privacy

Google Buzz proves problems with single online identities

February 24, 2010 By Dan Thornton

I’m assuming most people have been caught up in the huge amount of discussion around Google Buzz, the new social sharing and conversation tool from Google which surprised a lot of people by suddenly appearing as a full release within Gmail, and again by having some serious privacy problems at launch, which Google has had to work hard and fast to rectify.

But I think the launch of Google Buzz has simply highlighted the inherent problems with the move towards a single profile and identity for each internet user, whether that ends up being controlled by Google, Facebook, or an alternative service. Particularly as Google tested the system internally, where everyone had a Gmail account and several of the public problems just never arose.

1. Security: Almost everyone has encountered a scam or phishing attempt by email or a social network. There’s no way to eradicate these entirely, and a single identity which is then linked out to every other internet location would be a valuable prize for phishers. Seperate logins encourage you to use seperate passwords, so if one acocunt is compromised you’ll be able to alert people and still get on with most things – For example, my online email is backed up elsewhere, and contacts are replicated between Gmail and LinkedIn, so I could get the word out if problems occurred. Stalking also becomes a lot easier if everything is linked to one central location.

2. Embarrassing Content: This doesn’t have to just mean naughty pictures, although if you’re of legal age then I have no problem with you using the internet how you like. But it can also mean drunken photos and comments, or perhaps surprise presents or events being organised online which end up being discovered. The rule of thumb is to never publish anything online that you’d mind anyone seeing, even if it’s behind the thin veneer of a privacy setting, but we’d all still like to have some illusion of control over whether our boss discovers the pictures of our last night out, and we certainly wouldn’t want to ‘cross the streams’ and inadvertently shove it in front of him or her.

3. Different tools for different things, and added hassle: I’m a slight edge case here as I use several work accounts in addition to my own on a lot of networks, but even within my house, there is a shared computer which has at least two profiles used on the same site. Switching accounts suddenly becomes a real hassle – for instance, Youtube now automatically logs me in with my Google Profile, forcing me to log back out and then in again as Absolute Radio or OGS Labs.

4. Anonymity can be a good thing: Obviously this crosses over with the security and embarrassment issues, but not every anonymous person is a troll or 4Chan prankster. Take Wikileaks as an example of the positives that can come from anonymity.

5. Dependancy: Most people are combining email and social networks in varying amounts now, but if your email and social network ids are combined and potentially based in the cloud, any loss of access will leave you completely stuck. Or if your profile is removed for any reason, whether it’s a mistake or justified removal by whichever company controls all of your details…

But maybe there is a solution.

The people discussing Vendor Relationship Management hold the secret. Let me own some software – ideally Open Source, which is stored locally on my own devices, and then allows for the initial interaction with networks and service providers. And potentially have a mirror of certain elements of that software which is securely stored online somewhere that is also owned entirely by me. And that online element can then be differentiated into each of my personal and work profiles allowing me to quickly and easily switch between them, and not cross the identity streams. Companies would be able to access the particular information I wish to share with them, and use of that system would be a key part of digital education, which would implicitly educate people about privacy and sharing issues.

The only problem with this is who would store that info online – would you trust the Government of your country any more than Google, Facebook or Amazon?

Why I won’t be signing up to Blippy…

February 8, 2010 By Dan Thornton

A fair number of tech luminaries have been writing about Blippy recently – a new service which tracks your on and offline card purchases and shares them with followers. Not surpising with investors including Sequoia Capital, Jason Calacanis and Evan Williams. And Louis Gray has been publishing his experiences with the site.

I’m not averse to sharing my purchases and recommendations, and I’m fairly realistic about online security. Despite taking precautions, I’m aware that all banks and ecommerce sites have to transmit data, and that phishing and scam sites will always be a part of online life, as much as card cloning and skimming is a part of offline life.

I’m also happy to share a lot of info on social networks, only drawing the line at things which reveal more about my family than they might wish. After all, I’m choosing to let people know where I am or what they’re doing, but my family should choose their own privacy levels for themselves.

But surely there’s a big security risk inherent in the way Blippy works, which noone seems to have highlighted?

If you phone your bank or credit card company, they’ll generally require security details. And if you’re unable to provide them, or in addition, they’ll ask for you to reference a couple of recent purchases…

What does Blippy show? Recent purchases…

While I believe banks and other financial organisations should be adjusting their security to the new online world (and at the moment many are a bit subpar), it seems like a pretty big element of a financial security check to be sharing right now. So in the same way I’d happily use a location service to share when I’m in the pub but wouldn’t check into my home address, I think I’ll be giving Blippy a wide berth.

UK Govt – tackling piracy but in court on privacy!

October 31, 2009 By Dan Thornton

Quite funny seeing which stories followed each other on PaidContent this morning – one story is following the response from UK ISPs to Lord Mandelson’s proposal to disconnect illegal filesharers – but that immediately followed that the EC has set a two month deadline to overhaul UK rules on digital privacy.Or the UK Govt will end up in court.

Interestingly, it appears the EC are reacting fairly strongly to the UK passing of behavourial-targetting technology, e.g Phorm, but meanwhile France already has a law forcing ISPs to identify filesharers and using a three-strikes rule with disconnection as the eventual punishment, and the UK is looking likely to follow.

The conclusion is that my privacy matters when a private company wants to advertise to me, but doesn’t when private business industries influence a Lord to go against EU legislation which states access to the internet is a fundamental human right.

(For a nice, well-reasoned summary, read Hannah Nicklin’s open letter to Lord Mandelson – it includes plenty of useful links to relevant sources of information, including Ben Goldacre’s comprehensive dismantling of the claimed ‘seven million’ British people illegally downloading).

When concerns over social networks go way too far…

June 25, 2009 By Dan Thornton

Businesses and organisations can either embrace the opportunities and challenges of increasingly easy social interaction, or they can react against it. And two recent examples show how worrying that reaction can be.

Most digitally-aware people realise that anything you put on a public (or even supposedly private) social networking site can be seen by people including your employers.

But how about Bozeman City, in Montana, which requires job applicants to hand over their log-in information and passwords to any internet chat rooms, social networks or forums?

Why should potential employees have any right to privacy at all?

And then a media company, which by rights should know better, gets shown up. The Associated Press has issued social media guidelines, which not only match the restrictions put out by other media outlets such as the Wall Street Journal, but actually asks employees to monitor and edit what appears on their social network profiles, even when it’s written by their friends.

From the guidelines (via Mashable)

“Q. Anything specific to Facebook?

It’s a good idea to monitor your profile page to make sure material posted by others doesn’t violate AP standards; any such material should be deleted. Also, managers should not issue friend requests to subordinates, since that could be awkward for employees. It’s fine if employees want to initiate the friend process with their bosses.

The News Media Guild, which represents 1500+ AP employees is rightly speaking out about the matter, which could, in theory, see AP employees punished for something written by someone else on their profile wall etc. Or, as is equally likely, a spambot.

Court allows Viacom to invade privacy of Youtube viewers

July 3, 2008 By Dan Thornton

Due to the litigation case between Viacom and Google, a federal court has ordered Google to produce:

all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website

Time to boycott any Viacom products? Read more details on how this erroneously ignores the protection of the US Video Privacy Protection Act on the Electronic Frontier Foundation’s website. For the record, actions like this are a far bigger problem than Twitter failing to scale!