Social banking

[Dave Birch] I was reading about “social media lessons from banking insiders” in a report published by the noted Swiss co-operative KPMG International. The report asks the question (on page 2) “Will customers really want to be ‘friends’ with their bankers?”. Now, as everyone already knows, the answer to this is no. I cannot imagine any circumstances under which I would to earn “thank you points” on Facebook from my bank in return for the amount of money I have on deposit with them. I would much prefer them to fire the social media gurus and consultants behind this sort of idea and give me another 0.5% on my savings account instead. And further integration inside the Facebook framework doesn’t seem to have much to offer either.

In my opinion, banks that are enabling or attempting to enable transactions via a Facebook app are barking up the wrong tree. I’ve seen nothing to suggest that customers want this or would even use this. In fact, I’ve seen evidence of the contrary.

[From Celent Banking Blog » Are Bank Facebook Apps the Future of Digital Banking?]

That’s not to say, of course, that Facebook is irrelevant to banks. For one thing, as I’ve bored on about at length before, if there were a transactional element to social media integration then banks might have some really good products and services to offer in that space.

I don’t want to be friends with my bank—after all, I’m a typical consumer so I hate banks—but I do want to be friends with my bank account.

[From Friends and relations]

But that’s by the by. KPMG make a very interesting point on page 16, where they note that the lack of security infrastructure means that banks in any case have no way of knowing whether social media data comes from real customers, competitors, corporate saboteurs, mischievous hackers, agents of foreign powers or dogbots. This, it seems to me, opens up an interesting and immediate route for exploring the bank/Facebook boundary to find value. I was thinking that while the bank doesn’t know if you are a person or a dogbot e-mailing them or tweeting about them, and they can’tt use CAPTCHAs or similar to find out, they might be able to find out if you are human if they began exploring your social graph. Which leads on to the obvious further thought that using customers’ social graphs as an adjunct to conventional credit references and other cardboard-era identity management might deliver some interesting results.

He submits his information to the online-only PotterBank.com, but halfway through the application process, the website asks for his Facebook login. Then his Twitter. Then LinkedIn… A new wave of startups is working on algorithms gathering data for banks from the web of associations on the internet known as “the social graph,” in which people are “nodes” connected to each other by “edges.”

[From As Banks Start Nosing Around Facebook and Twitter, the Wrong Friends Might Just Sink Your Credit | Betabeat — News, gossip and intel from Silicon Alley 2.0.]

Suppose that this works. Then it has security benefits because the social graph ought to prove much more difficult to forge that a photocopy of a gas bill — the gold standard for authentication in the UK — and, some people suspect, it may have additional benefits because the social graph could be more accurate than a conventional credit reference agency when it comes to deciding whether you want someone as a customer or not.

Brett King, CEO of Movenbank, has a radical idea: a “credit score” built — at least in part — on consumers’ social media activity. Sound crazy? Maybe, but the idea has attracted the attention of big league investors who just pumped $2.41 million into King’s startup.

[From Is The World Ready For Social Media Credit Scores? | The Financial Brand: Marketing Insights for Banks & Credit Unions]

Brett is on to something. Whether his “CRED” score and algorithm is correct or not I couldn’t say, but the core of the idea — that if your Facebook friends are bank robbers, you might well be more likely to turn out to be a bank robber — seems wholly plausible. The social graph might be a better predictor of future activity (and future financial services requirements) than past credit scores. The social graph can tell things about you — like you’re going on holiday or getting married or moving to Hong Kong — that an intelligent and customer-centric organisation can act on in a supportive win-win framework. In Christophe Langlois‘ “A practical guide to social media in financial services” he talks about “Know Your Followers” (KYF) as the social media equivalent of “Know Your Customer” (KYC) in compliance. Obviously, KYF isn’t yet a legal requirement, but you get the idea. If organisations develop tools, algorithms and techniques for exploring the social graph then they might find that social media identity, or some kind of social media-based financial services identity, is far better than traditional KYC, credit agencies and old utility bills and predicting which customers they do or do not want.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

 

Real names, real problems

[Dave Birch] There is an assumption, which is reasonably well-founded I think, that many social media companies want to develop “Real Names” policies of one form or another not to prevent trolling or to protect the kiddies in one way or another, but to help with the commercialisation of their services and the monetization of the identities that they hold. Whereas the identity “Dave Birch of Consult Hyperion” may be worth something to commercial organisations (debt collectors, payday loan sharks and so forth)  — according to real names thinking — the identity “Leadbelly Gutbucket, mightiest of the Dwarven heroes of Ravenscrag Pass” may not. Hence the drive to find out who people really are.

Real Names is slithering into the whole fabric of the company’s offerings, whether specific sites benefit from what will often be “over-identification” or not.

[From IdentityBlog – Digital Identity, Privacy, and the Internet’s Missing Identity Layer]

One of the smokescreen reasons for wanting real names is trolling. I might think that it is my right as an Englishman to post abuse about the Chancellor of the Exchequer on The Telegraph web site, but others think that if I were forced to use my real name to log in then I would be more polite. I say smokescreen, because we don’t even have to guess whether a rigorously-enforced real names policy will make any difference to civility in online discourse, because we already know it won’t. What’s more, we know something else too: if you make people smear their “real” identities all over the internet because of such a policy, thus delivering the “over–identification” noted above, then that will make identity theft worse.

Korean sites were also inundated by hackers, presumably after valuable identities.

[From Surprisingly Good Evidence That Real Name Policies Fail To Improve Comments | TechCrunch]

The Korean case study shows clearly that a real names policy does not reduce trolling because the morons who troll are, well morons. Someone who posts racist abuse on Twitter, such as the noted association footballer Mr. Rio Ferdinand, really ought to understand that other people will read it and take offence since Twitter is a public communications channel (it’s not confined to football: look at the athletes sent home from the Olympics for sending racist tweets). What’s more, the real names policy does more harm than good, because it provides even more sources for the bad guys to obtain the real names that they need to commit other crimes. I read in the minutes of the recent Eurim meeting on the European Commission’s proposal for a regulation on electronic identification and trust services for electronic transactions in the internal market that

Identity fraud is the top enabler for all aspects of crime in Europe, and a major contributor to the Euro-crisis. The level of fraud in Europe last year was estimated at €500 billion, with an estimated €2 trillion for 2011-12. Europol have announced that unless this is addressed, they will be unable to contain crime.

I absolutely guarantee that a misplaced real names policy will make this worse. If you collect real names, things will always end up going wrong. You simply cannot assume that any information you give to organisations will remain private, no matter how well-intentioned.

Witnesses who complained about anti-social behaviour on a crime-hit estate were given police protection after a council error led to their personal details handed to troublemakers… Police are now patrolling a housing estate around the clock to protect the residents involved.

[From Council handed names of residents who complained about anti-social behaviour to trouble-makers – Telegraph]

Oh dear. Doesn’t sound like “real names” are working out too well in that case. Especially since there was no reason for the council to obtain the “real names” of the complainants. This is a case where “real attributes” are the key. The council needed to know that the complainants were council tenants living in a particular area. If we had an identity infrastructure befitting a modern economy (we don’t) then the tenants would have been able to submit their complaint by smartphone and have the text followed by a blinded cryptographic token attesting to their status but from which it would be mathematically infeasible to determine their identity. So no matter what the berks at the council do, the identities reman secret.

One thing that might really help the real names nutters, by the way, is making it easier to spot what are actually real names. If I create a Facebook profile as Theogenes de Montford, for example, how do you know whether that’s a real name or not? It would help if there were a relatively short list of real names, so I suggest that Facebook puts some lobbying money into Sweden.

Activists are lobbying for parents to be able to choose any name for their children (there are currently just 170 legally recognized unisex names in Sweden).

[From Hen: Sweden’s new gender neutral pronoun causes controversy. – Slate Magazine]

This seems like an odd story until you realise that in Sweden can you only choose a legally-approved name for your child. Sensible policies for a better interweb: Facebook should make a list of allowable real names and make you choose a combination of them. That way, any disloyal subject of Her Majesty trying to post abuse about the Chancellor of the Exchequer using a made up name could be instantly spotted and blocked.

P.S. In case you’re interested, Theogenes de Montford is indeed a real name.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

 

Friendly fire

[Dave Birch] Some time ago, in the early days of Twitter, I happened to be involved in some work concerning a financial institution’s social media strategy. I was rather rude about the idea of setting up a Facebook page, because I couldn’t see the point, but it was nothing to do with me or any of the other technical persons. I was reminded of this episode this morning, when I read about another organisation’s Facebook-related travails.

It wasn’t long before Barclays’ Facebook page devolved into a minefield of jokes lambasting the company, which only served to highlight the socioeconomic rift between the banking institution and its customers.

[From Epic Fail: Barclays’ Facebook Debacle Highlighted the Chasm Between the Bank and Its Customers]

Well, given current circumstances this is hardly unexpected. As a naturally curious person, I thought I’d go and look at a few bank Facebook pages to see what sort of things they did. But I gave up almost immediately, since I realised that I’d have no way of knowing which of them might be real or not. Here’s what I got when I searched for Lloyds, for example. Real? Who knows. It’s certainly boring enough to have come from a bank, but that’s not much of a clue. Still, given Facebook’s noted “real names” policy, it probably is true and I’m sure it’s safe, just like the NatWest page that I found. I went to the Barclays Online Banking Facebook page and I couldn’t even work out what it was. This Barclays’ page looks quite plausible, but as a security-concious consumer I wasn’t sure whether to click on anything or not. Perhaps the British Bankers’ Association has some list of the real Facebook pages. I’ll check.

In the meantime, I expect that if I call NatWest they can point me to the their public key certificate that I can use to check the digital signature on the Facebook page so that… no, just joking. But all of this begs a more general question. What was the Facebook page for? What could customers do? Open accounts? Send money? Pay bills? No. As is generally true of Facebook pages for financial institutions, it was all about communications. There’d be no point a bank e-mailing my kids since they never read e-mail, so I suppose if you could persuade them to “friend” your bank you might be able get the odd status update into their field of vision.

At the Credit Suisse Research Institute 2012 meeting, experts discussed the benefits of social media over traditional communication tools, as well as the constraints – the most significant of which regards the current regulatory environment.

[From Credit Suisse – Banking on Social Media]

In fact, all of this potentially interesting discussion was actually about marketing. I’m no expert on marketing or social media, but I would imagine that the key to social media strategy is interaction and the whole web 2.0 thang about user-generated content and such like. For any organisation to just use a Facebook page to broadcast marketing messages seems like a missed opportunity for a richer connection with customers. If this is the right line of thinking, then the strategy ought to consider what customers might actually want to do in that context. For banks, I suspect that what they want to do is transact. What about the benefits of social media over traditional transaction tools? As I’ve said before (many times)

I’m naturally more interested in social media for transactions: social commerce.

[From Friends and relations]

I’ve bored some of our clients about this enough over the last couple of years, and I won’t rehearse the arguments here, but I will say that I think there’s evidence that the social commerce approach for financial institutions is sound. Customers want to do banking in their context and given that their context is increasingly within social media, it makes sense to move banking there.

Facebook announced that it is testing an online-banking service with Australia’s Commonwealth Bank expected to debut this year. The new system lets people make payments to other Facebook users, and will become a test of how well Facebook can handle the deep-science realities of financial privacy and security.

[From Facebook Announces Online-Banking Test – Forbes]

If Facebook do crack the privacy and security side of things, then they will become the route to banking for a great many consumers, frankly, and I don’t know whether financial organisations of all kinds have yet developed an effective strategy to deal with social media gatekeepers other than to pay them. Perhaps if their products and services could develop a direct relationship with the customer using social media channels (rather than simply provide those products and services inside the social media context) then they can become valued by customers.

I don’t want to be friends with my bank—after all, I’m a typical consumer so I hate banks—but I do want to be friends with my bank account.

[From Friends and relations]

My Barclays mobile banking app works really well and I can’t imagine any circumstance under which I’d bother going to their Facebook page, even if I could work out which one it is, but I might be tempted to venture outside the app if for richer social media interaction. At the moment Barclays interaction with me is basically limited to alerts by text message, which is fine, but does waste their money as well as limiting the amount of information. I’d rather have richer data sent through Twitter or as Facebook updates or whatever. Why can’t I have every transaction on any of my accounts sent through to me? 

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

I’m authentically not real

[Dave Birch] The whole “identity thing” has been obsessing me because I’ve been invited to give my first TEDx talk at TEDxSussexUniversity later this week and I decided to talk about identity. I thought I’d try my PsychicID idea out on a different (i.e., not identity specialists) audience to test it out further. As far as I’m concerned, the need for it is growing.

According to Sheryl Sandberg, Facebook’s chief operating officer, and Richard Allan, its director of policy in Europe, a critical mass of people only want online interactions supported by “authentic” identity.

[From Online identity: is authenticity or anonymity more important? | Technology | guardian.co.uk]

They’re not even wrong about this. Authenticity and anonymity are not on the same axis. My Facebook profile is entirely authentic, it just doesn’t share my mundane non-unique sort-of-identifier (i.e., name). So what? Why would anyone need to know that my Facebook profile is in my “real name”? Well, apart from people who want to harass children, for example…

In an recent investigation, the TV station MSNBC found that many university sports departments now require students to “friend” their coach, giving officials access to their “friends-only” posts.

[From 12-year-old US girl suing school over Facebook comments row – Telegraph]

It’s really interesting to see how the “etiquette” around this is evolving. I picked up on it a few years ago and had the feeling then that the way the Facebook generation see identity will redefine they way society as a whole will come to see it in time, which is why attempts to force “old” identity notions on to them are doomed.

The kids aren’t stupid: they live in that world and they can distinguish their multiple virtual identities. Faced with a privacy violation that undermines a virtual identity, they slash and burn.

[From Digital Identity: Bring it on]

Quite. And why shouldn’t they? Why shouldn’t I have two Facebook identities, one for my work friends and one for my friends and family? And if want them to be able to connect me, then that should be up to me. I can easily have an identity that is authentic and anonymous.

The issue here isn’t anonymity. It’s privacy. Facebook should be looking at ways to deploying Privacy Enhancing Technologies (PETs) as part of its fundamental infrastructure. This is at the heart of my view of digital identity: that the only way to meet the requirements for security and privacy is stop seeing them as opposites or countervailing forces to be balanced, but as the simultaneously achievable goals of a properly designed identity infrastructure.

Many people do think eID could and should be implemented without full identification, i.e. more granular disclosure with pseudonymity – see e.g. Dave Birch’s brilliant and very readable paper “Psychic ID: A blueprint for a modern national identity scheme” (PDF).

[From Tech and Law: PETs – Stephan Engberg’s response]

So this is what I’m going to talk about on Friday: why Dr. Who should be our national design authority for identity infrastructure for 21st century because Dr. Who (and not Martha Lane Fox or the Cabinet Office) has a narrative about the future of identity, authentication and credentials that everyone can understand and buy into. And he’s already shown us that he uses NFC. We’ll see how it goes.

But back to the problem space. If my Facebook profile is the name of Ziggy Startup, and all my friends know this, then what’s the problem? It’s not really anonymous is any sense: if Ziggy Startup starts making off illegal posts, then it won’t take long for the police to get a warrant for the IP address and password and Ziggy will be off down the nick.

A man was jailed yesterday for posting videos and messages mocking the deaths of teenagers including a girl who threw herself under a train.

[From Internet ‘troll’ jailed for mocking dead teenagers on Facebook – Telegraph]

These people are pathetic, revolting and deserve the appropriate penalties, but they’re not a reason to make a fundamental and unrecoverable mistake in the design of the future online world. Since we don’t have a national narrative around the future of identity, it’s been abandoned to competing national security and commercial imperatives. Indeed, some observers would say that this is what’s really going on with all the fuss about “real” names at the moment.

Is it possible that free and expressive social logons will take over where bank and government identities have failed to interoperate? Or will the higher risk management standards of serious online transactions remain beyond reach of the cyber brands?

[From A new theory of digital identity – Networks – SC Magazine Australia – Secure Business Intelligence]

The battle over “authentic” identities is a power struggle. If the social networks are able to enforce it (I’ve no idea how they might do this, but let’s say they can) then they have a fantastic business opportunity because they will be able to leverage their arbitrage around personal data even further: how much more will advertisers pay for a list of people interested in whatever-the-f**k-it-is if they get the real identities too? If you know who everyone is, then you have much less risk to manage anyway. But the nightmare (for my clients anyway) is that they’ll end up having to offer Facebook Connect as a login otherwise they get no customers, and then Facebook know exactly what customers are doing all of the time.

On the one hand, I think good for them. The banks are doing nothing sensible in this space: they are messing around with one-time-passowrds by SMS, EMV-calculators thingies and a variety of incompatible dongles, when they should be working on an industry standards-based infrastructure. But is it good for us to abdicate responsibility for identity infrastructure and hand the whole thing over to Facebook?

I love Facebook. I use it many time every week to keep in touch with friends and family. What they should be doing is introducing optional 2FA (to end the problem of “fraping”, for one thing) and moving to an NSTIC framework to accept identities from identity providers that meet certain standards. So if I turn up at Facebook with a Barclays identity that says I’m Ziggy Startup, then that should be fine. Facebook don’t need to know who I am, all they need to know that someone knows who I am. If they insist that they need to know my “real name”, then it’s because they expect to exploit this for commercial opportunity – it has nothing to do with protecting children.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

Frenemy of the state

[Dave Birch] More on Facebook’s “real names” nonsense. Their S1 filing admits to 1 in 20 bogus accounts, but who knows what the real figure is. None of my Facebook accounts are in my “real name” and I doubt I’m the only one.

“There may be individuals who have multiple Facebook accounts in violation of our terms of service, despite our efforts to detect and suppress such behavior. We estimate that false or duplicate accounts may have represented approximately 5-6% of our MAUs as of December 31, 2011.”

[From Major Changes In Facebook’s Amended S-1: Mobile Ads, Zynga, Yahoo Patents, Credit | TechCrunch]

I don’t really care about this, except for the fact that if people believe that Facebook, or any other online space is a “real name” space, then that does more harm than good because people who don’t really understand how all of this works could be misled and I can see how that might lead to problems. Still let’s hope that some people (e.g., sex offenders) do use their real names…

A new app will let you check all your Facebook friends against the National Sex Offender Registry.

[From Are Your Facebook Friends Sex Offenders?]

This isn’t all about dating scams, crime and teenage bullying. It’s national security as well. How Facebook know whether someone’s name is real or not I have no idea, and I certainly don’t believe for one moment that they are capable of distinguishing agents of foreign powers from “legitimate” users. Nor, for that matter, is anyone else.

NATO’S most senior commander was at the centre of a major security alert when a series of his colleagues fell for a fake Facebook account opened in his name – apparently by Chinese spies

[From How spies used Facebook to steal Nato chiefs’ details – Telegraph]

I read this with a certain nostalgia. When I worked at the Supreme Headquarters Allied Personnel Europe (SHAPE) Technical Centre in the Hague in the early 1980s, my first day on the job began with an extensive lecture on the security responsibilities attendant on our clearance level. I was working on a project concerned with keeping secure communications networks up and running in the event of a Russian nuclear attack, which was quite interesting, and once we had been sternly advised to be wary of beautiful tall blonde Eastern European women striking up conversations with us in supermarkets, I spent literally every waking hour of my young life praying for this to happen. It never did, but if there are any beautiful tall blonde Eastern European women who have any interest in white-noise jamming of direct sequence spread spectrum satellite channels, here are my contact details:

STC Card

My point: people are misled by the social network environment and so they make poor decisions. We already know that men will do almost anything if asked to by an attractive woman:

The story also revealed another sad truth, a reflection on human nature. Men will do anything for an attractive woman, without even bothering to check whether she’s real or not.

[From Digital Identity: Linked]

And we already know that woman will do anything for a handsome non-existent soldier. Absent a working identity infrastructure, we really shouldn’t let people meander along under the impression that social media identities a real. Which, by the way, did make me wonder about the wisdom of publicising the NATO story. Wouldn’t it have made more sense to to pretend to go along with the “Chinese spies” and feed them misinformation rather than let them know that you had blown their cover. Haven’t these NATO guys ever read “The Zimmerman Telegram“? I thought this was high up on the reading list for anyone entering a career in a security-related profession. It would be have been infinite to friend the American brass with a convincing bogus Ahmadinejad and then start posting stuff about shipping centrifuges to Tibet and such like.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers


Reviews and reviewers

[Dave Birch] There’s a long running debate going on about whether people should be able to post online without disclosing their “real” identity. This is getting especially heated around online review sites. Remember this row — one of many — about Trip Advisor?

He said he is considering suing the site over what he claims is a “dishonest” review published about one of his hotels and accused the internet giant of trying to “bully” him into silence using threatening letters

[From Duncan Bannatyne to campaign against ‘cowardly’ trip adviser – Telegraph]

Look, review sites aren’t going to go away. And they are a good thing. I happened to be talking about reviews to my wife yesterday. She regularly uses a particular web shop to buy all the usual household stuff that neither of us can be bothered to go to the shops for: in yesterday’s case, a new mop for the kitchen floor. She uses that particular site precisely because it publishes bad reviews as well as good ones. When she last looked for a new mop, the one she looked at had very bad reviews. Yesterday, she looked again and there was a new mop, with good reviews. So she bought it. How can you trust good reviews unless you see the bad ones as well?

We need review sites: they are way to make a market more transparent and improve the quality of goods and services. Therefore, making the reviews work is important. How do you do this?

Here’s a question to get the thinking underway: if you let people post under assumed names, will they post rubbish? Can you trust a review site where you don’t know who anyone is either, whether they are astroturfing for corporate puppet masters or opening up information for the people? I travel a lot, so I post a lot on Trip Advisor. But I don’t post under my “real” name – I don’t see why who I am is material. Consequently, I was most interested to read a thorough corroboration of my theory that a pseudonymous interweb is a better interweb.

The platform, which enables people to comment across multiple websites via the same identity, has just released data showing that pseudonymous participation is actually the healthiest type.

[From Disqus data shows pseudonymous commenters are best « Mariamz]

Well, well. I can think of many reasons why this is true (one of the main ones being that people reveal their real likes and dislikes, prejudices and opinions, views and perspectives under pseudonyms whereas they are alway constrained when using their “real” names) and it certainly matches with my experiences in online chat and debate environments.

Personally, whether it’s positing abusive messages about government ministers or arguing about the merits of a return to the gold standard, I always use pseudonyms unless I am posting in a professional capacity, in which case (I  sincerely hope) my expertise and experience is relevant to the discussion at hand. In some cases I use the same pseudonym across multiple sites, in other cases I use a specific pseudonym.

Pseudonymous identifiers are random identifiers that change for each relying party (so my identity at relying party A might be 123 while my identity at relying party B might be 345). Good pseudonymous identifiers are large random values (so that they are unpredictable) and are not reused across multiple users (so the same identifier is never used at different relying parties for the same or different users).

[From Conor’s Web Log of Esoterica: Pseudonymity would help]

Right. So pseudonyms deliver the best online interaction. But, I will hear you say, who can this scale? With interaction through pseudonyms, there will always be people — even if a tiny minority — getting up to no good. What if you are small business and you get a review like this?

The review said: “Robbed My RAM and Touched 9 Year Old What a scam artist, he stole RAM from my computer and replaced it with smaller chips hoping I wouldnt notice and also I later found out touched my 9 year old inappropriately. A Violator and a rogue trader. DO NOT DO TRADE WITH THIS MAN!”

[From BBC News – Google removes ‘paedophile’ claim on review website]

How can you take a civil action against someone for posting a defamation or libel or malicious accusation or whatever? How can you make sure that someone posting a review is actually a customer?

The solution is to institute a simple system of pseudonymous tokens — cryptographic tokens, I mean — so that you the customer can only post a review of something if you have a token showing that you used it, and it should take a court order for the token provider to reveal the person who had the token. This is technologically trivial and can easily be achieved using well-known and well-understood techniques for cryptographic “blinding”. A “blinding” service would work something like this: when you register at the hotel, the hotel chain e-mails you a URL. Later on, you log in to that URL and the system generates a “blinded” token that the hotel chain digitally signs and sends back to you. Whereupon you unblind it. To write a review, you must submit the token. The review site can easily check the digital signature from the hotel chain that proves that you did stay at the hotel during the previous month (or whatever) but doesn’t link to your identity. The hotel can be sure that you were a customer, but neither they nor the review service know who you are. If you post something that is against the law, a court can then order the blinding service to turn over the connection.

It’s not only review sites that might make use of such a service because there are many sites where who you are is material to the discussions and there may be not entirely honest reasons for using a pseudonym.

The chief executive and chairman of cashless payments vendor USA Technologies has resigned over “inappropriate” comments he posted on the Yahoo Finance message board… George Jensen posted approximately 450 comments on the forum, primarily under the alias ‘investor.texas’.

[From Finextra: USA Technologies CEO quits over message board posts]

Which reminds me of something. A linguistic clarification to distinguish between pseudonyms (which are identifiers) and personas (which are bundles of attributes around an identifier). Robin Wilton is surely right to insist that there is a difference

However, a persona can also consist of a number of attribute assertions (“I am male, single and over 20”), without containing either a ‘genuine’ identifier (Kal-El) or a pseudonymous one (Clark Kent) – therefore I maintain that personas and pseudonyms as distinct rather than identical.

[From Racingsnake –
the blog of Future Identity: Liberty, pseudonymity and personas
]

Personas may use anonyms, pseudonyms or absonyms. But I’m having second thoughts about the word “absonym” that I made up to mean the “real name” of something. It bothers me that the derivation mixes Latin (“absolute”) and Greek (“name”). I’m wondering about going all Greek with “alethnym” (“true name”) or just going for something that mixes more wildly but sounds better (such as “pravdanym” using Russian or “verinym” trimming the Latin “veritas” or “emenym” abusing the Hebrew “meet” and simultaneously evoking the stage name “eminem” to get down with the kids). Suggestions?

Anyway, you get the idea. Technology has a solution to a real societal problem. Perhaps the way to actually get something done would be to put forward that solution, using existing technology, but inside the kind of framework envisaged in the NSTIC. It would be easy for a US newspaper, say, to require commenters to have a digital identity from a US provider. These digital identities should be pseudonymous as a default: thus, I can post political comment or hotel reviews or jokes about celebrities or whatever. If I actually libel someone (under proper libel laws, not the UK’s libel laws) then someone can get a court order to ask the identity provider to reveal the digital identity that they were provided with (this, of course, may in some circumstances be another pseudonym).

Here’s a simple example: let’s say that my mobile operator were to give me the identity “citizendave”. I go around logging in to various web sites as citizendave using the mobile handset as part of a 2FA process. Now suppose I log in somewhere and post a libel. The target goes to court and gets an order: this is delivered to O2 (digitally-signed by the Attorney General, naturally) and O2 will then return my name and billing address. Without the court order, cryptography means that no-one can find out who citizendave is. This seems like a reasonable accommodation.

By the way, this is a serious issue – it’s not all about people writing abusive hotel reviews. A couple of years ago Bob Gourley, the former CTO of the U.S. Defense Intelligence Agency, summed the issue up as fundamental and important question about the future identity infrastructure. He said:

We must have ways to protect anonymity of good people, but not allow anonymity of bad people. This is going to be much harder to do than it is to say. I believe a structure could be put in place, with massive engineering, where all people are given some means to stay anonymous, but when a certain key is applied, their cloak can be peeled back.

[From A CTO analysis: Hillary Clinton’s speech on Internet freedom | IT Leadership | TechRepublic.com]

What should be done? I saw this in a comment on an article about the internet and anonymity.

If we create a technology that allows one person, in the privacy of his living room, to create multiple identities to ruin a person or business, then we should create a legal mechanism to allow victims with the same ease to stop it.

[From Anonymity and the Dark Side of the Internet – NYTimes.com]

I think this is, essentially, correct. I was listening BBC Radio 5 yesterday and there was a story about a woman whose life was ruined by an ex-boyfriend impersonating her online (it’s not that difficult to pretend to be someone on IM or whatever) and how hard it was for her (or the police) to stop it. So there is a real need to get on and so something about this but not in the privacy-destroying North Korean-style “you have to show a passport to log on” way that will lead to disaster.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers


I love the way they think

[Dave Birch] The subject of identity infrastructure came up again yesterday and this led on to a discussion about banks, identity providers, attribute providers and business models. When we are thinking about identity infrastructure in the mass market, a very simple identity vs. attribute example often comes to mind. It’s the apparently simple case of age verification: how do you prove to a web site that you are over 18 or to an bar in the US that you are over 21 or to a bus company that you are over 65, or whatever. I think this is a pretty reasonable measure of how a system intended for the general public is going to work. Talking about this in the meeting, the example of Facebook came to mind, where there is an utterly prosaic, immediate and important use case. You have to be 13 to exist on Facebook.

Now, one interesting question is… why? Why do Facebook ban under-13s? I mean why not under-18s? or under-12s? I mean 13 sounds rather arbitrary and there’s no obvious reason for it that springs to mind. So I began to look for a rational reason for this, thinking that it was a Facebook policy. But it isn’t. The reason for this abitrary and capricious age boundary is, as I should have suspected, a consequence of government regulation of the interweb tubes.

Internet companies have set up the rules against under-age users because they must comply with the federal Children’s Online Privacy Protection Act (COPPA), passed in 1998, which says web sites that collect information from children younger than 13 must obtain parental consent.

Obtaining that consent is complex and expensive, so companies like Facebook and Google, which owns YouTube, reject anyone who tries to sign up using an age below 13.

[From Facebook Users Who Are Under Age Raise Concerns – NYTimes.com]

Unusually, across the spectrum of wise political steering in cyberspace, this legislation has not turned out precisely how the politicians and lobbyists intended.

The Children’s Online Privacy Protection Act is a well-intentioned piece of legislation with unintended consequences for parents, educators, and the public writ large. It has stifled innovation for sites focused on children and its implementations have made parenting more challenging.

[From danah boyd | apophenia » Why Parents Help Children Violate Facebook’s 13+ Rule]

I realise that Facebook-13 seems like a very particular and specific issue, but I think it is entirely representative of a class of problems in the new, online world. The way that people talk about this issue illustrates—I would at least postulate—how they think about stuff like online identity at a deep level and is a rather useful guide to technologists and legislators.

In Victoria’s fifth-period honors English class, all 32 students said they had faked their birth year to gain access to one site or another… Jerry Ng, Victoria’s 14-year-old cousin, agreed. “It’s one thing to lie to a person,” he said. “But this is lying to a computer.”

[From Facebook Users Who Are Under Age Raise Concerns – NYTimes.com]

I love this comment, which is utterly revealing about how the so-called “screenagers” think about the world. A new ethics, discontinuous to our pre-post-industrial moral paradigm. Talking of which, perhaps an alternative to a sophisticated modern identity management system and the new mental models to with it is simply to clear the plebs off the playing field.

The Pope has warned of the dangers of social networking sites such as Facebook and MySpace, saying that communication between people online must not stop face-to-face conversations.

[From Pope warns Facebook can’t replace human contact – Telegraph]

There’s a heritage to this kind of pedagogical panic.

Similar concerns arose in the 18th century, when newspapers became more common. The French statesman Malesherbes railed against the fashion for getting news from the printed page, arguing that it socially isolated readers and detracted from the spiritually uplifting group practice of getting news from the pulpit.

[From A history of media technology scares, from the printing press to Facebook. – By Vaughan Bell – Slate Magazine]

God knows what he would make to the newspapers I saw at Woking train station this morning. The front pages included a splash about whether bread is bad for you, voyeuristic photographs up a female pop star’s dress (I think she was a pop star – I didn’t recognise the name or, for that matter, anything else) and something about the X-Factor. All this at time when the eurozone is in crisis and people are being machine-gunned on the streets of Syria. But back to Facebook.

Whether Facebook is responding to changing social norms or, in fact, leading the charge is an unresolved question

[From FT.com / FT Magazine – Facebook’s grand plan for the future]

This is very important question. I think that people are disoriented about post-industrial society and confused about the fractal online/offline (or virtual/mundane) boundary. Facebook provides a way to think about some of these things. I don’t think it’s right to say that it it “leading” the change but I think it is fair to say that until a new model emerges, Facebook will continue to provide a kind of substitute. I think that we should have an identity infrastructure that does not have a mundane analogue, where you can prove that you are an adult or a child without disclosing who you are and that this should be the basic test of fitness of any proposed solution. At the moment, Facebook doesn’t provide this, because it’s still trapped in industrial age identity thinking.

Facebook insists on what it calls authentic identity, or real names. And it is becoming a de facto passport vendor of sorts, allowing its users to sign into seven million other sites and applications with their Facebook user names and passwords.

[From Rushdie Wins Facebook Fight Over Identity – NYTimes.com]

I’m sure it does. But doesn’t this have dangers associated with it?

The information leak can be exploited by social-engineering scammers, phishers, or anyone who has ever been curious about the person behind an anonymous email message. If the address belongs to any one of the 500 million active users on Facebook, the social-networking site will return the full name and picture associated with the account.

[From Facebook bug spills name and pic for all 500 million users • The Register]

Yet another good reason for not having your Facebook account your real name, as indeed I don’t (for either of my accounts). My point is that what Facebook has now isn’t the identity infrastructure we need for the information age, but unless someone else gets to work on building it, we’ll end up with what Facebook has and we’ll be stuck with it.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers


Friends with things

[Dave Birch] I enjoyed the presentation that Christophe Langlois (Visible Banking) gave to the Financial Services Club in London and particularly the enjoyed the question and answer session afterwards. Christophe was talking about banks’ use of social media and was comparing and contrasting some different approaches that explored further in his new book “Customer Experiences without Borders” (which I won a signed copy of at the event, hurrah!). During the question and answer session, I made the point about the mismatch in the use of social media.

I don’t want to be friends with my bank—after all, I’m a typical consumer so I hate banks—but I do want to be friends with my bank account. Why can’t Barclays let me friend my current account so I can see its status updates like “Premium card fee £10.00”, “Direct Debit British Gas £37.85” and “Counter Credit £5.00” and so forth?

[From Friends and relations]

This is a point that I amplified in Retail Banker Interactive, finishing up with plea.

So a plea to my account, card and service providers: I don’t want to be friends with you, because you are corporations and not mates, but I do want to be friends with my stuff: my money, my cards, my phone. How hard can it be?

[From Social media is not just another communication channel – Blogs – Retail Banker Interactive]

A discussion about this continued over drinks, and I am indebted to David Harris from salesforce.com for bringing a fascinating example to my attention. Apparently, Toyota are going to have a system whereby you can be friends with your car, which is a great idea.

For example, if an EV or PHV is running low on battery power, Toyota Friend would notify the driver to re-charge in the form of a “tweet”-like alert. In addition, while Toyota Friend will be a private social network, customers can choose to extend their communication to family, friends, and others through public social networks such as Twitter and Facebook.

[From Toyota USA Newsroom | Salesforce.com and Toyota Form Strategic Alliance to Build ‘Toyota Friend’ Social Network for Toyota Customers and Their Cars]

So your friends could be friends with your car too. You might wonder why anyone would want to do this, but consider this: my sister has borrowed my wife’s car for a couple of days while she goes looking for another car, so it would be great if my sister could be friends with my wife’s car (and it would make sense for me to be friends with my wife’s car and vice versa) for a time.

What I’m not sure about is if I would want these connections to be in my hilariously-entitled “real name” or via a network like Facebook. I’m not paranoid, but I don’t want to be bombarded with crap all the time because Facebook has noticed that one of my brake pads is wearing a little thin and has sold this information to a hundred different brake pad companies around the world. And I’m sure it will only be a matter of time before some guy tracks down and murders his ex-girlfriend because she forget he was friends with her car so knows where she is.

There’s a layer of infrastructure missing here and I hope that the Cabinet Office’s Identity Assurance Programme that we were discussing yesterday is going to take this into account. They’ve finally got a budget so I hope that some of the input from the Working Groups can now be acted on.

Cabinet Office minister Francis Maude has earmarked £10m for implementation of the government’s Identity Assurance (IDA) programme,

[From Government earmarks £10m for Identity Assurance and targets over £500m savings – 10/31/2011 – Computer Weekly]

So what has being friends with my bank account got to do with the Cabinet Office? We need an identity infrastructure for things as well as for people. I need to delegate permission to access my wife’s car to my sister just as I need to give permission for my sister to be friends with my wife’s car for a while. Right now, there’s precious little security around people, but even less around things, largely because the “internet of things” wasn’t designed with security in mind.

Typically, the person who designs the embedded software system for a car or a power grid system or a generating system are engineers who learn programming maybe as part of their engineering course, but they are not trained computer scientists or computer engineers. The point is that someone whose primary job is understanding control theory is not someone who knows anything about software vulnerabilities.

[From The internet of things | Interviews | Opinion, News, Analysis | BCS – The Chartered Institute for IT]

If this sounds esoteric, it isn’t. It’s a real issue that should be taken seriously as input to the deployment of devices right now. Here’s a straightforward example from Rob Bratby.

The deployment of smart meters is one of the most significant deployments of what is often described as ‘the internet of things’, but its linkage to subscriber accounts and individual homes, and the increasing prevalence of data ‘mash-ups’ (cross-referencing of multiple databases) will require these issues to be thought about in a more sophisticated and nuanced way.

[From Watching the connectives | A lawyer’s insight into telecoms and technology]

So I should be able to make friends with my electricity meter and under some circumstances I might need to be friends with my father’s electricity meter but I don’t want burglars and ne’erdowells to be friends with it. It seems to me that we already sort of know how to do this sort of thing: we understand public / private key pairs, tamper-resistant stores for private keys, certificates, selective disclosure and everything else. But we’re going to end up using Facebook Connect, because it’s all too complicated for the marketing people to understand and we haven’t yet found a way of explaining it to them.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers


Friends and relations

[Dave Birch] While I was sitting through a presentation (a very good presentation, I might add) on social media strategy for one of our client's financial services business, it struck me that they were slightly misjudging the more interactive and transactional nature of social media, doing great stuff but treating social media as another customer communication channel. I'm naturally more interested in social media for transactions: social commerce. I've given a couple of talks about this recently, pointing out the opportunities that social commerce opens up.

One prediction says social commerce will top $30 billion globally by 2015 with Facebook-generated sales one of the primary drivers.

[From Infographic: The history of F-commerce | SMI]

There are many different ways that financial services organisations can exploit this. A good example, to my mind, is the way in which Amex works with Foursquare.

Just after announcing that it passed 10 million users, location-based check-in service Foursquare has said it is partnering with American Express to give members even better deals when they check in at merchants’ stores across the country.

[From Foursquare partners with American Express for deal check-ins | VentureBeat]

This is a terrific proposition and it's well implemented (through statement credits, so no coupons or vouchers or anything are needed). And, to follow this example, Amex also has a Facebook pages where its large number of fans can come to learn about products and services, share with the community of card holders and so on. Great stuff. And it isn't only financial services organisations that are integrating themselves into social media to create new kinds of social commerce.

That is because the well-known mobile service provider is now allowing its customers to log on to Facebook to purchase phone credit.

[From O2 details new contactless payment technique]

Wow, that's pretty interesting.

Pre-paid subscribers will now be able to access a secure app on the social networking website, where they will put in credit card details in order to purchase top ups.

[From O2 details new contactless payment technique]

Credit card details? Not Facebook credits? But you get the picture. Something like Facebook can be used to create a more intimate transactional environment without having to develop software, making it easy for consumers to "friend" and "like" and so forth. Personally, I don't find this sort of thing particularly appealing because to me it's the wrong kind of social relationship: I want something more granular.

Here's what I mean. I don't want to be friends with my bank—after all, I'm a typical consumer so I hate banks—but I do want to be friends with my bank account. Why can't Barclays let me friend my current account so I can see its status updates like "Premium card fee £10.00", "Direct Debit British Gas £37.85" and "Counter Credit £5.00" and so forth? I quite like the text messages that Barclays sends me but would prefer something more immediate and more detailed (I often call this "streaming commerce") so that I can make decisions and respond.

Similarly, I don't especially want to be friends with MBNA, but I do want to be friends with my MBNA American Express card. If i see a status about about my payment being use, that would be really useful. If I see a status update from my card that appears to have gone on holiday to Kazakhstan while I'm in Peckham, I can press a button somewhere and get straight through to lost and stolen cards. I wouldn't mind if the status updates where now and then promotional messages instead of transaction reports, that would be handy. It would due like my friend telling me that there's double reward points in Sainsbury's today, so something like that. I'm using "friend" generically, of course, I don't mean to imply that Facebook is the one and only way to implement a social media strategy.

Facebook usage in the UK fell nearly 4pc in July to its lowest level since 2009, sparking concerns that the social network has hit its peak and may be declining in popularity.

[From Facebook usage falls to three-year low – Telegraph]

I don't use Facebook that much—it's really for sharing with my brother and sister, other family members and a few old friends—and I've not got a crystal ball to see whether we'll still be using it in a couple of years.

Many of the smartest people I know are leaving Facebook as well. I predict we’ll see many people leaving over the coming months and adopting Twitter.

[From The Facebook Exodus and the Future of Human Communication « Far Beyond The Stars | Cyborgs, second selves and cybernetic yogis]

My idea would work even better with Twitter. Suppose Barclays knew my twitter name—maybe they could ask me when I log in for home banking and get permission to send tweets to me—and connected it to my bank account. Now, whenever Barclays gets a new follower on twitter it can scan it's customer database to find out if that twitter name belongs to a customer. If it does, they can starting sending out all status changes as Direct Messages (DMs). That would be simple and great.

I'd love to follow my John Lewis MasterCard on Twitter in this way instead of having to log in to find out what it's been up to. Since I use Twitter all day and every day anyway, it would be a much better channel for payment products to develop a more intimate relationship with me. And think of the practical benefits: if I get a tweet from my debit card telling me it's just been used to withdraw money from an ATM in Belarus, I can call Barclays right away to block it from further misbehaviour. This doesn't seem terribly complex: all Barclays need to know is my twitter name and then it can use the Twitter API to post tweets and only allow me to follow them.

If I could follow my transactional instruments, I could also (in time) feed their tweets, status updates, notifications and so on into other software for mash-ups. I don't know what kind of mash-ups – I'm not smart enough for that – but I'm sure there are people out there who could do great stuff with the data. So a plea to my account, card and service providers: I don't want to be friends with you, because you are corporations and not mates, but I do want to be friends with my stuff: my money, my cards, my phone. How hard can it be?

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

I’m certainly me

[Neil McEvoy] I’ve been at the EEMA e-Identity conference in Tallinn, Estonia. I’ve heard a lot of people say that relying parties need to know the ‘level of assurance’ that can be ascribed to someone’s claimed identity, or in some attribute associated with an identity. A somewhat stronger version of this that I’ve also heard is that they must know the ‘probability’ that a claimed identity (or attribute) is correct.

This leaves me perplexed. If I see a die that looks like a regular cube, I can postulate that there is a one in six probability that if I throw it once I will get a six. I have implicitly assumed a couple of things; that my vision is sufficiently acute to spot any irregularity in its shape, and that the die is of an even density (strictly speaking, that the distribution of mass has cubic symmetry). I can test my proposition by throwing the die (say) 96 times. If I get roughly 16 of each number, my confidence will be increased (in a way which can be quantified) that it is a true die and that my initial postulation is correct. The points here are that:

  • my assertion on the probability rests on a limited number of assumptions
  • it can be tested
  • the more tests I do, the more confidence I can have
  • the past is a reliable guide to the future.

None of these are the case when trying to assess the veracity of a claim to a certain identity. If you receive a bundle of bits that encodes ‘Neil McEvoy’ (with some ancillary bits that indicate that some process, designed to validate the claim to my identity, has occurred), you cannot know the probability that I caused that bundle to reach you. I either did or I didn’t; but the number of ways in which I might not have is not known to you—or anyone.  Neither would you generally be in a position to repeat the process a hundred times and check the number of times that it is me or isn’t me. And, even if you could, there is no way that you can be sure that the past experience is a reliable guide to the future.

If we want an analogy with a die, it is that you receive some bits from me that purport to represent one throw of one die. Now, a die may not have been thrown—I could have made it up. It may have been thrown and I reported the wrong number, by accident or design; someone may have told me to type ‘6’ while holding a gun to my head; someone may have tricked me by handing me a die with two sixes and no ones; someone may have stolen the credentials I use to ‘prove’ that I entered a report; someone may have broken the cryptographic algorithm used to sign the transmission; or, for that matter, some Rumsfeldian ‘unknown unknown’ may have occurred. I think it is pretty clear that the probability that a report reaching you is truthful cannot be calculated, nor divined by any experiment.

So what should a relying party want? Clearly, not to be told by a provider that they can provide electronic identities that are 99.9% truthful, for such a person is a fool or a knave. By all means, he should expect the provider to have confidence in his service; but that is worth nothing unless he puts his money where his mouth is. The provider who accepts liability and has the balance sheet or the insurance to meet any losses that might ensue from your reliance on a false claim, that they have endorsed, is the only one that is worthy of your business. They will have every incentive to employ cost-effective business processes and technical measures that will limit the necessity for meeting claims.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers


Subscribe to our newsletter

You have successfully subscribed to the newsletter

There was an error while trying to send your request. Please try again.

By accepting the Terms, you consent to Consult Hyperion communicating with you regarding our events, reports and services through our regular newsletter. You can unsubscribe anytime through our newsletters or by emailing us.