Trent Adams's Library tagged trust → View Popular

Filter:
All
Annotated

03 Jun 09

Untitled

trustindigitallife.eu/Home%20Page.html - Preview

identity trust

The Trust in Digital Life Partnership (TDLP) is a new initiative that aims, over the course of two years, to set out a vision for trustworthy products relating to information and communications technology (ICT), including devices, applications, services, and infrastructures. Central to this vision shall be a recognition of the importance of the rule of law, security, and privacy and other core democratic freedoms in contributing to trustworthiness.

24 Apr 09

A Few More Thoughts on Email Authentication… errr… Trust

www.circleid.com/..._on_email_authentication_trust - Preview

authentication trust identity

For authentication to be useful, you also need some sort of evaluation mechanism, whether an ad hoc, private whitelist or a trusted, third-party assessment service. Authentication is only one component of a trust service. This, of course, leads to a chicken-and-egg problem trying to get adoption by parties who might not see concrete benefit anytime soon. While the mechanics and operation of authentication are well understood, they aren't cheap to implement. Absent an immediate value proposition, why should an organization go through the expense? Operations folk are not usually swayed by vague promises of eventual benefit. So what are the specific, immediate assessment, whitelist, reputation, certification benefits available for an adopter of DKIM or SPF? Absent a meaningful assessment mechanism, the answer is: none.
The simplest is application of classic Bayesian content analysis, to develop a reputation history for a particular identifier. Perform the usual types of statistical evaluation of a stream of messages having the same signature. You will quickly formulate an assessment. If your assessment is negative, you are in the unusual position of knowing who to complain to: Since the message stream is authenticated, there is an explicitly and reliably specified responsible party. If your assessment is positive, you can start treating that stream differently (and better) than messages lacking authentication.
1 more annotations...
- The second approach involves a published list, but is much more modest than an all-out certification service. Affiliation Lists (AffiL) is a proposal that Jeff MacDonald, of e-Dialog, and I developed:
  
  "Typically, an affiliation list merely documents an existing relationship, whereas quality assessment statements are the result of incremental and subjective work by the publisher. Hence, affiliations are more easily documented. In terms of using the publication information for performing decision-making by the consumer, the utility of an affiliations list is based on having the consumer of the list perform the quality assessment step, rather than the publisher." (See specification)
  
  Imagine a list published by the Federal Deposit Insurance Corporation (FDIC) of member organizations or one for licensed pharmacists. Membership already exists, even if it is not already published. Such a list would indicate domain names registered to a member. Anything signed under one of these domain names would mean that the signing organization had an affiliation that could be meaningful for a receiver's message handling analysis. The lists do not certify email quality by the signer, but they do provide useful input. While membership would not automatically mean that a receiver should trust the message, it ought to mean a higher level of safety than stray messages coming in from the world of mistrust.

17 Feb 09

MediaPost Publications FTC Guidelines: Drilling The Details 02/13/2009

www.mediapost.com/publications - Preview

trust behavioral targeting identity

A day after the Federal Trade Commission issued its revised guidelines for managing privacy concerns in behaviorally targeted advertising, industry figures are starting to weigh in and pore over details.
The FTC continues to stress four main principles of "Transparency and Consumer Control," "Reasonable Security," "Affirmative Express Consent for Material Changes" and "Affirmative Express Consent for to Using Sensitive Data for Behavioral Advertising.
1 more annotations...
- Murkier still will be the core definition of PII (personally identifiable information). The FTC believes that PII is data "that could reasonable be associated with a particular consumer or computer or other device, regardless of whether the data is 'personally identifiable' in the traditional sense." In the long run, the most challenging part of the revised guidelines for the industry may not come in the official principles themselves so much as in the evolving thinking at the FTC about PII. The Commission officers indicate throughout the document that changing technologies "have made the line between personally identifiable and non-personally identifiable information increasingly unclear."