In my line of work at TrustBearer, we work with a number of different identifiers, be they OpenID URIs, usernames, or email addresses. In this way, I probably don’t have an realistic appreciation for how most people using such identifiers think and feel about their email addresses, usernames, or twitter handles. And for this reason, I’ve found the research of doctoral student Ben Gross (@bengross) quite interesting and valuable.
In short, Gross has found that people have rather personal feelings about the identifiers that they are assigned and used, and they have a hard time using these identifiers how they would like, or how their employer expects them to.
Much of this research was discussed in a recent presentation at BayChi San Francisco (a chapter of the ACM Special Interest Group on Computer-Human Interaction).
Gross’s research involved talking with people in two types of companies, financial and creative, about the identifiers they use at work and in their personal life. His findings help explain why people often accidentally (and purposely) misuse identity systems:
- Most people are managing a few email addresses, dozens of usernames and passwords, and several other identifiers, and they make very complex social decisions about how and why they use these identifiers.
- The people Gross talked with wanted their identifiers to be their own name—even John Smith— or something meaningful and easy-to-remember.
- People want to use personal and other identifiers at work; if they have trouble with identity and communications systems at work, they use personal ones, e.g. their Hotmail.
- Everyday use of identifiers can involve technical concepts, which are foreign to most users.
- Some people Gross talked with started using an identifier in a certain way, but they don’t remember the initial reason or preference for this.
- People usually don’t understand and often dislike and avoid identity system policies and rules.
Gross also has looked into what people know and don’t know about their privacy related to identifiers. Like something you are or something you have, the things that you are assigned, such as a IP address, a location, or a web cookie, act as identifiers. And it is these identifiers that are most often used on the web for tracking people’s behavior and information (See Kim Cameron’s recent post about browser fingerprints). In this case, Gross looks forward to better applications and tools that allow average web users to control their privacy and for more transparent policies with regard to what information companies or other entities store and track.
Gross’ dissertation and published writings are available on his website. He has written about OpenID and OAuth on his blog at The Messaging News.
Digital Trust 