1. The Laws of Identity and Cardspace Charles Young Solidsoft

2. Embodies Kim Cameron’s ‘Laws of Identity’ – Universal identity systems Supports the Identity Metasystem CardSpace

3. The Identity Meta-what??? The Identity Meta-system – A single identity ‘fabric’ supported by many different technologies – A system of systems – …so standards are important here!!

4. Yes, but what is an identity? It’s a list of claims about an entity – Entities….that’s me and you! – My name is Charles – I work for Solidsoft – My email address is…. …well, that would break laws 2 and 3

5. Law 1: User Control and Consent Only reveal information with the user’s consent – It’s their identity, after all

6. Law 2: Minimal disclosure for a defined use Disclose as little identifying information as possible Limit the use of identifying information as much as possible Helps build stable long-term solutions.

7. Law 3: Justifiable Parties Don’t disclose identifying information to a party that cannot ‘justify’ itself. – All parties must identify themselves – Establish trust relationships

8. Law 4: Directional Identity Omni-directional – Publicly broadcast your identity – ‘Look at me everyone! Here I am. It’s me.’ Uni-directional – Privately assert your identity – ‘Psst…It’s me. The password is ‘Cardspace’. Let me in.’ Identity systems must support both.

9. Law 5: Pluralism of operators and technologies If it’s Microsoft-only, its useless! …but seriously… – The Identity meta-system MUST NOT be bound to proprietary solutions and technologies – Different cultures – Different contexts

10. Law 6: Human Integration Humans are first-class components if the identity meta-system (duh) Unambiguous human-machine communication Machines don’t attack you – humans do.

11. Law 7: Consistent experience across contexts ‘Thingify’ your identities Consistency shines the spotlight on attackers

12. Cardspace Actors: Subjects

13. Cardspace Actors: Relying Parties

14. Cardspace Actors: Identity Providers

15. Reason over your identities Smart selection The Cardspace Identity Selector

16. The Cardspace Logon process

17. Contains self-asserted claims about me Stored locally Use instead of username/password SELF - ISSUED Information Card Types

18. Provided by banks, stores, government, clubs, etc. Claims stored at Identity Provider and sent only when card submitted MANAGED Information Card Types

19. Cards contain metadata only! Cardspace can handle any claims tokens – SAML tokens are most common Cardspace uses WS-* standards Cards and standards

20. Call to action Cardspace-enable your web sites – Relying parties Invest in Secure Token Server technology – Identity providers Spread the word.