value of the physical asset to which authentication is being tied will continue to decline, at which point authentication will provide no disincentive against misrepresentation of identity whatsoever. Authentication is useless if not tied to the person, and can be tied to the person only with the compliance of the person, which in effect reduces it to self-identification.

not desired because authentication essentially involves the transfer of control over one's own identity from oneself to a service provider or identity broker, and as a consequence, enables the breach of the user's security and privacy whenever it is in the interests of that service provider or broker to do so. It moreover undermines the individual's fundamental right to determine and express who they are.

Part two of Stephen Downs series on identity is 'mIDm - Self-Identification the World Wide Web'. In it Stephen explains how a system of self-identification would work.


Originally posted by Gerrit Visser from Eyebeam reBlog, remediated by yatta on May 6, 2005 at 12:09 AM