Good to get straight to the point.

Would that make the non-serrated knives an edge case?

OAuth is being stress-tested by agents, delegated authority, proof-of-possession, and richer context. The interesting question isn’t which new draft wins. It’s where OAuth should draw its boundaries. My latest:…

You do not need to know everything about the Web platform to be a good W3C TAG member. You do need depth somewhere, curiosity beyond it, W3C experience, Process knowledge, time, funding, and an employer who understands that “do it on top of your day job” is not support. I wrote about what it…

A wallet can be standards-compliant. A verifier can be standards-compliant. The transaction can still be a mess. I'm learning to really dislike "interoperability." The RP has to deal with browsers, operating systems, wallet behavior, credential formats, trust decisions, fallback, and all the…

Wallets can be mandated into existence. Good verifier experiences can’t. The question I keep coming back to: when an RP accepts a digital credential, what old process actually disappears? If the answer is “none,” the carrot still isn’t…

Which identity conference should you attend? I made a field guide to RSAC, Identiverse, EIC, ID4Africa, IIW, Authenticate & The Identity Salon—what each is good for, who should go, and when your travel budget is better spent elsewhere. Not a ranking. A decision…

A standards process can be public and still be hard to understand. Better structured process data could help people answer: What matters? How mature is it? Who’s involved? Where’s the discussion? Do I need to care yet? Some thoughts on transparency beyond…