InternetBonding

“Internet Bonding” refers to an “Internet Bonding Process.” You become Internet Bonded when you keep a consistent presence on the Internet. Everyone can search your past and future online, and thus there is a trust that you aren’t just an artificial personality. The longer you are online, the more trust there is. You are “Internet Bonded.”

Things that strengthen InternetBonding:

People want to trust that you will behave and be responsive to the community. Anonymous contributors are often suspected, perhaps unfairly, for being less trustworthy. By securing your comments to your identity, people trust you more, and allow you greater participation.

InternetBonding does not spell the end of zones of anonymity. You can still dress up in a costume and go to a ball. But, it does mean that, when communities need to be secure, that they are able to do so.

InternetBonding does not necessarily mean HardSecurity.

Small HardSecurity may or may not be used to secure a person’s expressions with the person itself.Huh?

However, SoftSecurity can frequently be used to rectify breaches of online identity.

(page title)

Would “IdentityBonding?” or “ProofOfIdentity?” or “EvidenceOfIdentity?” be a better page title ?

(translations)

[fr] LiaisonInternet

See Also

OpenSocialNetworks

Discussion

Does Internet Bonding require Hard Security?

This is a far bigger issue than I’ve posted here; This is mostly a StubPage?. I imagine that, in the future, this page (or something like it) can grow to much, much more.

InternetBonding will almost certainly become more sophisticated and graded in the future. I would not be surprised to see agencies, both public (voluntary, ThePublicWeb,) public (government,) and private, made to grade and authorize that specific posters are who they say they are, and that particular accounts are secure representations of that poster’s words.

I can imagine an elaborate InternetBonding procedure developing in the OpenSource / FreeSoftware world, or any other place where people are doing serious things. I could easily see computer registration, examination of premesis, (performed by local people who were previously InternetBonded) and biometrics being held in a public store.

A web-site could use a PGP-system to verify identity now. I suspect it would take special browser plug-ins, and prevent posting away from one’s terminal. One could just confirm one’s posts when one gets home, I suppose…or refute actual spoofs. For fully secure posts, one would need to be at home.

Does this sound at all workable?

Let’s see, how does this work? Are you authenticating a particular browser?

I’d do it so that if a post was not authenticated, and the user had signed up for authentication, there’d be a note saying, “Warning: This user may not be who this says they are!” It’d also note that certain IP addresses had been abused before, for IdentityTheft.

I think we’d want to be able to authenticate multiple browsers to the same person.

I think on a social level (SoftSecurity-wise) we already have this. I know I thought of “building trust” in my name back when I started to post private information and rambling thoughts on my first web pages on Geocities. And with OnlineDiary and WebLog and all that we’ve come a long way to consciously build an image of ourselves; a name, an identity for other people to attache their trust to. So when I post a comment on some stranger’s blog, I make sure to post a link to my own blog, not to push my Google rank, but to give the other person a chance to check out who I am.

Given this SoftSecurity aspect, I hesitate to introduce HardSecurity such as public key infrastructure to the system. Because then we’re replacing social trust (where we can be spoofed, but where we can also explain that we have been spoofed and then it isn’t so bad!) – we’d be replacing a working social system with a technical system. And experience has taught us that technical systems are brittle where they should be resilient. SoftSecurity is resilient eventhough it is, well, “soft.” ;)

Let us not go down this road. Let us remember that the main issue here is trust. And no amount of passports, logins, and cryptography will increase trust. They just complicate things.

Alex: you say that no amount of passports, logins, or crypo will increase trust. Why should we believe you? --EvanProdromou

P.S. Couldn’t resist. Sorry.

shrug

I’m not so attached one way or the other.

I prefer SoftSecurity.

But I bank with HardSecurity.

:“No, I didn’t write that check. No, I don’t have that Playstation 2. Yes, I realize I’m in that demographic. Yes, I was planning to buy one. Yes, I realize the man you talked with said he was LionKimbro. But no, I didn’t. My friends can vouch for me. You don’t happen to have a friend of my friend of my friend, do you? Let’s check Friendster.”

;)

Sometimes, I don’t know if something’s SoftSecurity, or HardSecurity.

If we collaboratively authored trust metrics, would that be SoftSecurity, because we did it as a community? Or would it be HardSecurity, because we did it by computers, databases, and data sets were validated by PublicKeyEncryption?

I don’t know. I’m not really attached to it, either way.

When I read BruceSchneier’s books, I take home two messages:

  1. Security is a strong as the weakest link. Consider trust metrics validated by strong cryptography. Are we fortifying the weakest link? I don’t think so. We’ll have bugs, identity theft, we’ll have revoked keys, spoofing, certifying authority problems, trolls, people sneaking into communities to break them, … All of the real problems continue unsolved. In the mean time, some grown-up kids get to play with cryptography. This is why I don’t believe in HardSecurity for social problems. HardSecurity is for logins to multi-user systems, protecting against eavesdropping on the Internet (the end-points remain insecure!), SerialIdentity.
  2. Consider whether the time, energy and money spent actually matches the risk reduction. Given that the current system works so well for me, I have a hard time convincing myself that I should join a social network. I don’t need tools to tell who my friends are. Because I’ll know just as much as I knew before. Maybe planning a trip accross Europe will be a tiny bit easier. How much time would you invest for this remote possibility: Half an hour? More? Less?

So, Evan, why should you trust me? Because it makes sense. Would you trust me more if I had a password? 8-D

Wait- that was me- I don’t know why my name disappeared off of there. Evan wrote the first one above, I wrote the second.

I really don’t want to get involved in this discussion right now; Maybe I should not respond. But anyways-

In answer to your question: Yes. I would trust your words more, if you were password protected. (AvoidIllusion. I wouldn’t trust the words that say they’re from you entirely. But I would trust them more.)

Why is HardSecurity okay for banks, but never okay for protecting our online mouths? People can still hack bank accounts, and stuff. They can still play crypto games. But, I think it’s worth it.

I thought we’d decided to leave new ideas for a few days before jumping on them with a ColdBlanket?

I fixed some spelling, and changed the somewhat unfair characterization of anonymous contributors as ne’er-do-wells. Actually, I think this is a great idea, and one worth exploring. I’m a fan of online identity. As for Alex: I actually trust you to behave and give intelligent, thoughtful comments and be community-minded because you’ve built up an online reputation for it. I guess I’d be slightly more trusting in what you say if I had some kind of mathematically-provable way to show that it was really you, but not a lot. --EvanProdromou

I suppose what I mean is:

It’s not my trust in Alex that is the issue. Password or no, it’s still Alex.

It’s my trust in did these words on the screen actually come from Alex.

If someone logs in and starts posting as if they were AlexSchroeder, it would be very jarring. I would start to distrust this particular CommunicationsChannel?.

I think this brings me closer to what I am trying to say, however: If somebody starts posting and the posts look as if they were mine, then perhaps it doesn’t even matter in the short term. And if you notice immediately that the new posting “just doesn’t sound like him” then we don’t have a problem, either. What I think that means is that for some transactions I want hard security: Buying books online, transfering money, etc. Or at least I want limited or no liability. The “Internet Bonding” described in the intro, however, doesn’t require hard security. That was what I was trying to say. :)

Ah, right. That’s totally true.

InternetBonding doesn’t require HardSecurity.

I bank with HardSecurity.Sometimes, I don’t know if something’s SoftSecurity, or HardSecurity.

Yes, most people assume every kind of security measure at a bank is HardSecurity. But I think I would argue that DelayAction is actually SoftSecurity, even when banks do it, even when it is implemented in hard metal.

DavidCary

(EditHint: move to DelayAction)

What do you think of the “gravatar” idea? It seems to be a step towards InternetBonding. One can use the same gravatar when commenting on many different blogs. The “gravatar” includes an image (which might be a photo of a face, or it might be an abstract symbol), and also includes an MD5 hash of that person’s email address. That hash makes it much more difficult to impersonate someone else (one can easily check from the Gravatar system the last N posts that were made using that hash), and it posts that hash in a way that spammers cannot get your email address. (I’m a little fuzzy on whether only the “owner” of a particular gravatar – the one in control of the corresponding email address – can check; or if anyone can check …)

Tom Werner discusses adding features to the gravatar system such as MicroPayment.

Brainstorming:

The “confirm later” idea posted by ChrisPurcell is interesting. I wonder what would happen if a discussion forum was structured so that always happened:

  • all the text is always posted completely anonymously (without even a pseudonym). However,
  • People could securely authenticate themselves, then attach an authenticated “tag” to a piece of text with one of a very few kinds of labels: “I agree”, “I disagree, but it is a valid opinion”, “This is very, very interesting – if true”, “spam”, …
  • Each piece of text ends up with lots of tags attached to it, each tag with someone’s name on it.

Usually the original author of the text would attach an “I agree” tags. But the first one to agree would not necessarily be the original author. And sometimes the original author may no longer agree with statements he made when he was less experienced.

Perhaps a system like this would help focus on the actual ideas, rather than the person, reducing ad-hominem fallacies. Yet still allowing people to “vote” and do other things that seem to require authentication.

I agree anonymity helps detach intent from content.

This very much fits with my visions of a interface where adjustments to files or to the UI are immediate and permanent at the local level (like selecting a style-sheet backed by a cookie) and are also implicit votes for those changes. PlainTextWiki talks about this.

So if I change the DEFINITION area of some page, it might show up as for other users as a light-colored annotation that they could mark as [agree|disagree|edit|spam] etc.

See http://gplv3.fsf.org/comments/gplv3-draft-3.html for a demo of the FreeSoftwareFoundation’s tset annotation software that might be close.

implicit votes for those changes. Yes, that sounds like a good idea. I wonder what is the best way to handle the fact that many users will probably accept the “default” version of the UI:

  • treat it as a no-vote – assume “accept the default” merely indicates people who are too busy to customize their UI
  • treat it as a vote for that default – assume these people prefer the default UI, and would have customized things if some other UI were the default.

Do we REALLY want to aggregate all our social networks? reminds me of someone who claims that co-workers who had worked in the same building with her for months failed to recognize her at an after-hours party. (There was apparently a corporate policy against extremely long hair, which she worked around by tucking her hair into a “professional-looking” wig at work … which she forgot to bring to the party).

It also reminds me of people who keep telling me “Never use your banking password for anything else”.

I think the “Wikipedia: user committed identity” looks like another step toward Internet bonding.

Define external redirect: StubPage IdentityBonding CommunicationsChannel ProofOfIdentity EvidenceOfIdentity SmartMobs

EditNearLinks: HardSecurity WebLog OnlineDiary FreeSoftware ColdBlanket AvoidIllusion FreeSoftwareFoundation PublicKeyEncryption SerialIdentity IdentityTheft BruceSchneier OpenSource DelayAction

Languages: