Bob Blakely, Global Head of Information Security, Citi Group Larry Lessig argued in “Code (And Other Laws of Cyberspace)” that computer program code can create a place of freedom or a place of oppressive control. In this session, Bob Blakely argues that the code of logon and registration interfaces creates a power imbalance in which organizational interests override individual interests—and that this imbalance can be reduced or eliminated by making one small change in the code of those interfaces.

1. WHAT IF IDENTITY WERE
PASS-BY-REFERENCE?

2. WHAT IF IDENTITY WERE
PASS-BY-REFERENCE?
A drama in text messages

3. HI, I'M BOB

4. I'M INTHE DRAMA
DEPARTMENT

5. I'M INTHE DRAMA
DEPARTMENT
At Citibank

6. WATCH THIS.

7. SHORT ATTENTION SPAN
SUMMARY

8. SHORT ATTENTION SPAN
SUMMARY
Passing a pointer to your identity
is a better idea
than passing your identity

9. TELL ME MORE...

10. TELL ME MORE...
I hear you cry

11. TEXTINGTHE CAR
DEALER

12. I'd like a car

13. I'd like a car
I have a Cadillac STS for
$32,000

14. I'd like a car
I have a Cadillac STS for
$32,000
I like the STS, but I'm only
willing to pay $27,000

15. I'd like a car
I have a Cadillac STS for
$32,000
I like the STS, but I'm only
willing to pay $27,000
OK, but you'll have to get
the LE package with 4
cylinders

16. I'd like a car
I have a Cadillac STS for
$32,000
I like the STS, but I'm only
willing to pay $27,000
OK, but you'll have to get
the LE package with 4
cylinders
OK. I'll take the red one. I'd
like to finance over 4 years

17. I'd like a car
I have a Cadillac STS for
$32,000
I like the STS, but I'm only
willing to pay $27,000
OK, but you'll have to get
the LE package with 4
cylinders
OK. I'll take the red one. I'd
like to finance over 4 years
That loan is at 6.25%

18. I'd like a car
I have a Cadillac STS for
$32,000
I like the STS, but I'm only
willing to pay $27,000
OK, but you'll have to get
the LE package with 4
cylinders
OK. I'll take the red one. I'd
like to finance over 4 years
That loan is at 6.25%
I want 5.5%

19. I'd like a car
I have a Cadillac STS for
$32,000
I like the STS, but I'm only
willing to pay $27,000
OK, but you'll have to get
the LE package with 4
cylinders
OK. I'll take the red one. I'd
like to finance over 4 years
That loan is at 6.25%
I want 5.5%
I can do that

20. TEXTINGTHE CAR DEALER

21. TEXTINGTHE CAR DEALER
If Identity Architects sold cars

22. I'd like a car

23. I'd like a car
That will be $52,000

24. I'd like a car
That will be $52,000
Here you go

25. I'd like a car
That will be $52,000
Here you go
Here's your white Ford
Escort.

26. I'd like a car
That will be $52,000
Here you go
Here's your white Ford
Escort.
It comes with a vinyl wrap
advertisingThe Gap.

27. I'd like a car
That will be $52,000
Here you go
Here's your white Ford
Escort.
It comes with a vinyl wrap
advertisingThe Gap.
And the radio plays Fox
News

28. YOUTHINK I'M BEING MEAN

29. YOUTHINK I'M BEING MEAN
DON'TYOU?

30. I'd like a social media
account

31. I'd like a social media
account
Send me your name, email,
SSN, Credit Card, and phone

32. I'd like a social media
account
Send me your name, email,
SSN, Credit Card, and phone
Here you go

33. I'd like a social media
account
Send me your name, email,
SSN, Credit Card, and phone
Here you go
Here's your account.

34. I'd like a social media
account
Send me your name, email,
SSN, Credit Card, and phone
Here you go
Here's your account.
You want cheapViagra?

35. I'd like a social media
account
Send me your name, email,
SSN, Credit Card, and phone
Here you go
Here's your account.
You want cheapViagra?
You'll be hearing from the
FISA Court

36. I'd like a social media
account
Send me your name, email,
SSN, Credit Card, and phone
Here you go
Here's your account.
You want cheapViagra?
You'll be hearing from the
FISA Court
But you didn't hear that
from me. Tell them
Snowden told you.

37. I'd like a social media
account
Send me your name, email,
SSN, Credit Card, and phone
Here you go
Here's your account.
You want cheapViagra?
You'll be hearing from the
FISA Court
But you didn't hear that
from me. Tell them
Snowden told you.
Seriously.

38. WHAT DOESTHE CAR DEALER KNOW...

39. WHAT DOESTHE CAR DEALER KNOW...
THATTHE IDENTITY ARCHITECT DOESN'T?

40. I'd like a car
I have a Cadillac STS for
$32,000
I like the STS, but I'm only
willing to pay $27,000
OK, but you'll have to get
the LE package with 4
cylinders
OK. I'll take the red one. I'd
like to finance over 4 years
That loan is at 6.25%
I want 5.5%
I can do that

41. WHAT DOESTHE CAR DEALER KNOW...
THATTHE IDENTITY ARCHITECT DOESN'T?
The car dealer knows how to deal with counteroffers

42. TEXTINGTHE SERVICE PROVIDER

43. TEXTINGTHE SERVICE PROVIDER
If Identity Architects understood counteroffers

44. Identify me. Use this
@address and this #token

45. Identify me. Use this
@address and this #token
OK. Hang on

46. Identify me. Use this
@address and this #token
OK. Hang on
...

47. Hey @address! Some dude
says you can identify him
using this #token

48. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token

49. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR

50. WAIT, WHAT?

51. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token

52. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?

53. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?
#name and #address

54. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?
#name and #address
What will you use it for?

55. LIKE, ZOMG, RIGHT?

56. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?
#name and #address
What will you use it for?
FedEx. AndViagra ads.

57. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?
#name and #address
What will you use it for?
FedEx. AndViagra ads.
That'll be $50

58. MIND. BLOWN.

59. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?
#name and #address
What will you use it for?
FedEx. AndViagra ads.
That'll be $50
Whoa. Just FedEx?

60. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?
#name and #address
What will you use it for?
FedEx. AndViagra ads.
That'll be $50
Whoa. Just FedEx?
Deal. Stephen Falken,Tiny
Island, Oregon

61. Maybe. Who are you?
Hey @address! Some dude
says you can identify him
using this #token
My name is @WOPR
What do you want to know?
#name and #address
What will you use it for?
FedEx. AndViagra ads.
That'll be $50
Whoa. Just FedEx?
Deal. Stephen Falken,Tiny
Island, Oregon
OK, but...

62. How do I know the guy who
sent me the token is really
Falken?

63. Send him this #challenge.
if he replies with this
#response, it's him.
How do I know the guy who
sent me the token is really
Falken?

64. Send him this #challenge.
if he replies with this
#response, it's him.
How do I know the guy who
sent me the token is really
Falken?
KTHXBAI

65. Identify me. Use this
@address and this #token
OK. Hang on
Answer this #challenge
...

66. Identify me. Use this
@address and this #token
OK. Hang on
Answer this #challenge
#response
...

67. Identify me. Use this
@address and this #token
OK. Hang on
Answer this #challenge
#response
Greetings, Professor Falken.
...

68. Identify me. Use this
@address and this #token
OK. Hang on
Answer this #challenge
#response
Greetings, Professor Falken.
...
Would you like to play a
game?

69. API

70. IDENTITY
CONSUMER
identify_me()

71. IDENTITY
CONSUMER
identify_me()
IDENTITY
PRODUCER
identify_subject()

72. IDENTITY
CONSUMER
identify_me()
IDENTITY
PRODUCER
identify_subject()
SUBJECT
challenge()

73. PROTOCOL

74. IDC.identify_me
(*IDP, subject_token)

75. IDC.identify_me
(*IDP, subject_token)
IDP.identify_subject
(subject_token, IDPname,
requested_subject_attrs,
requested_uses)

76. IDC.identify_me
(*IDP, subject_token)
IDP.identify_subject
(subject_token, IDPname,
requested_subject_attrs,
requested_uses)
subject_attrs, restrictions,
challenge_token,
response_token

77. IDC.identify_me
(*IDP, subject_token)
IDP.identify_subject
(subject_token, IDPname,
requested_subject_attrs,
requested_uses)
subject_attrs, restrictions,
challenge_token,
response_token
subject.challenge
(challenge_token)

78. IDC.identify_me
(*IDP, subject_token)
IDP.identify_subject
(subject_token, IDPname,
requested_subject_attrs,
requested_uses)
subject_attrs, restrictions,
challenge_token,
response_token
subject.challenge
(challenge_token)
response_token

79. IDC.identify_me
(*IDP, subject_token)
IDP.identify_subject
(subject_token, IDPname,
requested_subject_attrs,
requested_uses)
subject_attrs, restrictions,
challenge_token,
response_token
subject.challenge
(challenge_token)
response_token
RINSE AND REPEAT FOR NEGOTIATION

80. USE CASES

81. IDP =
subject
IDC
FIRST-PARTY REGISTRATION

82. IDP =
subject
IDC
FIRST-PARTY AUTHENTICATION

83. subject IDC
THIRD-PARTY REGISTRATION
IDP

84. subject IDC
THIRD-PARTY AUTHENTICATION
IDP

85. BENEFITS

86. No identity information is exchanged
until terms of use are negotiated

87. Both users and Identity Consumers
can state terms and negotiate

88. Phishing defense
via authentication of Identity Consumers

89. Simple, minimal "webdevified" API and protocol

90. Anonymity, pseudonymity, and "real names"
are supported using a single API and protocol

91. First- and third-party identity producers
are supported using a single API and protocol

92. Registration and authentication
are supported using a single API and protocol

93. BOB.BLAKLEY @ CITI.COM

94. THANK YOU

95. I'LL BE HAPPYTO ANSWERYOUR QUESTIONS