|
|
Many thanks to all who attended the Kantara Initiative Workshop at RSA this year. The room was packed (with standing room only at one point), and I heard a number of fantastic comments from attendees about the presentations… many who wanted more detail on some presentations.
Along those lines, many thanks to the many energetic and informative presenters and panelists we had on stage. Of course, PayPal’s Andrew “Rock Star” Nash was a crowd favorite, as was Google’s Eric Sachs (too bad Chris Messina was wrestled to the ground by the RSA registration system… ask him that story, it’s hilarious). Add Patrick Harding (Ping Identity) into the mix talking about securely federating clouds, and you’ve got an appetizer to his company’s all-out party the following night.
Rounding out our party was Matthew Gardiner from CA (who earns the dubious distinction of being the first person to utter the term “cloud” during the conference), as well as Chris Sharp from MEDecision who offered up a peek into how the real world deals with cloud identity.
We were also able to dive deeper into cloud services with Oracle’s Uppili Srinivasan and his panelists Gail Coury (Oracle), John Donovan (NetApp), and Archie Reed (HP). Adding to the panel party was Matthew Gardiner’s cross-cutting Identity Services Roadmap with Mark Coderre (Aetna), Debbie Bucci (NIH), and Todd Inskeep (Bank of America).
… and who could resist the Prezi(c) by Paul Madsen (NTT), representing his gold-hording country on stage (despite the fact he actually missed the final hockey game while in the air). Besides, who else would include in a presentation about the state of OpenID, SAML, InfoCard, and OAuth a slide depicting the dangers of incorrectly checking for dirty diapers?
Finally… much and many thanks to Dervla and Joni for rolling in early on Sunday to set up, and staying late on Monday to break down. Not to mention all the lead-up work they did (including hounding folks like me to get in our presentations). Thanks!
And in case you wanted to see the presentations:
- Kantara Initiative Overview (Trent Adams, Internet Society)
- Kantara Initiative Groups (Trent Adams, Internet Society)
- PayPal KI 2010 RSA 2010 IA and Real World (Andrew Nash, PayPal)
- CA KI Workshop 2010 RSA Conference (Matthew Gardiner, CA; Chris Sharp, MEDecision)
- NTT KI Workshop 2010 RSA Conference (via prezi.com) (Paul Madsen, NTT)
- Ping ID KI Workshop 2010 RSA Conference (Patrick Harding, Ping Identity)
- Oracle KI Workshop 2010 RSA Conference Customer Panel (Uppili Srinivasan, Oracle; Gail Coury, Oracle; John Donovan, NetApp; Archie Reed, HP)
- Google KI Workshop 2010 RSA Conference (Eric Sachs, Google)
It was at the last RSA where we announced the formation of the Kantara Initiative. One very strong (and busy) year down… and here’s to many more to come (hoping they get easier). Cheers!
 Colin Wallis from the New Zealand Government’s Department of Internal Affairs joins this episode of the Identity Matters Podcast. As the Kantara Initiative eGovernment Work Group Chair, he provides an overview of what the group is doing. He talks about how the adoption of the initial eGov Profile has spurred on development of version 2. He also discussed how the eGov work dovetails with the Kantara Interoperability Review Board (IRB), as well as work taking place outside Kantara.
Currently in Development: eGov Profile 2.0
Identity Matters: eGovernment
Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.
Download MP3 | Episode Length: 0:15:10 | Filesize: 10 MB
NOTE: This podcast was produced in collaboration with the Kantara Initiative Identity Community Update Discussion Group.
In this episode of the Identity Matters Podcast, Eve Maler presents an overview of the User Managed Access (UMA) Work Group. Eve, the UMA WG chair, starts off with background of the group working within the Kantara Initiative and defines the problem space. She then provides an overview of the process the group is taking as well as where they are in their roadmap toward delivering a specification to the IETF.
From the UMA charter: The purpose of the UMA work at Kantara is to develop a set of draft specifications that enable an individual to control the authorization of data sharing and service access made between online services on the individual’s behalf, and to facilitate the development of interoperable implementations of these specifications by others.
Identity Matters: User Managed Access
Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.
Download MP3 | Episode Length: 0:27:41 | Filesize: 18.5 MB
NOTE: This podcast was produced in collaboration with the Kantara Initiative Identity Community Update Discussion Group.
It’s not a bad start to the new year (and decade) when a journal like Global Finance sees value in the work you’re doing. Their cover story on “A Wide Open World” just hit the stands and I’m pleased that some of my contributions made their way into the article. Specifically:
The ISOC’s Adams believes access to information will be a key driver of change. “Whereas today users generally manage data within the silo of single institutions—for example, individual bank, brokerage, or credit card companies—new capabilities will allow them to delegate access to and control authority over their data as it is shared across institutions,” he says.
While it wasn’t mentioned by name, I was referencing work being done by Eve Maler, Iain Henderson, Joe Andrieu and others in various Kantara Initiative working groups. Specifically in the User-Managed Access (UMA) and Information-Sharing groups. Too bad they weren’t included by name, but I hope this helps give them the recognition they (and their long list of collaborators) deserve.
They also reference my comments about “open trust frameworks” and the Kantara Identity Assurance Program, but reduced it to generalities. There’re a lot of amazingly dedicated folks working hard on open specifications in this area to help standardize a trusted model for information exchange. Even though they’re not named, this is a great example of their work starting to permeate the broader market.
Great job, folks. Keep it up!
(PS Many thanks to Greg and the ISOC communications team for facilitating my contribution to the article.)
 A common problem when deploying wide-scale networked solutions is how to power the elements of the net. As reported in a MIT Technology Review article, Perpetua Power Source Technologies based in Oregon developed a solution for effectively powering small devices off excess heat.
According to their product literature, the Perpetua Power Puck generates it’s power using thermoelectric generator (TEG) technologies. It can convert low temperature differences into regulated voltages of 1.8 V, 2.5 V, 3.0 V, and 3.3 V. According to the MIT TR article, each puck is small enough to be placed in tight locations and can generate electricity with a temperature difference as little as 10 degrees C.
I was recently talking to some people at ISOC working with the OECD on research into developing reliable sensor nets. This type of solution plays right into this project as it can vastly simplify many of the power requirements. Assuming a use case in which a wireless sensor can be co-located with a hot water pipe, it is now possible to generate the required power to run the transmitter from excess heat. There is also often more than enough of a temperature differential just a few inches below ground in desert climates, making this type of solution a viable source for long-haul monitoring.
 There’s a great discussion taking place on the OAuth list around how to make it easier to deploy. It was started with a post by Kent Brewster lamenting the problems he ran into. His post is a fun read, I’ve only snipped the top-level bullets:
- My Timestamp was Stale
- The Parameters in my Signature Base String were Out of Alphabetical Order
- I Forgot a Question-Mark between my Request and my OAuth Payload
- I Didn’t URL-Encode my Signature
- I Didn’t URL-Encode All Illegal Characters
- I URL-Encoded the Ampersands Separating my Method, URL, and Request Parameters
- I Didn’t Append an Ampersand to my Consumer Secret to Make my Signature Key
- I Used the Same Nonce, Over and Over and Over Again
- I Generated a Random Nonce, but (you guessed it) Failed to URL-Encode It
- And, Finally: I URL-Encoded my Signature Key
That post sparked a note by Chris Messina asking others if their experience is similar. What follows, then, is a useful thread on what might help make it easier for others.
The reason I find this interesting? Because, IMO, focus on this type of work is what will help move the ball forward. Whether it’s OAuth, OpenID, SAML, InfoCards, or whatever, these are solutions that interface with real people doing real code. The easier the deployment, the fewer mistakes and more time to focus on security over sytax, etc.
…and happier coders. 
 At the ID Workshop leading into the RSA Conference, we announced the impending formation of the Kantara Initiative. To those following the Identity Community, this wasn’t really ground-breaking news as we’ve been working on this for the past year or so (under various monikers). What was worth mentioning in the workshop, however, was that we’d signed a number of founding member organizations (including the Information Card Foundation, Internet Society, DataPortability Project, XDI.org, Project Concordia) and put out a call for more to join before the launch in a few months. Oh, and we settled on the name.
After much (much) debate, the founders settled on the name Kantara as it is a Swahili word for “bridge” and has Arabic roots meaning “harmony”. And yes, we know that some people believe it should be spelled “Qantara” (while others want to add a trailing “h” on the end, too). In the end, there was strong support for the name as it blends key points of the group’s mission to:
Foster identity community harmonization, interoperability, innovation, and broad adoption through the development of open identity specifications, operational frameworks, education programs, deployment and usage best practices for privacy-respecting, secure access to online services.
Beyond the announcement itself, the bridge-building we hope to facilitate already struck a positive chord throughout the RSA Conference. Of the meetings I attended, here are a list of them where Kantara was mentioned (either by the presenters or in audience questions):
- Fostering Collaboration and Opportunities in Identity Management
- Federate Access Policy, Not Identity
- Building Authorization into the Enterprise Identity System
- Cloud Computing and Identity Challenges
- Identity Management for the Cloud: Challenges, Opportunities, and Best Practices
- Identity and Privacy Models
In each case, the comments were positive and hopeful. Like opening a new birthday present, the IdM professionals were excited to play with the new group. Our goal, of course, is to make sure the Kantara Initiative lives up to our collectively high expectations. Taking a page out of the Concordia playbook, the initiative will provide neutral ground for all participants. There is no cost for participation, and all contributors are welcome. The playing field is level, and we’re excited to see what projects take advantage of the unique opportunity to have a truly open dialog.
 The Tweet Race: As you can tell from the photo to the right, Eve Maler (a.k.a. @xmlgrrl) was apparently happy that her Kantara announcement Tweet beat mine. I’m relatively convinced, however, that she cheated by typing her’s in advance (only needing to hit “send” from the stage), while I had to type mine on the spot. In fact, her announcement blog post also won. Hmmph.
|
|
March 3rd, 2010 | 
I was recently in line at the first airport security checkpoint, waiting my turn for the TSA agent to allow me into the gate area. In front of me was a man who had just handed the agent his documents, and I was about to see an example of the human brain in action as a finely-tuned (and flexible) pattern matching machine and decision engine.
User-Managed Identity Starts at Home
About 8 years ago I took on the challenge of securing the digital borders around the e-commerce systems for the Kraft Group’s sports properties. At that time, I could see a storm cloud gathering on the networked horizon as we built a system to unify all of the current properties and set the foundation to build out a series of interconnected portal communities. Looking forward, I knew that it was only a matter of time before a major press-worthy event would raise everyone’s awareness regarding the protection of user privacy, in the form of personally identifiable information (PII), and associated payment information.
Our business strategy was to build a core commerce engine that could handle online transactions embedded within each separate portal. Key to our success was enabling users to have a persistent identity throughout their engagement with our products. In this way we could minimize the barriers to their interacting with our content, as well as streamlining the purchase pipeline. Essentially, once users logged into any of our portals (to access premium/personalized content, manage accounts, and purchase products), we were able to effectively cater to them by simplifying their experience.
The problem with this single-sign-on model was that if a user account was compromised, the intruder could have free reign over the victim’s PII and associated payment information. I had to make the case for going the extra mile(s) by designing strict access control procedures, knowing that something bad was going to happen to a company soon and that we should be ahead of any reactionary solutions imposed upon us. I had a feeling that after some bad press, the e-commerce industry would be pressured to lock down the porous borders that were relatively common at the time.
Just such a case occurred in 2004 when hackers were able to access an estimated 8 million credit card numbers from BJ’s Wholesale Club. It took a few years for details of the incident to emerge, but it was clear even then that there were two primary issues: insecure access points, and poor audit logging. Regardless of whether it was an inside job (as was initially assumed) or an outside hack (which it turned out to be), BJ’s (among other compromised companies) had poor access control and monitoring.
This, as well as other similar incidents, prompted the creation of the Payment Card Industry Security Standards Council, founded in 2006 by American Express, Discover, JCB, MasterCard, and Visa. The payment card industry thus began requiring strict practices and controls around systems that perform above a modest threshold of transactions. It was a strong move, in advance of looming legislation, that helped steer wayward companies toward better practices. Regardless of the critiques of their programs, it has succeeded in shining a light on many problems needing to be addressed.
Fortunately, by the time the PCI guidelines hit the market, we were able to breeze through their audits. The commerce engine we’d built was tighter than what they required. It’s rare that you can so easily point to a situation like this where the extra capital cost on the front end so clearly saved money that would’ve been required to retrofit a running system.
Now, here’s where the history lesson circles around to become informative for current events. We should learn from these cases of identity intrusion and address the core issues. The obvious lesson is not to be cavalier regarding the protection of your email accounts. After all, they are your core identity asset in today’s online world. Be careful when setting up your email account and follow common sense when selecting passwords and associated “remind me” features.
Beyond what you can do for yourself today, the industry needs to step up it’s game, too. Fortunately, there are a number of efforts currently under way to help protect your identity. They just need to be more whole-heartedly embraced and helped to mature by the major players in the market. What’s uniquely interesting about many of the emerging solutions is that they’re user-centric, rather than being centered around any one company’s digital security practices. This focus helps solve the root problems: privacy protection starts at home, and it’s not a simple matter of more/better cyber-security and encryption.
For more information, and to become involved, I highly recommend following the open standards development relating to user-managed identity:
And, of course, the Internet Society Trust & Identity Initiative. Tell them I sent you.