The new vocabulary

One of the more irritating features of Identity 2.0 is the apparent determination to rename every concept in the field regardless of whether the existing nomenclature serves the intended purpose.

Specialized vocabulary plays an important part in any field, it serves as a shorthand for arguments that we do not wish to have to repeat every time. But specialized vocabulary is also potentially a trap, in particular it may contain assumptions which we need to examine.

I don't think we need to introduce nebulous terms such as 'Identity' into the mix. But some apparently minor changes in vocabulary represent a major change in viewpoint. For example:

User Experience, not User Interface. Despite sounding like an exercise in marketting the difference is important. Using the term user interface concentrates our attention on the code and implies that the user is just another machine for the computer to interact with. The term experience is much broader and includes code, documentation, graphical layout and installation. The term experience encourages us to think about psychology and whether the user's expectations from the product will be met.

Trustworthy not Trusted. As I pointed out at the first meeting of the Trusted Computing Group, almost every computer system we have today is trusted. The challenge we need to solve is that they are not trustworthy. Since then others (notably Microsoft) have made the same observation independently.

Least Risk not Least Privilege. As pointed out earlier today the Least Privilege 'principle' is really a mechanism rather than a governing principle. Talking about least privilege encourages us to think only in terms of setting ACLs on system resources. We need to think about reducing risk in other ways. The Default Deny principle is essentially another instance of least risk as is the idea of concentrating all security sensitive operations in a TCB.