In some ways, wouldn't it be great if the internet had evolved with, analogously to DNS, 'User Name Servers', like a sort of global distributed IAM?
Leak monitoring would be a service provided by the UNS, not falling to a volunteer, and credential revocation could be automatic and immediate.
I suppose we sort of have that bolted on with OpenID/OAuth, but that's still 'choose a provider' rather than 'this is the one way', with many servers run by different entities, but one 'system'.
It's existed since 1988: LDAP/X.500[1] It's just not used globally because of three reasons, as far as I can tell,
1) most people don't want their information public and searchable to that extent
2) most orgs _want_ to silo you in or otherwise control your account
3) the org using x500 still needs to have their own permissions separate from the central directory, which is the harder part of auth[nz], so just rolling your own authn is often easier.
Ah yes, and Shibboleth is another I should've thought of in earlier comment.
I think you're absolutely right in particular with #2.
But if it had come originally, alongside DNS, 'everything has an address, everyone has an identity', it might've been an unquestionable fact of the internet.
Orgs can't silo you in to their alternate net where they have a more desirable domain name, because it's just not practical or user friendly.
I just think it might have been so for user identity.
At first glance it seems worth reading properly tomorrow. Except, '1 April', is it a gag RFC? (In a way, I suppose, it doesn't matter - those tend to be as worthwhile!)
The critical flaw (for users) of Oauth is that there is no portability between providers. Unlike a domain name, You can't move your login ID to a different provider
Leak monitoring would be a service provided by the UNS, not falling to a volunteer, and credential revocation could be automatic and immediate.
I suppose we sort of have that bolted on with OpenID/OAuth, but that's still 'choose a provider' rather than 'this is the one way', with many servers run by different entities, but one 'system'.