scrapbook: A question of trust online

April 23, 2004

A question of trust online

We should embrace the "trust economy", argues technology analyst Bill Thompson, even if there are bad people out there.

I was contacted this week by a reader of these columns who was worried that she had inadvertently given away the password for her Vodafone e-mail account to an online scam artist.

When she got an official-looking e-mail warning her about security and online fraud, she clicked on the link it contained to log on to the service and check all was well with her account.

Then she realised that she could not be sure the e-mail had actually come from Vodafone. She might easily have been taken for a ride by a "phishing" site and just have disclosed her user name and password to a fraudster.

Unfortunately, nobody at Vodafone customer support could help her because they had no idea whether or not their e-mail people had been sending out messages about security.

And she had deleted the message so couldn't go back and check the address which was embedded in the mail.

There have not been any reports of a Vodafone phishing attempt, so she is probably OK, though I did suggest that she changed her password straight away, just in case.

But Vodafone's inability to help her was a clear sign that the fraudsters are several steps ahead of the online services at the moment.

Obvious steps

I was reminded of a similar situation I encountered a couple of months ago when Cahoot, the online bank, sent me an e-mail which was so badly written that I instantly thought it was suspicious.

I checked the e-mail in plain text view to see if the web link was correct - and it was - but being ultra cautious I also e-mailed the bank and asked them to confirm that they had sent it.

A day later they got back to me to reassure me. Of course, if it had been an urgent security alert then I would have been in big trouble, but at least they tried.

There are ways to avoid this sort of thing, and two strike me as obvious first steps.

Every e-business should have space on its website where copies of every e-mail are kept.

If I buy tickets online then I expect to get a confirmation e-mail so I will not worry about it. But if my bank or favourite online airline are going to send me marketing stuff or security alerts they should put a copy somewhere I can find them.

Second, companies should advertise a hotline - either an e-mail address or a phone number - that you can use to check whether the message you received is legitimate or a phishing expedition.

We cannot rely on the public service sites like the Anti-Phishing Working Group to do this - they cannot be responsive enough, and there is no guarantee that they have not missed something. It has to be down to the firms that benefit so much from operating online to reassure their customers.

Otherwise we may decide that good old fashioned technologies are better - telephones, post and even face-to-face meetings might well make a comeback.

Communal web

Even as I despair about the number of spam e-mails, phishing attempts, 419 frauds and deceitful websites out there, other aspects of our online world give me hope that things can be better.

Wikis, for example, are a perfect example of the "trust economy", a space in which the exchange of ideas and information depends almost entirely on a high degree of trust between all the participants.

A wiki, at its core, is a universally writable website with a mechanism for adding and linking new pages automatically.

Anyone can come to the wiki, read the content, and then edit it. Or overwrite it with rubbish. Or delete it.

You can ask people to register and control their access, but most wikis do not bother with this, relying instead on trust between users and the realisation that few people are going to be bothered to trash a random page.

I am peripherally involved in NotCon '04, a loosely formatted day of discussions about the nature and impact of the net and the tools we have built on top of it, and it is being organised almost entirely on a wiki.

The fact that this works, and that we can organise this event in a public space where anyone could disrupt us, is a testament to the social cohesion that is possible online.

And there is the wikipedia, a community-written encyclopedia that has evolved over the years from a largely technical bunch of articles into one of the most reliably useful sources of information around, on or off-line.

Shared interests

The wikipedia relies on peer review, letting anyone who is interested in a topic start a page about it, and working on the assumption that others who know or care about the subject will criticise, correct, extend and generally improve what is already there. And it works.

As an old-time socialist, I believe that social justice will come from the freely made choices of us all, and even though I am in favour of government and the rule of law, the legitimacy of that government comes only from the people.

That means having political systems built around collective action, participation and respect for each other's views and values.

Wikis, like the old Left Book Club, the Workers' Educational Association and the trade union movement, show what that collective action can achieve when it is based on trust and shared interest.

When I am overwhelmed with despair by the spammers and the scammers, they give me hope.

Bill Thompson is a regular commentator on the BBC World Service programme Go Digital.