Online identity management and single sign-on still doesn't work. Not well enough, anyway. OpenID is a good step forward. So are a bunch of other less familiar approaches. But we still haven't arrived.

For example, I've been a member of Blogger for the duration. That is, since long before Google bought the company. In the old days, making a comment on a Blogger blog was fairly easy. Now it's a lot more complicated. I'm sure that's mostly because comment spam is a gigantic problem, especially for a gigantic company like Google.

But still, from the human visitor's perspective, it's a mess. Here's a screen shot I took after failing for the Nth time to successfully post a comment on a Blogger blog:

For what it's (not) worth, I have a Blogger ID, a Google ID, several OpenIDs, some number of i-names, maybe some information cards (I'm not sure I actually have any yet, but I do think they're good to have), plus cookies from countless sites in my browser's jar, none of which seems to help with this.

I shouldn't complain, because I've been involved in the user-centric identity development community for many years, and have played an active role in helping various efforts (both competing and complementary) to move forward and get along with each other in the process.

But still, we ain't there. And I don't believe we'll get there until each of is known and/or trusted automatically by those with which (or whom) we have relationships. You know, like in the Real World.

For that to happen, we need to hack a way for the individual to drive the interaction. It isn't enough for identity to be "user-centric". In fact, it isn't enough to focus just on identity. After all, I don't need to identify myself when I walk into a grocery store and pay cash to buy stuff. In fact, the stores' "loyalty cards" are terrible systems that not only fail as identity cards, but require dual pricing for every item they "discount", while also slowing down the checkout line. It's as if some kind of digital identity disease has infected ordinary brick & mortar stores as well.

Real engagement needs to be user-driven. That means the individual should be fully empowered to engage with any person or service in the digital world on his or her own terms, in easy, consistent and well-understood ways that may or may not require identifying one's self.

We each need to be independent variables, not dependent ones. What makes me trustworthy to a service like Blogger shouldn't be code that lives entirely on Blogger's side, while all I've got is one among a zillion ID/password combinations, most of which I don't remember. I need to be trusted when I show up. Automatically.

Maybe the means for making this happen will live out in the cloud somewhere. Or in many places. (I can see a lot of potential business here, actually.) But none of it will work unless it starts with the individual. Each of us operating in the digital world needs tools for engagement that belong to us, are operated by us, and give us autonomy, capability and control.

If we get that, we can say goodbye to ugly stuff like the interface above — plus the massive market friction that comes from every vendor having its own silo'd ways of dealing with customers, including CRM (customer relationship management) systems that are controlling and inhuman beyond endurance.

Can we do that? Can we build tools that make individuals both independent of vendor control yet better able to engage with vendors? Can we fix the silo'd authentication problems that have plagued online markets from the beginning? I think we can. That's one reason why I started ProjectVRM at Harvard's Berkman Center.

But I don't know the answer yet, because we don't have the code. Some of us are working on it. You might see evidence by peeking through windows here, here, here, here, here and here — as well as in various corners of the identity community and via links in the blogroll here.

But it's still early. The challenge is still out there.

Is this an itch any of you programming folks feel like scratching — for your own good as well as the rest of the world's? If so, say so below. Or follow what we're doing at the VRM Workshop on Monday and Tuesday.