Sunday, April 1, 2012

Social Networking Security

Originally posted 9/9/2010

On the internet, no one knows you’re a dog.  That famous New Yorker cartoon by Peter Steiner from 1993 illustrates a fundamental issue faced by today’s social networking sites: are the members who they say they are?

We’ve learned a lot about participation in social networks via the internet over the last few years. We know from the good old days of altnet newsgroups (don’t worry if you’re too young to remember those) that anonymous participation in social networking sites is always problematic.  People post under multiple identities, they post under false identities (which is why Twitter has a “verified” flag for celebrities), and they can be incredibly disruptive by posting argumentative, obnoxious, inflammatory, obscene and generally vile remarks.  After all, when you’re anonymous, no one knows you’re “that” dog.

One solution to the problem is to try to tie a member identity in the community to an actual person.  Most sites accomplish this by requiring unique user names tied to an email address: that way when you sign up, they can at least send you an email to confirm that you are a real person and that you own that particular email address.  Of course, this doesn’t prevent people from signing up with multiple email addresses, but it helps.  By making members identifiable (rather than anonymous), most of the problems mentioned above go away (or the user is rapidly ejected from the community for being a jerk).  If a social networking site doesn’t require an email address for registration, or if they don’t make new members verify it by clicking on a link in an email sent to them, the site runs the real risk of degenerating into a de facto anonymous network. 

The flip side of requiring a unique user name and a valid email address is that it limits member participation.  Someone using a work computer, for instance, has a problem joining with their personal email address, since their personal email may be unavailable on their work computer (or vice versa).  Or people may fear that the social networking site is collecting their email addresses for nefarious purposes like spam or phishing, and refuse to provide it (and thus be barred from participating in the network). 

This is the classic tension found in systems requiring security: The ultimate secure system lets no one in, assuming that everyone poses a threat to the system; an open system lets everyone in assuming they have a right to be there.  In the real world, security and openness is a balancing act: Make security too hard and lots of people that you want to participate won’t; make security too simple and lots of people that you don’t want to participate will.

No comments:

Post a Comment