Got say, the mini wildflower meadow looks amazing.

Standards processes need appeals, objections, and ways to challenge decisions. But when those same tools are used to exhaust people, delay work, or make participation unsafe, the process stops protecting the work. New post: When Process Stops Protecting the Work

Choosing a Discovery Mechanism Is the Hard Part Heather examines why choosing the right discovery mechanism is one of the most challenging aspects of digital identity architecture. This episode explores how DNS, well-known URIs, registries, and catalogs each solve different discovery problems, and…

When Discovery Starts Taking Action Discover how discovery is evolving from simply finding information to enabling automated action across AI agents, digital identity systems, and distributed services. This episode explores why capability discovery, metadata, and governance have become essential…

The Digital Life We Forgot We Had Examine the growing challenge of managing the digital lives we accumulate over time. From forgotten accounts and subscriptions to digital estate planning and account recovery, this episode explores how personal identity data becomes increasingly difficult to…

Off to Las Vegas for Identiverse. I should be saying something fun and uplifting, but I’m mostly tired from wrangling content for 170 amazing sessions. I got to review so much in advance, which is a privilege. The tradeoff is that I rarely get to attend sessions onsite.

Identity Discovery Is More Than Finding the Login Button "In the first post in this series, I framed discovery as a broader systems problem." The challenge is not simply that search engines need to be better....

Discovery is not just search. It is how people and systems find information, accounts, credentials, endpoints, and authority across an increasingly fragmented internet. This post starts a new series on why that matters.

Consensus is great when it works. But standards work also needs a path for serious disagreement. Appeals, Formal Objections, and similar processes are not failures by default. They are how standards bodies make room for review when consensus breaks. Time to talk about the less-than-happy path!

Identity conferences discuss wallets, proofing, AI, and future trust models. Many organizations are still dealing with duplicate accounts, legacy systems, and unclear ownership. This post is about why identity maturity is uneven, and why practical progress matters more than generic advice.

Wallet and digital credential adoption is accelerating through regulation, mobile IDs, and age assurance laws. That does not mean the market is mature. Standards remain unsettled, ROI is uneven, and trust models are still forming. Here's my latest take on what comes next.

Identity Systems Don’t Make Decisions Heather examines why identity systems do not actually make decisions on their own, and how enterprise security outcomes emerge from fragmented, distributed processes. By unpacking how identity, risk, and policy tools interact, this episode reframes modern…

What the AI Vendor Landscape Reveals About Fragmented Identity Systems Heather explores how the AI vendor landscape reveals deeper challenges in fragmented identity systems and enterprise security architecture. By examining how tools function across identity, signals, policy, and enforcement…

NEW BLOG: From CDT’s Nick Doty, “Distributing the Keys for Private Access to the Web.” Every lock needs a key – but encrypted DNS and Encrypted Client Hello (ECH) only work if users can obtain the configurations that enable them.

Your talk was accepted. Excellent. Now you get to navigate the *abundance* of advice on how to prepare. A few practical tips on what actually matters and how not to make things harder than they need to be.

“Think of the children!” is a powerful argument. But building age verification into the internet raises real questions for privacy and identity systems. I took a closer look at where age assurance stands today.

I am the adultiest adult to ever have adulted. Annual exam AND dental appointment all in one day! Wooooo! I am now going to go back to avoiding acting like a grown-up for the rest of the day. Neener neener!

When AI agents start buying things online, the web’s architecture gets interesting. Identity, payments, delegation, liability... all suddenly matter in new ways. A few thoughts on the emerging world of agentic commerce.

Just recorded (and now live!) on the IDAC podcast 🎙️ Thanks to Jeff and Jim for a sharp, enjoyable conversation. It’s always an honor to be on the best identity-focused podcast. www.identityatthecenter.com/listen/episo...

It’s a super low key day. Just ask my neighbors.

oooh, a second April 1st RFC! This is a subtle one: RFC 9949, BUSA-TLS: Mandatory Audio Component (MAC) Pre-Shared Key (PSK) Derivation for TLS 1.3 Using 2 Live Crew's "Banned in the U.S.A." www.rfc-editor.org/info/rfc9949

I wish there were a good answer here. The tension between competing regulations and what's technically possible makes this a nightmare for any company that has to deal with it. I do actually have a post coming out about it on April 14. (Sorry I didn't respond on thread; interaction was restricted)

I was worried we wouldn't see an April 1st RFC this year, but they've come through! RFC 9948: Internet Protocol Police (IPP) - Schedule of Punishments www.rfc-editor.org/info/rfc9948

Last time I asked whether AI-enabled browsers fit the W3C definition of a Web User Agent. Short answer: mostly yes. But that raises the more interesting question: What needs to change in the Web Platform Design Principles to make that answer a comfortable yes? Some thoughts.

Right now, we’re calling them “AI browsers.” But like most things labeled AI, that name probably won’t last. Soon they’ll just be… browsers. Which makes this question worth asking now: if a browser starts acting on your behalf, does it still fit the W3C definition of a Web User Agent? Maybe.

To all the independent journalists out there, a colleague of mine has a request, if you have a few minutes and are open to chat about your process:

The protective case for my new laptop arrives today, which leaves me with some very important decisions to make. What stickers go on the new case? (In addition to these two, of course)

There are oodles of great nuggets in the @aaronfrancis.com keynote from the Commit Your Code conference. Some that really resonate for tech blogging…

If you work in digital identity, you will eventually run into ISO and ISO/IEC work. This guide breaks down how ISO, IEC, and JTC 1 actually operate, and why participation and timelines often feel very different from more open SDOs.

Shopify is preparing for an ecommerce transformation via AI shopping agents, says president Harley Finklestein.

Poll: Nearly 1 In 10 Adults Have Postponed Retirement Due To Healthcare Costs https://theonion.com/poll-nearly-1-in-10-adults-have-postponed-retirement-due-to-healthcare-costs/

It’s pretty, but I’m glad I’m not outside.

How NOT to Get Your Conference Submission Binned Heather Flanagan explores why conference submissions succeed and why many proposals get rejected during call for proposals review. As a content chair, she shares what reviewers look for in an abstract, including clear outcomes, audience fit, and…

Digital wallets are moving into production — and suddenly the difference between selective disclosure and ZKPs really matters. Here's a practical look at where the complexity actually lands.

#til that Organic Roasted Seaweed is more addictive than potato chips nom nom nom nom.

Ooooh, it's pruning season and folks are in the yard working on my orchard. I love seeing the cleanup before spring and am just sad that I'm not out there with them. (I'm prepping for some meetings and events over the next 10 days and am going to miss all the pruning fun.)

We’re hosting an absolutely amazing lineup of speakers and talks this year. Take a look and pls join us if anything looks interesting. It's free + virtual. www.scylladb.com/2026/02/17/m...

This post tackles a bunch of questions around what "success" means when it comes to technical standards. Is it purely about adoption, or is there room for technical purity? Should a standard describe reality, or shape it? Let's discuss! #standards #techindustry

As generative AI evolves, a Google VP warns that LLM wrappers and AI aggregators face mounting pressure, with shrinking margins and limited differentiation threatening their long-term viability.

Erlend did a pretty good job responding to the “Be wary of Bluesky” article, but I’ll add a couple of other comments

Mood

Understanding the FIDO Alliance’s Standards and Working Groups Heather Flanagan explores why the FIDO Alliance can feel difficult to follow from the outside, and why that silence is often misunderstood. This episode examines how FIDO’s approach to standards development differs from more open…

Chairs run the process. Contributors write the standards. If you want to influence how specs actually turn into something implementable, this post breaks down the skills that make contributors effective and trusted.

Twenty-three hours before my first international trip of the year. Amsterdam in February is not my favorite, but the small conference will be fun to facilitate (tiime-unconference.eu).

Internet shutdowns make Internet fragmentation real. They’re not technically hard, and they’re becoming normal. Using Iran as a case study, this post looks at how shutdowns work, why they’re increasing, and what they mean for identity, platforms, and global interoperability.

“It is impossible to protect privacy from authoritarianism without addressing consumer privacy.” - from Daniel J. Solove, Privacy in Authoritarian Times - final published version here: papers.ssrn.com/sol3/papers.... #PrivacyMatters

This week’s mantra turned out to be: “Murder is a choice I am not making today.”

OH in a meeting: “They are like assholes. Everyone has them, and everyone should have just one.”