Password stealing is about to become simpler...

Just read on Nicholaz's blog about the upcoming change to the way authentication is done in SL.

Let's put it short and simple: implementing it this way in the context of SL would be the most serious mistake, if the goal was to improve security.

D'oh... I'm speechless.

A simpler solution to the ID verification in SL

Reading Gwyneth' stance on IDV, I started to reply, but the reply came up bit long that I am making it a separate post instead.

I am not at all opposed to having the ID verification. I am very opposed to having yet another somewhat-trusted party which holds a large entity of personal data, even if they mined it in public records - it's not quantity, it's the colocation. The total amount of uranium on earth is much more than critical mass - and it is available. But putting all this publicly available uranium makes up the nuclear bomb.... So, sorry I do not buy the argument of "the information is already there" :-)

Ok, so here goes my stance on how this could have been done without nukes :-)

It's dead simple.

1) The registration to SL remains free, but the "unverified" new residents are placed into the "welcome areas" - either controlled by the LL themselves, or subcontracted to the partners. Here the residents learn to build, script, behave, and may earn a few lindens by helping other new residents with this task.

2) The IDV is not free. It costs a few bucks, and is payable either by L$ that the resident has earned in step 1, or by credit card/paypal/whatnot.

3) The LL generates a 8-digit random number for each resident, and uses the address and the name that were entered, to send this number printed on the sheet of paper, to the human that is verifying the identity, by registered mail. The number is not stored in the profile, the cryptographic hash of it is stored instead.

4) upon the receipt of the mail (and there are mailing services that verify the recipient's identity), the user goes to IDV page and enters the number found in the envelope.

5) If the cryptographic hash over the entered data matches the one present in the profile, the name and address of the person are verified. tada.
Also, I believe that the option of accepting the registered mail is available only to those who are 18+ - so this automatically performs the age verification as well.


No extra data is stored, everyone is happy, and LL has their back covered (since that's really what it is about, in my opinion - to prevent the lawsuits by the parents who do not have time to properly raise their children).

There can be more convoluted versions of this - without the usage of the postal service, but the protection of the information there and the logistics would be bit more difficult, so I do not write it here.

open social graph...

Undoubtedly a clever marketing trick by Google.

I'd be highly surprised that three people at once who had signed NDAs would be willing to part with their massage in the office and other perks.

But if this is true, let's see what this brings.

It might be that instead of experimenting with the world without the privacy, we might have to try it out how it feels on the humans...

Maybe I am just being paranoid. Let's wait and see what happens on 5th november. If.

Financial regulations in SL - good, bad, or inevitable ?

With the unfolding of the WSE-gate, and the Ginko fighting bank run (presumably the second is caused by the rough moves of the LL to smash down the casinos in SL), it is interesting how the future would develop.

Financial institutions are to a huge extent based on trust in the good will of the establishment - none of the real world banks holds the cash reserves equal to 100% of the deposits - otherwise they would simply have no instrument to work with to pay the interest. So, the situation with Ginko is just a typical consumer rush - reading the interview with Nicholas Portocarrero, he seems to be a reasonable person, so hopefully this is a temporary - assuming that the latest news do not shake the economy hard enough to eliminate the high-return opportunities.

But the WSE story does set quite a few interesting examples and questions.. Will the investors just eat the pill and continue as is, or will they form any kind of controlling entity ?

IRL the financial establishments are regulated by the government, does this mean we need to re-run the SLelections with real voting, and all the boring stuff that comes with it ?

SL has been always touted as "a new society", and what I am observing is that the humans behind the screens drive it more and more to be just a replica of what we have already in the first life. So, then, what's the point ? I do think that the interface in firstlife is still way better than in secondlife, and is free to join :)

I've been thinking about this and more and more come to a conclusion that the only way to achieve anything cardinally different is to apply cardinally different rules to build it.

Here goes my pick, just for a mental experiment :-)

1. The privacy is eliminated. Anyone has the right to know anything about anyone, and the target should be made aware of the activity of obtaining such a knowledge. No animal is more equal than the other.


2. The ground rule would be "do not do to others that you would not like to be done to you".


3. A dispute is resolved by a random selection of N members of the society, in a sufficient quantity to avoid the possibility of bribing/biased opinion - who judge the action based on the previous rule, by applying it to themselves.


4. The only measure of punishment is a temporary of permanent full expulsion from the society.

While the first one does sound scary and orwellian - it is not. The scariness of the lack of privacy comes from the fact of the unequal lack of privacy, and of the imperfection of the ones that have more privacy than yourself. There is only one drawback in this system which I see - it would be vulnerable to privilege escalation by the ones "in the know" of the system of enforcement/informing - which obviously has to be fully automatic and distributed. This needs further thought. However, assuming the "cybergod" could have been made perfect, I think these rules would might form an interesting society. Best ? Probably not. Coherent ? I think so. Definitely more coherent than we have today - the rules will take care that only the "similar" will remain. And, since according to Bruce Schneier, the majority of the people are good - it should lead to the good society.

But until there is a platform to try those things out and experiment - we'll need to wait, and meanwhile we return to our regularly scheduled programming...

UPD: Nice coverage by Wrath here. The "last lottery" winner does make me think I was a bit too naive in the above post, and everything is a bit more fun :)

Few simple principles for your SLex privacy

Vint is being excellent as always, with provocative and thought-provoking posts.

First thing it reveals - time is an illusion, and lunchtime - doubly so. Ooopz. That was not for this post... So, where was I... first thing it reveals - is that privacy is indeed more an illusion, rather than a reality. Second thing - despite of all us being perfect SL avatars composed of pure ones and zeros, we all do exhibit the interesting human property of curiosity.
Would I sneak peek if I heard such an encouragement in the main chat ? But of course! (Even though I do not engage into SLex - but I do not engage either in everything that I find odd/fun to take a look at, e.g.: thai cooking, stock trading, chaos theory, UFO studies, and tons of other things).

So, the question is "but what about my privacy and when do you stop the white noise in this blogpost and start with something useful to me ?"

Ok, I'm done with white noise. but couple of disclaimers:
first, since as we have found out, there is no absolute privacy, these will just help you (maybe!) to minimize the chances to trigger the interest of the passers-by and tempt them to move the camera. Second - all of the stuff here is fairly basic (from my point of view that is), so do not shoot the pianist, he plays the way he plays :-)

1. Avoid the main chat. The range of the main chat is 20 meters sphere (as per the doc on the lslwiki). And no, the walls nor roofs, nor anything do stop this sphere. Take that into account.


2. If you are doing something you do not want others to see, try to avoid being seen. This translates to not putting the sexgen bed into your house on the main busy street just across the road from the club. Put it into a box and move it somewhere in the sky, somewhere above 400-500 meters. The altitudes just below the 768, being the "official maximum" are usually pretty crowded, so you would need to increase the rendering range to something big, and check how does the surrounding look.


3. Note that the land restrictions do not work on high altitudes (and they anyway do not prevent the camera movement), so it is easier just to avoid setting them in the first place.


4. Remember that the "guard" scripts only take care of the avatar, not of the camera.
   And even if you put one of those (grr. why would you need it anyway?), ensure you do leave an ample time (30-60 seconds) for the AV who has stepped on.