I agree completely with Kim’s Third Law.

The Fewest Parties Law of Identity

Technical identity systems MUST be designed so the disclosure of
identifying information is limited to parties having a necessary and
justifiable place in a given identity relationship.

This is, IMHO, the same thing that caused the failure of
Novell’s digitalMe project … after it was taken over by others in the
company. It’s funny how some people at Novell really thought that
Novell was somehow going to become the de facto source of identity
information in the world.

I kept hearing these funny internal pitches about “billion
user directories” … and silly me I just kept thinking “I would rather
sell hundreds of millions of personal directories, then a couple
of ‘billion user’ directories!” How many “billion user”
communities are there on earth?

I think of a different theory on why these grand schemes
fail. Kim touches on this also. If you try to build the
“one big thing in the sky”, and there is a second group of people that
don’t like you or trust you, then they’ll build their own
version. Which means there will be two. If there are two,
then there will be three or more … and then things start to go in all
directions. It’s funny to see this even occurring in the Open
Source world. People have disagreements and fork a project …
and then it get’s forked again. I’m not saying this is bad at all
… it’s the natural progression. So build to embrace this!

The original digitalMe team was after building community
platforms, and then providing methods to federate … however much of
what we were pursuing was “client-side federation” … allowing the
user to be the federation point, since they exist at the intersection
of all of the communities that they belong to. We figured that we would allow anyone
to create a community … and allow people to choose the communities
that they wanted to belong to, and which ones they would trust.

Part of the reason that I strongly believe in the Third
Law is that this is how the “philosophical” views fall also. When
I participate in an identity transaction, I can choose to limit the
parties involved if I trust the other party or if the information being
exchanged is not too valuable. On the other hand, I might have to
bring in a third or fourth party if we both want to feel secure about
who the other party is, or I want to authenticate the identity
information being exchanged.

In the end … I like Kim’s thoughts …