Zero Privacy? Zero Knowledge May Have a Way Around That
One of the most famous cartoons in online history shows a dog in front of a computer saying, “On the Internet, nobody knows you’re a dog.” It spoofs “avatars”--virtual identities that swept the chat rooms and online communities a few years back.
Like most things Internet, that cartoon lost currency fast. Nowadays, direct marketers, employers and hackers can identify most users’ pedigrees with ease.
From psychographic profiles based on analyzing your Web-surfing “click stream” to precisely targeted junk e-mail, or “spam,” and from “sniffer” software that captures personal information over the network to “cookie” files Web sites plant on your PC to chart your comings and goings, the industry exploits the growing transparency of Internet identities.
“You have zero privacy anyway,” Sun Microsystems’ refreshingly blunt Chief Executive Scott McNealy reportedly quipped at a recent event announcing Sun’s Jini technology for networking digital appliances. “Get over it.”
“Zero Privacy” McNealy probably hasn’t heard of Zero Knowledge Systems, a small Montreal firm whose Freedom software will be shown publicly for the first time today at the Demo industry conference in Indian Wells, Calif. The product should be commercially available in March.
If Freedom works as advertised, it would help reverse the seemingly inexorable slide toward full disclosure. It offers the possibility of secure Internet privacy for the entire personal online experience.
The security industry has already produced spam filters and encryption algorithms; some are even usable by mere mortals. And every reputable Internet merchant protects your credit card number from online thieves.
But no such scheme prevents marketers from finding out where you shopped. And no single product handles all personal security needs. Several security gaps--for example, instant messaging and chat--make comprehensive Internet privacy elusive.
One product, Web Anonymizer (https://www.anonymizer.com), obscures your identity during Web surfing but relies on servers (the computers that transfer and manage Web traffic) that could reveal your identity if they were compromised by hackers or their administrators were compelled by court order to disclose data on users.
Freedom encrypts messages and personal identifiers (such as e-mail address and Web domain codes in the message “header”) by bouncing them around a network of intermediary servers between your click and your destination. Each server knows the last machine to pass off the data, but none knows both the originator and the destination, so they have nothing to reveal.
The company claims that because Freedom works at the network level, it will be compatible with any Internet software program or service provider’s system.
In short, Freedom would provide security for the full range of Internet personal privacy concerns--e-mail, Web surfing, instant messaging and chat, plus a spam filter and cookie protector--in one inexpensive package. For $50, you buy as many as five pseudonymous identities for a year or one identity for five years.
You might use your real name for business or family matters and one or more untraceable pseudonyms for participating in, say, a support group for recovering alcoholics, a forum on abortion or a role-play fantasy world.
If the product lives up to its billing, this combination of features will offer unprecedented protection, according to Bruce Schneier, chief executive of Counterpane Systems, a computer security and cryptography consulting firm in Minneapolis.
“It could be an important step forward,” said Evan Hendricks, editor of the Privacy Times newsletter. He noted, however, that there are still gaps related to how personal information you offer voluntarily is surreptitiously sold or otherwise abused.
And the e-commerce effects might be the most important. Only a fraction of Web users buy goods or services online. Among those who don’t, more than half blame security and privacy concerns, according to a recent study by San Diego-based market researcher InfoBeads.
Freedom is pseudonymous, not anonymous; you can establish persistent identities with buying habits, interactions with ads and Web site preferences. Because marketers sell against profiles, not individuals, they don’t care who you are, just where you click. Therefore, somewhat paradoxically, Freedom could also free online buying.
“When users don’t see themselves as having privacy, they’ll just lie and give totally false [demographic and personal] data, so a lot of the data that marketers get today is useless,” said Zero Knowledge Chief Scientist Ian Goldberg. Goldberg is an original “cypherpunk”--a loosely knit group of crypto-libertarians known for untangling knotty algorithms and sporting long ponytails. He’s famous for having cracked some of the most secure encryption systems ever devised.
So if you can buy goods and volunteer accurate data with confidence . . . open the e-commerce floodgates.
Even if Zero Knowledge falls on its face, the concept is so strong that somebody will figure out an alternate scheme that proves the McNealys wrong.
But what about those who might abuse such privacy? Zero Knowledge Systems says it restricts the number of messages a user can send to an average of 300 a day, far below the threshold of a practical junk e-mail business. Send more and you’re kicked off the system.
One caveat, however. Freedom could also protect online stalkers, shysters and criminals--hardly an incidental problem in light of the cyberstalking and hate e-mail cases that have surfaced in the last month. Law enforcement officials already have a hard enough time catching up with cyber-savvy creeps.
Zero Knowledge Systems, like privacy advocates, tends to discount such downsides with the age-old “technology is value-neutral, but on balance, it is used more for the common good” argument.
“This might make it more convenient for stalkers, but the overall benefit to the population of Internet users outweighs the threat,” said Hendricks of Privacy Times. “There are ways [stalkers] can mask their activity now. Either way, it takes good investigative work to catch criminals.”
Don’t expect that argument to persuade the FBI or police, but the point is not without merit. Consider that if you use a product such as Freedom and a little common sense, the bad guys might have a hard time distinguishing the real you from a golden retriever.
*
Times staff writer Charles Piller can be reached via e-mail at charles.piller@latimes.com.
