Posted 9:55 AM

I don't wear a mask when I go to the grocery store

Paul Madsen comments on Kim Cameron's first post in a series he's about to do on privacy and collusion in on-line identity-based transactions. He notes:

"A meaningful distinction for RP/RP collusion that Kim omits (at least in the diagram and in his discussion of X.509) is 'temporal self-correlation', i.e. that in which the same RP is able to correlate the same user's visits occurring over time."

and concludes:

"Not to say that designing identity systems to inhibit correlation isn't important & valuable for privacy, just that there is little point in deploying such a system without addressing the other vulnerabilities (like a masked bank robber writing his 'hand over the money' note on a monogrammed pad)."

I'd like to add that Kim's posting seems to fall into what I call on-line fallacy #1 - the on-line experience must be better in some way than the "real world" experience, as defined by some non-consumer "expert". This first surfaced for me in discussions about electronic voting (see Rock the Net Vote), where I concluded "The bottom line is that computerized voting machines - even those running Microsoft operating systems - are more secure and more reliable than any other 'secret ballot' vote tabulation method we've used in the past."

When I re-visit a store, I expect to be recognized. I hope that the clerk will remember me and my preferences (and not have to ask "plastic or paper?" every single blasted time!). Customers like to be recognized when they return to the store. We appreciate it when we go to the saloon where "everybody knows your name" and the bartender presents you with a glass of "the usual" without you having to ask. And there is nothing wrong with that! It's what most people want. Fallacy #2 is that most Jeremiahs (those weeping, wailing, and tooth-gnashing doomsayers who wish to stop technology in it's tracks) think that what they want is what everyone should want, and would want if the hoi-polloi were only educated enough. (and people think I'm elitist! :)

I do wish that all those "anonymity advocates" would start trying to anonymize themselves in the physical world, too. So here's a test - next time you need to visit your bank, wear a mask. Be anonymous. But tell your lawyer to stand by the phone...