Basically this Law says that identity system must define human user as one of the component in distributed systems and communication between human-machine should be protected against attacks.
Returning to the discussion we've just had about the problems with today's browsers, I would summarize my thinking by saying we have done a pretty good job of cryptographically securing the channel between web servers and browsers - a channel that might extend for thousands of miles. But we haven't done a very good job at all of setting up the two or three foot channel between the browser and the human who uses it. And this is the channel that is attacked by phishers.
I tried to solve the problem of Phishing and unsecured browser-human channel by providing an alternative to address bar (I know Kim is not a big fan of 'yet another address bar'). The alternative is that if user has identified his Service provider he/she can store the link to it as a metadata in Smartcard and once he has successfully pinned his Smartcard, this meta data will be extracted (securely) by some custom control in browser. I used this approach in Liberty LECP profile demo using .NET Smartcard storing the list of service providers as Xml metadata.
I feel that if we can achieve such kind of interaction [friendly enough for non-technical users] with the human element in distributed systems we should be good ? ....... Please comment.