I mentioned earlier that the best way to protect your privacy is to control your identity. But, while proactive publishing of one's identity is a necessary step, one of the other aspects to controlling identity online that's going to become increasingly important is authentication. It's inevitable that open, interoperable systems for authentication will become widespread.
The question then becomes, "Who do you trust your identity to?" We've got the listless Liberty Alliance, AOL seems to have abandoned its Magic Carpet project to turn screen names and AIM identities into a single sign-in service, and Passport is hamstrung by widespread (and generally deserved) distrust of Microsoft. It doesn't seem like a single, monolithic login system will take control. It will be left to federated systems cobbled together across hundreds of sites.
The rise of federated authentication systems will mean that there will be dozens of identity providers, all trying to be the repository that provides your information to others on the web. There are lots of contenders in this space, such as Amazon and eBay, though neither does a good job of extending their authentication systems to other sites, with the exception of eBay's recently-purchased subsidiary, PayPal. There were a spate of other companies trying to hold your wallet for you, like Yodlee and Paytrust. But I wouldn't leave my identity in their hands.
So who does that leave? What company would you feel safe in giving control of your identity to? I've been pondering the idea for a while, as I think there's a strong consumer market for third-party identity services. My list of companies to whom I'd trust my identity right now only includes Google and Six Apart. Broadening things out a bit, I'd probably also let Matt manage my identity through my MetaFilter login, and I've got a high enough respect for Nick Bradbury's ethics and responsiveness to his users that if he were to switch businesses to something that managed logins, I'd use his service.
There are lots of other decent companies that we could trust to not be evil with our information, but these are the ones that I know well enough to say "Yeah, that'd be okay." What are yours?
Why assume that there needs to be 3rd-party service at all? Why assume inevitability? Why not manage your identity (identities?) yourself? I do a lot of e-commerce and don't feel any particular need to have a third party interface between me and the places I do business with. Not convinced yet that there's a real burning need, here...
Even if you're dealing with independent organizations where you know and trust the people, you're still not safe with a third-party identity service.
Small independent companies tend to get bought out by Evil Empires, and then your personal information is in the hands of the nefarious greedy ones.
medley - While managing our own identities sounds great (we can certainly trust ourselves), we run into problems getting other people to trust us. Basically, your only proof of who you are is that you say so. Not very compelling proof.
Example: you are doing a transaction with someone. He claims to be the President of the United States. You ask for proof. He says, "My own identity management server (which has only one client) says so." Would you believe him?
I see Medley and Adina's points, but I think the question really comes down to a "trust one" or "trust many" situation; either you trust the single entity or you trust all the smaller, independent entities.
It seems ultimately smarter, though admittedly somehow scarier (although I suppose it shouldn't be), to store it all in a single place. Having my usernames and passwords scattered across scores of databases worldwide doesn't keep me awake at night, but it does freak me out a little. I'd rather have everything stored on an app that I own, that resides on my PC, that communicates in a trusted way with a trusted host, and that disconnects from that host once the transaction is complete (somehow returning control back to me, the way I put my wallet back into my pocket after I pick up the check). If someone could figure out how to do that, that'd be great. But Anil, to answer your question, I don't think I could trust *anyone* to store that information remotely; it'd all have to be stored under my control.
Certifying that you are who you say you are is a simple matter of cryptography -- it's called certification. You get someone who is well-known to vouch for you by digitally signing an assertion ("George W. Bush lives at 1600 Pennsylvania Ave.") with their private key, and others can use that person's well-known public key to verify the signature. If the District of Columbia certifies the authenticity of George W. Bush's driver's license you can be pretty sure you're really dealing with the President of the United States.
As for storing it on someone else's server, that, too, can be dealt with satisfactorily using encryption, so that even if (say) Microsoft has all your data on their servers, nobody but you (not even them) can read it casually.
(Disclaimer: I used to work for a company that invented many of the concepts of digital identity, and hope to work with essentially the same team again in the near future. So temper my optimism with knowledge of my personal investment.)
Nothing is ever as simple as just 'add crypto and stir.' While public key systems are a major advance over symmetric key, they're far from fool-proof--encryption is hard to get right technically, and everything depends on good implementations, good policy choices, and uncorrupted insiders, among other things. This stuff is not simple.
As for putting your wallet back after you pick up a check -- that's after the waiter has taken away your credit card and perhaps run it through a copier machine or swiped it into a rogue scanner. We somehow assume that we've got good control over our identities in the non-digital world, but we don't.
The single point of possibly major failure vs. several points of probably minor failures is a hard decision. I lean toward not having to trust or rely on any one particular service -- a single point of failure also means a single target for the bad guys to go after.
I don't think I trust any company with my identity over the long term. Imagine dealing with the anything even remotely like the kind of hassles we deal with now in domain registration on that kind of grand scale, and with those kind of stakes? Granted, it might not turn out that badly, but with examples like that already in existence,I don't think I'd want to leave it entirely up to the whims of the market.
How about some sort of distributed or community solution in the spirit of the open source movement? Not being a techie, I have no idea how the nitty-gritty of this would work, but I'd much prefer it to any sort of monolithic, and thus easily corruptible control.
I'm spending the next few weeks looking at what happens when online communities collide. Would you want your slashdot karma to be portable to ryze? How about your contact information? Your posts? really confusing and lots of interests to balance.
DigitalID has two faces: authentication and authorization. If you want to read my public weblog, I may need neither. If you want to read my bondage diaries, I may want you authenticated as someone I can trust with sensitive material, maybe someone from a buddy list group or a member of my neighborhood dungeon. neither Microsoft nor Visa need to authenticate you for that access; it may even be a bad idea. Thus the need for ID services specializing by use.
I've been fond, though not sure, of the idea of a Passport on every desktop. no technical reason why authentication federation can't be extended to the p2p model, just practical ones. For many markets, concentration seems to be the way of things. Only 3 consumer credit bureaus these days, only two global credit card networks. This concentration reduces friction and transaction costs. Distributed alternatives have to beat that operating cost.