Trust me, I have an IP address

I spent the day today at the Wealth of Networks II con­fer­ence, the agenda of which was set out as the next-​​generation of the Internet.

It was a good event and the organ­isers managed to bring together some top-​​rate speakers in a great venue with rock-​​solid internet, for once. And it was free – yay for the ESPRC which created the funding.

The slight oddness was that all three of the three panel events at the con­fer­ence, and one keynote, despite their ostens­ible themes, turned out to be about trust and identity online. I rather suspect that might have been in reaction to the top-​​down research model described in the first keynote which admitted that E70mn of EU research funding into the next ‘net was being spent without invest­ig­ating users’ concerns or agendas.

We’re becoming increas­ingly aware that there’s an issue with the identity and trust thing. What are the head­lines? Backlash against StreetView; Facebook’s T’s & C’s; stalking, bullying, frauds and impositions.

There are two poles in this debate that need to recog­nised and recon­ciled in whatever the Next Web brings.

Authentication is a good thing. Being able to prove that it’s you buying that DVD and accessing the details of your bank account; you (if you’re a 12-​​year-​​old-​​girl) joining that social network designed for 12-​​year-​​old girls; you regis­tering your general election vote, should that come to pass. Tracking down cyber­bul­lies, slan­derers and child-​​porn dis­sem­in­ators also sounds good.

On the other hand, anonymity is also extremely valuable. If you’re in a repressive regime and blogging about that, then it ought to be possible. It should be possible here in the UK, if you stay lawful (I’m already inviting some big ques­tions, to which we have no answer).

You might want to have separate pro­fes­sional and personal online personae – if you join a dating site, for example, you probably don’t want your col­leagues finding that profile. Avoiding stalkers without retiring from online would be a good thing. Teens fre­quently maintain multiple personae to explore dif­ferent social scen­arios and make mistakes without (real) con­sequences, I under­stand, and that cer­tainly sounds like a very good thing compared to the horror of my own teenage years.

So we need a way for people to prove their identity if they need to; to protect their identity if they need to. And about a million shades of privacy and open-​​ness in between.

The internet safety /​ gov­ern­ment services agenda would sway towards everyone having a registered identity with some third-​​party, let’s say the BBC, who would act as a trust broker.

But how much are you going to trust anyone to be that broker? A panel late in the day high­lighted several elements of grey in the word ‘trust’. For example, some­times, a better word would be ‘confidence’:

• I trust that my bank won’t run off with my salary next month.
• I do not trust my bank to offer me the best fin­an­cial advice for my indi­vidual situation.

So do I trust my bank or not? You see? The first example is better described as con­fid­ence. You know that NatWest would probably not be better-​​off running away to southern Spain with your month’s wages. It’s an informed gamble. But you don’t think they could be trusted with your finances full stop – you don’t think they’re all beau­tiful people who only care about your interests.

Trust (real trust) depends enorm­ously on context and implies a belief in the moral char­acter of a person/​organisation/​business. Most likely, a lot of the services we might be described as trusting (Banks, Amazon, eBay) would be better described as things we have con­fid­ence in.

Added to that, some­times we have no choice but to sort-​​of trust. Helen Keegan pointed out that often­times we click through accept­ance of a service’s terms and con­di­tions, because there’s no real altern­ative. We either want to do banking online or we don’t – we can’t disagree with point 5 in the t’s & c’s and have them changed. It’s like it or lump it.

I don’t really trust anyone to be the trust-​​broker of my online iden­tities – or yours, dear reader. Let’s look at the pos­sib­il­ities, currently:

• The Government. Obvious non-​​starter. I might be a dis­sident of some sort. (and *what!* 25% of gov­ern­ment data­bases are already illegal)
• Government Organisation: e.g. BBC. Similarly flawed.
• Private Corporate: e.g. Google. Already massively failed in China.
• Private small company: might turn evil; vul­ner­able to hackers, poten­tially, eh monster.com. And who the hell are you, anyway?
• The UN: this is a pos­sib­ility, but once the UN is hacked, then how do I recover my ID?

So this probably leaves the least neat, least integ­rated, least semantic possibility:

Lots of stuff. Regular password for stuff you don’t care about; unique pass­words for stuff you do; OpenID and Facebook Connect and MyBlogLog and Google for social apps; NI number and PIN for gov­ern­ment apps; Account Number and PIN for com­mer­cial stuff.

Messy. And I think it may be the case that ‘messy’ is the best solution to online identity, trust and anonymity for a long time to come. I can’t really imagine that computer sci­ent­ists are going to be the people that manage to overcome that.

That is probably not what the ESPRC, or Southampton & Imperial Universities wanted me to walk away thinking today. But thanks again for the thinking.

Share this post:

Possibly related:

• Trust Me, I’m a Journalist
• A Question of Trust
• How Carphone Warehouse Regained My Trust