Text archives Help


Re: [projectvrm] "Trust" [was: NY Times article: Personal Data and Privacy...]


Chronological Thread 
  • From: M a r y H o d d e r < >
  • To: luk vervenne < >
  • Cc: , ProjectVRM list < >
  • Subject: Re: [projectvrm] "Trust" [was: NY Times article: Personal Data and Privacy...]
  • Date: Sat, 11 Oct 2014 09:26:51 -0700

When we purchase things, a house, a refrigerator, a phone.. a meal in a restaurant.. 

We don't fully trust the auditors of these items. Some are licensed (house inspectors and appraisers
are highly regulated after the prior real estate mess called the S&L crisis  circa 1987-94 -- and health inspectors
and their ratings for food purveyors vary by place) and some aren't (Consumer Reports just doesn't take money or even the 
product to perform reviews).

It's up to each person to assess the risk of the effects of the purchase. Different entities make information
about the effects of the purchase available, and because they are regulated or have stated certain public
self-imposed boundaries, we can decide for ourselves what we each rely on and what we don't. In Seattle
they are just imposing the posting of heath scores in restaurants for patrons to see before they walk in.

There is a bit of (nervous) trust in relying on something(or one)-else for the review, the audit, etc, but what the reviewers and auditors
care about may not be what you care about. So depending on how important and the expense, people still assess
the situation and ultimately the choice is theirs.

There isn't much trust but the control is in the individual's access to know transparently how reviewers and auditors
work, and make the assessment yourself. The reviewers and auditors are *assuring* a level or standard of care.

It is possible to do this with policy reviews, or the effects of sharing personal data, to give people assurance.

But the word trust, as used now, will probably backfire, if used widely. This is because "Trust Frameworks" and "Trust Marks"
can't be trusted. They are "assurances" only.  (Re: Trust Marks --  this not the IP kind.. which adds an additional 
layer of confusion for people familiar with those as the IP kind has already a legal definition: you can trust this "mark"
is only used by the owner of the mark and not someone else, trying to confuse you as a customer -- that's all you are asked
to "trust" when you see a TM next to a logo, slogan or color scheme/design). Using Trust Mark in this context: as a 
signal of the use of a brand or logo or what is currently called a "trust framework" could work, if the "trust framework"
was changed to be an "assurance framework."

So for regular people, when they see Trust Framework or Trust Mark, they may think they can trust it more. But rather
they cannot trust it any more than anything else. And when they find it untrustworthy on any level, they will likely get angry and
just like with TrustE (whom no one trusts because they are .. not trustworthy[1][2][3] ) TF and TMs will be nastily made fun of
for implying they could be trusted when they can't.


Rather, all these things, TFs and TMs and Truste, just like Consumer Reports, can only give assurance to a standard, leaving individuals to be the judge
of what they will rely on, or control.

In the end, all we have is the ability to manage risk. Control is another way of saying: you want to control for risk, and being assured something
has met a standard helps. But it doesn't mitigate the risk. Only you, and insurance companies can do that, and likely the risk mitigation will be limited,
and payback, if there ever is any, won't make someone or the company who loses, whole.



On Oct 11, 2014, at 1:16 AM, luk vervenne wrote:

Having to Trust someone is a discomforting and weak business proposition. 
Better is if  the other side can proof their trustworthiness.

Here audit by design needs to be build in so end2end trust assurance is provided as an always-on service

In short, "trust is good, control is better" (Stalin)

luk


 
On 11 October, 2014 7:21am Johannes Ernst wrote: 

If, on the other hand, they hired, say, the EFF, to go through their
security / privacy architecture and implementation with a fine comb twice a year ...

This is not something the EFF does today nor would it if approached, but do folks
think this is something the EFF should do? Seems like being an auditor is a much
different business than being an advocacy organisation with a tech capacity.

I only meant to say that many people -- myself included -- would *** trust *** a statement
by the EFF about some organisation's (particularly government's) security and/or
privacy practices, while this would not be true about many other org's that
typically audit.... 

[emphasis in last sentence added by me]


I can't help but note the strange use of the word "trust".  You're talking about trusting an organisation do do something it cannot actually do.  That's kind of academic isn't it?  

We were asked to consider if audit is something the EFF perhaps should do.  But what happens to the "trustworthiness" of a body like the EFF if it was to be convinced to start doing something that it has never done before?  I should say I am no fan of the audit industry.  I am not at all convinced that existing commercial privacy audits and trust marks are any good either.

There's another topical case where "trust" has been exposed.  We're supposed to trust Open Source software right?  Yet the terrible Heartbleed bug in the Open SSL library resulted from a coding error (really, a high school level programming blunder) which went through the Open SSL Foundation peer review process unnoticed.  AFAIK nobody has worked out exactly what happened but it is entirely possible that no meaningful code review was done at all before the affected code was released.  

The term "trust" is almost useless to characterise what we need and what think we're getting from a software development process.

We really need to stop over-using "trust".  As the old Italian proverb goes, it's nice to trust but it's better not to.  Let's get precise.  What we need is accountability, verifiability, liability and so on.  

More by me:
http://lockstep.com.au/blog/2011/01/10/reading-peter-steiners-dog
http://lockstep.com.au/blog/2014/04/14/heartache

Cheers,

Steve.


Stephen Wilson
Lockstep
http://lockstep.com.au
Lockstep Consulting provides independent specialist advice and analysis
on digital identity and privacy.  Lockstep Technologies develops unique
new smart ID solutions that enhance privacy and prevent identity theft.







Archive powered by MHonArc 2.6.19.