* Who controls your identity?
As I said in the last issue, there’s sure to be dozens of newsletters’ worth of topics coming out of this week’s RSA Conference. And my “potential topics” list for the newsletter is hovering around 150 entries right now. But today, at least, I want to get back to a topic that’s near and dear to me – defining identity.
Microsoft’s Carl Ellison (https://cme-spam.blogspot.com/), commenting about identity says: “I suspect that each individual has an inherent identity, but that it is irrelevant. Rather, I define the identity of person P as being a function not I(P) but rather I(P,O,t) – the identity of P from the point of view of observer O at time t.”
Former Novell identity guru Scott Lemon states (https://www.freeid.org/axioms/), “I posit that we humans do not have any inherent identity.” His thesis is that of all the identitifiers, “…none of these are inherent to you … they are all given to you by outside entities.” He mentions Social Security number, name, height weight, etc.
Ellison’s claim implies that an “identity” is a non-unique identifier while Lemon’s claim implies that no one owns their own identity. Both seem to bolster the argument that no one controls their own identity.
It all depends on what you mean by “control,” I guess.
I am uniquely identified by my DNA and my fingerprints (you need the fingerprints because, not surprisingly, identical twins have identical DNA). No one else who ever existed, or ever will exist, has that same identifying combination. It doesn’t depend on a point of view, it doesn’t derive from some government agency and it isn’t variable. Everything else which people call an “identifier” is merely the value of an attribute, which can be used as an alias in some system to refer to the unique individual who carries my DNA and fingerprints. But all of these attributes (as far as I know) are changeable – address, phone number, Social Security number, even my name.
For a worldwide, all-encompassing federated identity scheme to work there has to be a way to identify uniquely every man, woman and child. Only DNA plus fingerprint seems to satisfy that condition. Still, if you know of another way – or you think a guaranteed unique identifier isn’t needed – I’d like to hear from you.
