Econometa

Matt Mullenweg questions claims that OpenID is a workable spam blocking tool. Expanding on my comments there, I see at least three ways people are looking at using OpenID:

(1) As a way to prove you own the URL associated with your blog comment. This is the original problem that OpenID was designed to address, and although commenter impersonation isn’t a big problem for most blogs, OpenID is a great solution.

(2) As a way to identify yourself to a web site without having to create yet another username and password. This is web single sign-on, which addresses a real problem for those who want to easily use all the great web apps out there that aren’t part of Google/Yahoo/Microsoft (a big advantage of which is that you can then log in using their IDs, which you probably already have).

(3) As part of a way to calculate reputation, which can then be used to block spam or grant permissions. Other commenters point to ways in which OpenID is headed in this direction, but I think Matt’s point is that it isn’t there yet, and there are existing solutions that work reasonably well.

I think (2), web single sign-on, is by far the most compelling. It’s a big problem, and OpenID could be a big part of the solution. To me it makes a lot of sense to focus on getting some real traction for Web SSO before tackling the much tougher reputation / spam problem, which unlike Web SSO already has some workable solutions.

But looking at the progress of OpenID and Web SSO in general, what is the biggest barrier to widespread adoption? Lots of people talk about issues like security, technology, and usability, and these are all important. But as I’ve said before, the most important thing is to make it as easy as possible for site owners to adopt the system.

That means minimizing integration requirements and supporting the identity interfaces these sites already use. This is exactly what we’re trying to do at PrefPass, for OpenID as well as the other IDs that a lot of users already have: make it easy and risk-free for site owners to eliminate passwords for most of their users right now.

Eric Janszen’s recent article notes the serial bubbles that have occurred since the 90’s, and predicts that the only viable candidate for the next bubble is alternative energy.

The argument that there will be another bubble seems pretty strong; but to me, the reasoning around how and why “the bubble cycle has replaced the business cycle” raises a lot of questions. He traces origins to the 1971 decoupling of the dollar from gold and the 1999 repeal of the depression-era Glass-Steagall Act regulating banks and markets. I don’t see a complete story there, but then again, maybe his book goes into more detail.

A backstory that I see being mentioned many other places is the question of how much longer the standard “reflation” methods can be used to recover from burst bubbles while inflating new ones. Interest rates, the dollar, and taxes are all already low, while the federal deficit is high; and the credit / real estate bust has yet to run its course. I suppose that short of moderating the cycles themselves, the lesson is to be disciplined in increasing rates, taxes, and surpluses while a boom is on.

Again via Steve Hsu, a thought-provoking article on how to make easy money running a hedge fund.

The basic idea is that a fund manager has a good shot at generating outsized returns over a limited time period by selling insurance against a low-probability event. The reason for the high return is the low but significant risk of losing everything.

This would be no problem ordinarily. This is the same reason a treasury note pays less than a corporate bond pays less than credit card debt: the federal government is less likely than a corporation to default, and a corporation is less likely than a single individual.

The problem is in transparency: since the investors don’t know what risks the manager is taking, they can only judge on results over a finite time period. If they were explicitly asked whether they were willing to run a 10% risk of losing everything for an extra 2 points of return, they might make a different decision.

At the root of this problem is compensation. The standard “2 and 20″ structure rewards gains but does not pass through losses, and it reflects a built-in assumption that some kind of reliable algorithm, strategy, or talent lies behind the higher returns. You could argue that the same problem exists with massive CEO stock grants: risky ways of boosting the stock price may pay off for the CEO in the short term, but may hurt the company and its investors in the longer term. In both cases, the manager is highly incentivized to increase risk behind a curtain of reduced transparency.

Which brings us to reputation, which is often cited as a factor that helps to solve this problem. The idea is that the above may work short term, but the manager’s career will be over when this hidden risk-taking inevitably comes to light. But this argument loses its force when today’s pay scales are considered. Loss of reputation has got to seem less threatening to many managers if the short term reward is so high that it permanently moves the manager into a new wealth strata. Many recent articles have made the point that top pay scales are really set by cultural norms; the reputation problem is at least one good argument for lowering these norms.

Supplemented by Steve Hsu, a rant on how few people get the training to really understand distributions, which are increasingly important in everyday life.

This reminds me of my foray into tagging, where I had to dust off my own understanding of distributions. On the one hand, the fact is that the topic can just be plain hard, and at times pretty counterintuitive. On the other, I’m sure that numbers themselves seemed hard until they became part of almost everything we do.

One point that seems like a good one: it’s true that statistics are essential to understanding things like news reports, Google Analytics, sales dashboards, sports stats, etc., and it probably wouldn’t be a bad idea for this fact to be reflected in school curriculums.

We just launched a new PrefPass product that I’m pretty excited about. You can think of it as a universal login widget. It’s some code that you paste onto your registration and login pages, letting users join your app without having to choose a password. Instead, they can use any of a growing list of IDs. For the launch, we’re supporting Yahoo, Facebook, OpenID, and AOL/AIM.

This is a really cool way to get more users to sign up for your app, without having to deal with the fast-changing landscape of digital identity solutions. Instead, just paste some code, and we’ll take care of it for you! The idea is to address some of the pain points for site owners (or “relying parties”) that I talked about in my previous post on the Laws of Identity.

You can read more about the new PrefPass service here; we’re also working on a WordPress plugin that should be out soon. Check it out!

This is old news, but somehow I’d never come across this particular chart before. In a white paper on solar power, I came across the following graphic:

This sheds new light on the stats regularly circulated about the growth of Internet advertising as a whole. Apparently, a fixed pot of money has just been getting re-allocated among various players, while Google has single-handedly been responsible for nearly all of the actual growth since 2002. Amazing.

I managed to stop by day two of the Internet Identity Workshop for a couple hours, and had some good conversations while seeing important specs come to life right there on the spot. Impressive stuff!

I had really wanted to attend the day three session on “The Business of Identity” initiated by Johannes Ernst, but I wasn’t going to be able to make it and so stopped by the previous afternoon.

One thing that’s clear is that the identity space is evolving to the point where the technologies are going to see adoption by web apps and sites as well as the larger companies that already are active users. I heard some pretty impressive news on this front from Andy Dale, but it doesn’t seem to be public yet so I won’t mention specifics here.

I do hope more folks keep thinking about marketing and how the profit motive can help drive the adoption of identity technology on the web. Great progress has been made in ensuring that these technologies are open, flexible, and not controlled by any one company or entity; but now that these barriers are gone, I think it’s time to start thinking about positive forces that can help to jump-start the entire identity ecosystem.

iiw2007

Kim Cameron’s Laws of Identity have received a lot of attention, and for good reason; these laws encode properties that are very important to users and identity providers, and previous attempts at identity systems violating these laws have been rejected by these two groups.

However, there’s another important group whose needs don’t seem as well represented in the Laws as they should be. That group is site owners, or “relying parties”. And it seems to me that on the web, site owners represent “reality”: an identity system might encompass the best ideas of the day and be beautifully self-consistent, but unless it meets the needs of this group, by definition it cannot be a success.

Now, it probably says more about where my head is at than anything else, but I’ve been noticing a lot of parallels between the current state of digital identity and that of another area I pay a lot of attention to: theoretical physics. So at the risk of establishing a completely opaque metaphor, I’m going to propose that:

The Laws of Identity are like String Theory

Like the Laws of Identity, string theory encompasses the best ideas of the day and has a beautiful self-consistency. But by definition, to be a success any proposal based on this theory has to match the actual universe we see around us. And so far, string theory has failed to generate such a proposal.

Similarly, any system based upon the Laws of Identity as formulated today cannot be successful unless it meets the needs of site owners, who in the real world are the folks who have to adopt the system. And right now, I think that the systems out there don’t match what many site owners need.

To be more specific, lets take a look at two standards with a lot of momentum right now: OpenID and CardSpace.

OpenID is like General Relativity

Like general relativity, OpenID simply and elegantly solves a specific problem: how to prove to a site that you own a URL. Here’s a diagram showing at a high level how the system works:

I’ve skipped some of the details here and in subsequent diagrams in order to create pictures that are easy to compare to each other.

Also like general relativity, OpenID is an amazingly effective but demanding tool. In particular, if used as an authentication tool, OpenID demands that the site owner integrate and keep current a block of additional code, and that the user database be altered to accommodate users who instead of a username/password use a URL to authenticate.

This makes sense for a site that really needs what OpenID offers: proof of URL ownership. And this is what OpenID was originally designed for: verifying the identity URL of blog commenters. But what about a typical site that just wants to offer its users an easier way to log in?

To me, asking a typical site to deal with libraries and database changes just to ease logins seems about as sensible as asking missile designers to use general relativity to calculate trajectories. You want to use the simplest tool for the job, and while GPS calculations might require GR, the vast majority of gravity calculations do not. Along the same lines, I’d argue that proof of URL ownership isn’t the simplest way to authenticate for most web apps.

CardSpace is like Quantum Field Theory

Now let’s consider CardSpace. Like quantum field theory, CardSpace is a flexible and powerful framework that can be used to solve a wide variety of problems. Here’s a diagram for CardSpace, simplified to be easily compared to the previous diagram:

CardSpace is another demanding tool for site owners: as with OpenID, they are faced with code integration and altered databases. But beyond this, CardSpace shares another characteristic with QFT: the feeling that something’s just not right. For me, QFT feels wrong because, among other things, it’s dependent upon a background metric. In the case of CardSpace, the problem is dependence upon client software. CardSpace is PC-centric, and dependence upon client software just feels wrong in today’s web-based world.

In particular, CardSpace puts the “identity selector” on the PC as software. This means that every client has to have this software, and even worse, the identity cards themselves are not web-native; they need to be transferred from PC to PC using a USB key. To me, this makes using CardSpace in place of username/password for web apps about as sensible as using QFT in place of Ohm’s Law. The PC-centric approach might make sense in the enterprise, but for consumer web apps it seems to me like a bad fit.

Another issue I have with CardSpace is that authentication with the identity provider doesn’t take place in a browser; instead, it seems to be constrained by what the identity selector software offers. If I have this right, this really limits options for the identity provider — what if they want to use two-factor authentication, or a captcha, or a personal image for anti-phishing? Only a browser interface provides the flexibility that at least I think is needed to accommodate the diverse landscape of identity scenarios.

Identity Meta-Providers are like Quantum Mechanics

OK, so what is it that web apps need then? I think that what’s needed is the analog of Quantum Mechanics: an approach that incorporates the core ideas of more complex systems yet is usable for solving practical problems.

Leaving the tortured metaphor behind, this means moving from an identity meta-system like CardSpace to an identity meta-provider. The new web is all about services, mashups, widgets — all available from any browser. Why should identity be any different?

The key differences between the idea of an identity meta-provider as opposed to a system are:

(1) the “identity selector” function is provided by a web service instead of by software on the PC
(2) rather than simply pass on whatever auth token is issued by the identity provider, the identity meta-provider translates this authorization into a form that is easily digested by the relying party

Since I’m focusing on web apps, I’ll assume the IMP translates auth into the usual username/password, which is certainly easy to digest by existing sites; but this isn’t a requirement. Here’s a picture, easily compared to the previous two:

The main idea is to change two things about existing approaches:

(1) to require minimal effort on the part of sites
(2) to keep everything web-centric

To me, this approach has a bunch of incredible advantages:

- The identity provider can now use a web page to authenticate
- No cards exist on the PC to be stolen, moved around, etc
- Site integration is incredibly easy

Of course, these advantages come with tradeoffs:

- Sites must trust that the IMP actually authenticated the user; no signature proves this (sites for whom this is important can always choose a IMP that passes the native token on)
- Users can only use identity providers that the IMP decides to support (this can be addressed by competition among IMPs)
- The additional network communications to and from the IMP are attackable

In my opinion, these tradeoffs are well worth it.

The 8th Law of Identity?

Coming full circle, the idea of an identity meta-provider addresses what could be thought of as the “missing 8th Law of Identity”. This would be something like:

A universal identity system must streamline site adoption by minimizing integration requirements and supporting the identity interfaces these sites already use.

For most web sites who would like to ease user registrations and logins, this means that the system must hook up to existing username / password systems.

Is an 8th law, along with the concept of identity meta-providers, enough to get us to Kim Cameron’s “identity big bang”? I’m not sure, but I do think it’s a step in the right direction.

Get Flash to see this object.

UPDATE: Since writing this, I’ve come across a couple of proposals that have some of the same moving parts, but accomplish different objectives.

Kim Cameron proposed using CardSpace to authenticate OpenID users at their identity provider. This sounds like one way to reduce the phishing vulnerability of username/password authenticated IPs, but of course it brings back the requirement of client software.

Dmitry Shechtman proposed (and illustrated) a browser plug-in that, as I understand it, would implement a kind of CardSpace-style OpenID identity selector. This also helps reduce phishing vulnerability, and has a nice flow that simplifies the current OpenID user experience. But again, client software is required and relying parties still face the same integration issues.

I noticed that I keep having the same conversation with people on fundraising. Understanding how ownership changes when a company raises money by issuing stock really is simple and straightforward. I think I’ve pinned down at least one issue that might make this stuff seem more complicated than it is.

The issue is that entrepreneurs are usually most interested in one number: percentage. As in, what percentage of the company will I own after raising money? This can confuse things because the way financing works, percentages aren’t treated as inputs; they’re treated as results of decisions on value. It was suggested that I lay this out in a blog post, so, here it is.

At its most basic, the important inputs to financing math are the pre-money valuation, and the amount raised. These numbers result in percentages. So let’s say for example that two founders decide to each own 50% of a company, and then they decide to raise $500k on a $1M pre-money valuation. That means that before the financing, the company is worth $1M, and right after the financing, the company is worth $1.5M (since it now has $500k in the bank). So, since the investors contributed $500k of the $1.5M post-money value, they now own 33% of the company. That means that the founders now own 33% each — they’ve been “diluted”.

This approach makes sense since the focus is on something that shouldn’t depend on how much money is raised: how much the company is worth right now. Then, depending on how much money is raised, the existing shareholders are diluted to lower percentages to make room for the investors.

Here’s a quick spreadsheet to play with that hopefully will make this all clear. The yellow bolded cells are the ones where you enter values; everything else then falls out from there. The number of shares per dollar of value is totally arbitrary; here it’s pegged at 10 cents a share.

Kevin Burton points out that given current ad monetization capabilities, CraigsList is leaving millions on the table every year. And Kevin says that it’s “evil” to do so, since that money could be given to charity.

I can see his reasoning: a way to do good is to make tons of money and give it away to help people. So if you leave potential money unearned, you’re either shortchanging yourself or the people you would have helped. This especially seems like a compelling argument when it comes to advertising, which appears to be “free” money since it is only exchanged for the momentary attention of users.

But the fact is, the absence of ads on CraigsList represents value for users. How big a value is it to not have to see a few ads? My own feeling is that it’s not all that big, but I think it’s safe to say that most people would choose a site without ads over one with ads if given the choice. And since there’s no shortage of CraigsList imitators, that translates to what could be a very important competitive advantage.

So you can view the decision to not run ads as a bet: a bet that in the long term, this will enable CraigsList to keep their lead in the market. Sure, they could run ads now and send a few billion to charity, but that would be short-lived as they lost users. GM could sell all their assets and send it all to charity too, but there wouldn’t be any GM in the morning.

Now I have no idea if Craig or anyone else at CraigsList thinks of it this way, but you can view this decision as the application of a straightforward business philosophy: listen to your users fanatically and give them exactly what they want as long as you can cover costs. By never building any excess profit cushion into your business, you never leave the door open to a competitor to undercut you. And as a bonus, customers love you.

I would even say that as everything about web apps gets easier and easier, this might well become one of the only ways to build a sustainable business on the Internet. The barriers to both building apps and to users switching are getting lower all the time. This leaves critical mass and customer loyalty as two of the only real competitive advantages left. Charging the minimum to users, both in terms of fees and distractions, is a solid strategy. It’s a way to build and defend mass and loyalty against the competitive apps that will inevitably be chasing the same users in short order.

Update:

Some commenters in the original NYT article point out that ad revenues can also be used to address the “unmet needs” of CraigsList users, and that if this investment is not made, CraigsList will lose to a competitor that does fund this additional work via ads. This is a valid point, but I’d argue that the success of CraigsList so far is evidence that the company is keeping profits at the right level to develop *only* those features that user really want. This is a judgement call, and so far at least, it looks like they’ve made the right calls.

Other commenters say that CraigsList is engaging in “predatory pricing”, and that this pricing is putting others like newspapers out of business. I don’t find this a convincing argument. Predatory pricing (or loss-leading or dumping) is when a company sells a product at a loss in order to either build market share or drive others out of the market. CraigsList is profitable. While they are not *maximizing* short-term profits, this may be exactly what is needed to stay a viable business. The fact that classified ads are not bringing newspapers the same revenues as they used to is just further evidence of this; evidence that minimizing excess profits is what’s needed to compete in a market where it’s so easy for ideas to be realized and for users to switch.