Decius wrote:
1. Anyone can host identities.
2. Anyone can accept identities.
3. The identities mean something.
I figured I'd preemptively answer the obvious question this raises. The way you achieve this is by: 1. Allowing identity providers to make assertions about the identities they provide. 2. Providing identity acceptors with mechanisms for managing the list of identity providers from whom they trust assertions and what sort of assertions they trust. -- 1. Allowing identity providers to make assertions about the identities they provide. Basically, the identity host must be able to say things like: User Bob54 says his name is "Bob Marley."
User Bob54 says his email address is "bob@gmail.com."
- We tested this with a verification email on 01/01/06 and it worked.
User Bob54 has been a user of our system since 01/01/06. Preferably, the user should be able to control which assertions the provider provides to which acceptors, so that private information can be managed in the system. 2. Providing identity acceptors with mechanisms for managing the list of identity providers from whom they trust assertions and what sort of assertions they trust. There are many possible architectures here. It may be the case that a small number of widely trusted identity providers will emerge, but unlike passport the system will be open to competition. One approach that I like is to have an entity that audits identity providers and publishes a list of ones that follow certain best practices. That entity could collect user fees from both providers and acceptors. RE: Mind blowing delivery of Identity 2.0 | 
