Dizzy and I had a wide-ranging conversation today about identity. We agreed that trust and identity are two quite separate issues -- trust is something that is built on top of identity. But what is identity? Something's identity is the bundle of characteristics associated with it (often, but not necessarily, its more stable, essential, or distinguishing characteristics). But notice that word "something" -- the concept of identity depends on the more basic concept of entity. Identity is not merely that bundle of characteristics, it is those characteristics bundled together or integrated by the fact that they are all related to a particular entity.
For example, the folks at my local library might know me as the guy who shaves his head, has blue eyes, and always orders such interesting books through interlibrary loan (they also might know me by the number on my library card, but that's only once I hand them my card -- I know my library card number from memory, but I doubt they do). But they don't have in their heads a random bundle of "shaved head", "blue eyes", "lots of ILL books" -- those characteristics are integrated by the fact that they all pertain to a particular person. If someone else walked in with those characteristics, they would not mis-identify that person as me (in fact they'd probably look for differences, such as the fact that this other person doesn't have a goatee).
Now, in the physical world we are all familiar with the kinds of characteristics that we focus on in identifying other people, because humans have hundreds of thousands of years of experience in doing just that (and survival often depended on correctly identifying someone else). The challenge in the digital realm is that we have only a few years of experience in figuring out what the salient characteristics are -- and that most people don't have very many characteristics. I think this last point is significant, because lots of folks don't actually do much online (or what they do does not leave public traces). Other people have more online presence, as it were. For instance, I keep a weblog, have a website with many pages of content, periodically leave comments at other people's blogs, am associated with a public organization (the Jabber Software Foundation), post to lots of public discussion lists from a well-known email address, participate in archived chatrooms using a well-known Jabber ID, there are photos of me online, I have a PGP key, and so on. There are many ways to find me or find out about me (blog, personal website, organization website, email address, Jabber address, etc.), so that results in a larger bundle of characteristics than is associated with some random Joe who sends you a message.
But it seems to me that these are still all just bundles of characteristics. How does one integrate all those web pages, addresses, posts, archived conversations (etc.) into a digital entity? A lot of people and companies talk about digital identity, but it strikes me that we haven't even figured out digital entities yet (or, perhaps, figured out how to associate all of those digital characteristics with a physical person).