Re: [saag] Liking Linkability

[to strip off mailing lists except WebID]


On 10/22/2012 02:32 PM, Harry Halpin wrote:
> On 10/22/2012 02:03 PM, Kingsley Idehen wrote:
>> On 10/22/12 7:26 AM, Ben Laurie wrote:
>>> On 22 October 2012 11:59, Kingsley Idehen <kidehen@openlinksw.com> 
>>> wrote:
>>>> On 10/22/12 5:54 AM, Ben Laurie wrote:
>>>>> Where we came in was me pointing out that if you disconnect your
>>>>> identities by using multiple WebIDs, then you have a UI problem, and
>>>>> since then the aim seems to have been to persuade us that multiple
>>>>> WebIDs are not needed.

Also, from a linkability/privacy perspective, you would still by virtue 
of the URI in the SAN reveal that you control (or have delegated 
control, i.e. it may just mint WebIDs for anyone) to that domain with 
the "multiple WebID" solution. It seems like in this case that anonymous 
credentials/ZKPs would make more sense without revealing any URI or key 
information, although deployment of that work in browsers is still I 
think quite far away.

Again, I think a good approach towards WebID CG is to say "Here is what 
use-cases its good at (you control a URI, you like FOAF and the SemWeb, 
you want a public profile), here's what use-cases its not good at or 
specialized at (linkability, UI, etc.)" rather than attempt to paint 
WebID as a silver bullet across as many mailing lists as possible. 
Realistically, most standards and techniques have trade-offs. Whether or 
not industry or users agree with your particular trade-offs determines 
the success of the standard in my experience.

Good luck! Again, there's some good ideas in WebID, there's some ideas 
that I personally think are good (stronger authentication) but unlikely 
to be adopted by industry (such as FOAF), open problems (multiple 
devices) and there's some ideas I don't personally agree with (approach 
of WebID to linkability and URIs) but happy to see other people use if 
they if they have different use-cases.

And if you want changes in the browser, I suggest you attempt to discuss 
in a polite manner with browser vendors that takes their concerns on 
board as well as people that contribute code to open-source browsers, or 
contribute such changes yourselves.



>>>> Multiple WebIDs (or any other cryptographically verifiable 
>>>> identifier) are a
>>>> must.
>>>>
>>>> The issue of UI is inherently subjective. It can't be used to 
>>>> objectively
>>>> validate or invalidate Web-scale verifiable identifier systems such as
>>>> WebID or any other mechanism aimed at achieving the same goals.
>>> Ultimately what matters is: do users use it correctly? This can be 
>>> tested :-)
>>>
>>> Note that it is necessary to test the cases where the website is evil,
>>> too - something that's often conveniently missed out of user testing.
>>> For example, its pretty obvious that OpenID fails horribly in this
>>> case, so it tends not to get tested.
>>
>> Okay.
>>>
>>>> Anyway, Henry, I,  and a few others from the WebID IG (hopefully) 
>>>> are going
>>>> to knock up some demonstrations to show how this perceived UI/UX
>>>> inconvenience can be addressed.
>>> Cool.
>>
>> Okay, ball is in our court to now present a few implementations that 
>> address the UI/UX concerns.
>>
>> Quite relieved to have finally reached this point :-)
>
> No, its not a UI/UX concern, although the UI experience of both 
> identity on the Web and with WebID in particular is quite terrible, I 
> agree.
>
> My earlier concern was an information flow concern that causes the 
> issue with linkability, which WebID shares to a large extent with 
> other server-side information-flow. As stated earlier, as long as you 
> trust the browser, BrowserID does ameliorate this. There is also this 
> rather odd conflation of "linkability" of URIs with hypertext and 
> URI-enabled Semantic Web data" and linkability as a privacy concern.
>
> I do think many people agree stronger cryptographic credentials for 
> authentication are a good thing, and BrowserID is based on this and 
> OpenID Connect has (albeit not often used) options in this space.  I 
> would again, please suggest that the WebID community take on board 
> comments in a polite manner and not cc mailing lists.
>>
>>
>>
>

Received on Monday, 22 October 2012 12:50:32 UTC