News/Blog

Information Cards can Authenticate Online Petitioners While Protecting Anonymity

• In 1215, King John signed the Magna Carta, which recognized the right of the barons to petition the crown.
• In 1775 Thomas Paine wrote in Common Sense that "... frequent interchange ...between the electors and the elected ... will establish a common interest with every part of the community ... they will mutually and naturally support each other, and on this depends the strength of government, and the happiness of the governed."
• By 1789, Founders of the United States embedded the right to petition into the Constitution in the First Amendment: "Congress shall make no law ... abridging ... the right of the people ... to petition the Government for a redress of grievances."

Today petitioning has become an instrument of mass politics, designed to make a point, not a plea. To quote the First Amendment Center:

"Petitioning" has come to signify any nonviolent, legal means of encouraging or disapproving government action. The direct appeal and individualized response that once marked petitioning belong to a more organic past when leaders knew petitioners by name. No branch of the government today is equipped to provide such personal attention.

Sites like The Petition Site provide tools to create online petitions, but you need to fill out the usual form -- name, address, etc. Not only is this work, but by signing a petition, you may create a record that you later regret. To avoid this, you might choose to enter a false address (Beverly Hills 90210). Verifying signatories of an online petition is a laborious and lengthy process.

Sara Peters wrote a great article about how Information Cards are awesome and furthermore, how flawed SSNs are, since no one, not even the Social Security Administration, can verify that your SSN belongs to you.

But do Information Cards have a fatal flaw? Are they secure? Do they live on your computer? Are they portable? Can your information cards be stolen? Even if you are downloading managed cards verified from a trusted identity provider, are they giving you something that you can lose or can be stolen?

The Information Card Foundation was formed by a community of thoughtful Internet architects and developers whose primary objective is to provide us all with the tools to control our personal information in a safe secure manner. This is not an easy task. But to make it easy for the end user, the core of the design was a user ceremony we are all familiar with -- cards. The digital equivalent of the pieces of paper and plastic we carry around in our purses or wallets -- driver's license, library card, etc.

But what do digital cards really mean? As usual, it is just an analogy. Think about e-mail -- it is usually delivered much faster than postal mail, so much so that the latter is now often referred to as 'snail mail'. Or think about your computer's 'desktop' Well, it's sort of like a desktop, but it has these other cool features like organizing tools, deleting or storing files, changeable backgrounds, etc. So it is much more than a physical desktop, yet if the architects that created the Macintosh had not chosen such a simple, understandable metaphor, early users would have been confused.

The prospect of digital identity working at Internet scale—and Internet strength—has occupied the attention of many in the industry for the better part of a decade. Perhaps that should come as no surprise—cross-domain authentication and authorization has long been one of the thorniest problems in networking. Blow it up to Internet size—and add the Internet’s staggering diversity—and even Don Quixote might start looking for a more possible dream.

Yet twice before the Net has beaten such interoperability odds. It owes its very existence to a no-frills internetworking protocol—TCP/IP—emerging from a thick protocol soup to become a lingua franca of packets. Less than two decades later another minimalist approach—HTML—turned the universe of information into a World Wide Web by giving us a universal way to link content.Could there be a hat trick for the Internet identity layer? And if so, what’s under the hat?

When I first started reading about Information Cards in Kim Cameron’s blog posts in 2004, it was a disarmingly simple metaphor: no more than the online equivalent of the cards we carry in our wallets to prove our identity and use for transactions every day. Could such electronic cards really be the key to an “identity metasystem” that can bridge security and privacy domains the same way Web pages bridged content domains?

SPECIAL TO RSA-San Francisco-April 20, 2009-At the RSA Security conference beginning today at the Moscone Center in San Francisco, the Information Card Foundation (ICF) announced publication of a new white paper on Information Cards by noted industry analyst Craig Burton. The Information Card Ecosystem: The Fundamental Leap from Cookies and Passwords to Cards and Selectors explains why the Information Card metaphor is being recognized across the industry as the future of digital identity both in the enterprise and on the Internet.

"This is the first analysis of digital identity that explains why Information Cards are an inevitable next step in the evolution of relationships on the Internet, just as cookies were in the 1990's," said Mr. Burton, principal analyst at Burtonian and former CTO of Novell. "Cookies solved the problem of how a user could share information across the pages of the same website. For example, without them, e-commerce shopping carts would not work. Information Cards solve the next wider problem: how a user can safely share private information across completely different websites of their choosing."

The paper uses the common example of booking travel. Today, a traveller must re-enter their trip details into every travel site they visit. Even though that travel site may set a cookie to recognize the returning user, that's all the cookie can "remember". With Information Cards, the traveller will be able enter the trip details once, then use an Information Card to securely and privately share it with each travel site they wish in one click.