Top all-time · #4771
Kim Cameron
Personal blog · identityblog.comsecurityphilosophy
Kim Cameron's personal blog at identityblog.com covers security and philosophy. Since 2010, 16 different Hacker News readers have linked it 23 times, most often “The laws of identity (2005) [pdf]”. The last post was in 2020, but the archive is still widely read.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link Kim Cameron's blog for its writing on digital identity, including his Laws of Identity and posts on federated identity, privacy and Facebook tracking.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /stories/2004/12/09/thelaws.html3 people · 4 mentions · first linked 2011-12-02
- The laws of identity (2005) [pdf]3 people · 4 mentions · first linked 2018-02-11
- 24 year old student lights match: Europe versus Facebook3 people · 3 mentions · first linked 2011-10-18
- /?p=3522 people · 2 mentions · first linked 2013-01-01
What Hacker News says?
Apologies for the late reply - with Xmas and so on I've only just seen this. That said, I suspect you're familiar with neither the scope nor scenarios and clients that Government Gateway services. Verify only does SAML. No ADFS/WS-* (so no support for the NHS, for example), no Chip & PIN (both Identify and Respond, on Java and .NET silicon -- this is important because provisioning), and assorted side-scenarios requi…
Comment linking /stories/2005/05/13/TheLawsOfIdentity.pdf
on “NHS.UK frontend”Submitted 24 year old student lights match: Europe versus Facebook as a story · 579 points
HN discussionI think if you look at Kim Cameron's Laws of Identity, it's clear that the research team at MS has had it right for at least a decade, it's just that none of their ideas have made it into production. http://www.identityblog.com/stories/2004/12/09/thelaws.html Ballmer had both the plans and source code for an identity product that would have been 10x more advanced than Facebook, but they decided to axe the project so…
Comment linking /stories/2004/12/09/thelaws.html
on “Introducing Mozilla Persona, An Identity System for the Web”Submitted Gov2.0 and Facebook ‘Like’ Buttons as a story · 4 points
HN discussion> Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? Of course not. In fact, business models were only considered tangentially in most cases because the general goal was to create an ecosystem of federated identity providers transacting over open protocols. Differentiation would come from the relationship between customers and their provi…
Comment linking /stories/2004/12/09/thelaws.html
on “People (understandably) hate to register”Submitted The laws of identity (2005) [pdf] as a story · 2 points
HN discussionHey, what's the point of DuckDuckGo when you have the NOTORIOUS FACEBOOK TRACKING CRAP in the page http://duck.co/topic/duckduckgo-in-opera and the forums ? see http://nikcub.appspot.com/facebook-re-enables-controversial-... and http://www.identityblog.com/?p=1201 http://europe-v-facebook.org/EN/en.html defeats the intent and reputation of DuckDuckGo.
Comment linking /?p=1201
on “DuckDuckGo included in Opera”Submitted Zip code deemed personally identifiable in California. as a story · 1 points
HN discussionMicrosoft acquired U-Prove-It way back in 2008 [1]. I wonder if there is any connection between the U-Prove-It approach and ION. The linked article is from Kim Cameron's blog, and if you are interested in identity I highly recommend following his content. [1] https://www.identityblog.com/?p=939
Comment linking /?p=939
on “How to get back into a hacked Facebook account”Submitted Microsoft's chief architect of identity criticizes Apple,Google on privacy as a story · 1 points
HN discussionIf you need any ammunition to get it looked at more intently, here: http://www.identityblog.com/?p=1201
Comment linking /?p=1201
on “Tim Berners-Lee: Tell Facebook, Google you want your data back”Submitted Identifying website visitors through "history stealing as a story · 1 points
HN discussionYou're right, I think. If anyone worries about whether their design is correct or not it's because they've never treated PII with the respect it deserves. This is doubly so for entities engaging in user-hostile practices. And it's a sad state of affairs. ~12 years ago, in 2005, Kim Cameron first published his 7 laws of identity[1]. Follow those and you'll ace GDPR. Instead we've been directing the sharpest, brightes…
Comment linking /stories/2005/05/13/TheLawsOfIdentity.pdf
on “GDPR: sorting the fact from the fiction”Submitted MyPay demonstrates how not to do good security user experience . as a story · 1 points
HN discussionFirst, it's awesome that this rather important subject is getting attention, and kudos to Jen for giving it thought and providing a perspective [1]. Logging adds value once an account is compromised, so is a contingency measure (minimising impact). Solving this problem requires mitigation (minimising probability) as well as contingency. Many comments here suggest the use of PKI. PKI is part of a solution and, as wit…
Comment linking /?p=352/
on “I long for the future where I can safely assume my passwords are stolen”I'm of the opposite opinion because the seven laws of identity ( http://www.identityblog.com/?p=352 ). Specifically law 3 (justifiable parties): Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.
Comment linking /?p=352
on “Flickr is removing Facebook and Google sign-in”Not quite sure which (or who's) whining you're having a go at, but as an identity system OAuth is indeed a pile of poo. First, OAuth1's poorly-spec'd signatures make implementation difficult. That's an accepted and pretty well-documented fact. OAuth2 removes all crypto and instead relies on bearer tokens and SSL/TLS, while not mandating it. It does away with signatures in favour of ease of implementation. [edit] Thi…
Comment linking /stories/2004/12/09/thelaws.html
on “The OAuth chronicles: I am not stupid”Note that this is my personal opinion. I think we should be trying to come up with new solutions - BrowserId/Persona some some identity problems, but nowhere near all. Have a read through Kim Cameron's post [1] to get a feel for how naive, if noble, Mozilla's efforts are. http://www.identityblog.com/?p=352
Comment linking /?p=352
on “Show HN: A decentralized Internet identity system I'm working on.”Neither. Google and identity is a bad idea regardless of the problem you're trying to solve ( http://www.identityblog.com/?p=1204 ). It's the worst of the three. OTP is good, but challenge-response is better. Is your OTP from a second factor? Card Space is my personal favourite, but the [card] portability issue hasn't been solved. U-Prove holds promise. CardSpace, with U-Prove and second-factor challenge/response wo…
Comment linking /?p=1204
on “Foamicate: A new system for authenticating users without using passwords.”You're right. It's the poor man's identity federation. Before I start, let me make myself very clear - I think Dan did an awesome job with Foamicate. Seriously. One guy. The balls to put something out there that's innovative and seeks to solve a REAL problem. I'm impressed. And if I were in a position to, I'd ask Dan to work for me. That said, it's worth (IMO) considering what an identity system should provide - Use…
Comment linking /
on “Foamicate: A new system for authenticating users without using passwords.”I'm not so sure identity in that sense is that important. It's important to advertisers for sure, but where's the value to Jane or Joe consumer beyond being able to claim a piece of cloud data as her or his own? The mistake, in my opinion, is to insist on connecting identities across devices, and across meat space and cyberspace. I don't have any answers, but do know that Kim Cameron's seven laws of identity[1] are…
Comment linking /stories/2004/12/09/thelaws.html
on “In mobile, everything is still wide open”When two postal-code locations (e.g., day and night, home and work) are sufficient to specifically identify 90% of the population, and with Android devices being infested with location-tracking capabilities (above and beyond GPS), creating a pseudonymous account != hiding your identity from Google (or whomever else it shares data with, intentionally/willingly or otherwise). As I've noted previously (< https://news.y…
Comment linking /?p=1168
on “Aurora Store Accounts Blocked by Google”A good backgrounder would be The Laws of Identity https://www.identityblog.com/stories/2005/05/13/TheLawsOfIde...
Comment linking /stories/2005/05/13/TheLawsOfIdentity.pdf
on “Why use OpenID Connect instead of plain OAuth2?”
