Tech Life Your brain is an excellent judge of identity

The Second Leap

Disclaimer #1. I know nothing about security and its relation to this entry’s topic. I’m saying this because in my career I’ve had more professional beat downs when I’ve sat in a meeting with security types and hinted that I know a thing about Security. Seriously. The last time I met with the security folks and tried to sound intelligent about security and it’s relation to my product, I was jumped, “You can’t say that Rands. Your product is a clear example of the Mxyzptlk conundrum and would be vulnerable to Chomsky-variant attacks.”

I have just said nothing. More often than not, that is how I feel when I leave my security meetings. I walk in smart and leave stupid because I hear nothing… and I’m smart.

Disclaimer #2. To whoever comments on the security-related aspects of this column, I pre-emptively say “You are right and I am wrong.” I realize security is your religion and I apologize for offending you.

Key to the web application revolution is that we’re all ok with the idea of our data being somewhere else. Your average Internet users don’t know whether their Gmail storage is sitting on their hard drive or on a server in Oregon. Don’t know, don’t care. At some point, they will. In the near future, bandwidth will be fast enough and storage will be cheap enough that it’ll make good sense to store everything somewhere else.

The reason for this is simple. You’re busy. Your job is not to reliably back up your data, your job is to do whatever it is that you do all day. Sure, you want to back-up your data because “it’s a good idea”. We all think that about back-up… we all say “it’s a good idea”, but we don’t actually do it because that takes work and we’re already busy doing all our other work.

Realize this. There are people out there who have these big red cell phones on their respective hips. These cell phones have a special ring tone that, when used, cause their owners to totally freak out because it means one or more of their servers are down. The owners drop whatever it is they are doing and they bolt to the data centers to get their servers back up because that’s their job… keep those servers happy no matter what.

This is why the mail sitting on Gmail is significantly safer than the mail sitting on your portable.

This is the point where security and privacy folks freak out. Let’s give them a moment to settle down and then I’ll continue.

I’m not saying it’s not convenient to have all your content following you around, it’s just not that convenient when all that content vanishes in a puff of OH MY GOD MY DRIVE CRASHED smoke when you could have trusted someone else’s well maintained server to care for your content.

The Internet is rightfully being made out to be a scary place. Apparently every hacker in what was the Eastern Bloc is out to break into your computer, steal your personal information, and sell it to the lowest bidder in some shady corner of cyberspace. You should be worried about these folks because they do exist and they are actively looking to exploit ignorant users.

But…

The second key to the web application revolution is what we need to make another leap.

We need to trust that other people’s servers aren’t evil.

This issue of trust in cyberspace has been around since the moment someone realized that money would need to transfer via the Internet. This spawned an industry of folks debating the creation of public key certificates. All of this discussion is important and I’m glad it’s mostly being handled by folks who are qualified to have an opinion, but it strike me as odd that we’re still arguing about this when I’ve got a trust model that’s working really well right on my desktop.

AOL Instant Messenger.

Stop laughing.

Some important facts about my AOL Instant Messenger (AIM) account which I currently access with iChat.

  • I’ve been using it every day since it was first bundled with Netscape back in the late 90s.
  • At this very moment, there are 50 active folks in my buddy list.
  • I hit the ceiling of 200 total buddies over two years ago.
  • Unless I’m on vacation, I’m always online. Always.

Lastly and most importantly, in all of these years of usage, I’ve never received a single IM spam. Not a single one.

Does this mean that AIM is secure? That they haven’t shared my personal information with telemarketers? I don’t know. What I do know is that it’s been eight years and I still consider my AIM account to be an invaluable communication resource. A huge part of that perceived value is because AIM just works. I can’t think of a time I’ve been unable to access the service and, again, no spam. At this moment, there are over 900 spams sitting in my Yahoo account and over 3000 sitting on my Gmail account. Yes, they’ve done a fine job of filtering them into another folder, but they still sneak through.

How does AOL do it? It’s a feat. Eight years of usage of a free service and I have yet to be pimped to advertisers. Well, the solution is partly technical, but mostly educational. From the technical perspective, yes, AOL has done a fine job of keeping their database of AIM user names secure. One would assume if this database ever got in the wild that all AIM users would’ve been spammed at some point. Go AOL. Keep up the good work.

On the educational front, I’ve done two things. First, I know to never broadcast my AIM username is a public forum. Yes, I know there’s an account right there on the front page of the weblog, but that’s not my main account. (As an aside, the jerkyrands account has only been spammed once in a few years of usage.). Second, I choose the right people for my buddy list. This is a big deal. When you think about adding someone to your buddy list, you go through a blindingly fast qualification process: Who are they? Do I want to keep talking with them? Are they idiots? Are they who they say they are? What if I ask them this?

Your brain is an excellent judge of identity. When a random person sends you an AIM, you can qualify them as a decent human being with just a few random questions. This quality control creates a buddy list full of trusted relationships and that’s why I don’t receive spam via AIM; I don’t have buddies who are out to screw me.

The same idea applies to trusting web applications. We can define another dozen security protocols to make sure your credit card is getting from here to there without nefarious parties sniffing out your data. We can paste digitally signed certificates everywhere. We need that technology, but we also need the users of web applications to be educated. We need to keep explaining to them the clever ways phishing sites are trying to steal their PayPal accounts. We need to fill their brains with useful data about the four clever questions they should ask themselves before they ever enter their credit card information because trust is best assessed and maintained by a human.

#

9 Responses

  1. Doug 19 years ago

    “This is why the mail sitting on Gmail is significantly safer than the mail sitting on your portable.”

    Definitely. I’d rather trust something that millions of people count on daily than a self-run mail server that I could easily f-up with a couple of ill-made commands typed while half-asleep. Anything that’s life-critical shouldn’t be needed to be typed into a computer anyway.

  2. J 19 years ago

    Any security scheme is only as good as the weakest link. And frequently that weak link is the user. No matter what you tell some of them, they just lack the ability to use any form of analysis prior to entering their credit card into a page or downloading spyware-ridden useless software. It’s even worse when ordinarily intelligent people become blubbering idiots within a foot of a personal computer.

    On AIM … I use Gaim under Windows and Linux, and AdiumX on the Mac. I have a lot of friends that use Trillian in Windows. And none of them have an encryption scheme that will work with any other client. Would be nice to see at some point.

  3. Jo-Pete Nelson 19 years ago

    I agree with you on all counts except the use of AIM as an example of the internet’s savior. They do sell your soul to evil men, just not by allowing spam. Instead, they install several spyware/adware apps that come bundled for “increased productivity” or some such junk. Consider, for example, this quote from their EULA concerning their Pop-up blocker:

    “Pop-up blocker and browser bar with one-click AIM features. Also improves access to search by resetting IE browser error and search pages.”

    This is the exact behavior in certain adware programs that makes me run Ad-Aware and WinPatrol to monitor my computer for possible malware.

    They also install Viewpoint to show ads with or without your permission. I’ve nothing against Viewpoint specifically, but any time a third party program is installed, I want to be able to make my own decision (in this case, my decision would be NO, because Viewpoint is used for nothing but annoying ads).</rant>

  4. J 19 years ago

    Pretty sure he was just referring to the protocol. Not the official client. Always Gaim, Trillian, and Miranda as alternatives on Windows.

  5. JohnO 19 years ago

    Rands, I am amazed that you’ve never recieved IM spam.

    Anyhow, there is one more problem when we solve the two you’ve mentioned. ‘Lock-in’. With my data sitting on someone else’s servers, they have to understand it is MY data, and they aren’t entitled to keep me from it. If someone bumps up the subscription price, and I want to leave b/c of it. I need my data, and it has to be given to me in a format such that I can move it to a competitor.

    Granted, it doesn’t make much sense for any company to do that. Open file formats and standards are very much needed.

  6. Mike Purvis 19 years ago

    That’s why, when picking an open service, it’s important to look for ones with open APIs so that with a little effort you can get at it. (But not have to stoop to screen-scraping…)

    Examples: Flickr, Delicious, etc.

    Gmail is a shining example of not locking you in– they offer to forward your mail for free. They know they’re good enough that you’ll be there even if you don’t have to.

  7. Jerkass 19 years ago

    I can think of one… maybe two times… that I’ve gotten AIM spam.

    It strikes me as so odd that such an idiot-proof “for the masses” communications program can be so effective in preventing unwarranted messages.

    I had an ICQ account for about 6 hours, and I was pissed at how often “029862967” wanted me to chat about her huge hooters in that time.

  8. Martin Sutherland 19 years ago

    I’m totally with you on part of your argument: this bit about my important data being safer from random destruction when it is off-site on someone else’s servers. And I do really trust those servers, and the engineers who run them. What I’m still worried about is the continued existence of the companies that own and run those servers. Companies like Google have only been around for a few years, and although they’re doing really well right now, I’m still not entirely convinced they won’t disappear in a puff of smoke if the economy takes another nose-dive.

    Okay, maybe Google is a poor example, as they are bigger than most of the IPO-chasing startups were during the bubble. Maybe I’d trust my data to Google. But I would have a hard time handing over my primary working data to a smaller company, like Ludicorp/Flickr (before Yahoo bought them), or Six Apart.

    What I’d like to see is some kind of “data re-insurance”, in much the same way as other kinds of re-insurance work. Except instead of a (government-mandated or otherwise) financial guarantee or bond to back it, the data itself could be redistributed over a wider network of redundant servers. I’m not talking about redundant backup in the sense of having multiple data centers in case one of them burns down to the ground. In the case of an Enron-style corporate meltdown, I would like to know that my data was retrievable even if all of a company’s data centers were suddenly shut down and stripped for parts.

    Actually, I suppose I’m talking about some kind of P2P secure data storage and mirroring app, aren’t I?

    (One google later…)

    Here we go: Peerio (http://www.peerio.com/testdrive/)

    Interesting.

  9. Jeoff Wilks 19 years ago

    Your overestimate the value of AIM. The reason you don’t have to broadcast your AIM address in a public forum is because you can use your email address for that. Your email address takes the spam beating, and then those select few contacts who establish themselves as valuable get the upgrade to your AIM buddy list.

    Now imagine there’s no email. How do people get your AIM address? Your friends can contact you but what about everyone else? Do you post it publicly? If not, you would lose out on many potentially valuable relationships because it’s harder them to make first contact with you.

    In summary, IM only works because of its blue-collar friend Email, who handles all the street fights so that IM won’t have to.