Down with the Registration!

I argued in a previous article that we should use this web3 momentum as an opportunity to direct our efforts toward the building of a more decentralized internet. Although these ideas help us to think about our future, people wonder about concrete situations in our lives that justify why decentralization and self-sovereignity matters.

Consider how many people get unwanted calls from banks and mobile carriers. When wondering, “how did you get this number?” we are in front of the discussion about user accounts and the problems of personal data collection.

Another model for digital identities is possible: One that does not relies on targeted advertising, trading of personal data and does not encourage surveillance. A model based on privacy and individual sovereignty.

This alternative is known as Self-Sovereign Identity (SSI), and many good people work on the standards and technologies to make it viable. It’s a job that brings hope to someone who, like me, hates signup forms.

Snitch Society

I live in a small town, but with many pharmacies. It is almost impossible to buy any product, like a simple toothbrush, without the infamous question:

Are you a registered member?

Or some other variation, to get your phone number. Department stores are also part of this pandemic.

I know a person who gave up on buying a pair of socks because it was impossible to pay with cash without informing her phone number.

A. Pair. Of. F***ing. Socks.

Create your free account to continue reading

This intrusion is not limited to the physical world. In the digital world, the practice of snooping around is wider and disproportionate.

Try this experiment: Open the Google homepage, or any news site, in a private tab. Chances are that you will be bothered with a reminder that you didn’t identify yourself. Receiving content unhindered is the exception.

Examples of online services that require registration are everywhere — private, public, national, international, large, or small.

Everything is online

On a closer look at the examples offered, the separation between physical and digital might not apply, because the systems of most pharmacies and department stores are connected to the internet.

There isn’t a single day in our lives that we don’t interact with multiple systems and devices that collect personal data (whether with or without our consent).

Laptops, cell phones, and video games (and their proprietary OSes) already require registration even for their basic functionality - its setup requires the user to register as soon as they are turned on.

Even devices that have no reason to be online, are connected. This is a topic for a whole separate article. We can browse the blog @internetofshit, which collects examples of IoT (Internet of Things, ), to have a sample of ​​the many connected¹ things that surround us.

It is pretty normal to inform some data here and there; it is harmless; it is almost inevitable; everyone does; Google is free; help me with maps; it had as a motto the phrase “don’t be evil”; we can trust; no one at the drugstore have bad intentions; the salesman earns poorly and needs to hit his imposed goals; I can even get discounts if I rat three more friends…

Is it paranoid to worry about the fate of this data?

Or have we failed as a species? Have we normalized the invasion of privacy, lost control, and gone too far?

I don’t know; here’s a discount coupon to buy a snack, and let’s forget about it… “Alexa, turn on the living room light.”

How did you get my number?

Although nobody is listed in the telephone directory, those who have a cell phone invariably receive calls from banks and telephone companies every day in Brazil.

This plague also affects newly acquired mobile numbers. When answering a call like that, it’s hard not to engage in the dialogue and ask, “How did you get my number?”

Is telemarketing boring? Yes. But it is not the only or the worst consequence of concentrating personal information in systems with databases connected to the Internet and available to partners.

If someone messages you asking for money, it’s not me

Data leaks are irreversible. Exchanging permanent data, like social security, or sensitive data, like the cell phone number, it’s a one-way street.The toothpaste doesn’t go back to the tube.

As the number of leaked information increases, it becomes cheaper and more available for mass fraud, forgery, identity theft, lending, shopping, and impersonation attacks. Not even newborns escape from having their social security compromised.

https://www.youtube.com/watch?v=U5ya0cP-NgU

Scammers clone the social security of a seven-month-old baby

The world has changed fast, and we haven’t adapted at the same speed. We now need to care about stuff that wasn’t concerns² in analogue times. It is easy to forget how the internet is dangerous and unintentionally³ expose ourselves.

Make up for the lost time

Progress has been made with registration on online services — federated logins, selective and revocable consents, password managers, two-step authentication, and data protection laws — we are moving forward.

But we are still losing the race. Our information is out there, out of our possession, we still have to rely on other people’s systems to hold this sensitive data.

Big platforms concentrate a lot of information in big “data lakes” (data swamps), which is terrible. Even the most powerful and modern institutions, with the resources to hire the best engineers, don’t know how to handle the data they collect.

The path forward needs to be in the direction of minimizing the dependence and trust in centralized entities. Move away from the big platforms — our profiles, preferences, and histories — and keep them closer to us.

Where did I put my wallet?

In the physical world, we carry a handful of credentials, which are documents issued by entities that assert claims about us such as: date of birth, the approval on a driving test, preferred football team, nationality, proof of vaccination.

Depending on where I go, establishments may or may not accept the value of the information presented. If they do, they may use for granting access to additional benefits, for example, a discount on movie tickets.

In the digital world, we can rarely transfer our credentials from one site to another. We are frequently required to re-issue “our driver’s license” for every new road and city we decide to visit. Even when sites recognize the claims attested by a common entity (e.g., the Google account name), our credentials are held by the identity provider — instead of being carried with us.

A model more similar to the first situation is being worked on in the Verifiable Credentials (VC) standard.

The W3C VC model parallels physical credentials: the user holds cards and can present them to anyone at any time without informing or requiring the permission of the card issuer. Such a model is decentralized and gives much more autonomy and privacy to the participants. -- Wikipedia

Challenges of the post-Snowden web

Anyone building a website or service today has to ask themselves the following questions:

• How do I design a product with privacy in mind? (Privacy by design)
• How do I design a product that does not require registration?
• What version of the product I want to build doesn’t have a Sign-Up button?
• Can I provide value to my customers in a way that circumvents, avoids or fights, KYC?

Identity is what others say about you

There is a deep discussion about what identity is, but I won’t go into it for practical purposes.

For many things in life, identifiers and certificates serve as a summary for identity. If I write “Aurora” on a puppy’s collar and she gets lost. Someone who finds her can check the collar and confirm with me that she is the same dog I’m looking for by asking: “What’s the name of the dog you’re looking for?”

However more than one dog can have the same name since the word “Aurora” alone is not a unique identifier.

Institutions such as the São Paulo city hall can issue an animal registration that attempts to solve this problem. Although they provide a unique identifier, this is still a central authority, and here we want to talk about alternatives to that ;)

A more decentralized alternative would be to put a padlock on the collar. If I ever need to prove that the found dog is the same one that I look for, I can use my key. This approach has the added benefit of not disclosing identifiable information on the collar, like her name or my phone number. Privacy by design!

In the digital world, this lock-key solution can be made using cryptographic keys, which allows anyone to build as many of them as needed. It’s elegantly simple and independent of entities such as the city hall, Google, etc. It is purely mathematical, unique⁸, and can be generated offline.

Identity is what you reveal about yourself

On the Internet, nobody knows you’re a dog. Therefore, if part of my identity is having yellow as a favorite color, I can keep this information secret and selectively reveal it only to who I want. The control of this data is mine.

With some help from math, I can even join digital clubs that accept lovers of the “yellow or red” colors (another fascinating subject for another post) without disclosing my favorite color. In this club, the privacy of its members is preserved; and not even a court order would be able to find members who love yellow since the information is not stored in the system.

Summary

We live in times where the collection of personal data is excessive. Everyday activities such as buying a pair of socks are difficult to carry out without leaving a trace and giving personal data to snooping networks.

This centralized nature of platforms, characterized by excessive collection and careless storage, has harmful consequences, from being annoyed by telemarketing to being a victim of serious scams, identity theft, and stalking.

It is possible to reduce the damage caused by registrations. Mathematics can help design more secure systems where the control of digital identities and data disclosure is in people’s hands.

Bonus

Check out the following video, made for Microsoft, where Dr. Ann Cavoukian helps with why privacy matters for businesses¹⁰.

https://www.youtube.com/watch?v=vYzDn8Ws4as

Footnotes

1. Examples: elevators, menus, stoves, grills, lamps, dishwashers, faucets, drill batteries, fridges, printers, car keys, fast-food kiosks, TVs, the Facebook building lock…
2. Everyone carries a camera in their pocket today. And yet, “careless” credit cards keep coming out of the factory, containing all the data (the 16 digits, the expiry date, and the confirmation code) printed and explicitly visible.
3. Check the case of Brazilian general Augusto Heleno, who published a photo of his Covid exam on Twitter, and got himself registered in multiple systems that he did not choose.
4. See https://pt.wikipedia.org/wiki/É_verdade_esse_bilete
5. From SweetWilliamLondon’s store on Etsy
6. Antique Dog Head Lock
7. See https://twitter.com/SeedMint21/status/1518934554840600579
8. So absurdly unlikely to repeat itself, if generated with good randomness, it can be called unique
9. See https://twitter.com/rot13maxi/status/1509169063150465025
10. Because I know we tend to listen more to people in suits and summaries with the word “business” in the title.

Originally published in Portuguese at Egoismo Duplicado.

Header photo by Luis Cortés on Unsplash

English translation by Marcio Galli and revised by me.