August 2011 - Community - mailman.kantarainitiative.org

Kantara announces Attribute Management Discussion Group formation
by Dervla O'Reilly 24 Aug '11

24 Aug '11

Kantara Initiative is pleased to announce the formation of the Attribute Management Discussion Group (AMDG). The purpose of this Discussion Group is to: IDENTIFY: Consensus on a working definition of “Attribute” for purposes of fulfilling further bullets below. IDENTIFY: Kantara Initiative stakeholder requirements regarding Attribute Management. DISCOVER: Attribute Management activities under development both internal and external to Kantara Initiative. GAP ANALYSIS: Attribute Management KI stakeholder requirements compared to work under development (both internal and external to KI) RECOMMEND: scope of work, potential KI adoption of external works, collaboration with external organizations and/or new WG in KI to perform design phase of Attribute Management based on requirements, discovery and gap analysis. Thanks to Sal D’Agostino, IDmachines who will act as Interim Chair. For more information on the Attribute Management DG, please visit the home page: http://kantarainitiative.org/confluence/display/AMDG/Home Join the Attribute Management DG: http://signup.kantarainitiative.org/?selectedGroup=31 Review the Charter: http://kantarainitiative.org/confluence/display/AMDG/Charter Mail list and Archives: http://kantarainitiative.org/pipermail/dg-am/ Copyright Policy: Kantara Initiative IPR Policy – Creative Commons Share-Alike Attribution We welcome your participation! ________________________ Dervla O’Reilly Program & Event Manager Kantara Initiative +1 415 731 4487 business +1 509 757 4487 fax dervla[at]kantarainitiative[dot]org http://www.kantarainitiative.org Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

Kantara Initiative News Round-Up: August 2011
by Dervla O'Reilly 22 Aug '11

22 Aug '11

Read the round-up of recent Kantara updates: Registration open for Kantara Initiative Meeting Oct. 20-21, 2011 hosted by CA, Redwood City, CA, USA Spotlight on Colin Wallis New leadership for Kantara Initiative Identity Assurance Work Group New leadership for Kantara Initiative Japan Work Group UMA webinar recording now available Announcing User-Managed Access: UMA Gives Data-Sharing Power to the People Kantara announces NSTIC Discussion Group formation Industry events – Kantara members receive a discount at the following events, contact Dervla O’Reilly for the discount codes dervla[at]kantarainitiative[dot]org: - IIW XIII – Oct. 18-20, Mountain View, CA, USA - Kantara Identity Summit - Nov. 1, 2011, Washington D.C. USA + Smart Card Alliance Government Conference – November 2-4, Washington D.C., USA - Hacker Halted USA – Oct. 21-27, Miami, USA - Hacker Halted Asia – Nov. 17-19, Kuala Lampur - Gartner Identiy & Access Management Summit – Nov. 14-16, San Diego, CA, USA - Takedowncon 2 – Mobile & Wireless Security – Dec. 2-7, Las Vegas, NV, USA - The Smart Card Alliance 2012 Payments Summit - Feb 8-10, in Salt Lake City, Utah. - HIMSS HIE Symposium 2012 – Feb. 20, 2012, Las Vegas, NV, USA ________________________ Dervla O’Reilly Program & Event Manager Kantara Initiative +1 415 731 4487 business +1 509 757 4487 fax dervla[at]kantarainitiative[dot]org http://www.kantarainitiative.org Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

Kantara Initiative Spotlight on Colin Wallis
by Dervla O'Reilly 18 Aug '11

18 Aug '11

Colin Wallis is the Chair of Kantara Initiative’s eGovernment work group and serves as Leadership Council rep on the Board of Trustees. Colin has been actively involved with the Initiative since it’s inception and was previously Chair for Liberty Alliance’s eGovernment group. Colin originally comes from New Zealand and is Authentication Standards Manager, Government Technology Services at the Department of Internal Affairs, New Zealand Government. Colin has been involved in the New Zealand Government’s online IAM Programme since 2004, for which it won the Identity Deployment of the Year (IDDY) Award in 2007. This follows five years in the UK, where Colin worked on the UK eGIF and private sector eBusiness initiatives. Today, Colin holds leadership positions across the consortium space in the area of online Identity. In OASIS, he sits on the Steering Committee of the eGov Member Section, and on the identity-related Technical Committees of Security Services, Customer Information, Identity in the Cloud and Transformational Government. Colin is also engaging in ITU-T’s Study Group 17 Q10 Identity work and UN/CEFACT’s eGov group,TBG19. In ISO JTC1 SC27, Colin is an acknowledged subject matter expert on identity and privacy in Working Group 5. Colin’s interests are maintaining his property on a 10-acre lot in Wellington and he enjoys a few days skiing each year – a little less now than the months of skiing he had in the 70′s as a member of the New Zealand Ski Team! We’re proud to have Colin participation and leadership – his knowledge and experience in the identity landscape is appreciated. ________________________ Dervla O’Reilly Program & Event Manager Kantara Initiative +1 415 731 4487 business +1 509 757 4487 fax dervla[at]kantarainitiative[dot]org http://www.kantarainitiative.org Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

ISO Review Documents Posted to BoT Liaison Sub-Committee
by Joni Brennan 10 Aug '11

10 Aug '11

Hello Community, Please be advised that a new set of review documents has been posted to the BoT Liaison Sub-Committee (LSC) space [1]. This review is due on Sept 10, 2011 and last comments are requested from KI Members by Sept 5. [1] http://kantarainitiative.org/confluence/display/lsc/Home All Kantara Initiative and Leadership Council Members are eligible to review and provide comments to these confidential ISO documents. However, each Kantara Member who wishes to participate must join the LSC. Confidentiality policy around these reviews and the page to join the group are available via the link above [1]. Note: once you receive confirmation that your agreement to join LSC has been processed you will need to login to view the page "Review Documents - ISO" which is available from the home page [1]. Please don't hesitate to contact me with any questions or concerns you may have. =Joni Joni Brennan IEEE-ISTO Kantara Initiative | Executive Director voice:+1 732-226-4223 email: joni @ ieee-isto.org gtalk: jonibrennan skype: upon request Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

OASIS Trust Elevation TC Launched
by Joni Brennan 08 Aug '11

08 Aug '11

Hello Community Of your possible interest.... OASIS has just launched their new Trust Elevation TC. Further details can be found below. Note that Kantara Initiative has a liaison relationship with OASIS. Full Charter: http://lists.oasis-open.org/archives/tc-announce/201107/msg00000.html “The Trust Elevation Technical Committee will identify methods being used currently to authenticate electronic identities by online relying parties and service providers, and similar methods in development or identified in theoretical models. By comparison and factoring of those methods, the TC will propose and describe a set of standardized protocols that service providers may use to elevate the trust in an electronic identity credential presented to them for authentication, at generally-recognized levels of assurance, representing increasing degrees of authentication certainty.” Regards, =Joni Joni Brennan IEEE-ISTO Kantara Initiative | Executive Director voice:+1 732-226-4223 email: joni @ ieee-isto.org gtalk: jonibrennan skype: upon request Join the conversation on the community@ list - http://kantarainitiative.org/mailman/listinfo/community

1 0

Survey of suspended Google Accounts
by John Kemp 04 Aug '11

04 Aug '11

(via @zephoria on Twitter) From: http://infotrope.net/2011/07/25/preliminary-results-of-my-survey-of-suspend… [[ Reasons people gave for their choice of name: • “I am a high school teacher, privacy is of the utmost importance.” • “I publish under my nom de plume, it’s printed on my business cards, and all of the thousands of people I know through my social networks know my by my online name.” • “I have used this name/account in a work context, my entire family know this name and my friends know this name. It enables me to participate online without being subject to harassment that at one point in time lead to my employer having to change their number so that calls could get through.” • “I do not feel safe using my real name online as I have had people track me down from my online presence and had coworkers invade my private life.” • “I’ve been stalked. I’m a rape survivor. I am a government employee that is prohibited from using my IRL.” • “I work for a private club. I have to carry a card around which states I will not share any element of the club with any sort of media. So, If I want to talk about work (and I do) on the net, I have to use an alias.” • “I’ve been using this name for over 10 years in the “hacking” community. There are a nontrivial amount of people who know me *only* by that name.” • “As a former victim of stalking that impacted my family I’ve used [my nickname] online for about 7 years.” • “Under [this name] I am active in a number of areas of sexual difference for which it would not be wise for me to use my flesh legal name.” • “My actual real name is utterly non-identifying, as 1) it is the name of a character in a movie (Girl, Interrupted), and that overwhelms google search results 2) it’s not unique at ALL.” • “[this name] is a pseudonym I use to protect myself. My web site can be rather controversial and it has been used against me once.” • “I started using [this name] to have at least a little layer of anonymity between me and people who act inappropriately/criminally. I think the “real names” policy hurts women in particular. • “I use the pseudonym to maintain my online anonymity because I am polyamorous and have no desire for professional acquaintances to discover this.” • “I enjoy being part of a global and open conversation, but I don’t wish for my opinions to offend conservative and religious people I know or am related to. Also I don’t want my husband’s Govt career impacted by his opinionated wife, or for his staff to feel in any way uncomfortable because of my views.” • “I have privacy concerns for being stalked in the past. I’m not going to change my name for a google+ page. The price I might pay isn’t worth it.” • “We get death threats at the blog, so while I’m not all that concerned with, you know, sane people finding me. I just don’t overly share information and use a pen name.” • “This identity was used to protect my real identity as I am gay and my family live in a small village where if it were openly known that their son was gay they would have problems.” • “I go by pseudonym for safety reasons. Being female, I am wary of internet harassment.” ]] Regards, - John

1 0

Identity & Impersonation.
by Owen Thomas 04 Aug '11

04 Aug '11

On 4 August 2011 03:34, Bob Pinheiro <kantara(a)bobpinheiro.com> wrote: > Although this discussion has focused on whether people should be able to > use pseudonyms online, there is a related issue that no one has raised. > Using a persistent pseudonym like "Identity Woman" in effect becomes > someone's personal brand. ... > I would like to add my comments about the use of personae and the projection of personal identity. I am told through letters like the one from Bob Pinheiro to which I am replying that the NSTIC community is having problems relating personae back to a single identity. For what anyone thinks it is worth, I think I have answered many (if not all) of these problems with a simple data model. Very basically, my data model (which is in fact more abstract, but this example will give you the gist of what is going on), comprises a collection of Element types; three of which represent 1: a user's individual identity, 2: an affiliation that a particular user can assert over 3: a particular device instance. Now, a user, using a particular device, and asserting a particular affiliation can hide any of these details to other users so that other users only get to see perhaps one or two, but not all three of these identifying characteristics. So, should the user choose to hide their singular identity, they can still project the devices and their associated affiliations (personae/pseudonyms) to others, without disclosing who they really are. Because my system knows who one really is (the structure of my data model mandates a user identify who they really are to my system), the user can advise my system to let others know if one persona identifies the same user as another persona. Hence, other users can infer an identity relationship between two or more personae as being the same user without the need for this user to disclose their unique identifier. I think this is quite a powerful solution to the problem of multiple identities. It solves a dilemma that one has in keeping one's identity private, while also allowing others (should one permit) to infer that multiple personae represent one's self. What do others think? Owen. -- Employment-from-home. Make mine part-time. You've go a job for me working full-time from an office? No thanks. Clique Space(TM). Practical, Ubiquitous, Individual, and Real-time Security and Identity in Cyberspace. Research paper on Clique Space: http://ssrn.com/abstract=1714848 Owen's Garden of Thought: http://owenpaulthomas.blogspot.com/ Twitter: @CliqueSpace <http://www.elance.com/CliqueSpace>www.cliquespace.net Skype: owen.paul.thomas Mobile: +61 401 493 433

1 1

Re: [Kantara - Community] [community] Google+ "real" names and NSTIC
by Nicholas Crown 04 Aug '11

04 Aug '11

And how does an anonymous online profile help the Ugandan facing a death penalty for homosexuality, or a person facing murder in the US for being gay? Was it a post on Facebook that tipped the scale for them? The issue in Ugunda is one of an oppressive government regime. The people there do need to fight for their freedom, or flee. In the U.S. example, it's against the law to kill someone for their sexual orientation. Having a social networking site that supports pseudonym's would not have prevented the deranged person from taking another's life. Nick On Tue, Aug 2, 2011 at 12:09 PM, Blakley,Bob <Bob.Blakley(a)gartner.com>wrote: > Nicholas, > > Translation of your question: > > Why can't people with unpopular views just stand up in public and be > killed for them, or stay in the closet? > > It's great to stand up for what you believe in in a nice safe affluent > white suburb where everything is theoretical. It's a lot different to come > out of the closet in Uganda, where the government is trying to impose the > death penalty for homosexuality. > > And you don't have to go to Uganda; people are killed for being gay every > year in most states of the USA. > > And gay isn't the only thing that can get you killed – ask any Muslim you > happen to meet. > > > -- bob > > BOB BLAKLEY > > Vice President & Distinguished Analyst, Gartner ITP Identity & Privacy > > bob.blakley(a)gartner.com | +1 (512) 657-0768 > http://www.gartner.com | http://blogs.gartner.com/bob-blakley/ > > From: Nicholas Crown <nick(a)thecrowns.org> > Reply-To: Nicholas Crown <nick(a)thecrowns.org> > Date: Mon, 1 Aug 2011 18:09:30 -0400 > To: "community(a)lists.idcommons.net" <community(a)lists.idcommons.net>, " > community(a)kantarainitiative.org" <community(a)kantarainitiative.org> > Subject: Re: [community] Google+ "real" names and NSTIC > > but that is a totally different problem then the one I am raising > which is whether people with medical conditions they want to talk about with > others and get support (share +1s) or a buddhist in Kansas (can share freely > with other buddhists or seekers without their hyper conservative christian > neighbors finding out) or having a feminist persona that is not linked to > your work identity in the tech industry (and if it was you would find work > had to come by in the valley) is free to use google+ not linked to a "real > name". > > Why can't people just be who they are and stand in their own shoes for > what they believe in? Trying to be a buddhist behind closed doors in Kansas > does no one any good. If you believe in feminist tenants, than stand up for > those and speak your voice. I understand that persecution could come in any > one of these cases, but that is the beauty of taking a stand on the truth. > If your ideal is not worth sharing with your own ID, then it's not for you. > About the only one that I struggle with is the case where you have some > medical condition you would like to discuss in a private setting. Can that > case not be solved with a private/closed group? If it's too sensitive for > that, then take it offline. > > Nick > > On Mon, Aug 1, 2011 at 4:49 PM, Tony Rutkowski <trutkowski(a)netmagic.com>wrote: > >> "Rights to anonymity." Surely you are joking. >> >> In law, there is no such network based right. >> In technology, there is no such capability. >> >> Like Scott McNealy said rather publicly in >> 1995 - Privacy: get over it. >> >> --tony >> >> >> >> On 8/1/2011 5:38 PM, Stephen Wilson wrote: >> >>> (3) If you use crime prevention as the rationale for taking away users' >>> rights to anonymity, then >>> >> >> ______________________________**______________________________ >> You received this message as a subscriber on the list: >> community(a)lists.idcommons.net >> To be removed from the list, send any message to: >> community-unsubscribe(a)lists.**idcommons.net<community-unsubscribe(a)lists.idcommons.net> >> >> For all list information and functions, see: >> http://lists.idcommons.net/**lists/info/community<http://lists.idcommons.net/lists/info/community> >> > > > ------------------------------ > This e-mail message, including any attachments, is for the sole use of the > person to whom it has been sent, and may contain information that is > confidential or legally protected. If you are not the intended recipient or > have received this message in error, you are not authorized to copy, > distribute, or otherwise use this message or its attachments. Please notify > the sender immediately by return e-mail and permanently delete this message > and any attachments. Gartner makes no warranty that this e-mail is error or > virus free. >

13 20

Google+ "real" names and NSTIC
by Kaliya 03 Aug '11

03 Aug '11

NSTIC "says" it is about maintaining privacy and freedom of speach we have today on the internet while enabling "when you want to" the ability to use a verified account...but I don't have a good feeling about this. Over the last week in preparation for the "official" door opening of Google+ they have been sweeping it clear of personas and avatars. Yesterday I myself was included in the sweep post here: http://www.identitywoman.net/googlereal-name-identity-woman I had been working on a post I will publish this week about NSTIC being part of the push for so called "real names" in Google+ (and apparently you can't get a google e-mail address without one either). I am curious what others think is there a link? and are you having your accounts suspended? I am all for "Accountability" that is different then the sort of mantra around "trusted identities" that the only ones worth trusting for anything must be "real". - Kaliya Kaliya Hamlin, Identity Woman (blog) (twitter) Internet Identity Workshop - Co-Founder, Co-Producer, Co-Facilitator Kaliya(a)identitywoman.net Cel +1 (510) 472-9069 Skype: IdentityWoman GTalk: Identitywoman(a)gmail.com AIM/ichat kaliya(a)mac.com Yahoo! earthwaters

26 54

Re: [Kantara - Community] [community] Why anonymity norms are undesirable
by Tim Cole 02 Aug '11

02 Aug '11

> It is not the goal of a civilized society to spend a lot of money or > effort making things easy for the police. @bob: think about that one again. Of course it is! We spend millions a year as a society to make things easier for law enforcement officials so that they can protect us from all kinds of real or imagined threats. There is a consensus that this is a good thing in general, but we also worry, as did Seneca, about who should guard the guards. Security and individual freedom are two opposites that need to be balanced. The tricky question is: where and how? In Europe everybody is perfectly happy to carry around a government-issued ID card that he or she is compelled to present to police or other state officials in order to prove his/her identity at all times. Sooner or later most of us will be using them for online transactions. The notable exception are the Great Brits, from whom Americans inherited our loathing of prying governments, but internationally speaking the Anglo-Saxons are the odd men out. In fact, Americans are probably completey alone in their Hollywood-inspired enmity towards policeman in general. The British love their "bobbies". Contrariwise, everybody in America seems to hate the "fuzz", which is interesting because a policeman is of course by definition a representative of the state, so I draw the conclusion that Americans hate their own state, and that's not just the Teapotties. Okay, principiis obsta and all that. But being watchful does not mean reflexive rejection of all state authority, especially not if its democratically delegated. I mean, how paranoid is this? In the case of NISTIC, I would argue that we need to cut these guys some slack. They don't work for the Evil Empire, after all. Anyway, my two cents worth. And I apologize for the Latin quotations... Tim

2 1