In defense of HTTPS Everywhere

Today Doc Searls reposted Dave Winer’s three part post challenging the need for HTTPS Everywhere.  Dave writes:

There’s no doubt it will serve to crush the independent web, to the extent that it still exists. It will only serve to drive bloggers into the silos.

Some pretty strong claims from Dave and his posts are worth a read.  They come, in my opinion, to an entirely wrong conclusion despite some valid points and a “sky is falling” delivery.  Why wrong?  Consider how you might prioritize security in a software development project.  This is something I tell my consulting clients but I’m going to give it to you for free:

[Read more…]

Vendor entitlement run amok

My main issue with vendors turning us into instrumented data sources isn’t the data so much as the lack of consent. My Fitbit knows a lot about me but it’s an add-on that I self-selected and it provides value to me. The tracking in my browser is not something I can easily avoid since the browser is now an integral part of my life. Between those extremes there are lots of IoT devices that you can currently choose a private version but where that choice is rapidly disappearing. You can still buy a dumb light switch but not a dumb car, for example. Your shiny new GT phones home.

Among the vendors who seem to feel an entitlement to our data is Microsoft, whose Windows 10 is basically a box of spyware disguised as a user-productivity-gaming-and-cat-video-watching platform. I’ve already written about the issues there, how to mitigate them, and the disheartening number of those “features” that can’t be disabled. Yet as bad as all that is, this latest revelation still managed to surprise me across several metrics: the lack of consent, the extent of the invasion, the degree of exposure, the fact that it’s already been exploited to infect user devices, the fact that the entity who exploited it is a “legitimate” vendor, and the fact that said “legitimate” vendor egregiously exposed the exploit to the Internet. [Read more…]

Apple applies for patent to deliver ads based on credit status

In USPTO Application 20150199725, Apple describes a system for targeting advertisements “based on the amount of pre-paid credit available to each user.”  The application goes on to say that “An advantage of such targeted advertising is that only advertisements for goods and services which particular users can afford, are delivered to these users.”

I’m unhappy with this for a few reasons.  My first objection is that the human-readable description on the application is deceptive.  Your pre-paid balance is not an indicator of what you “can afford.” For example, if you deposit $X each week for your college kid’s expenses, that balance on the card doesn’t mean (s)he can “afford” luxury products costing $X or less. If you are me, it means they can afford ramen noodles, paper, pens and not much else.

People shouldn’t be bombarded with ads products costing $X or less just because that amount shows up in their debit card regularly. It would be a very effective technique to market items with a street price of $(1.25*X) discounted to $X to such people. That changes the equation from “can’t afford to buy it” to “can’t afford *not* to buy it, at these prices!”

Ads for things that cost more than you can spend are described in the application as being disappointing.  But I submit that a constant barrage of ads for things you know you can buy but should not is worse.  Having to say no to things you obviously cannot buy gives you practice saying no to things you should not buy.  You get used to a large portion of things in your ad stream being unavailable.  Exercising that “no muscle” helps at times of vigilance fatigue when you are sorely tempted to do something self-destructive, and who doesn’t have days like that?

On the other hand, a constant stream of things you want, have the cash to pay for, but really cannot afford would be depressing.  It leads toward the rationalization of “why shouldn’t I buy this? I can afford it.”  In a bit of psychological alchemy, it converts “can pay for” to “can afford” much as the patent application conflates the two and to the same ends.  I suspect there are people for whom this system will make shopping even more addictive than it already is and I doubt they can get a medical exemption from the advertiser.  At least not without agreeing to let the advertiser use their medically diagnosed addiction as a targeting criteria.

I can see it now.  Ads for “Shopaholics Pseudonymous – more effective than any 12-Step program and only $69.95/month!”

I also wonder about the subtle but significant disconnect between the example of “pre-paid credit” used in the human-readable introduction, versus the text of the patent claims which consistently use the words “credit status” as the decision criteria. Credit status is a lot broader term than pre-paid credit and could include FICO scores, payment history, income-to-debt ratio, etc. Future Terms Of Service documents supporting this technology could use a similar suggestive and ambiguous language construction to bootstrap unwitting permanent permission grants by consumers that allow advertisers to run full credit reports at will.

Various Federal and State laws restrict who is allowed to pull your credit report and for what reasons. The last project I worked on at Equifax was designed to get as far as possible around those laws in order to sell credit-qualified mailing lists without recording a credit report hit. Bypassing those legal restrictions is the holy grail of reporting agencies because it opens up their information database to lucrative new markets eager for that data. Of course, none of that matters once the consumer explicitly grants permission and a TOS worded to grant access to your “credit status” could do just that.

Of all the claims in the application, I especially like this one:

[0044] In one embodiment, the advertisement management system 14 is arranged to reserve a portion of the available credit (or actual credit) equal to the amount of an item in an advertisement being delivered to a user upon delivery of the advertisement. Thus, if the user wants to purchase the advertised item, they would definitely have available credit. However, the user would not be able to use this reserved credit, if needed, for other purchases.

Assuming widgets cost more than half your balance and you don’t like Apple’s widget on offer, you are prevented from buying Orange’s widget until the charge hold expires.

Incidentally, substitute “gun” for “widget” and Apple just implemented a mandatory cooling-off period for gun sales. Well, except for the one Apple wanted to sell you. You can have that one immediately.

IYou can't buy this am imagining the series of ads you get. Say you have $500 of credit available. The first few ads are for $100 items like expensive wine or flower delivery for your spouse. But now the credit is reserved and you have only $200 left to spend so the next ads are for a pair of mid-tier headphones and a new mobile handset costing $50 and 2-years of indentured servitude. But those ads reserved some of your balance too and now you have less than $100 available.

It continues on like this until the only ads you receive are for a soft drink in the vending machine and all you can afford there is the generic soda and not the Coke or Pepsi. At some point you are turned down at the grocery checkout trying to buy baby formula and diapers because Apple’s been pushing ads for iPads at you all day.

Many years ago, Eve took a bite out of the apple and Bad Things happened.  Hang onto your wallets folks because it looks like the Apple is finally getting around to biting back.

 

 

Better surveys = better signal

I’ve spilled many bits in this blog about the difference between vendor-driven creepy malvertising ad-tech versus consumer-driven intentcasting and Vendor Relationship management.  The vendor-driven model is the one where you are surveilled from all sides and the data compiled, analyzed, sliced, diced, massaged, correlated and enhanced until the vendor has a good idea to which things you will respond viscerally and then attempt to manipulate you with them.  This model is based on exploitation of human biases and vigilance fatigue. Vendor Relationship Management (VRM) on the other hand is about the consumer broadcasting intent and preferences to a market that can respond accordingly.  This model is based on fulfillment of the consumer’s self-directed interests and desires.

Somewhere in the middle are consumer surveys: direct customer input, wholly vendor driven.  Or at least many people, vendors and customers alike, think these are somewhere in the middle.  Me?  I’m a sucker for surveys since they are about as close to VRM as it gets most of the time these days.  I fill them out in bulk in hopes of detecting some whiff of VRM in one of them, and now and then I’m rewarded for my effort.  But only once in a blue moon.  Sadly, virtually all surveys I’ve seen fail to rise to a level that might qualify as anything close to VRM and most are just plain clueless.

[Read more…]

Intentcasting…to a roach?

OK, so it’s a robot and not a roach. But it is a robot that *looks* a lot like a roach. Researchers at Bielefeld University are experimenting with emergent behavior on a robot platform they named Hector. Their software thus far has been reactive. The new software aims to give the robot “what if” capabilities to solve problems it has not been programmed for. This would imbue the robot with independent goal-directed behavior – i.e. robot intentions.

But beyond that, “they have now developed a software architecture that could enable Hector to see himself as others see him.” In other words, they gave it theory of mind and their ultimate goal is for it to be able to sense the intentions of humans and take these into account when formulating responses and actions. They want it to be self-aware. Though the rest of the world will probably see in this the parallels to Skynet of Terminator fame, the more interesting part to me is the notion that it will sense human intention.

Perhaps this is because the current crop of “smart” devices seems very autistic to me.  Though they have a wide range of apparent intelligence, they respond only to what they can directly sense, and only within a context of which they are the center.  The inability to make inferences about humans, and in particular to understand their intentions, is a typically autistic cognitive deficit.  While it is possible to emulate this to some extent, it is often perceived as inauthentic and creepy, which may be why I write about it so much.

Bielefeld University's Hector robot

Bielefeld University’s robot Hector is close to being self-aware

The quest by the marketing industry to provide targeted messaging tailored to your specific interests and intentions very much parallels the autistic experience.  Any given product or brand seeks to better understand how it is perceived by humans.  Or to put it another way, products and brands lack theory of mind and the ability to infer human emotions and intentions from non-verbal communication.  Like any autistic person, they attempt to mitigate their cognitive deficits by gathering data, observing reactions, forming a model of human behavior, calculating appropriate responses, then improving data sources and refining the model over time.  When humans do this we call it vocational training and independence skills.  When vendors do this we call it ad-tech.  Both groups tend to wonder why people at large often perceive it as creepy.

Hector is essentially autistic.  With the addition if self-awareness and the ability to infer human intentions, Hector may cross the line to creepy.  We’ll find out shortly.

JTPhoneHome

JT (Jibo Terrestrial) phone home!

The consciousness of most of our iconic sci-fi robots like C3PO and Robbie was modeled after that of humans – it was self-contained and part of the robot itself. Even though the Star Wars bots could access the networked world, they didn’t send their sensor data back to a central mother ship to be interpreted, processed, and turned into instructions for the robot to follow, then transmitted back. Everything happened locally. Contrast this with our real-world robots that use the mother ship architecture. Siri, Cortana, Alexa, Google [x], Jibo, Pepper, etc. all phone home more often than ET.  If you use these products, their vendors have access to all the data they send back to the mother ship.  Because that data is potentially very valuable, it would be naive to believe that it will be discarded once its benefit to you  the user has been realized.

It remains to be seen how the software coming out of Bielefeld will work, but one hopes that some aspect of self-awareness will be so incompatible with latency as to strongly favor local processing. If that is true and the new robot architecture is more like science fiction of yesteryear than the science fact of today, there is some hope that someone, somewhere on the planet will finally use intention detection in a non-creepy way that primarily benefits the individual and not the vendor.  It might also give us insights that will improve the lives of autistic people by helping us learn to infer human behavior in non-creepy ways.

On the other hand, if you ever read about Hector in Ad Age, we are all doomed. Skynet will have awoken. And it will have a really good deal for you.

 

A version of this post which more deeply explores the autism connection is posted on my Ask-An-Aspie blog here.

The Newtrain Manifesto

Next month Deborah Schultz will be presenting a keynote called Smart Data: The Struggle to Enhance Customer Experience in a Digital World at the Direct Marketing Association’s upcoming Marketing Analytics Conference.  In preparation she bounced the topic off of the VRM mailing list asking how the crowd there would challenge this audience.  Naturally, I had a few ideas.

[Read more…]

What is your definition of personal?

Over at the Cloud Ramblings blog, John Mathon provides his list of Breakout MegaTrends that will explode in 2015.  There’s an entry in there about Personal Cloud rising to prominence.  Yay!  John and I often see eye to eye on our visions of the near future of computing and Personal Cloud is definitely huge in that future.  But it seems that once you get past the name “Personal Cloud,” our visions begin to diverge.  I’d like to explain how they diverge, why my vision is better, and beseech John and all the other pundits, analysts and trade journalists out there to adopt a slightly stricter interpretation of what, exactly, constitutes “personal.”

[Read more…]

What the Dark Web going mainstream means for you

Need some hacking done? Penetration testing for your web site? Change your college grades? Hack your ex’s email and social media accounts? Now you too can hire a hacker because marketplaces for freelance hackers are no longer the province of the dark web. Today they operate openly alongside the likes of other freelance sites offering more traditional work like graphic design, web site building, or fixing that shutter that’s about to fall off the house. In fact, there are now enough freelance hacker sites that at least one meta site, Hacker For Hire Review, has sprung up to review and rate them. Whether your company operates the legacy or the VRM model, there are a few takeaways here.

[Read more…]

Online advertising is the new digital cancer

cancer cellMany news reports of late have described malware being delivered through advertising networks. But that leaves the impression that the AdTech itself is benign and being hijacked for nefarious purposes. While it may have started out that way, that is definitely not the case today. Kaspersky Labs mention several times in their latest report that the adware has become so aggressive, intrusive, and exhibits such bad behavior that they are now classifying the adware code itself as malicious.

According to AdWeek, global advertising revenues have reached $512B and they forecast declines in revenue growth for 2015.  Meanwhile, cybercrime is estimated to cost the global economy $445B annually and that cost is increasing steadily due to advances in technology and in part because victims pay the price over many years so the victim pool grows relentlessly year over year.

Online advertising has escaped its digital Hayflick limits and is spreading out of control. Online advertising is the new digital cancer.

[Read more…]

Online privacy as a policy issue

I’ve been spending a lot of time working with Qredo which is a company and a technology that seeks to provide in code many of the online privacy protections we fail to provide (or fail to enforce) in policy and law.  While I believe this is a Good Thing and necessary, it doesn’t eliminate the need to fix the policy and legal framework for online privacy.  In fact, it makes these things even more urgent.

[Read more…]