[OpenID] IMPs in a post-postal world

[Peter Williams]

The large social networking sites increasingly play the communications role formally played by the post office and regulated telco - the institutions that for 200 years mediated and control communications across public boundaries.

The really funny part (below) is the use of the term IMP - the first internet router/switch. Perhaps you have to be too old and irrelevant to find that ironic as the means to implement the [social] control plane.

Pay for registered mail assurances *only* when occaionsally needed? Yes - that's the right political compromise model - which the world of SSL exhibits, ofcourse. There is the low-assurance public CA space of VeriSign et al (that comes with realtime monitoring, data retention, key escrow, and all the other control mechanisms of TTPs). Then there is the medium-assurance self-signed cert model, with commodity crypto. Then there is the high-assurance "military-grade" model, that critical infrastructure players (and some larger US multi-nationals) also use.

In openid, one should conceive of a similar step up - when there is a need. one starts with low-assurance social networking sites (where you are being monitored by governments, where the mega-OPs are proxies for mandatory governance policies). Then one moves to medium assurance self-hosted OPs (when there is some real social benefit, e.g. the trust between a realtor and her 50 clients, or doctor and her patients). Then there is normally the high assurance  space, which openid's websso crypto/security design probably can't address (but SAML websso can, since its security architedcture has access to full-power asymmetric key management).



------

Vernon Coaker the U.K. Home Office security minister, on Monday said the EU Data Retention Directive, under which Internet service providers must store communications data for 12 months, does not go far enough. Communications such as those on social-networking sites and via instant-messaging services could also be monitored, he said.

...

Under the EU Data Retention Directive, from March 15, 2009, all U.K. ISPs are required to store customer traffic data for a year. The Interception Modernisation Programme, or IMP, is a government proposal, introduced last year, for legislation to use mass monitoring of traffic data as an antiterrorism tool.

The IMP has two objectives: that the government use deep-packet inspection to monitor the Web communications of all U.K. citizens; and that all of the traffic data relating to those communications are stored in a centralized government database.


http://news.cnet.com/8301-1009_3-10199107-83.html?tag=mncol;posts

> -----Original Message-----
> From: SitG Admin [mailto:sysadmin at shadowsinthegarden.com]
> Sent: Sunday, March 22, 2009 6:56 PM
> To: Peter Williams
> Cc: general at openid.net
> Subject: Re: [OpenID] Fwd: [OpenID Foundation] New Poll Opened
>
> >And to be fair, it was and still is the mega-OP with openid2
> >capabilities that drives our commercial interest (seeing as they can
> >nowhandle the ~6 million accounts of users who occasionally come to
> >our site, now to authenticate using websso - or "identity
> >verification").
>
> Recalling the "post office to make identity unique and verifiable"
> posts we made back in December:
> http://openid.net/pipermail/general/2008-December/007046.html
> http://openid.net/pipermail/general/2008-December/007048.html
> It's not a question of who IS trustworthy; with that much power in
> the hands of any one (centralized) authority, even when corruption is
> not imaginable, it would become too tempting a target for outside
> criminals to compromise. Security would go up to protect the system
> from that, and the end users would be inconvenienced (maybe even have
> to pay more, subsidizing the costs) for a feature they might not be
> using!
>
> Then again, can't we send registered mail nowadays and only pay for
> that level of security when we want it?
>
> Perhaps a better approach, here, would be (for the larger OP's) to
> rebrand OpenID - as CorpID ;) (for Corporate) or FedID
> (Federated/Federal) - naming its suitability of purpose. The same
> underlying technology, but users who want their "OpenID" could be
> given a clearly different set of information about its implications
> (and concerned OP's might insist that users select a "disposable"
> password for their phishable OpenID), not easily confused for the
> reliable ID.
>
> -Shade