Identity vs. Identity Records

Identity (and Identity Theft) is a huge topic and seems to be getting even hotter.

I'm worried, however, that so many people focus in on identity records (digital bundles of bits that are supposed to represent a person) or ID cards, rather than identity. Sure, we can have lots of fun moving ID records around and we can design all sorts of competing protocols to do that - but it's all a pointless game unless we tie this to real identity. All ID mechanisms I've seen are based on false assumptions to tie them to real identity.

X.509 is based on the false assumptions not only that a Disgintuished Name (DN) identifies a person uniquely (false) but that any Relying Party (RP) encountering that DN will know to whom it refers (laughably false). Until those false assumptions are corrected, this is a totally pointless activity.

Government-issued, photo ID cards have a photograph to tie an identity to a person - an authenticator that the person examining the ID card can verify. Given that, we can ask about the probability of false positive (or false negative) from that biometric match - and ask about the difficulty of forgery.

But, let's not bury ourselves in discussions of ID cards or ID records or protocols for moving ID records around, as if the hard problems had been solved. Let's solve the hard problems first and then re-examine what we need in the way of cards or records or protocols. My guess is that once we solve the real identity problem, we will have discovered things that may improve on current ID record and ID card thinking enough to make current plans obsolete.