What do you call it when a metaphor or analogy outgrows the word it is based on, thus co-opting that word to mean something quite new? Metaphors are meant to clarify complex concepts by letting people think of them in simpler terms. But if the detailed meaning is actually different, then the metaphor becomes misleading and dangerous.
I’m thinking of the idea of the electronic passport. Ever since the early days of Big PKI, there’s been the beguiling idea of an electronic passport that will let the holder into all manner of online services and enable total strangers to “trust” one another online. Later Microsoft of course even named their digital identity service “Passport”, and the word is still commonplace in discussing all manner of authentication solutions.
The idea is that the passport allows you to go wherever you like.
Yet there is no such thing.
A real world passport doesn’t let you into any old country. It’s not always sufficient; you often need a visa. You can’t stay as long as you like in a foreign place. Some countries won’t let you in at all if you carry the passport of an unfriendly nation. You need to complete a landing card and customs declarations specific to your particular journey. And finally, when you’ve got to the end of the arrivals queue, you are still at the mercy of an immigration officer who has the discretion to turn you away. As with all business, there is so much more going on here than personal identity.
So in the sense of the meaning important to the electronic passport metaphor, the “real” passport doesn’t actually exist!
The simplistic notion of electronic passport is really deeply unhelpful. The dream and promise of general purpose digital certificates is what derailed PKI, for they’re unwieldy, involve unprecedented mechanisms for conferring open-ended “trust”, and are rarely useful on their own (ironically that’s also a property of real passports). Think of the time and money wasted chasing the electronic passport when all along PKI technology was better suited to closed transactions. What matters in most transactions is not personal identity but rather, credentials specific to the business context. There never has been a single general purpose identity credential.
And now with “open” federated identity frameworks, we’re sleep-walking into the same intractable problems, all because people have been seduced by a metaphor based on something that doesn’t exist.
The well initiated understand that the Laws of Identity, OIX, NSTIC and the like involve a plurality of identities, and multiple attributes tuned to different contexts. Yet NSTIC in particular is still confused by many with a single new ID, a misunderstanding aided and abetted by NSTIC’s promoters using terms like “interoperable” without care, and by casually ‘imagining’ that a student in future will log in to their bank using their student card .
Words are powerful and they’re also malleable. Some might say I’m being too pedantic sticking to the traditional reality of the “passport”. But no. It would be OK in my opinion for “passport” to morph into something more powerful and universal — except that it can’t. The real point in all of this is that multiple identities are an inevitable consequence of how identities evolve to suit distinct business contexts, and so the very idea of a digital passport is a bit delusional.