[slx26]

Hey, I've seen the project in the past and it's very interesting, and definitely an improvement over existing alternatives. That said, I have one complaint quite unrelated to tech itself: I think the liberal use of the term "identity" is very inappropriate. Of course "identity" is an extremely hard term to even define, but as far as I can see ory kratos is only assisting with email and phone verification. To talk about "identity" on that context seems very out of place to me. Maybe there's more that I've missed, and if that's the case I'm sorry. I understand words have more than one meaning, but there are big challenges to solve with regards to identity in the digital world that as far as I can see ory doesn't try to solve at all, and we end up spending time reading through the docs and trying to see if someone is making a meaningful contribution to the field for nothing. I know competitors use the term irresponsibly too, but... nevermind.

Sorry for the rant and what may sound like a very negative comment, I wrote this quickly. I think it would be great to right away stop using the term "identity" so freely and use something else, or at least clearly explain what do you understand for identity. I think it would be great for programmers to start disambiguating the concept, and I think projects like ory have a good opportunity (that you yourselves created and built, of course!) to make it a bit better.

[harel]

I understand what you're saying here. I'm doing some looking-into identity as the concept of a verification that a person is who they say they are, not in the context of authentication but in the "real world". I've learned to read that word "identity" very loosely. As you said - it's very had to define.

[unethical_ban]

Hm. I agree with you: Identity is a user account or role. Verification is backing up the assertion of initial registration with phone, email, address, and so on.

Authentication is the verification of identity after registration.

Authorization is the verification of permission for an identity to take an action.

[j0057]

I usually understand "Identity" in the context of authentication and authorization to mean "who is the person or process trying to access the service", what do you think is inappropriate about this use of the word? Or another way to put it, from what should it be disambiguated?

[slx26]

A user account, an email or a phone number do not uniquely identify a person or process, and it doesn't tell you whether it's actually a person or a process.

Edit: "account" may not fully capture everything ory might be trying to do, but it's definitely closer than "identity".