Who someone is, to a system.
WHAT IDENTIFICATION IS
Claiming an identity.
WHAT AUTHENTICATION IS
Proving that claim.
WHAT AUTHORISATION IS
Determining what that identity may do.
WHY THE DISTINCTION MATTERS
They are frequently conflated, and the conflation causes serious faults.
WHAT AN IDENTIFIER IS
A value referring to a person or entity within a system.
WHAT MAKES A GOOD ONE
Unique, stable, and not carrying meaning.
WHY NOT CARRYING MEANING
Identifiers derived from personal attributes leak information and break when attributes change.
WHAT FEDERATED IDENTITY PROVIDES
Authenticating with one provider and using that across services.
WHAT IT REDUCES
Passwords, and the surface for credential attacks.
WHAT IT CONCENTRATES
Risk, in the identity provider.
WHAT SELF-SOVEREIGN APPROACHES PROPOSE
Individuals holding credentials themselves, presenting proofs rather than data.
WHAT SELECTIVE DISCLOSURE MEANS
Proving a fact without revealing the underlying data.
WHY THAT MATTERS
Proving someone is over an age without revealing their date of birth.
WHAT TO MINIMISE ALWAYS
Identity data collected and retained.
