Friday, June 25, 2010

Identification and the Intenet

We trust the government to do a lot of things. One of these things that receives little objection and that we do not think about is identification. Society relies on birth certificates, social security numbers, and drivers licenses to identify individuals.

However none of these help much with identification on the internet. You can not see these 'documents' in person to assure their authenticity and you can not look at the person to make sure their picture matches.

Yet identification is of critical importance on the internet.

If a person is banned from a forum, nothing is really to stop them from just creating a new profile. Online polls can be spamed by the same person over and over again. The ease of having dummy accounts leads to an increase in spam.

But at the same time anonymity is valued on the internet. Well I put forward that we can have the best of both worlds.

Image that the federal government instituted a Internet ID or IID service. To register you would need to go in person to your DMV. You would create a username and password that would then be associated with your identity.

Now if a website wanted to check your IID, they would have a button on their signup page while you are filling out the signup form. The button would redirect you towards the governments IID website. There you confirm your identity and the IID site sends back either an 'ok' or 'not ok' message to the original site. The IID will only send an 'ok' message if two things happen:
1) The IID site is able to verify the users identity.
2) The IID site checks a database checks a database to determine if the user has already created a profile on the site.

All the original site knows is if the IID site was able to confirm your identity. They don't know who you are, but they know that this is your first time creating a profile. They are never exposed to your IID profile name or password. You are still anonymous.

Using this would not be required. It would simply be a service offered up by the government. Websites may choose to make it a mandatory part of their registration process, but that is up to them.

I suspect private companies have likely tried doing something like this before. The problem is, the system needs to be unified and trustworthy if people are going to bother signing up for it. Hopefully people would not be worried about the government selling their personal information (because it all ready has a lot of it).

People could even create some sort of public profile that could sit on top of their IID. They would not need to use their real name, but this profile (essentially a 2nd username and password) would be tied to their IID. Sites that support this Universal IID (UIID) could allow people to login in with their UIID without first registering at the site. Personally I hate having to register at a site I am only going to use once. This would help mitigate this annoyance.

Now there is one problem with this proposal. The 'www' part of most urls. The internet is world wide. If a website required an IID verification to login, then citizens of other nations would have no way of logging into the site. If they allowed people not from the US to register without an IID, then what is the point of the whole thing.

If we allowed other nations to participate in the IID system we would need to ensure that they are being rigorous about checking people's identity when they first register. If they were being lax in this the entire system would be undermined.

I do not know how to deal with this problem. Perhaps I could think of a way with enough thought. It may also be that there is no way to implement such a system without isolating our websites from the rest of the world. And that would certainly not be acceptable.

No comments:

Post a Comment

Have comments about my ideas? If you see something wrong with them, leave a comment. I'll try to comment back. If you have seen these ideas implemented/mentioned somewhere before, leave a comment. I like to think I am 'original' but that doesn't mean somebody has not beaten me to the punch. Finally, if you just have something to say, well comment that as well.