The W3C recently held a workshop on Identity in the Browser for which a number of position papers are available as well as a blog post, agenda with presentation links, and a workshop report.
I submitted a position paper and gave a presentation noting that requirements that are simple to express can have large consequences in terms of complexity and implementation. I mentioned as an example to efforts in the Liberty Alliance to avoid correlation of identity across service providers through the use of opaque name identifiers. Another example is managing policy definitions with multiple parties involved in setting policy. I also highlighted the applicability of the FTC Do Not Track requirements mentioned in the previous W3C workshop on Web Tracking and User Privacy.
The workshop was well attended, including significant attendance and interest from a wide variety of stakeholders.
Possible next steps were focused on incremental improvements to current technology, with the intent of achieving results in a short time frame, including
(a) Creating a standard for tagging web form fields so that password fillers can work reliably (e.g. know which field is user name, password etc )
(b) Enabling crypto functions available to Javascript applications, with the approach of encouraging re-use of secure implementations rather than use (mis-use) of primitives
(c) further discussion of the broader issues on a mail list.
There was a useful review of requirements with rough agreement on most of these. Discussion of the failure of some earlier attempts at addressing these issues included mention that this is a wicked problem, that usability is essential, that it must be a decentralized and user-centric system and that the buy-in of all stakeholders, including web service providers is essential, and that there must be incentives for all.
Note was made of the relevance of the NSTIC (US National Strategy for Trusted Identities in Cyberspace) initiative.
There were many interesting papers, a small sampling is the following:
Federated Browser-Based Identity using Email Addresses, Mike Hanson Dan Mills Ben Adida
The Emerging JSON-Based Identity Protocol Suite, Michael B. Jones, also see the slides
(edited first paragraph to update link to workshop report and provide link to agenda with presentations)