Commentary by Mark Wahl, CISA
Organizing principles for identity systems:
interpreting claims, assertions and opinions (20070802)
Dave Kearns writes in "Social networking fatal flaw" on yet another social networking web site, one which focuses on its users providing recommendations to their friends. Dave Kearns questions the assumption made by this web site: that recommendations made by one's "friends" are more reliable. In once sense that assumption is correct; actual, real-world, friends are unlikely to be touting. However, some social networking services appear to subvert this goal, by making its users into marketing vehicles, as I observed in the recent post "Anti-utopian social networking", or by tying friendship into fan clubs, as in "A friend is someone who'll help you move...a profile", where presumably, as in the real world, celebrities are spokespeople for products and services, rather than recommending what they actually use.
Furthermore, Dave Kearns writes that
...I don't value my friends' opinions higher than strangers because they're intrinsically better. I value them because I understand my friends' likes and dislikes, prejudices and preferences. In other words, I can put my friends' recommendations in context - something I can't do with the opinion of a stranger.
Also, Bob Blakley of the Burton Group has posted a followup summary of the OSIS user-centric technology demonstration, that includes a list of the issues found in attempting to establish interoperability between an identity provider and a relying party. Many of the issues arose around the lack of schema management for claims, and a lack of semantic definition for claims handling. In particular,
The semantics of an IDP issuing a claim are not clear; in particular it is not clear whether creation of a signed token containing a claim constitutes a statement by the IDP that it believes the claim is accurate.