knowing who you are ...

Scaling out from my tumblr post on providing long term access to an email redirection service for students, knowing who someone is over time is an interesting problem.

And it's not the email forwarding solution that's the problem - essentially if what you do is create a rule on your incoming mail gateway that says

if recipent == 'xx@yy.edu.au'
then
add_reply_to (xx@yy.edu.au)
rewrite_to (%actual_address)
forward_to (%actual_address)
endif

all fairly straightforward and it can run forever - computers are good at that sort of thing. Obviously there's things like scaling and processing time, but basically if you can process these rules for 30,000 accounts you can easily scale up to three times that amount.

And of course you can play tricks like rewriting the reply to address to be xx@alumni.yy.edu.au if you want to make it clear that the person isn't really anything to do with yy.edu.au anymore.

There is of course the 'Dan Smith' problem - you probably want to ensure that the able young researcher is dan.smith@yy.edu.au and the miserable old bugger with a degree in landscape design is dan.smith9@yy.edu.au. There are a range of ways to solve that problem but the easiest is probably making alumni alumni.yy.edu.au and giving duplicates the possibility of changing their name to be dan.t.smith@alumni.yy.edu.au.

After all no one really wants to have a clunky looking email address - which is why alumni never much bother with their student email address when it looks like ccz34567@yy.edu.au once they've told all their facebook friends and they're new address is funky_dan@xyz.com.au - a decision they may later regret, but hey, that's life.

No, the problem comes with when they tire of funky_dan and want to change the redirect to something more professional - how do we allow someone to prove who they are?

My initial suggestion is to make them get an OpenID or tie it to a yahoo or google account. That's probably an ok solution for email forwarding - if there's a compromise probably the worst that will happen is that some embarassing emails from a former girlfriend end up in the mailbox of some poor guy in Patagonia. No worse than what happens when you get a new, but actually recycled, phone number.

However, if we also say that students can access their transcripts - something that's important for proving their qualifications - online we have a different problem - we have a serious long term identity management problem, especially when someone has stopped using the system for a number of years, changed address and name twice, and now wants to apply for a job, needs a transcript and has forgotten their student number - the problem of persistence of online identity - oh yes and in an international university you can't appeal to things like id card numbers or drivers licenses - they change as well ...

The probable actual solution is to have a password/identity management system that allows multiple entry points, ed student number, or if you've forgotten that, either a previously nominated OpenID, or the email address that you previously nominated to have your email forwarded to - this at least identifies you as a person known to the system.

However, given that you might not actually still be using that email address, what we do in the latter two cases is drop you into a classic challenge/response magic questions scenario where you have to answer three out of the five that you answered when you registered for alumni services when graduating, or even better when you first got your student computing account.

As the answers for these questions need to be long lived they need to be gender and culturally neutral and things already unlikely to change by the time you're eighteen.

Examples include:

What is the name of the first school you went to?
What was your mother's first name?

Bad examples include 'what street did you live on when you were eight' - some places don't have street names, eg small towns in 1960's Sarawak, 'what is your mother's maiden name' - some cultures have different rules about what happens to a woman's name when she marries.

Answer three out of the five correctly, and we'll confirm your student id number. Answer a different three out of the five correctly, we'll let you change your password, and then you can change your email forwarding address, download your transcript, update your alumnus record with new name and or address or whatever, and we can be reasonably assured that you are who you say you are.

The important thing is to realize this is very much an 80% solution - there will be people who somehow escaped registration for alumnus services, people who answered 'Pope Celestine XII' to all the questions, and who twenty years on can't remember what they did, and people who just do wierd things - offering a 1900 paid for support line should however keep the support load to a minimum.