Nymbus

Sam Walton’s Ghost Is Watching You

2012-04-29T00:00:00-05:00

Great news, libertarians: you now have a reason to be leery of Wal-Mart. It has come to my attention that Wal-Mart maintains a near-impregnable 125,000-square-foot facility in Arkansas that likely houses every slice of information about every purchase in the store’s history. Terabytes upon terabytes of data live here in this super-secretive, tornado-resistant warehouse.

You can read the article yourself, so I won’t go through every detail. The creepiest part to me, though, is that Wal-Mart is experimenting with video technology that can watch someone browse the store and facially identify the customer. The kicker: thanks to RFID tags, the system can activate whenever a customer picks up a product. No purchase is necessary; they know what you’re looking at in-store and they know who you are. Creeped out yet?

Like many, I’m not a huge fan of Wal-Mart. I usually buy only three things at a time, so a catch-all superstore isn’t attractive to me -- the day hasn’t come when I needed dog food, motor oil, some DVDs, and five new pairs of slacks all at the same time. Plus, if I ever need to walk three football fields to buy a bookcase, I’ll go to Target first (I’m conveniently ignoring Target’s creepy privacy issues, by the way).

However, I am not a vocal critic of Wal-Mart. You won’t see me picketing the opening of any store. If anything, I’m a Wal-Mart defender. They found a way to find crazy success by running huge stores across the rural and suburban centers across our great land. Wal-Mart stores allow people in formerly remote locales to easily purchase a big-screen TV or a decent six-pack of beer. True, it’s a behemoth that threatens the smaller businesses, but that’s the way things work. Popular, successful, convenient entities tend to win out, and those who don’t are forced to adapt. If you’re bothered by Wal-Mart, you’re bothered by every strip mall across the country, and what’s the point of protesting every successful American business?

I can’t decide whether this piece of Wal-Mart big-brotherism should surprise me, upset me, or please me. I know it shouldn’t surprise me -- I’m pretty much inured to the fact that corporations want as much info about us as possible. I’m not particularly upset about it because I’m privileged enough not to need to go to Wal-Mart, so I’ll just patronize a store that doesn’t make me feel like an Orwell protagonist. I’m actually somewhat pleased by this revelation because finally, I have a tangible reason to hate Wal-Mart.

Before, I could only say that Wal-Mart’s clientele depresses the hell out of me, or that the lighting in their stores was unsatisfactory (something they’ve improved in recent years). The smiley-face logo makes me uneasy. A desk I bought from them was kinda shoddy. The most tangible reason I had to hate them previously was that I think emphasizing “Made in the USA" is a bit economically narrow-minded, but even that never raised my hackles. But now -- now! They’re watching us like hawks and have all our info in a fortress! They don’t let any outsiders into the facility and guard it as if it’s Fort Knox! When I pick up a pack of razors, cameras immediately turn to me, recognize me, and a little bitlet of data shoots to Arkansas that says, “Darrell Johnson needs razors". That might not be a malevolent purpose, per se, but it’s just the breach of privacy that excites the kook in me. So thank you, Wal-Mart, for making even the most pro-corporate libertarians among us distrust you as much as everyone else does.

-Darrell

Privacy and YOU: The Interconnected Menace

2012-04-15T00:00:00-05:00

FADE IN on a high-school classroom. It’s clearly just before class starts; most children are in or near their seats, but all are chatting happily. Near the side of the frame, a paper airplane makes a brief flight from the middle to the edge of the room. As the teacher, wearing horn-rimmed glasses, walks in, the students begin to settle down, all smiling.

The camera focuses on a girl in the front row wearing a white blouse, flowered skirt below her knee, and pink sweater.

NARRATOR: Meet Susan. An all-American girl. She wants to go to Tech State University next year. Her teachers and counselors say she has a great chance of getting in as long as she keeps her grades up. What they don’t tell her is that it’s much more than bad grades that can ruin a young girl’s dreams.

CUT TO: A local drug store / lunch counter / soda fountain / pinball arcade filled with rambunctious scamps. Couples are sipping malts with two straws; some of the more casually dressed fellows are at the pinball machine; and our SUSAN is in a booth sharing a plate of french fries with her girlfriends CAROL and LISA.

CAROL: Hey, Suze, are you on Facebook?

SUSAN: Facebook? You mean our class yearbook? Of course I’m in that!

CAROL: No, this is on the computer. [pulls out iPhone] It’s a way for friends to stay connected over the internet. See? I’m on it, and so is Ruth Burrows, and we even found our math teacher Mr. Hawkins! Plus, you can play games with each other and post your vacation pictures…

SUSAN: [investigating Carol’s phone] Wow, what DOESN’T this thing do?

LISA: Girls, I don’t like the sound of this. Aren’t all our friends right here anyway?

CAROL: Oh, don’t be such a nerd. This is the future of technology! Suze, I’ll help you sign up. Just go to facebook.com on your phone.

Quick DISSOLVE to forty seconds into the future

CAROL: And now all you have to do is post a picture of yourself and fill in all this information.

SUSAN: Okay, favorite foods: french fries, milkshakes, and sushi… religion: Methodist… hobbies: watching movies, going to sockhops, and laser tag… now to put on some photos for you guys…

LISA: Do you really want to be putting all this online?

SUSAN: Stop worrying, geez. Ooh -- it says here that I can “check in” at the lunch counter on something called FourSquare. What does that mean?

CAROL: Do it! I’m on it, too, and whenever you check in, you get little rewards on the screen. I’m currently the “Mayor” of this booth, which means these fries were a dollar off!

SUSAN: Wow, a whole dollar!?! [excitedly presses icons on her iPhone]

PAN to five tables over. A group of three boys, LARS, HENRIK, and IVAN, are eating cheeseburgers, each with an iPhone of his own

LARS: Dude, check out this new app. [presses icon on iPhone] It’s awesome.

IVAN: Is this another stupid tower-defense game? I have no patience…

LARS: No man, it’s called Girls Around Me. It lets you check out girls.

IVAN and HENRIK: Let’s see it!

Camera ZOOMS on LARS’s iPhone and shows a map of Anytown, USA. Red markers dot the landscape, including a noticeable cluster around a square labeled RED’S FUN THYME HANGOUT

LARS: See all these dots? They’re girls who checked in on FourSquare recently. The app links that info with their Facebook profiles, so we can see extra photos and info about them.

HENRIK: [noticing a picture] Hey, who’s that?

LARS: [touches one picture] Her name’s Susan. She’s a Methodist, likes sushi and laser tag, and best of all, all her photos are public.

IVAN: [rubbing his hands together] This is already my favorite app ever.

LARS: [eyes bugging] Whoa! Check out her with her two friends on the beach! They’re crazy hot. And according to Susan’s profile, she’s single.

HENRIK: I don’t see any boys in these pictures…

IVAN: [noticing the girls behind them] Dudes! Dudes! They’re right there! All three of them! We gotta go talk to them.

CUT to a brief montage of the three boys standing near the girls’ table chatting them up. A music bed prevents the viewer from hearing what is said, but the boys smile and the girls giggle. As the music comes to a close, the girls start clapping

SUSAN, CAROL, and LISA: Triple date! Triple date! Triple date!

The montage continues with the six of them having a grand time at a sockhop, a sushi restaurant, and a laser-tag arena. All the while, SUSAN snaps silly pictures with IVAN, her date. As the evening comes to a close, the boys drop all three girls off at SUSAN’s house.

IVAN: [to SUSAN] Can I call you again some time?

SUSAN: Absolutely! Tonight was a lot of fun. Goodnight!

FADE to a view of a college campus whose sign reads “Tech State University -- home of the Tigers”

NARRATOR: The girls’ evening was a great success. But things weren’t all rosy for Susan on the day of her big interview with the Tech State admissions office.

FADE to a college admissions office. A square, brown desk sits in the middle of the room; pro-TSU pennants and posters adorn the walls

ADMISSIONS OFFICER: Your grades are excellent, Miss Hargreaves, and the story you told about digging wells as a volunteer in Nicaragua was heart-rending. However, Miss Hargreaves, there is one problem.

SUSAN: Problem? What ever do you mean?

ADMISSIONS OFFICER: Are you familiar with Facebook, Miss Hargreaves?

SUSAN: Why yes, I just got on it a few days ago. It’s pretty neat!

ADMISSIONS OFFICER: Neat, yes. You see, Miss Hargreaves, the problem is whom you’ve associated with in recent days. You’ve been out with a gentleman named Ivan Godunov, have you not?

SUSAN: Yes…?

ADMISSIONS OFFICER: That’s the problem. You might already know, then, that Mr. Godunov is a card-carrying member of the Communist Party. [pulls out iPhone] See these pictures?

ZOOM on the ADMISSIONS OFFICER’s iPhone. On it we see pictures of Ivan holding a copy of The Communist Manifesto, then another of Ivan next to the Kremlin, and another of him saluting a statue of Lenin

ADMISSIONS OFFICER: You do see how this might reflect poorly on you, I’m sure.

SUSAN: But… but I’m not a Communist. I’m a Methodist!

ADMISSIONS OFFICER: Whether that’s true or not is not my concern. The fact is, we have evidence that you’ve consorted with Communists, and I’m afraid we here at TSU don’t condone such behavior. As impressive as your resume is, I can’t in good conscience admit you to our school. You and your Red friends can find education elsewhere.

SUSAN cries and runs out of the office. The camera follows her sprint through the TSU campus and driving cello music punctuates the scene

NARRATOR: Had poor Susan simply kept her wonderful night out to herself instead of posting it for everyone to see, she would have a bright future as a TSU coed. Instead, a life of wandering and sadness awaits her. Be careful, boys and girls, what information you put on the internet. You never know who might see it.

FADE OUT

A Truly Secure Password Should Be as Long as This Post

2012-04-02T00:00:00-05:00

In my previous post, I ranted at length about the inconvenience of passwords. While researching for these posts, I encountered a number of articles about password security. The articles gave tips like “don’t write your password down” and “make it as long and random as possible”. Sounds reasonable, but some take it further. I read posts from many who bother to use a random-character generator to make passwords upwards of twenty characters -- punctuation included -- that are different for every single site they visit. Some consider this excellent security. I consider it clinically insane.

As it is for most, password security isn’t my biggest concern. If someone wants to hack into my Twitter and post racist bile, I guess I’ll contact Twitter, clean up the mess, and change my password. If someone gets my financial info, I’ll report it to the bank and get my money back. We have plenty of ways to react to nefarious activity when it arises, yet we’re so frightened of its prospect that we’re willing to do anything to prevent it.

Previous complaints notwithstanding, I see the need for passwords and the need to have different ones. There are frauds and thieves in the world, and we shouldn’t make it easier for them to lie and steal. However, the proliferation of passwords is another incarnation of humanity’s excessive fear of everything.

A few years ago, huge fences were built around every high school in my home state due to fears that some maniac might infiltrate the campus during school hours. Never mind that a fence never stopped a maniac, or that such a maniac might be a student at the school (and is therefore inside the fence already), or that fencing-in students might be dangerous if, say, there were a fire. Nope. Our tax dollars went to erecting superfluous fencing simply because of a misplaced fear.

That’s kind of how I feel about the fellow who makes twenty-character passwords complete with $s, ^s, and }s. Why are you spending all this time and effort to protect yourself against something that A) is unlikely to happen and B) can be dealt with if it does? One of my credos is that you never get time back. You can always make more money, but once time is gone, it’s gone. Why spend even an extra second generating a random password every time you log into some site you probably didn’t need to visit in the first place? Stop fearing the unlikely and start appreciating that your time here is limited.

-Darrell

Passwords, Passwords, Passwords

2012-03-30T00:00:00-05:00

As part of my job, I often help out with office tasks for my company. Every time I do, I have to type in a slew of passwords for the different systems we use. To log into the computer, I have a work password that I have to reset every couple months (“I guess I’ll end it with a 5 instead of a 4 now...”). On top of that, I have memorized passwords for three different company-related email accounts, as well as separate systems that scan tests, send mass emails to students, access students’ information, enter that information in the first place, log course attendance, fill out my pay sheet, charge expenses to the company, send packages via FedEx, and access online classrooms. Every single item I just listed has a different username/password combination. I would complain about the efficiency of a company that doesn’t consolidate all those tasks, but I’m guessing you’ve worked at similar places.

At home, I get no relief. I have different usernames and passwords for my personal email, bank account, cable company, electric company, water company, cell-phone provider, Twitter, Facebook, and the various other games and services I use on the web. People wonder whether we’re getting dumber because we no longer have to memorize phone numbers. Ha.

Memorizing all those passwords isn’t so bad, really. For most of the frivolous stuff, I do what a lot of people do: I reuse the same three passwords. I have one for games, one for message boards, and variations on a string of unrelated characters for the ones that involve my financial information. Even that doesn’t simplify things perfectly, though, because every site has different rules about usernames and passwords. I can’t tell you how many times I’ve tried to log into a site I haven’t visited in awhile and wondered, Okay, which of my three regular usernames is being used here? Or did they provide the username and that’s why I can’t remember it? Or do they want my email address? Which email address did I give them? Did I consider this site game-related or thought-related? Or is this one of those game-related sites that curiously requires at least two non-consecutive “special characters” even though it has never asked for any personal information?

Usually, that frustration leads to one of two options: give up and say, “I guess I’m not visiting that site ever again” or click the “forgot password” button. The latter option only makes things worse, though, because it usually gives you a new, random-string-of-characters password I’ll never remember. So copy, paste, log in every time. Sometimes, it immediately makes me reset the password to something I haven’t used before -- and the system remembers all my prior passwords a whole lot better than I do. Copy, paste, lather, repeat. To sum up this overlong rant, passwords are a mess.

So what’s the solution? The ever-multiplying tentacles of Facebook are trying to be the solution by allowing sites to use a “Connect with Facebook” button. That might be convenient, but I hate that so many services turn the meaning of that button into “post high scores on your Wall so all your Facebook friends know you just played a stupid game”. I can’t tell you how many apps and games I’ve uninstalled for that reason.

In a previous post, Sean mentioned distributed identity systems like OpenID, which does more-or-less the same thing as that Facebook button, but is less popular and forces you to create yet another username and password. That sounds less convenient, unless every site embraces it. I don’t see it taking off, then, unless everyone simultaneously abandons Facebook.

Thus, I think I stumbled onto the real solution to our password woes: wait for the moment when the world finally, completely distrusts Facebook. Maybe they’ll publish all our most embarrassing photos on a 24-hour cable channel, running on a continuous slideshow. Maybe they’ll inform all our corporate employers exactly how much time we spend playing Farmville during working hours. Whatever it is, something will make the public turn against Facebook, allowing an entity like OpenID to swoop in and universalize all our passwords. Until, you know, someone exploits that entity and steals all our identities, turning us into penniless clones.

Perhaps that’s the (extremely unlikely) price of convenience. If it happens, at least it’ll be interesting.

-Darrell

Who Are You, and Who Am I to Ask?

2012-03-19T00:00:00-05:00

Much has been made of Google’s policy to require the use of one’s real name when signing up for Google+. The most compelling (and lengthy) upbraiding of Google+ I've read can be found here. I won't address Hinckley's every point because I have things to do this century; I will begin, however, by saying that his points are salient and correct, even though I can't personally identify with any of it.

You see, if I looked only within myself, I would have no reason to object to Google's policy. I don't maintain pseudonyms -- my few online personas are all somehow linked to my actual name. I have no problem letting you know that I have written political diatribes and dirty words on Twitter, Facebook, and my personal website, all of which are easily linked to my "true" identity. I'm somewhat proud of most of my writings, so I actually want my name attached to most things I do. I am not afraid of upsetting my family or employers with my words, nor do I fear reprisal from potential enemies. Naturally introverted, I anticipate no need to share deeply personal information with anyone, online or offline (contrast Hinckley's talking pseudonymously about his rocky marriage). I'm just not wired to need a pseudonym.

I realize, however, that this attitude is one of the many things that make me an oddity. I understand all the examples in Hinckley's long list of people who benefit from pseudonymity. But even if I didn't understand -- even if I took the heartless tack of "if you're embarrassed or oppressed, don't go on the internet", I would still object to Google+'s anti-pseudonym mandate because we, quite simply, have the right to misrepresent ourselves however we like.

I'm reminded of a Ninth Circuit Court of Appeals decision from about a year ago. In United States v. Alvarez, the federal government charged Xavier Alvarez under the Stolen Valor Act of 2006, as Alvarez publicly (and falsely) introduced himself as a retired Marine and Medal of Honor recipient. The appellate court denied the government's appeal because as abhorrent as Alvarez's lies were, it would be a First-Amendment violation to prosecute someone simply for lying. This wasn't fraud -- had he sought military benefits based on his falsehood, that would be a crime. This wasn't perjury -- he obstructed no judicial investigation with his lies. This was simply a guy trying to make himself look better than he is (and failing spectacularly).

In his brilliant (and funny) concurring opinion (which you should read in its entirety), Chief Judge Alex Kozinski affirmed our right to lie: "An important aspect of personal autonomy is the right to shape one’s public and private persona by choosing when to tell the truth about oneself, when to conceal and when to deceive." Amen, my jurist. This is more than an issue of constitutionality -- it's an issue of personal autonomy. If the federal government can't get away with violating it, why should we let Google?

-Darrell

P.S.: Because it made me chuckle, I am pasting below my favorite paragraph from Kozinski's opinion (you know, for you folks who can't be bothered to read an entire judicial opinion):

Saints may always tell the truth, but for mortals living means lying. We lie to protect our privacy (“No, I don’t live around here”); to avoid hurt feelings (“Friday is my study night”); to make others feel better (“Gee you’ve gotten skinny”); to avoid recriminations (“I only lost $10 at poker”); to prevent grief (“The doc says you’re getting better”); to maintain domestic tranquility (“She’s just a friend”); to avoid social stigma (“I just haven’t met the right woman”); for career advancement (“I’m sooo lucky to have a smart boss like you”); to avoid being lonely (“I love opera”); to eliminate a rival (“He has a boyfriend”); to achieve an objective (“But I love you so much”); to defeat an objective (“I’m allergic to latex”); to make an exit (“It’s not you, it’s me”); to delay the inevitable (“The check is in the mail”); to communicate displeasure (“There’s nothing wrong”); to get someone off your back (“I’ll call you about lunch”); to escape a nudnik (“My mother’s on the other line”); to namedrop (“We go way back”); to set up a surprise party (“I need help moving the piano”); to buy time (“I’m on my way”); to keep up appearances (“We’re not talking divorce”); to avoid taking out the trash (“My back hurts”); to duck an obligation (“I’ve got a headache”); to maintain a public image (“I go to church every Sunday”); to make a point (“Ich bin ein Berliner”); to save face (“I had too much to drink”); to humor (“Correct as usual, King Friday”); to avoid embarrassment (“That wasn’t me”); to curry favor (“I’ve read all your books”); to get a clerkship (“You’re the greatest living jurist”); to save a dollar (“I gave at the office”); or to maintain innocence (“There are eight tiny reindeer on the rooftop”).

That's Nothing -- K-Mart Told Me I'd Have a Son Named Stanley in 2024

2012-03-13T00:00:00-05:00

A few weeks ago, Forbes posted an article tantalizingly (if awkwardly) titled, "How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did". The article summarized Charles Duhigg's nine-page New York Times article about Target's advanced marketing research techniques. The whole article is worth the read, but to summarize even further, Target associates your buying habits with a unique customer ID that allows the company to distribute more focused advertisements and deals.

To address the privacy issue directly, this is nothing new -- focused marketing has been around for centuries. Most of you have a key-fob from your local grocery store that lowers prices for many items. Your bill is lower, but you're paying the store back by telling it everything about your shopping habits. It doesn't take tremendous pattern recognition to notice that the coupons you get at checkout are for items related to what you usually purchase. If that truly bothers you, never register with a store and pay only in cash. Problem solved; find another thing to be paranoid about.

What struck me about this matter, though, is that the privacy issue is treated as the most interesting part of the article. From Duhigg's original, Forbes latched onto one possibly apocryphal anecdote: A man's teenage daughter received baby-related coupons from Target, and that's how he learned he was going to be a grandfather a bit earlier than he anticipated. It's an amusing story that Duhigg used to discuss how Target decided to be less obvious about focused marketing. (After all, it's in Target's interest to have a customer base that's not completely creeped out.) Where Duhigg emphasized Target's desire to ease customers' worries, the Forbes article emphasized the "creepy" factor throughout.

Even The New York Times Magazine's cover photo proclaims "Hey! You're Having a Baby!" with products spelling out the letters. This is standard journalism as much as Target's practices are standard marketing. The New York Times wants eyeballs, so it only makes sense to have an attention-grabbing headline. But why is the illusion of privacy the most attention-grabbing issue? Duhigg's article was fascinating throughout, and he covered a lot of topics. His article wasn't about Big Corporations stealing our identities; it was about how habits are formed in the brain, how we studied chocolate-hungry rats to find that out, and how those findings eventually led to the successful marketing of Febreze. The creepy factor was a tiny part of the article, yet it's the part that most people remember.

I've been reading a little bit about the psychology of privacy -- why we crave it, why we protect it, when we go overboard with it. Since it's such a detailed topic, I'll refrain from getting specific. The predominant theme I'm noticing, though, is that people simply want control over what others know about them. It isn't that most people are particularly embarrassed about buying milk or beer; they just don't like the idea of being watched without their knowledge. Based on how much attention Duhigg's article has received, it seems to me that a lot of people simply had no idea that their shopping habits were being tracked so carefully by the stores they frequent. Is this true? Were you (yes, you, reader of my mellifluous prose) actually surprised by this info about Target's level of research? If a lot of you say yes, I think Duhigg's article reveals as much about human ignorance as it does human psychology.

-Darrell

A Polite Introduction

2012-03-05T00:00:00-06:00

Greetings, Nymbus readers. You probably don't know me. If you have access to the thousands of searches, credit-card purchases, and blog posts I've made online, you could have a pretty good idea of who I am. Even still, I feel the need to introduce myself. I'm Darrell Johnson, a blogger for this venture known as Nymbus.

The title "blogger" doesn't carry a whole lot of weight in the world, especially if there isn't a slash involved (e.g., "programmer/blogger", "astrophysicist/blogger"). Alas, whatever slashes I could include would seem irrelevant to the topics I'll be writing about. I teach test-prep, I drink beer, and I record a podcast for fans of professional wrestling (yes, really). That's not exactly the resume you'd expect from one who intends to write about privacy issues online. Unfortunately, that's the problem with how most of us treat online privacy -- only the well-initiated super-geeks would even pretend to care. I intend to change that.

The internet is a wonderful place. I say "place" rather than "tool" or "series of tubes" because as abstract as it is, the web feels to me like a global agora. Walk into the internet and you can say, read, watch, or purchase nearly anything you could imagine. As we all know on some level, to attend history's largest marketplace, we must sacrifice some of our privacy. Sometimes we choose to disclose this information (letting Amazon know you like Malcolm Gladwell), but most of the time we don't realize how much information we're giving away (letting Google know that you occasionally cheat at online puzzle games).

It's an issue that gives me constant pause: on one hand, I don't need any government or corporation to know about my every interest and peccadillo. On the other hand, I just explicitly told the world something about how I choose to waste my time, and I'm not bothered at all. In a world of near-complete information, I've become numb to the potential ramifications of giving away every piece of my identity. I'm only one step away from the dismissive and thoughtless trope, "I have nothing to hide, so why should I care?" The thing is, I do care, and we all ought to care. In a way, this blog will be as much about discovering my own boundaries as it will be about how internet companies try to push them.

One nice thing about online privacy as a writing topic is how many different angles and avenues are available. In the near future, I can promise that I'll get into posts ranging from Google's use of your statistics, to the overabundance of passwords, to legal decisions regarding the right to be a liar. I'm excited to be a part of Nymbus in whatever small way, and I hope you enjoy my posts.

-Darrell

The Horrible Equilibrium that is Facebook Connect

2012-02-25T00:00:00-06:00

This morning I read a blog post by Paul Katsen. He argues that nonprofits should fall into one of two buckets:

1. Solve human needs that will never be profitable

2. Push an unprofitable need along until it becomes 'market ready'

Everything else can be solved with a for-profit company riding the wave of market forces.

I worry about this viewpoint, and I also think it's not quite right. For one thing we're leaving out the role of government. (To be fair, Paul does casually mention the government once, but lumps them under the same umbrella as nonprofits). But let's just be crazy libertarians for a hot minute and pretend we don't need a government. If we limit the role of nonprofits to these two options we risk finding ourselves, as a society, stuck in a local maximum. There are probably many ways this could happen, but I have in mind one particular cause rooted in a flaw of human nature. It happens all the time, and in fact, this is why we started Nymbus.

When presented with a yes or no choice where the benefits of saying yes outweigh the costs, we would rightly choose yes. But given the same choice except now it's revealed the cost of some of us saying yes exceeds the benefits for everyone else, we almost always still say yes. We are terrible at this kind of decision. Business models based on this type of choice never factor the cost to everyone else into their price otherwise they would go out of business. But the benefit to society would be greater if we could eliminate these obviously broken business models on move on to something better. Take environmental regulation as an example. Until we regulated businesses, they were happy to ruin the environment and pass the savings on to customers. It took decades of educating regular people, largely the work of nonprofits, to get us to where we are now.

Therefore if we rely on consumers to factor in the total cost to society when making a decision, (which is what happens in a for-profit model), in most cases we will never discover the optimal solution for the market because of this basic flaw of human nature. Our reliance on for-profit entities means we often find ourselves stuck in a horrible equilibrium where each individual transaction seems to be worth making, for both parties, but the real net cost far outweighs the benefit.

The business model of collecting user data and reselling it to advertisers has already discovered this horrible equilibrium. We all know everything we do is being tracked across the web and fed back into an advertising machine designed to manipulate our buying decisions. None of us particularly likes this solution, but the benefit of clicking "Connect with Facebook" for instant access or searching through the entire history of human knowledge on Google, easily outweighs the marginal cost of giving the giant system yet another data point. So we'll always click the button. What we're losing, slowly but surely, is our privacy and, less obvious but still costly, the ability to conceal who we are. The cost of using our "real" identity everywhere is the loss of pseudonymity -- the cornerstone of creativity and meritocracy. What's at risk is watching this slowly fade away as we're left with our real identities and society's traditional methods of measuring the merit of an idea. The loss would be incalculable.

We can't rely on market forces to save our privacy. What rational, for-profit company would create a solution to the problem that charged users to log in? If you asked people to pay for a single sign-on solution instead of forfeiting a small piece their privacy, it's a very small niche indeed that will think the price is worth it. Most people think, "I don't have anything to hide, I'm not one of those privacy nuts." Many of us are irritated when asked to use Facebook Connect, but still we fail to calculate the cost to society of this one, small decision. This isn't a suprise, it's just human nature.

Many people think a distributed identity system, like OpenId, WebId, BrowserId, etc. are the solution. Ultimately I think they are right. But these systems have always and inevitably failed to gain traction. In the short history of the web, standards have always won the day. But we can look back and remember, sometimes there is a dark time preceding the eventual victory -- remember IE6 anyone? It took a nonprofit company, (backed by open source programmers and a thriving community), to create a superior open source browser based on standards and then market the hell out of it. The advent of the modern browser spurred a massive wave of value on the web. Microsoft could never justify making something like Firefox to its shareholders -- it makes no sense.

And so we find ourselves repeating history. Facebook Connect and its ilk succeed because they have massive mindshare and it's easy for everyone to understand. Plus they offer tremendous value to users and businesses and they have the force of a massive profit engine behind them pushing to collect as much user data as possible. And they have absolutely no rational reason to dismantle their monopoly on identity. How do you create this much value and slay a monopoly with a completely decentralized identity service that nobody understands how to use?

You can't. Someone needs step up and start a nonprofit to wave the banner of standards and forge a path ahead, just like Mozilla Foundation did with Firefox. This is exactly what we're doing at Nymbus, right now.

So, back to the original impetus for this post.

Paul proposes that nonprofits exist to:

1. Solve human needs that will never be profitable

2. Push an unprofitable need along until it becomes 'market ready'

And everything else should fall under the umbrella of a for-profit company.

Providing the infrastructure for online identity is obviously profitable. And a distributed identity system will never be "market-ready". You can't use the market forces to drive this change, it would never happen. So I propose a third purpose for nonprofits: discovering, exposing and then disrupting business models that rely on hidden costs to society.

This Stuff Matters: Google's New Privacy Policy (with a few edits)

2012-02-19T00:00:00-06:00

Note: The following is Google's new privacy policy. When we removed text, it looks like this. New text looks like this.

This Privacy Policy will be effective March 1, 2012, and will replace the existing Privacy Policy. Please see our overview page for additional details.

Last modified: March 1, 2012 (view archived versions)

There are many different ways you can use our services – to search for and share information, to communicate with other people or to create new content. When you share information with us, for example by creating a Google Account, we can make those services even better – to show you more relevant search results and ads, to help you connect with people or to make sharing with others quicker and easier. As you use our services, we want you to be clear how we’re using information and the ways in which you can protect your privacy.

Our Privacy Policy explains:

What information we collect and why we collect it.
How we use that information.
The choices we offer, including how to access and update information.

We’ve tried to keep it as simple as possible, but if you’re not familiar with terms like cookies, IP addresses, pixel tags and browsers, then read about these key terms first. Your privacy matters to Google so whether you are new to Google or a long-time user, please do take the time to get to know our practices – and if you have any questions contact us.

If you use the internet, you use one of Google’s services. If you use one of our services, we have a good deal of your personal information. We have changed our Privacy Policy in order to consolidate all that information across all our services. Please read below to learn about the information we collect, how we use it, and what you need to know about it.

Information we collect

We collect information to provide better services to all of our users – from figuring out basic stuff like which language you speak, to more complex things like which ads you’ll find most useful or the people who matter most to you online.

We collect information in two ways:

Information you give us. For example, many of our services require you to sign up for a Google Account. When you do, we’ll ask for personal information, like your name, email address, telephone number or credit card. If you want to take full advantage of the sharing features we offer, we might also ask you to create a publicly visible Google Profile, which may include your name and photo.

This part’s obvious – user names, passwords, addresses, searches… basically anything you type into a box.

Information we get from your use of our services. you don’t realize you give us. We may collect information about the services that you use and how you use them, like when you visit a website that uses our advertising services or you view and interact with our ads and content. We will definitely collect information about every single service you use. This information includes:
- Device information.

We may collect device-specific information (such as your hardware model, operating system version, unique device identifiers, and mobile network information including phone number) will totally find out everything about the computer, tablet, or mobile device you have ever used. Google may will definitely associate your device identifiers or phone number with your Google Account.

Log information

When you use our services or view content provided by Google, we maywill most definitely automatically collect and storecertain informationas much information as we can musterin server logs. Thismaywill absolutely include:

- - details of how you used our service, such as your search queries how often you emailed your mother last month or whether you searched for naked photos illegally hacked from celebrities’ cell phones
  - telephony log information like your phone number, calling-party number, forwarding numbers, time and date of calls, duration of calls, SMS routing information and types of calls how many times you’ve dropped your cell phone on concrete, how often you curse during conversations, and whether you say certain "key words" indicating requests for weapons or illegal drugs
  - Internet protocol address which might not mean anything to you, but is really all we need to track your every online movement
  - device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request and referral URL. bookmarks, how many concurrent games of Words with Friends you’re playing, and whether you bother to close apps on your mobile device
  - cookies that may uniquely identify your browser or your Google Account, which again, aren’t NECESSARY to identify you uniquely, but they make it easier for us to compile your habits and use the information to understand you better – from sleep patterns to movie-piracy behavior
- Location information

When you use a location-enabled Google service, we may will totally collect and process information about your actual location, like GPS signals sent by a mobile device. We may also use various technologies to determine location, such as sensor data from your device that may, for example, provide information on nearby Wi-Fi access points and cell towers. so that we know who uses our services while on the toilet and how often.

Unique application numbers

Certain services includePretty much every service includes a unique application number. This number and information about your installation(for example, the operating system type and application version number) may will at least twice be sent to Google when you install or uninstall that service or when that service periodically contacts our servers, such as for automatic updates decides to without your knowledge.

Local storage

We may Mark it down, son, we are going to collect and store information (including personal information) locally on your device using mechanisms such as browser web storage (including HTML5) and application data caches. We may also choose to store other people’s personal information on your device in an effort to help lighten our server load. Should you come across such information, we ask that you keep it to yourself.

Cookies and anonymous identifiers

We use various technologies to collect and store information when you visit a Google service, and this may include sending one or morecookiesoranonymous identifiers to your device. We also use cookies and anonymous identifiers when you interact with services we offer to our partners, such as advertising services or Google features that may appear on other sites.We already established that we have many ways to track you; this part explicitly mentions cookies and anonymous identifiers as two more.

How we use information we collect

We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones, and to protect Google and our users. We also use this information to offer you tailored content – like giving you more relevant search results and ads. figure out how best to make money off you. This usually manifests simply in the form of relevant ads, but if times get tough, we are not above resorting to blackmail.

We may There is no doubt that we will use the name you provide for your Google Profile across all of the services we offer that require a Google Account. In addition, we may replace past names associated with your Google Account so that you are represented consistently across all our services. If other users already have your email, or other information that identifies you, we may show them your publicly visible Google Profile information, such as your name and photo. Logging into one service allows all other services to have your information and trade it freely among them. This makes it easy for us to put publicly accessible markers on Google Earth indicating the names, locations, and YouTube viewing habits of our every user.

When you contact Google, we may keep a record of your communication to help solve any issues you might be facing. We may use your email address to inform you about our services, such as letting you know about upcoming changes or improvements. will keep a record of every bit of communication in case we need to hold it against you some day. We use information collected from cookies and other technologies, like pixel tags, to improve your user experience and the overall quality of our services. For example, by saving your language preferences, we’ll be able to have our services appear in the language you prefer.if your activity indicates that you like sports, we will bombard you with ads for ticket dealers and merchandise.When showing you tailored ads, we will not associate a cookie or anonymous identifier with sensitive categories, such as those based on race, religion, sexual orientation or health. ticklishness, birthmarks, or baldness.

We may have and will continue to combine personal information from one service with information, including personal information, from other Google services – for example to make it easier to share things with people you know.let your Google+ friends know how much time you spend shopping online for sex toys. We will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent. we make a "mistake".

We will ask for your consent before using information for a purpose other than those that are set out in this Privacy Policy. If there is a means to use your information that is somehow not covered in this Privacy Policy, we will ask for your consent. Should your consent be necessary, we will be very surprised.

Google processes personal information on our servers in many countries around the world. We may process your personal information on a server located outside the country where you live. has servers all over the world. Your information is already stored on every continent, including Antarctica. We are at the forefront of a true global order, so there’s no sense making a fuss about which nations have access to your information – they all do.

Transparency and choice

People have different privacy concerns. Our goal is to be clear about what information we collect (i.e., everything), so that you can make meaningful choices about how it is used. For example, you can we’ve made it possible for you to

Feel as if you can actually review and control certain types of information tied to your Google Account by using Google Dashboard.
View and edit your ads preferences, such as which categories might interest you, using the Ads Preferences Manager. You can also opt out of certain Google advertising services here. because we know you care about the quality and content of the ads you ignore.
Use our editor to see and adjust how your Google Profile appears to particular individuals. people who aren’t us.
Pretend to control who you share information with.
Take information out of many a small handful of our services.

You may also set your browser to block all cookies, including cookies associated with our services, or to indicate when a cookie is being set by us. However, it’s important to remember that many of our services may not function properly if your cookies are disabled. For example, we may not remember your language preferences.but we’ve made it so that if you do, nothing will work right.

Information you share.

Many of our services let you share information with others. Remember that when you share information publicly, it may be indexable by search engines, including Google. Our services provide you with different options on sharing and removing your content.You have a small amount of control of the information you knowingly share on our services. The following are the few options you have in this regard.

Accessing and updating your personal information

Whenever you use our services, we aim to provide you with access to your personal information. If that information is wrong, we strive to give you ways to update it quickly or to delete it – unless we have to keep that information for legitimate business or legal purposes. When updating your personal information, we may ask you to verify your identity before we can act on your request. At any time you may update or change your personal information, unless it results in limiting the amount of information available to every other user. For example, if you wish to change your password or correct the spelling of your name, you can do so after verifying your identity. If you wish to remove a tag of your house labeled as "Whoreville" that a vindictive ex-boyfriend placed on Google Maps, you must provide concrete evidence that the location is a private residence and not a legally run brothel.

We maywill absolutely reject requests that are unreasonably repetitive, require disproportionate technical effort (for example, developing a new system or fundamentally changing an existing practice anything that forces us to stay in the office past 5PM local time), risk the privacy of others, or would be extremely impractical (for instance, requests concerning information residing on backup tapes).our shareholders.

Where we can provide information access and correction, we will do so for free, except where it would require a disproportionate effort.when a request annoys us. We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems. our backup system ensures that none of your information will be completely deleted, ever.

Information we share

We do not share personal information with companies, organizations and individuals outside of Google unless one of the following circumstances apply:

With your consent

We will share personal information with companies, organizations or individuals outside of Google when we have your consent to do so. We require opt-in consent for the sharing of any sensitive personal information.

With domain administrators

If your Google Account is managed for you by a domain administrator(for example, for Google Apps users) then your domain administrator and resellers who provide user support to your organization will have access to your Google Account information (including your email and other data). Your domain administrator may be able to:

- view statistics regarding your account, like statistics regarding applications you install.
- change your account password.
- suspend or terminate your account access.
- access or retain information stored as part of your account.
- receive your account information in order to satisfy applicable law, regulation, legal process or enforceable governmental request.
- restrict your ability to delete or edit information or privacy settings.

Please refer to your domain administrator’s privacy policy for more information.

For external processing

We provide personal information to our affiliates or other trusted businesses or persons to process it for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures.

With entities we eventually take over

When Google acquires new companies, assets, or governments, Google will share your personal information with every one of the new assets. We’ll send you an email about it when it happens, though, so don’t be nervous.

For legal reasons

We will share personal information with companies, organizations or individuals outside of Google if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to: If we have a good-faith belief that your information is necessary to help prevent, enforce, or investigate a crime, we will share your personal information with all necessary authorities and every member of your Google+ Circles.

- meet any applicable law, regulation, legal process or enforceable governmental request.
- enforce applicable Terms of Service, including investigation of potential violations.
- detect, prevent, or otherwise address fraud, security or technical issues.
- protect against harm to the rights, property or safety of Google, our users or the public as required or permitted by law.

We may share aggregated,non-personally identifiable informationpublicly and with our partners – like publishers, advertisers or connected sites. For example, we may share information publicly to show trends about the general use of our services.

If Google is involved in a merger, acquisition or asset sale, we will continue to ensure the confidentiality of any personal information and give affected users notice before personal information is transferred or becomes subject to a different privacy policy.

Information security

We work hard to protect Google and our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold.We are as protective of your personal information as you should have been In particular:

We encrypt many of our services using SSL.
We offer you (an inconvenient and cumbersome) two step verification when you access your Google Account, and (if you share a computer with your spouse or mother) a Safe Browsing feature in Google Chrome.
We review our information collection, storage and processing practices, including physical security measures, to guard against unauthorized access to systems. We try our best to make sure hackers don’t monkey with things.

We restrict access to personal information to Google employees, contractors and agents who need to know that information in order to process it for us, and who are subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations. We will restrict access to your information only to employees who need access to process it. Yes, we are the ones to make that distinction, but they’ve all signed confidentiality agreements under penalty of termination with a generous severance package.

Application

Our Privacy Policy applies to all of the services offered by Google Inc. and its affiliates, including services offered on other sites (such as our advertising services), but excludes services that have separate privacy policies that do not incorporate this Privacy Policy.

This Privacy Policy applies to all Google services and entities that wish to use this Privacy Policy.

Our Privacy Policy does not apply to services offered by other companies or individuals, including products or sites that may be displayed to you in search results, sites that may include Google services, or other sites linked from our services. Our Privacy Policy does not cover the information practices of other companies and organizations who advertise our services, and who may use cookies, pixel tags and other technologies to serve and offer relevant ads.

Our Privacy Policy does not cover sites or services outside the ever-growing purview of Google.

Enforcement

We regularly review our compliance with our Privacy Policy. We also adhere to several self regulatory frameworks. When we receive formal written complaints, we will contact the person who made the complaint to follow up. We work with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of personal data that we cannot resolve with our users directly.

Overall, we do a good job keeping to this Privacy Policy, and we’re more than willing to take complaints and work with regulatory authorities. Just know that we’re the ones chiefly enforcing our own Privacy Policy. Try not to let that bother you.

Changes

Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of privacy policy changes). We will also keep prior versions of this Privacy Policy in an archive for your review. will change so often you’ll care even less than you do now. If anything changes, we’ll be sure to let you know, but you’ll probably ignore it anyway

Hello World. Nymbus is Here

2012-02-12T00:00:00-06:00

Just a test post. Nothing to see here. Move along.