<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: Needed: chpass, finger, and pw for the web</title>
	<atom:link href="http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/feed/" rel="self" type="application/rss+xml" />
	<link>http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/</link>
	<description>Isaac Schlueter on Web Development</description>
	<pubDate>Thu, 24 Jul 2008 02:29:19 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.5.1</generator>
		<item>
		<title>By: Isaac</title>
		<link>http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-720</link>
		<dc:creator>Isaac</dc:creator>
		<pubDate>Tue, 15 Jul 2008 19:28:13 +0000</pubDate>
		<guid isPermaLink="false">http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-720</guid>
		<description>Donald,

I think that there are actually two different kinds of "communicating anonymously".

There's "communicating without any eavesdroppers being able to know who I am", and then there's "communicating without the recipient being able to know who I am".  The first is essential to a free society; the second is essential for assholes who like to waste your time.

GPG/PGP and other signing/encryption schemes try to solve both problems at once.  Data is encrypted and signed, so you know exactly who sent it, and they know that no one but you can read it.  However, those kinds of systems incur a lot of overhead, and unless I already know the person who sent it, a public key doesn't tell me much about who they are.  (I still don't know if it's a fake name, etc.)

I think it's possible to do both.  The &lt;a href="http://chi.mp" rel="nofollow"&gt;Chi.mp&lt;/a&gt; folks are doing some interesting things around this.</description>
		<content:encoded><![CDATA[<p>Donald,</p>
<p>I think that there are actually two different kinds of &#8220;communicating anonymously&#8221;.</p>
<p>There&#8217;s &#8220;communicating without any eavesdroppers being able to know who I am&#8221;, and then there&#8217;s &#8220;communicating without the recipient being able to know who I am&#8221;.  The first is essential to a free society; the second is essential for assholes who like to waste your time.</p>
<p>GPG/PGP and other signing/encryption schemes try to solve both problems at once.  Data is encrypted and signed, so you know exactly who sent it, and they know that no one but you can read it.  However, those kinds of systems incur a lot of overhead, and unless I already know the person who sent it, a public key doesn&#8217;t tell me much about who they are.  (I still don&#8217;t know if it&#8217;s a fake name, etc.)</p>
<p>I think it&#8217;s possible to do both.  The <a href="http://chi.mp" rel="nofollow" class="external">Chi.mp</a> folks are doing some interesting things around this.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Donald Forrester</title>
		<link>http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-716</link>
		<dc:creator>Donald Forrester</dc:creator>
		<pubDate>Sat, 12 Jul 2008 14:44:09 +0000</pubDate>
		<guid isPermaLink="false">http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-716</guid>
		<description>That last paragraph of yours is the most telling.  "In order to be truly trustworthy, a stronger commitment to protecting privacy needs to be in place than just words on a corporate press release." 
The fact is that being able to communicate anonymously, yet effectively, is critical in an environment where every word you use is recorded, copied, and distributed.  

For your scheme to work as stated, we'd have to make it a lot easier to track us.  Every comment, every site, would be stamped 'real' or 'not real.'  Otherwise, you'd have to check with the person in question, and you could have done that anyway.  And if it's 'Real', then it can be used in a courthouse.

Frankly, if I end up being unwittingly on the contact list of some terrorist because I leave comments on his blog about football, I don't want the government to be able to get ahold of *his* contact list.  Privacy, not just for myself but for everyone, is a huge concern for me.

This is my worry: If communicating non-anonymously becomes the standard, then anonymous communication will be more and more difficult to use, eventually to the point where anyone who's anonymous is either on specialized sites where their contributions are meaningless, or considered spammers on sites that would have value.  

The recent decision against Google vs. Viacom, having to give up the entire recordset of Youtube watchers and relying on the mercy of Viacom to preserve user privacy is a clear example of why being able to 'finger' anyone online is a bad, bad idea.  Convenient?  Maybe.  But unsound.  

I'm on the fence as to whether or not Google will stop keeping records like those; it's a lesson learned, but is the cost higher than the potential gain of keeping the data?  I haven't been keeping up with the case, so I don't know if they've said anything about it or not.

Now, what would be interesting is a dual-layer approach, if it could be done.  A 'Public' persona, layered over a private one, which then connects to the person.  Facebook, Myspace, et. al. approach this; anyone can take the same pictures, some basic information about you, and create a profile; and while that's annoying on the face of it, it provides a certain amount of protection by stating that people *can* do this, can fake just about anything online, so it takes intimate knowledge of a person already in order to determine identity; knowledge which an institution can't access easily.

Opensocial is pretty good, too; you can have multiple identities, as many as you have email addresses; and you can give each one a degree of veracity or not, as you choose.  Still, eventually we'll find that people start insisting on talking to 'real' people, and the protections afforded us now will fall apart.</description>
		<content:encoded><![CDATA[<p>That last paragraph of yours is the most telling.  &#8220;In order to be truly trustworthy, a stronger commitment to protecting privacy needs to be in place than just words on a corporate press release.&#8221;<br />
The fact is that being able to communicate anonymously, yet effectively, is critical in an environment where every word you use is recorded, copied, and distributed.  </p>
<p>For your scheme to work as stated, we&#8217;d have to make it a lot easier to track us.  Every comment, every site, would be stamped &#8216;real&#8217; or &#8216;not real.&#8217;  Otherwise, you&#8217;d have to check with the person in question, and you could have done that anyway.  And if it&#8217;s &#8216;Real&#8217;, then it can be used in a courthouse.</p>
<p>Frankly, if I end up being unwittingly on the contact list of some terrorist because I leave comments on his blog about football, I don&#8217;t want the government to be able to get ahold of *his* contact list.  Privacy, not just for myself but for everyone, is a huge concern for me.</p>
<p>This is my worry: If communicating non-anonymously becomes the standard, then anonymous communication will be more and more difficult to use, eventually to the point where anyone who&#8217;s anonymous is either on specialized sites where their contributions are meaningless, or considered spammers on sites that would have value.  </p>
<p>The recent decision against Google vs. Viacom, having to give up the entire recordset of Youtube watchers and relying on the mercy of Viacom to preserve user privacy is a clear example of why being able to &#8216;finger&#8217; anyone online is a bad, bad idea.  Convenient?  Maybe.  But unsound.  </p>
<p>I&#8217;m on the fence as to whether or not Google will stop keeping records like those; it&#8217;s a lesson learned, but is the cost higher than the potential gain of keeping the data?  I haven&#8217;t been keeping up with the case, so I don&#8217;t know if they&#8217;ve said anything about it or not.</p>
<p>Now, what would be interesting is a dual-layer approach, if it could be done.  A &#8216;Public&#8217; persona, layered over a private one, which then connects to the person.  Facebook, Myspace, et. al. approach this; anyone can take the same pictures, some basic information about you, and create a profile; and while that&#8217;s annoying on the face of it, it provides a certain amount of protection by stating that people *can* do this, can fake just about anything online, so it takes intimate knowledge of a person already in order to determine identity; knowledge which an institution can&#8217;t access easily.</p>
<p>Opensocial is pretty good, too; you can have multiple identities, as many as you have email addresses; and you can give each one a degree of veracity or not, as you choose.  Still, eventually we&#8217;ll find that people start insisting on talking to &#8216;real&#8217; people, and the protections afforded us now will fall apart.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Isaac</title>
		<link>http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-520</link>
		<dc:creator>Isaac</dc:creator>
		<pubDate>Fri, 04 Apr 2008 03:52:19 +0000</pubDate>
		<guid isPermaLink="false">http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-520</guid>
		<description>&lt;blockquote&gt;Well, now we get into semantics, really, but I think we agree. There’s no money in email, i.e. the POP protocol, there’s money in “being an email provider”. This is the same situation.&lt;/blockquote&gt;

Exactly.  As neither of us appear to be idiots, I'd be quite surprised if we didn't agree on something that is, as you point out, only idiotically deniable.

The question is whether there's &lt;em&gt;enough&lt;/em&gt; money to make it worthwhile for a potential &lt;abbr title="Distributed Reputational Contact Protocol"&gt;DRPC&lt;/abbr&gt; provider to spend resources on developing the protocol that would make this all work.  OpenSocial has the potential to pave the way for a &lt;abbr title="Distributed Contact Protocol"&gt;DCP&lt;/abbr&gt; (without the reputational aspects being distributed across the network), but the "R" is arguably the most important piece of that acronym &lt;small&gt;which, of course, I invented, just now, and retain all right$ to...&lt;/small&gt;</description>
		<content:encoded><![CDATA[<blockquote><p>Well, now we get into semantics, really, but I think we agree. There’s no money in email, i.e. the POP protocol, there’s money in “being an email provider”. This is the same situation.</p></blockquote>
<p>Exactly.  As neither of us appear to be idiots, I&#8217;d be quite surprised if we didn&#8217;t agree on something that is, as you point out, only idiotically deniable.</p>
<p>The question is whether there&#8217;s <em>enough</em> money to make it worthwhile for a potential <abbr title="Distributed Reputational Contact Protocol">DRPC</abbr> provider to spend resources on developing the protocol that would make this all work.  OpenSocial has the potential to pave the way for a <abbr title="Distributed Contact Protocol">DCP</abbr> (without the reputational aspects being distributed across the network), but the &#8220;R&#8221; is arguably the most important piece of that acronym <small>which, of course, I invented, just now, and retain all right$ to&#8230;</small></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Laurie</title>
		<link>http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-519</link>
		<dc:creator>Laurie</dc:creator>
		<pubDate>Fri, 04 Apr 2008 01:49:46 +0000</pubDate>
		<guid isPermaLink="false">http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-519</guid>
		<description>Well, now we get into semantics, really, but I think we agree. There's no money in email, i.e. the POP protocol, there's money in "being an email provider". This is the same situation.

What you're really saying is that "there's money in the web", which only an idiot would deny :-)</description>
		<content:encoded><![CDATA[<p>Well, now we get into semantics, really, but I think we agree. There&#8217;s no money in email, i.e. the POP protocol, there&#8217;s money in &#8220;being an email provider&#8221;. This is the same situation.</p>
<p>What you&#8217;re really saying is that &#8220;there&#8217;s money in the web&#8221;, which only an idiot would deny <img src='http://foohack.com/blog/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Isaac</title>
		<link>http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-509</link>
		<dc:creator>Isaac</dc:creator>
		<pubDate>Thu, 03 Apr 2008 07:38:46 +0000</pubDate>
		<guid isPermaLink="false">http://foohack.com/2008/03/needed-chpass-finger-and-pw-for-the-web/#comment-509</guid>
		<description>&lt;blockquote&gt;What is needed is not a startup or a company, but a protocol. &lt;/blockquote&gt;

You're probably right.  Good idea.  Even if a single entity were to drive the development of it, it would simply have to be distributed.  Of course, a distributed system increases the potential for gaming and abuse by several orders of magnitude.

&lt;blockquote&gt;As for making money, there’s no money in this. For a protocol to be widely adopted it has to be free, or people will continue to use whatever is free.&lt;/blockquote&gt;

I'm not so sure of that.  There's money everywhere, and in everything, just waiting for some creative thinking to let it out of its current form.  (To paraphrase Michelangelo, &lt;q&gt;The money was already there, I just marketed away the excess...&lt;/q&gt;)  I mean, that'd be a bit like saying that there's no money in email or on the web because HTTP and SMTP are free protocols.

The protocol creates an ecosystem.  The big players in that ecosystem will do well if the system as a whole does well.  That motivates Yahoo to try to get more people on the internet, for example, even if they don't visit our pages.  Coors and Budweiser ads are less about making you want their product, and more about making you want &lt;em&gt;beer&lt;/em&gt;.  Johnson and Johnson ads are actually ads for babies.  De Beers has ads glorifying marriage.

If the protocol creates an ecosystem where a certain company can make a big profit, then that company can be very motivated to promote that system.  WIth a huge vested interest in the more immersive, communicative aspect of the web, I think Yahoo (among others) could stand to be a big winner.</description>
		<content:encoded><![CDATA[<blockquote><p>What is needed is not a startup or a company, but a protocol. </p></blockquote>
<p>You&#8217;re probably right.  Good idea.  Even if a single entity were to drive the development of it, it would simply have to be distributed.  Of course, a distributed system increases the potential for gaming and abuse by several orders of magnitude.</p>
<blockquote><p>As for making money, there’s no money in this. For a protocol to be widely adopted it has to be free, or people will continue to use whatever is free.</p></blockquote>
<p>I&#8217;m not so sure of that.  There&#8217;s money everywhere, and in everything, just waiting for some creative thinking to let it out of its current form.  (To paraphrase Michelangelo, <q>The money was already there, I just marketed away the excess&#8230;</q>)  I mean, that&#8217;d be a bit like saying that there&#8217;s no money in email or on the web because HTTP and SMTP are free protocols.</p>
<p>The protocol creates an ecosystem.  The big players in that ecosystem will do well if the system as a whole does well.  That motivates Yahoo to try to get more people on the internet, for example, even if they don&#8217;t visit our pages.  Coors and Budweiser ads are less about making you want their product, and more about making you want <em>beer</em>.  Johnson and Johnson ads are actually ads for babies.  De Beers has ads glorifying marriage.</p>
<p>If the protocol creates an ecosystem where a certain company can make a big profit, then that company can be very motivated to promote that system.  WIth a huge vested interest in the more immersive, communicative aspect of the web, I think Yahoo (among others) could stand to be a big winner.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
