Public Identity

LinkedIn Comparison

Sun, 15 Sep 2024 00:00:00 GMT

LinkedIn is one of the most popular sites for work-related profiles.

Advantages

Go-to directory for work-related stuff
Optional verification

Disadvantages

Their profiles reflect this focus on work.
They are trying to be a social platform, thus downplaying external blogs and social sites.

Sizing

They claim over 1 billion members in 200 countries.

Notable fields

website - options for:
- Personal
- Company
- Blog
- RSS Feed
- Portfolio
- Other
birthday - only day and month, no year
instant messaging - options for:
- Skype
- ICQ
- Google Hangouts
- QQ
- WeChat
name pronunciation - can only be set in their mobile app
location - only region, postal code and city
pronouns
headline - free-form text displayed under your profile image

Verification for LinkedIn Accounts

Sat, 14 Sep 2024 00:00:00 GMT

LinkedIn also has verification.

For identities, they use CLEAR, Persona and DigiLocker.

In addition to identity verification, they also have it for specific things that are on your profile:

workplace (via email domain, or if your company uses a Microsoft or LinkedIn service)
educational institution (via email domain)

They do not have verification for your website.

Verification for Google Play Accounts

Fri, 13 Sep 2024 00:00:00 GMT

Google has had to handle with a lot of bad behaviour in the Google Play Store and has come up with a comprehensive verification process.

Individuals (including the primary contact for an organization) need to submit photos of a government-issued ID: passport, driver's license, etc.

Organization need have a DUNS number and then submit proof of the exact name: tax forms, government-issued legal documents or a credit report from one of the major credit bureaus.

These are all in addition to the normal email, phone and website verifications.

Links:

Required information to create a Play Console developer account
Verify your developer identity information
Verify your website - uses the Google Search Console

Hellō.coop Comparison

Sun, 14 Jul 2024 00:00:00 GMT

I am planning to use Hellō.coop for authentication, but they can also be seen as a competitor.

Similarties

Verified identities
Verified links to identities at various services

Differences

PIDO will have unverified identities (presumably marked as such)
PIDO will have identities that are added/verified by admins
PIDO will have identities for organizations.
Hellō is going to monetize via paid validation.

Summary

Hellō is focused on verification while PIDO is focused on completeness. I think the differences are enough that I don't have to worry about them cutting off PIDO.

It would be awesome if I could get Hellō to add a "make my identity public" checkbox that publishes to PIDO.

Audit trail

Sat, 13 Jul 2024 00:00:00 GMT

I want to have a detailed log of everything that changes.

Schema:

table_id: which table is being updated
row_key: primary key of the changed row
action: insert, update or delete
before: JSONB of data before (or null for insert)
after: JSONB of updated data (or null for delete)
admin_id: user that is making the change
request_id
session_id
pib_key: the primary key of the identity

Maintainability

Sat, 13 Jul 2024 00:00:00 GMT

I want to have enough data to be useful, but I don't want to have to maintain/update it.

I am under no illusions that people will update their own data, so I will not store things that are likely to change.

Open question: should there be a specific page per identity? Versus just having the search results page with all the information. If there is a specific page, what should the URL be? I will do a separate post about having handles (and possibly monetizing them).

Examples:

Root website only: specific pages (i.e. contact page, location, etc) move too often
No detailed addresses: only country. Maybe city?

Deleting data

Fri, 12 Jul 2024 00:00:00 GMT

Inevitably, I will need to delete data. Should I use hard or soft deletes?

Hard deletes

Actually remove the rows from the database

Cons:

No easy way to show what has been deleted
Reliance on audit logs to see deleted data

Soft deletes

Add a deleted_at timestamp or deleted flag to the row

Cons:

all INSERTs have to be UPSERTs in case a deleted row exists
if not, duplicates have to be handled (i.e. deleted column has be part of the unique index)
database fills up with unused data
queries have to handle it (or use a view that does)

Notes

I don't think I will need to "undelete" a row.
There will be an audit trail, but it will get huge and need to be archived, etc.

Logins

Fri, 12 Jul 2024 00:00:00 GMT

Admins (and eventually everyone) needs to be able to login.

I do not want to maintain my own username/password database and want to use a third party provider.

I found Hellō which looks like a good fit from a product and a philosophy perspective. It could also be useful for validating identities with the different providers without having to integrate with them directly.

My current thinking is that users should be separate from identities, so a user could have zero or one or multiple identities, and an identity can have no users (if it was added by admin).

However, a "person" (vs "organization") identity should be limited to a single user. Though I'm not sure if this should be enforced at the database level.

Additionally, every login should be logged.

Blogs

Sun, 23 Jun 2024 00:00:00 GMT

A primary use case is finding blogs. Blogs will generally have an RSS or Atom news feed which is machine-readable.

Some sources of blogs:

Marginalia.nu - a search engine that has a public download of all blogs included in its index.
ooh.directory

Schema.org data schema

Sun, 23 Jun 2024 00:00:00 GMT

Schema.org is a standard for including metadata in web pages.

They have schemas for both Person and Organization

Google's deindexing/reindexing of Tuta

Sat, 22 Jun 2024 00:00:00 GMT

Tuta is a privacy-focused email provider and direct competitor to GMail.

In April 2024, Google deindexed Tuta from generic email-related terms. In June 2024, Tuta was back in the results.

Tuta has complained Google has a monopoly on search, and (IMHO) they are correct. I understand that Google doesn't want to share its algorithms with spammers, but it has a responsibility to provide a fair and unbiased results. When the results are (to an outside observer) blatently anti-competitive, it should (at least privately) explain what is going on.

I don't think that I'll ever get to the point of being a monopoly, but in any case, I plan on being fully transparent. External signals (and paid listings) will be noted and auditable.

Phonebook (yellow pages) Comparison

Sun, 16 Jun 2024 00:00:00 GMT

In the days before the internet, we used phone books to find the phone number of someone we wanted to call. The phone books were divided into two sections: white pages, with an alphabetical list of every number, and yellow pages with business numbers grouped by category.

Advantages

The list included every phone number for the given area.
Opt-out was monetized: you could pay for an unlisted number.
There wasn't any advertising, but you could pay to for ads and for enhanced (bold or boxed) listings.

Disadvantages

Each phone book only included numbers for a given area.
Areas with a lot of businesses had huge phonebooks.
It was run by the phone company and only included businesses with phones.

Notes

This is directly comparable to what I want to build. I wouldn't monetize opt-out, maybe I could charge for enhanced listings.

In the United Statues, the term "yellow pages" is generic and not trademarked. Thryv (owners of the yellowpages.com domain) has the trademark on "The Real Yellow Pages".

Keybase Comparison

Sat, 15 Jun 2024 00:00:00 GMT

Keybase.io is a service/website focused on private communication/sharing based on shared public/private keys.

Part of the service is claiming identities at various services.

Advantages

Ties multiple identities together is a secure and auditable way.
APIs to get and verify identities.
Profiles are not blocked by robots.txt and show up in Google searches.
Website has working search functionality.

Disadvantages

Requires a fair amount of technical knowledge.
Wants to install a client app.
Acquired by Zoom in May 2020 and has been very quiet since then.
At one point they had a way to add a new service to the list of places where you could verify, but the documentation link is no longer valid.

Current verified fields

Website - multiple allowed, verify via DNS or /keybase.txt file
Twitter - via tweet
Github - via gist
Reddit
Hacker News
In a "more" submenu:
- omg.lol
- DMOJ: Modern Online Judge
- Lobste.rs
- Quantum Resistant Ledger
- Galactic Talk
- LinkPool Market
- Tac Social
- LFG Directory

They also have:

PGP Key
Bitcoin address
Zcash address

Notes

Despite the Zoom takeover, the servers are still running, and the identities/proofs can still be found and validated, so I think it will be a useful as a seed data source.

Keybase Wikipedia entry says there are 407,163 registered users as of 2019-08-22 but does not indicate the source.
2019-04-15 HN Discussion when they started supporting Mastodon verifications.
Verification suggestions Github issue
Keyoxide.org is a possible alternative/replacement.

Soatok: Towards Federated Key Transparency

Sun, 09 Jun 2024 00:00:00 GMT

A blog post from Soatok about end-to-end encryption for the fediverse. The big problem that they see is not the private keys, but the managing the public keys.

While PIDO itself will be a centralized service, I'm hopeful that somehow it can be part of the solution.

Domain Names Comparison

Thu, 25 Apr 2024 00:00:00 GMT

Domain names are a key part of how the internet works.

Advantages

They are easily recognized and used.
They are public (by design).
Most identities that are big enough have a website and thus a domain name.
Generally speaking, you need to pay for a domain name, so there are some limits to spam.
Lists of registered domain names are available.

Disadvantages

Not everyone has their own website.
Not everyone has a top-level domain: Mozilla maintains a public suffix list of top-level domains that allow unrelated identities under them. Some of these allow free registration and are prone to spam.
There are a lot of unused domains.
The whois service shows who owns a domain, but is so heavily redacted that it is not useful.

Notes

As of 2024-04-24, there are about 379 million domain names (source).

I do not think domain names can be used for seeding identities.

Overview of all the top-level domains
jschauma/tld-zoneinfo - instructions for getting counts

Phonebook (white pages) Comparison

Wed, 24 Apr 2024 00:00:00 GMT

In the days before the internet, we used phone books to find the phone number of someone we wanted to call.

Advantages

The list included every phone number for the given area.
Opt-out was monetized: you could pay for an unlisted number.
There wasn't any advertising, but you could pay to have your name in bold.

Disadvantages

Each phone book only included numbers for a given area.
Areas with a lot of people had huge phonebooks.
Areas with a lot of people has a lot of duplicate names. They used address to help disambiguate, which is not currently desirable from a privacy standpoint.
It was run by the phone company and only included people with phones.

Notes

This is directly comparable to what I want to build. I wouldn't monetize opt-out, maybe I could charge for a bold listing.

Wikipedia Comparison

Tue, 23 Apr 2024 00:00:00 GMT

Wikipedia is an excellent resource for finding people.

Advantages

The data has been manually verified.
The infobox usually has all the relevant links.
Lots of people use it, so it (hopefully) is up to date.

Disadvantages

You need to be "Notable". This limits Wikipedia to only the most well-known people.
The identity is owned by Wikipedia. Wikipedia editors can change or block your updates.
Other people can make updates (which can be an advantage)
Not every article has an infobox.
There are multiple types of infoboxes.

Sizing

As of 2024-04-23, the English Wikipedia has 6.8 million articles (from Wikipedia:Size_of_Wikipedia).

This page also has a graph that shows the English Wikipedia is about 10% of the total, but much of that is auto-generated translations, and there will be duplicates even if it isn't. Wild guess: English is 25% of the total, so maybe 30 million articles.

Future research needed: How many pages have infoboxes. And which types of infoboxes?

Notes

I plan to use Wikipedia to seed the PIDO identity database.

Useful links:

Infobox
Infobox Help - guidelines and step-by-step instructions on created and editing an Infobox.
List of infoboxes - there are (unfortunately) a lot of different flavors of infoboxes.
Style Manual for Infoboxes

Google Comparison

Mon, 22 Apr 2024 00:00:00 GMT

Google is the 800 pound gorilla for anything involving search, including identities.

Advantages

They have indexed the entire public internet: so chances are that they know about you.

Disadvantages

They have indexed the entire public internet, so there is a lot of junk and noise. Your identity may not be in the top results.
They can't index identities if the GoogleBot isn't allowed in, so many social network identities will not be indexed even if they are public.
Their update algorithms are opaque and usually have a delay.

Notes

They have several different services that have profiles. Future posts will dive into each one.

Starting

Sun, 21 Apr 2024 00:00:00 GMT

I registered the publicidentity.org domain name and started a FAQ with notes about what I am planning to build.