Peter's Thoughts

Another perspective

noreply@blogger.com (Peter Cranstone) — Tue, 10 Mar 2015 15:48:00 +0000

The Apple watch compared to the Apple phone - remember BOTH are required, BOTH tell the time.

The Affordable Plumbing Act

noreply@blogger.com (Peter Cranstone) — Wed, 04 Mar 2015 16:36:00 +0000

Only weeks after leaving office on January 20, 2017, former President Barack Obama discovers a leak under his sink, so he calls Troy the Plumber to come out and fix it. Troy drives to President Obama’s new house, which is located in a very exclusive, gated community near Chicago where all the residents have a net income of way more than $250,000 per year.

Troy arrives and takes his tools into the house. He is led to the guest bathroom that contains the leaky pipe under the sink. Troy assesses the problem and tells President Obama that it’s an easy repair that will take less than 10 minutes. President Obama asks Troy how much it will cost. Troy checks his rate chart and says, “$9,500.”

“What?! $9,500?!” Obama asks, stunned, “But you said it’s an easy repair. Michelle will whip me if I pay a plumber that much!”

Troy says, “Yes, but what I do is charge those who make more than $250,000 per year a much higher amount so I can fix the plumbing of poorer people for free. This has always been my philosophy. As a matter of fact, I lobbied the Democrat Congress, who passed this philosophy into law. Now all plumbers must do business this way. It’s known as the ‘Affordable Plumbing Act of 2014′. I’m surprised you haven’t heard of it.”

In spite of that, Obama tells Troy there’s no way he’s paying that much for a small plumbing repair, so Troy leaves. Obama spends the next hour flipping through the phone book calling for another plumber, but he finds that all other plumbing businesses in the area have gone out of business. Not wanting to pay Troy’s price, Obama does nothing and the leak goes un-repaired for several more days. A week later the leak is so bad President Obama has had to put a bucket under the sink. Michelle is not happy as she has Oprah and guests arriving the next morning. The bucket fills up quickly and has to be emptied every hour, and there’s a risk the room will flood, so Obama calls Troy and pleads with him to return.

Troy goes back to President Obama’s house, looks at the leaky pipe, checks his new rate chart and says, “Let’s see, this will now cost you $21,000.”

President Obama quickly fires back, “What? A few days ago you told me it would cost $9,500!”

Troy explains, “Well, because of the ‘Affordable Plumbing Act,’ a lot of wealthier people are learning how to maintain and take care of their own plumbing, so there are fewer payers in the plumbing exchanges. As a result, the price I have to charge wealthy people like you keeps rising. Not only that, but for some reason the demand for plumbing work by those who get it for free has skyrocketed! There’s a long waiting list of those who need repairs, but the amount we get doesn’t cover our costs, especially paperwork and record-keeping. This unfortunately has put a lot of my fellow plumbers out of business, they’re not being replaced, and nobody is going into the plumbing business because they know they can’t make any money at it. I’m hurting too, all thanks to greedy rich people like you who won’t pay their ‘fair share’. On the other hand, why didn’t you buy plumbing insurance last December? If you had bought plumbing insurance available under the ‘Affordable Plumbing Act,’ all this would have been covered by your policy.”

“You mean I wouldn’t have to pay anything to have you fix my plumbing problem?” asks Obama.

“Well, not exactly,” replies Troy. “You would have had to buy the insurance before the deadline, which has passed now. And, because you’re rich, you would have had to pay $34,000 in premiums, which would have given you a ‘silver’ plan, and then, since this would have been your first repair, you would have to pay up to the $21,000 deductible, and anything over that would have a $7,500 co-pay, and then there’s the mandatory maintenance program, which is covered up to 17.5%, so there are some costs involved. Nothing is for free.”

“WHAT?!” exclaims Obama. “Why so much for a puny sink leak?!”

With a bland look, Troy replies, “Well, paperwork, mostly, like I said. And the internal cost of the program itself. You don’t think a program of this complexity and scope can run itself, do you? Besides, there are millions of folks with lower incomes than you, even many in the ‘middle class’, who qualify for subsidies that people like you must support. That’s why they call it the ‘Affordable Plumbing Act’! Only people who don’t make much money can afford it. If you want affordable plumbing, you’ll have to give away most of what you have accumulated and cut your and Michelle’s income by about 90%. Then you can qualify to get your ‘Fair Share’ instead of giving it.”

“But who would pass a crazy act like the ‘Affordable Plumbing Act’?!” exclaims the exasperated Obama.

After a sigh, Troy replies, “Congress… because they didn’t read it.”

Animated GIFs

noreply@blogger.com (Peter Cranstone) — Fri, 02 Aug 2013 16:42:00 +0000

Lets see if this works...

Innovation doldrums

noreply@blogger.com (Peter Cranstone) — Mon, 22 Jul 2013 16:39:00 +0000

Is it just me or has the tech industry hit the doldrums? Are we now in a mature market for PC’s, Smartphones and Tablets? If this article is correct ‘Apple to report dismal results’ then it would appear so. On top of this Microsoft just wrote off almost a billion dollars of ‘Surface’ inventory – what’s going on here?

Well I think we’re just exhausted trying to keep up with the Jones’s and keeping track of where all our data is. I’ve been in the business now for over two decades and I’m trying to cut down to just two devices simply because it’s hard to keep everything in synch and know ‘whose on first’.

With almost a million apps to choose from on iTunes (or is that the iStore, or the App store (am I the only one who gets confused with this?)) what can possibly be left to build? And with the average price of an app now around $0.99 cents Apple has effectively driven software to almost nothing in an effort to support it’s own high margin hardware products.

Microsoft learned early on that it’s all about the developers, and they provided the tools and the ecosystem for developers to flourish with decent margins. Apple has wiped that out and in doing so have given developers no ability to make money.

So with no room to make money and a mature ‘form factor’ for tablets and smartphones we have a ‘more than good enough’ situation which explains the doldrums. More of the same won’t solve the problem – what we need is some good old fashioned innovation and in my opinion it’s not wearable (the last thing I want/need is more stuff to support with software updates).

What’s needed is a way for developers to make what’s there work better and generate them net new revenue. That will have the effect of driving more hardware sales.

What I call ‘upstream innovation’ is really hard, easy to ignore, laugh at, or outright dismiss. But as history has shown us, that’s what drives the next wave (pun intended) – not more of the same.

The Do Not Track Conundrum

noreply@blogger.com (Peter Cranstone) — Thu, 31 Jan 2013 16:35:00 +0000

When you have a moment please read the following:

Consumer Watchdog Calls On FTC to Seek Do Not Track Legislation
- Also the letter mentioned in the article - link

Next please read the following from the DNT (TPWG) forum

Issue-144 etc - link
- Key sections
  - If you are a European citizen and visit a European website you expect your fundamental rights to privacy and data protection to be honored. You do not need to set the DNT general preference because you are already protected by law. The European site is obliged to not gather web history or any other data without "explicit & informed consent", as reiterated the Data Privacy Directive and the forthcoming GDP Regulation.
  - European sites need to have a standard way to signal not only DNT: 0 but also that their embedded third-parties must not gather web history even if the DNT general preference is unset. There only alternative to this is to remove untrusted third-party elements from their sites.

So here's the conundrum…

There's now US. legislation pending to force a global DNT policy however HTTP Do Not Track packets do NOT honor geographic boundaries
In Europe they're protected by law, but lack a simple method for the user to invoke a personalized Web page response based on the users ability to control the collection, flow and use of their private data

Summary…

Do Not Track is not going away because the alternative is regulation - Currently the approach to regulation is Do Not Track
3PMobile is the ONLY solution that allows packets to honor geographic boundaries and is a simple method that allows the users to selectively control the collection, flow and use of their private data

DNT for better or worse is the only solution on the drawing board so they can't go back now. The only question that remains is how fast what they have goes forward, even though there are some serious issues.

Re-Imagining the future of the Web

noreply@blogger.com (Peter Cranstone) — Thu, 24 Jan 2013 23:44:00 +0000

Hmmm…

What we do differently if we had the chance to do it all over again? There's no question that the Internet has ushered in some of the greatest changes of the century. And yet as humans we should ponder the question - What if?

What if in the future, the Web could deliver a richer experience and respect my privacy?

Think about that for a moment. It's actually a pivotal argument which appears to be an almost impossible problem to solve. The Web has always been synonymous with free. As in free content in return for using your private data to deliver advertising.

After 20 years of using the Web i've yet to see an advert that appeals to me on a Web page. It's like they (the advertisers) know absolutely nothing about me. I've often wondered why there isn't a simple menu option in the browser which allows me to 'share my personal ad preferences' with the content provider?

Any yet to this day there's nothing.

The question that no one can imagine asking is how can I share my private data in return for a better experience. There's currently no 'Internet of You' (or Me) and yet with Advertising becoming a limited resource (there's only so many Web pages for ads) why isn't someone 're-imagining the Web' to provide a richer more personalized experience?

I define Privacy as the 'ability to control the collection flow and use of my Private data'. What I want in a re-imagined Web is the ability to control that collection, flow and use in a simple and easy to use manner. And in the act of sharing more value with the content provider in return receive more value in return.

If you go back in time (Innovation, The Internet, Standards And the Arrow of Time – Part I & Part II) you'll see that the key to unlocking the future is to re-imagine the current. In the examples shown you can see how obvious it is as the arrow of time moves forward.

At 3PMobile we started out re-imagining the future of the Web. It's one which aligns perfectly with the current Web, and then extends it into the future for those who want something better.

Innovation, The Internet, Standards And the Arrow of Time - Part II

noreply@blogger.com (Peter Cranstone) — Wed, 12 Dec 2012 19:14:00 +0000

In Part I I introduced the notion of the 'causal arrow of time' and how innovation moves forward in time with what has come before, always enhancing existing technology and the infrastructure that has come to depend on it, in the least disruptive way. In each case there is always the same outcome, a lowering of costs, new customers and services, and an increase in revenues. I used two analogies to illustrate how building standards based infrastructure helps drive innovation and move commerce forward. In this final blog i’ll talk about 'Enhancing HTTP' and how a new innovation in three critical areas (Performance, Privacy and Personalization) will drive the next wave of revenue on the Web.

As I mentioned in Part 1 there was no option in the standard version of HTTP to transmit Privacy information over the Internet. In an ironic twist of fate the original designers of the HTTP protocol actually added a method for adding 'standard data' to the transmission. This link points to RFC 2616 which is the actual protocol which runs the Web. Here’s the critical section that points to how the protocol can be 'Enhanced' (see the bold highlights below) …

The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative, hypermedia information systems. It is a generic, stateless, protocol which can be used for many tasks beyond its use for hypertext, such as name servers and distributed object management systems, through extension of its request methods, error codes and headers

It’s those exact highlights which illustrates how you can enhance the Web using 'standards'. Unfortunately as you continue to read the spec (Section 12.1) it tells you why trying to do this is not a good idea. But 'what if you ignored that' and went ahead and did it anyway? Well you’d have to solve a lot of complex problems, but if you did, then you would have successfully enhanced the standard by which all devices connect to the Web.

So what would all this look like?

Standard HTTP: A browser talks to a Web server over current infrastructure using Web standards

Enhanced HTTP: A new data channel allows the browser to send real-time private data over current infrastructure using Web standards

Enhancing HTTP - Adding a Channel for Privacy, Performance and Personalization Data

The need to transmit private data over existing HTTP infrastructure is increasing. 3PMobile believes the best approach is to use an encrypted channel inside the HTTP protocol itself. Like on a telephone network, this data is hidden during transmission, but recognizable by a Web server. The 'Private Data' being added to the HTTP request can be either STATIC (privacy preferences, personal information, performance enhancing data) or DYNAMIC (GPS, sensor data, etc.). It is added using existing HTTP standards, such as headers and cookies, so devices and developers need not learn anything new.

The addition of a private data “channel”, just like the added channels to the phone networks, enables countless new revenue opportunities without disrupting the existing HTTP protocol or infrastructure. It inserts seamlessly into the existing protocol, to ensure no disruption and no new learning by developers and IT professionals. Location-based services are the first to be monetized and a privacy preference “switch”, like the Do Not Track (DNT) header is currently being considered by governments and the W3C. A sampling of what standards-based, private data channel innovation enables includes:

Enhanced Privacy
- Enterprise policy management & compliance monitoring
- Secure transmission of biometric user authentication
- Identity Wallets and consumer sharing choices
Personalized Web Services
- Personalized content and advertising
- Managing policy, promotion and simplifying navigation via browser menus
- Mobile apps that can rival apps in UI and functionality
Performance Optimization
- Real-time, real world device and wireless network performance testing
- Real-time performance monitoring by device, network and location
- Mobile SLA analysis & remote device testing and management via the Web

Innovating the Standard… 3PMobile®

Since the very beginnings of 'transmission technology', every time a standard has emerged and has been adopted for wide use there have been 'alternate channels' invented and applied to those standards for the purpose of transmitting 'more information' than the original technology was designed to transport…

… all without disrupting or replacing the original technology.

3PMobile, with it’s Choice® technology, applies this time-tested and proven approach. The company’s intellectual property adheres to the premise that the most valuable technological advances enable the successful introduction valuable products and services without disrupting the existing technology or economic base. Choice® is additive. It provides a path for new technological and economic growth – without requiring immediate change to current business practices or Web infrastructure. Effectively, the company’s contextual data communications platform simply extends the HTTP protocol with a new ‘data channel’ designed to support Web privacy, personalization, and performance-enhancing products and services.

3PMobile’s approach allows organizations and individuals to change - without forcing the pace of that change. It does so by respecting standards and utilizing existing programming skills for the HTTP protocol. And while many will argue that all standards-based solutions should be open source, one need only look at the number of FRAND and cross-licensing arrangements in play in modern Web and mobile ecosystems to know that while it may be the desire of some, it is not the reality. Market advantage and positive economic disruption is created by early adoption of innovative technologies that plug into the existing infrastructure. Strategically minded organizations have the opportunity to be the first to deliver and monetize products and services that utilize the 3Ps – and avoid the negative market impact regulation can impose on them.

Early adopters will gain the largest economic advantage, but everyone can participate for decades to come. As a standards-based technology, the 3PMobile approach is easily integrated into the enabling infrastructure, just as new services have been added to the fuel delivery, container-based shipping industries. It layers opportunity, just as tone-based dialing and data transmission have been added to the telephone network, or as digital data transmission has beyond simple information about the type of browser.

More data, faster transmissions, more choice in data sharing and management, means, quite simply, more opportunity for the development of profitable products and services. Successful innovation, like Choice®, is additive. It respects the technology, which has come before it. It enables yet-to-be defined monetization models. It ensures replacement revenue for established products and services as they reach their end-of-life. It supports both privacy and personalized content and services – with or without tracking. It is the next major evolutionary step in Internet communications.

Innovation, The Internet, Standards And the Arrow of Time - Part 1

noreply@blogger.com (Peter Cranstone) — Wed, 12 Dec 2012 02:05:00 +0000

Like the 'causal arrow of time', innovation moves forward in time with what has come before, always enhancing existing technology and the infrastructure that has come to depend on it, in the least disruptive way. However in each case there is always the same outcome, a lowering of costs, new customers and services, and increase in revenues. Two simple analogies come to mind:

The gas pump
Shipping containers (The Box) and the story of Malcolm McLean

The gas pump of today has changed little from the day it was invented by Sylvanus F. Bowser in Fort Wayne, Indiana on September 5, 1885. There’s a standard nozzle to dispense the fuel and there’s a metering mechanism to record the amount of fuel dispensed. All of this is 'packaged' in an attractive 'pump'. By following a standard there is now a global distribution mechanism for gasoline that powers commerce.

Building on this (the causal arrow of time) pumps have become driver services delivery kiosks. They offer patrons multiple fuel and payment options, along with wait time video and car wash service options. They enable a new generation of revenue generating services for station owners, energy companies, content creators, and carwash mechanism producers. However the underlying theme always remains the same - improvements to existing infrastructure drive new revenue opportunities

In the case of the shipping containers it was the genius of one man, Malcolm McLean who relentlessly pursued an agenda that made ships, railroads and trucks bow to the intermodal container, and in the process made globalization and a new standard possible. In doing so he created a new economic order by leveraging existing delivery methods. There were five critical elements to McLeans vision which are mirrored in all global innovations. They are:

Financial: In the beginning, total port costs consumed 48% (or $1163 of $2386) of shipment of one truckload of medicine from Chicago to Nancy, France, in 1960. Fast forward to today: the book quotes economists Edward Glaeser and Janet Kohlhase: “It is better to assume that moving goods is essentially costless than to assume that moving goods is an important component of the production process.”
Technology: The key was to figure out optimal container sizes and other system parameters, based on a careful analysis of goods mixes on their routes. Today, container shipping systems are so optimized that an added second of delay in handling a container can translate to tens of thousands of dollars lost per ship per year.

Labor: The streamlining of labor unions resulting in a more consistent and economical approach to handling containers
Globalization: Containerization represented a technological force that old-style manual-labor-intensive ports and their cities simply were not capable of handling. This required a clean sheet approach to handling containers which is now repeated around the globe, offering economies of scale never seen before.
Simplicity: By adopting a standard companies and countries could now easily move their products around the globe. Hard to believe it all came down to a single box.

Now lets fast forward in time the invention that helped usher in the Internet. At it’s core the Internet depends on the telecommunications industry and the enhancements made over time to the design that started it all - two cans and a piece of string which later became the telephone. In the beginning inventors found a simple way to replace 'vibrations on the wire' (the two cans and a piece of string we all played with as kids) with electrical signals. From there the race was on to continue enhancing the existing infrastructure with what’s now known as 'control signals', all without disturbing or having to change the in-place technology and standards. Todays telecommunications systems has evolved to support a myriad of new signals the latest of which we currently know as the Internet.

The history of the Internet began with the development of electronic computers in the 1950s. The public was first introduced to the Internet when a message was sent from computer science Professor Leonard KleinRock’s laboratory at University of California, Los Angeles (UCLA), after the second piece of network equipment was installed at Stanford Research Institute (SRI). This connection not only enabled the first transmission to be made, but is also considered to be the first Internet backbone. In 1982 the Internet protocol suite (TCP/IP) was standardized and the concept of a world-wide network of fully interconnected TCP/IP networks called the Internet was introduced. At it’s core the Internet is based in the advances made by the telecommunications industry followed by the computer industry.

Next in the causal arrow of time came 'Standard HTTP' which was layered in as a standard on top of another TCP/IP. HTTP was designed as a very simple stateless protocol. (A communications protocol (layer) that treats each request as an independent transaction that is unrelated to any previous request, so that the communication consists of independent pairs of requests and responses. It can easily be compared to the early days of telephony. The early HTTP technology standards only contained what was necessary to make connections and transfer generic content. There was no concept of 'Private Data' in the early HTTP design(s). It was simply a fundamental hybrid of both a transport and presentation layer protocol for data transfer.

In the next and final installment of this blog i’ll talk about 'Enhancing HTTP' following in the same 'causal arrow of time' footsteps as all of the other innovations mentioned above.

Is there room for another browser in the marketplace, the right question to ask ourselves?

noreply@blogger.com (Peter Cranstone) — Wed, 28 Nov 2012 23:02:00 +0000

No, I don't think it is.

The standard answer from any VC or investor in regard to the question, is that nobody can compete against Internet Explorer, Chrome, Safari or Firefox. On the surface I would agree, but if we peer a little beneath the surface things are different.

To illustrate this i'll borrow a quote from Stalin;

'I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this—who will count the votes, and how.'

Now let's plagiarize Stalin’s quote just a little…

I consider it completely unimportant who in the party will use whichever browser, or how; but what is extraordinarily important is this—who will use the features of that browser, and how.

Every modern browser now supports a new feature - the ability to turn on a Privacy setting called Do Not Track. It’s the single feature that EVERY OEM has agreed on that MUST be in place. They (the OEM's) control that feature, nobody else can ADD it to ANY browser and compete with them.

So if you're a company focused on Privacy on the Web and wanted to add a 'differentiating feature' via say a browser plugin, you have just been essentially shut out of that market place. (Not only can you not add a plugin to a mobile browser, doing so on the desktop adds no value to the already STANDARD feature).

Two other features like this come to mind. One is the 'Embed' tag and the other is real time disk compression. The embed tag inside HTML allows you invoke an external application from within the page. Real time disk compression keeps the hard drive contents compressed.

Both are 'features'.

But here's where it gets interesting (looking beneath the surface). Features are irrelevant until EVERYBODY decides they have to have them. Then they take on a completely different role. To effectively monetize a feature you need two things - everybody has to have it, AND it has to be deployed on a global scale, preferably as a standard. The embed tag fits that description and so does an operating system that contains real time disk compression. Both are global in nature and both are now standards.

So what is the latest 'Standard feature' inside EVERY modern browser?

It's the ability to go to a Privacy menu in the browser and enable a check box that allows you to send a Do Not Track header to a Web server. Since the standard started to evolve (it's still not a completely finished standard) there are now approaching 500 million browsers in the marketplace that support it.

What could be thought of as insignificant feature, now takes center stage as a MUST have feature for browser companies to remain competitive.

So maybe the real question to ask yourselves is this - who owns the idea behind adding the feature of a Do Not Track privacy header to the Internet which is activated from inside the browser? And for that you may wish to read up on US. Pat. 8,156,206

Footnote… to see how much a 'standard feature is worth' when it goes global.

Eolas owns the 'Embed' feature
Stac Electronics owned the 'disc compression' feature

Do Not Track

noreply@blogger.com (Peter Cranstone) — Fri, 16 Nov 2012 20:38:00 +0000

Consumer Reports Says Do Not Track, But Tracks Anyway

Here’s the punch line…

So, while the latest versions of IE, Firefox, Google Chrome, and Apple Safari do allow users to enable DNT, standards for whether or how online trackers should acknowledge those browser signals have yet to be agreed upon by government, advertisers, privacy advocates or the browser makers.

Google joins the Do Not Track Party

noreply@blogger.com (Peter Cranstone) — Tue, 06 Nov 2012 20:40:00 +0000

Just downloaded the latest version of Chrome and it’s official - Do Not Track is now a Privacy setting. Although you might want to read the disclaimer that shows up when you check the box.

A Fool in search of Privacy

noreply@blogger.com (Peter Cranstone) — Wed, 31 Oct 2012 22:27:00 +0000

As I watch with great interest in what can only be called the 'Shenanigans', taking place at the W3C Tracking Protection Working Group, my mind is drawn to Wikipedia's description of the Fool (link)

In various tarot card games he has a unique role - (and I quote)...

'In these games, the Fool is sometimes called "the Excuse". The tarot games are typically trick taking games; playing the Fool card excuses the player from either following suit or playing a trump card on that trick. Winning a trick containing the Fool card often yields a scoring bonus.'

You don't have to think too hard about whose playing the Fool card. That would be the advertising industry. On a day when California just passed this bill "California AG: Post Privacy Policy….Or Else!" (link) (in short there are heavy fines for abusing privacy) I can send a VALID DNT (Do Not Track) signal to a Web server (there are over 100 million browsers in the marketplace that can do this) and without everyone being absolutely, totally, 100 percent sure this was a 'fully informed decision on the part of the user'… the Web server can disregard it.

And the best part (the Fool Card) is that the server doesn't have to notify the user that they have just ignored their Do Not Track signal. Obviously the credibility of the W3C Tracking Protection Working Group is now reaching an all time low.

Throw in the other recent press release by Yahoo that they do NOT intend to honor a Do Not Track signal from ANY Windows 8 device and you're left shaking your head as to what these Ph.D's are thinking (or should I say smoking). Cue the sound track from John McEnroe - 'You Cannot Be Serious'.

Through their own cleverness the Do Not Track signal that a browser sends has no way of communicating with the server that it was an informed decision on the behalf of the user. So what's the server to do? Well - they can ignore it because how can they tell if the user was really informed?

Brilliant - the Fool is vindicated and the advertising industry marches on. Mission accomplished. The card now passes to the user and they now become the Fool in search of Privacy. Alas there is no such thing.

Well done to the W3C for architecting something so incredibly flawed that not even a Fool is protected.

Privacy and the Human in the Loop

noreply@blogger.com (Peter Cranstone) — Wed, 17 Oct 2012 17:26:00 +0000

When considering any system sometimes we forget that there's a 'Human in the Loop'. I've just finished reading a great white paper by Lori Cranor (A Framework for Reasoning About the Human in the Loop), and whilst this paper talks about security, it's kissing cousin is Privacy. So a lot of the ideas presented here are interchangeable.

In this paper Lori talks about keeping humans out of the loop when it comes to security unless it's absolutely unavoidable. In which case she talks about a framework that can be used to identify problem areas before a system is built.

Here are the components in her framework:

Communication: How are you communicating with the user (Notices, Warnings Status lights)?
Communications impediments: Can communications be interfered with (malicious 3rd parties)?
Personal variables: Human behavior and relevant knowledge about the system?
Intentions: Can the system be trusted and are users motivated to take appropriate action?
Capabilities: Are users capable of taking the appropriate action?

So what has all of this got to do with the proposed Do Not Track standard? Well actually, a lot. Systems live and die based on the 'Human in the Loop' so if the solution is poorly designed or cannot be trusted there is little chance of it succeeding.

The current proposed Do Not Track standard has an incredibly simple Human Interface. The user goes to the browser menu, selects Privacy and then checks the box marked 'Ask Web Sites Not To Track Me'. That's it. That one check box is all the human intervention required. So what could possibly go wrong? Well a lot.

The standard makes it very simple for a user to communicate an intention to a Web server - and then (dare I say it) deliberately removes the need for a Web server to communicate that it 'acknowledges and understands' the users intention. Right there is the fatal design flaw. (Image if HTTPS worked this way). A malicious 3rd party can easily change the users intention to an alternative undesired outcome i.e. 'Track Me'. As there's no need for the Web server to acknowledge what it received you can easily make the case that it can simply ignore everything and continue as normal. In short there's NO verification (as in Trust but Verify) required. So Do Not Track fails both item 1 & 2 in the framework.

As we go on we see that there are similar problems with all of the other framework items as well. Humans have really NO idea how their private data is being used on the Web. They love all the FREE services but fail to understand that 'pie is not free at the truck stop'. Their data is shared in an attempt to market new services to them. So Do Not Track fails item 3.

Lets look at the final two items. Intentions and Capabilities - again we have a 'swing and a miss' scenario. If I cannot verify what I sent then I cannot trust the system. I have to trust the content provider and due to the lack of transparency when it comes to privacy (NOT security) the Human has no idea what is really taking place under the covers. Finally - capabilities. Can I take appropriate action IF I find out my privacy is being abused. Not really - I can go to another Web site but that might be the same as jumping from the fire pan in to the fire. I cannot change my browser settings any further so essentially i'm stuck sharing my data if I want that free service.

However the user can fight back - and FaceBook is a good example of that. Approximately 25% of a FaceBook users use a fake profile. That's 250 million people all lying about who they are. And herein lies (pun intended) the real Privacy issue - where's the motivation for both parties (Human and Content Provider) to deliver meaningful value?

It's like everyone is stuck in the mud with the current status quo where everything is free and everything (my privacy) is for sale. The only solution that i've seen that comes really, really close to meeting Lori's framework guidelines is the RePriv idea from Microsoft. Why? Because it adds accountability back into the system.

As the old saying goes - 50% of all advertising is worthless - the trick is in figuring out which 50%. A better designed system as Microsoft proves in the RePriv paper showcases that it can be done and the benefits are significant for the 'Human in the Loop'.

Why Johnny Can’t Opt Out

noreply@blogger.com (Peter Cranstone) — Tue, 16 Oct 2012 22:13:00 +0000

In light of all the 'discussions' over at the Tracking Protection Working Group regarding the advertising industry claims that their polices 'really do work' I thought it might be a good idea to search for some more empirical data by a respected university. And as luck would have it I found this: Why Johnny Can’t Opt Out: A Usability Evaluation of Tools to Limit Online Behavioral Advertising - revised May 10th 2012, so it’s fresh off the press.

Spoiler alert...

We found serious usability flaws in all nine tools evaluated. Our results suggest that the current approach for advertising industry self-regulation through opt-out mechanisms is fundamentally flawed. Users’ expectations and abilities are not supported by existing approaches that limit OBA by selecting particular companies or specifying tracking mechanisms to block. There are significant challenges in providing easy-to-use tools that give users meaningful control without interfering with their use of the web. Even with additional education and better user interfaces, it is not clear whether users are capable of making meaningful choices about trackers.

Oh dear, another black eye for self regulation. For it to be meaningful a solution it has to be fundamentally 'sound' vs flawed. Is a solution possible? - Yes. Microsoft wrote a great paper on how it could be achieved - see my previous blog

Something will have to be done about the lack of privacy on the Web. All that remains is the 'How'. It’s obvious that current approaches like DNT with their all or nothing 'binary' approach will not satisfy the ad industry anymore than their own style of self regulated 'opt-out' cookies.

Lets see who gets serious first, before the regulators get called in.

Re-Envisioning In-Browser Privacy

noreply@blogger.com (Peter Cranstone) — Tue, 16 Oct 2012 21:02:00 +0000

I’ve been planning on writing about an alternative approach to In-Browser Privacy. Obviously we’re very much in favor of a better solution than the current Do Not Track standard that’s being offered, and to that end we set out over 6 years ago now to build a fully standards based solution that seamlessly integrates into all current Web infrastructures - we call it Choice®

So with the idea in mind I set out to do some research to see if anyone else thought that it would be a good idea. And the answer is 'Yes'. I’m linking to a Microsoft Research Report titled 'Re-Envisioning In-Browser Privacy'which I think is probably the best paper i’ve seen on the Web that not only showcases a solution, but also clearly shows how powerful a solution would be to drive new value and experiences for the ad industry and consumer alike.

I do disagree with two of their ideas: 1) Build a new browser & 2) Build a new protocol to layer in on top of HTTP - but that’s all.

We designed Choice® to integrate with all existing browsers AND use the current HTTP protocol. This allows seamless integration across all infrastructures. With the exception of those two items we’re in alignment on everything. The value proposition is simply huge - a true win - win for all concerned.

If you’re interested in privacy and want to be 'part of the solution' then I urge you to read this. If you want to see it in action then download a copy of Choice® today and see how far we’ve taken the idea.

DNT and the Tracking Protection Working Group - Did they "Just Jump the Shark"?

noreply@blogger.com (Peter Cranstone) — Thu, 11 Oct 2012 22:46:00 +0000

If you have a spare hour or so, and a large bucket of popcorn you might want to head over to the Tracking Protection Working Group Public Mailing list forum - link

You don't have to read all of the emails - it's way to confusing, however spend some time in Octobers list to get a hint of what is going on. It's like the IAB, DAA and DMA all decided that DNT has failed (Jumped the Shark) and even with speeches from people like Neelie Kroes (An update on Do Not Track The Centre for European Policy Studies (CEPS)/Brussels, 11 October 2012), it doesn't make any difference, because there really isn't a privacy problem because online trust has never been so high as it is right now. (This is a great email).

What people on the forum fail to realize is that this is just the first innings. The protocol is not even finished and it can be made to do more (you can extend it to carry more data). The advertising industry needs to get onboard with the improvement phase, and NOT keep trying to kill the current phase. It would be in their best interests to have a something vs the alternative which is regulation.

Nothing is ever perfect in the first rev - give it a chance before you make it 'Jump the Shark.'

Consumer Protection - the Do Not Track standard - and the W3C

noreply@blogger.com (Peter Cranstone) — Thu, 11 Oct 2012 15:05:00 +0000

The Do Not Track standard is now live in every major OEM browser. Consumers who are interested can check a box marked 'Tell Web sites not to track me' and the browser will add a 'header' (a message) to every request the user makes in the browser, indicating to the Web server that the person does not wish to be tracked.

It really is incredibly simple - and it's biased towards Consumer Protection, as it should be. However that's not the end of the story. The W3C is being pressured to water down the spec via the advertising industry. Instead of the Tracking Protection Working Group it's fast becoming the 'Please God Don't Let Us Lose Any Money' Working Group. If you want to see how bad things are spend a few minutes/hours reading through the mailing lists - link (you'll be shocked)

There have been lots of blog posts in the last few days on this subject - it's culminated with Neelie Kroes Vice-President of the European Commission responsible for the Digital Agenda Online privacy and online business giving us an update on Do Not Track The Centre for European Policy Studies (CEPS)/Brussels, 11 October 2012 - link
If the W3C is going to retain ANY credibility from this process they have to ship a standard that is in favor on the consumer. Failure to do so is really not an option as the stakes are so enormous. The alternative is to bring in the regulators which is what Neelie's next statement will be focusing on if Do Not Track fails to do the job it promised to do.

Every browser now supports sending the Do Not Track signal - what's taking so long is figuring out all the myriad ways that the Web servers can 'game the system' to avoid it. They'd be better off served accepting it and moving forward, because if they don't like Do Not Track they're sure not going to like what the regulators have in store for them.

Why the proposed Do Not Track standard is going to fail – it's all about Trust

noreply@blogger.com (Peter Cranstone) — Thu, 27 Sep 2012 18:28:00 +0000

As the saying goes "A civilized society cannot function without trust", ergo it's also appropriate to extend that premise to the Internet – "A civilized Internet based society cannot function without trust".

So how do we define trust? There's a great definition to be found on the Web - link - in short:

"Trust is a person's willingness to accept and/or increase their vulnerability by relying on implicit or explicit information."

So how does this all related to the proposed Do Not Track standard? Well the idea is a simple one – the user goes to his/her browser, clicks on the Menu, selects the Privacy option and then checks the box marked 'Ask Web sites Not to Track Me". You are now sending a message to a content provider that you are unwilling to "Trust" their behavior when it comes to sharing your data. You are reducing your vulnerability by transmit explicit information.

Now imagine you find out that even though you are sending this explicit information that the Web content provider is not only still tracking you but also sharing your data with other parties. Instantly your trust in them is diminished and the lack of value they offer you is also greatly diminished. Trust is therefore 'Contextual'. You have relied on a Web content provider to NOT do something and they have now failed.

This is exactly where Do Not Track is heading. The very second you transmit that explicit value to a content provider and they do not honor it the whole standard instantly collapses. Ironically they cannot afford to stay in business and offer free services WITHOUT the ability to share your data.

So what does Do Not Track need in order to overcome this problem. What would help content providers 'WANT' to honor that setting? Well for one it needs to be marketed as a true standard where one can have 'confidence' in the fact that if you chose the DNT setting that you will not be tracked. Secondly it needs to be extended to support additional 'Contextual Fields' that the user can share with the content provider. Binary solutions (like the current standard) lack the context needed to deliver value (without breaking the rules). For DNT to truly work it needs a mechanism whereby I can share more data and increase my trust levels in return for a better experience.

This becomes the win – win we so often talk about. Right now it's a win – lose. If I enable that Privacy setting and the content provider honors it then all 3rd parties are prevented from seeing my data. This means that only the very largest content providers survive and overnight a huge part of the ad industry is wiped out. Ergo the incentive to cheat is so ridiculously high that DNT will fail instantly. If it's a choice between sharing data and staying in business and not sharing data and going out of business what would you do?

Do Not Track is NOT a privacy solution, it's NOT a Trusted solution – in short it offers no value to an industry that is built on sharing your data. What we need is a solution that increases the value of my data that I'm willing to share – we call that solution Choice®

iOS 6 and DNT

noreply@blogger.com (Peter Cranstone) — Fri, 21 Sep 2012 12:44:00 +0000

Interesting - Apple quietly snuck in Do Not Track inside iOS 6. Here's how you turn it on. Go to Settings > Safari and then enable Private Browsing. There's NO indication that DNT is turned on until you check the headers coming from the browser. To do this we set up an echo page that reflects back everything that came from the browser. (link)

Here's the results:

The Future of Social Media Marketing?

noreply@blogger.com (Peter Cranstone) — Tue, 12 Jun 2012 16:13:00 +0000

The following article was written by Emily R. Coleman, President of Competitive Advantage Marketing, Inc. When I first read it I absolutely knew that Emily had hit the proverbial nail on the head, and with her permission we're now adding it to our blog.

A friend recently sent me Evan Bailyn’s Outsmarting Social Media with the instructions to “Read it!” It’s an interesting book, well worth the time to look at. Bailyn has some thoughtful and practical suggestions and insights on marketing through Facebook and Twitter (although I think Facebook’s new Timeline has thrown him a curve).

The subtitle of the book is “Profiting in the Age of Friendship Marketing,” and one of Bailyn’s key themes is how social media are changing the way marketers and advertising agencies will be using “influencers.” With social media, the concept of “influencer” (or “trend setter”) is being brought down from the realm of celebrities to individuals in our lives whose opinions we respect.

What makes this granularity and personalization of influence so potent is that we decide who influences us, taking the guess work out of picking spokespersons. As we add more and more personal information to our personal social media accounts, and as Facebook and Google (whom Bailyn sees as the main competitors in this emerging arena) perfect algorithms for real-time and truly personalized search, marketers and advertisers will be able to deliver their pitches at the level of the individual. (In fact, Google has just rolled out its newKnowledge Graph or “semantic web” to make searches more personalized and intuitive.)

Bailyn foresees the time when ads for sneakers, for example, will be sent to you with a picture of one of your individually chosen influencer friends wearing or endorsing the brand.

As a marketer, that sounds pretty exciting. People will tell us what they want, what they need, and what they worry about. Even better, they’ll tell us who they know who would influence their buying decision. Wow! My job just got a whole lot easier.

I have no doubt that sometime in the not-too-distant future, women will be getting personalized lingerie ads and Cialis™ promotions will be targeted more precisely.

As an individual, however, the whole thing makes me a little queasy.

It’s probably a generational thing, but I have a profound objection to the notion of my friends becoming shills for products. Certainly, I’m interested in their opinions and experiences with products and services and just plain stuff. But when I want those opinions, I’ll ask for them. (And I really don’t care what underwear my friends prefer.) More important, as soon as these opinions are co-opted by advertisers, they will be significantly diminished in my eyes. (Actually, I’d probably get in touch with my friends and ask them if they knew they were being used, and what were they thinking!).

Certainly, the idea of friendship (or relationship) marketing is not new. It is, after all, the basis for all the multi-level marketing (MLM) programs.

What is new is taking the personal out of the personal relationships, interjecting third-party interests between the individual and the individual’s influencers.

What is new is the coming unprecedented ability to gather and manipulate vast amounts of personal information at the most granular and individual level.

Okay, so I admit it. I’m old-fashioned. I’m not looking forward to a brave new world where we put more and more of what used to be private information online. And I’m not looking forward to a brave new world where that information is increasingly accessed by people I don’t know and is used to try and sell me stuff. I get enough unsolicited suggestions for how I should spend my money as it is.

I have no issue with companies making billions off “friendship marketing.” I am a capitalist to my toes. (Though I am probably not going to be a very good target for their campaigns.)

But this data collection (voluntary as it may be) makes me queasy because:

It will probably be a matter of minutes before politicians and political causes catch on to the advantages of granular marketing. They will obviously use this accessible database for fund-raising, volunteer gathering, and get-out-the-vote drives – at a minimum.
How long do you think it will be before politicians and government agencies use this data in less benign ways?
What do you think the chances are that all this private and personal information you are consolidating on social media sites will not be hacked?

Okay, I’m old fashioned. But I fear that in the not-too-distant future, we will be reminiscing about what personal privacy used to mean.

About Emily R. Coleman

Dr. Emily R. Coleman is President of Competitive Advantage Marketing, Inc., a consultancy that specializes in helping companies extend their marketing reach and impact. Her hands-on experience extends from the development and integration of enterprise-wide marketing communications, through the creation and implementation of strategy to achieve business objectives, into the innovation of techniques to ensure that tactics support business strategy. Dr. Coleman can be reached at ecoleman@colemanmgt.com. She can be found on LinkedIn, Twitter, and Facebook.

Why Privacy cannot be a Web Service

noreply@blogger.com (Peter Cranstone) — Wed, 06 Jun 2012 14:40:00 +0000

There’s a tendency when you have a hammer to think that everything looks like a nail. There’s plenty of “nails” out there to hammer with your web service, however Privacy isn’t one of them.

Why not?

In a nutshell - Because I want to be in control of the collection, flow and use of my data, AND I don’t want that data stored on a server anywhere where it’s open to others. What a web service does really well is to store and process lots and lots of data. Remember when Willie Sutton was asked why he robbed banks? The answer was simple – because it’s where the money is.

And that’s exactly the case when it comes to my private data. It’s far more profitable to the hackers to attack a data center rich with personal information than to try and access the data from my one device. They can access millions of records vs. a single record. Pretty much a no brainer when it comes to collect people’s valuable data.

Web services are springing up that store your private data for you, and then share that on an as needed basis with Web content providers that you authorize. Sounds pretty good so far (apart from the storage issue). They can charge a fee to manage your privacy. (Hmmm why can’t I manage my own privacy for nothing?)

But that’s not the problem – the problem is the content provider who you share the data with. You have no idea what they’re really doing with you data. What I want is a simple, easy to use solution that allows me to directly build a trusted relationship with a content provider and gives me a choice in how and what I share on a real time basis.

You don’t need an intermediary web service for that. And certainly not one that charges you for the privilege of storing your private data.

Choice – The Lynchpin to Online Privacy

noreply@blogger.com (Peter Cranstone) — Sun, 03 Jun 2012 22:09:00 +0000

Choice – such a simple word, and yet so misunderstood when it comes to privacy. All I really want is a say in how people use my private data. I want to participate in the process vs. getting frozen out.

In the last few days Microsoft shipped the pre-release version of Windows 8. In doing so they stunned the online privacy community. There crime? They dared to make a choice for the user. In the browser they turned on the default setting for Do Not Track which offers the highest level of privacy.

Quelle Horreur (isn’t that awful). They made a choice for the consumer. The advertising community immediately launched a PR campaign decrying the approach. Let users make the choice on their own they screamed – and to some extent I have to agree. But (there’s always a but) you have to remember that Microsoft is a global OS company and ships their software to countries that have far more stringent privacy laws than ours. Nobody wants to ship an OS that by default opens them up to litigation.

And so they made a choice. In the US the W3C group tasked with coming up with a solution for online privacy is in a quandary. What should they do? Some want the default setting to be the same as Windows 8, and yet others (from the advertising community) argue for doing nothing (no settings are made).

I think we should add a single word here that can help us resolve this issue. “Informed” as in informed choice. If the W3C wants the default set to no settings, then they must offer a choice to the consumer when they go to install the browser.

Simply doing nothing is not a choice when it comes to privacy, and only perpetuates the already high levels of mistrust within the online community.

Privacy is about to get really expensive

noreply@blogger.com (Peter Cranstone) — Fri, 25 May 2012 15:49:00 +0000

Tomorrow is the big day. The day the EU-Cookie directive goes into effect. Already people are talking about how expensive it will be to maintain compliance. Well folks they haven't seen anything yet.

It's not only expensive to be in compliance, you also have to think about the lost revenue that comes from being in compliance. I've been surfing around some EU sites and can already see the "banner-like" ads asking if you would like to Opt-In to having cookies on your device. I simply ignore them because there's NO downside. Funnily enough my experience is IDENTICAL with and without the cookies.

Hmmm - think about that for a moment. An identical experience and I get to keep my privacy. I like it. But this is a #fail. What should be happening is that my experience gets better if I Opt-In.

So corporations are going to have spend money to be in compliance and loss money because they're in compliance. Time to look for a solution that enables net new revenue from protecting my #privacy.

The Privacy Oxymoron - How do I increase My Privacy AND still get a great online experience

noreply@blogger.com (Peter Cranstone) — Mon, 30 Apr 2012 19:35:00 +0000

Everyday now there is more and more discussion on Privacy. On the one hand you have the Privacy advocates who want nothing more than complete control over every aspect of their Privacy, and then on the other hand you have the Govt. and online content providers who want even more detailed information on you.

It's becoming like a Seinfeld episode - "something's got to give Jerry!".

But what? Privacy is really an oxymoron unto itself. If you de-identify data enough it has no value in which case the experience isn't going to be that great because Web sites are built around figuring out who you are.

Two articles appeared on the Web today:

Also I'm starting to see Do Not Track show up in public company filings - saying that it could effect earnings. Let's face it the Web has been built on the premise that in exchange for "free" I get to use your information. So it could be a huge drain on resources if this standard gets implemented. And now we're also seeing new browsers pop-up (no pun intended) that basically anonymize your tracks on the Internet, but slows down your experience.

What continues to perplex me is that no one is turning this problem "on it's head" and looking at it from a different perspective. It's an opportunity vs a problem.

Lets face it nobody is going to suddenly overturn the last 10 years on the Internet. We're all addicted to free and we basically turn a blind eye to Web sites using my private data. However with Mobile showing up to the party things are beginning to change. Mobile is deemed "really personal" and so we want to be sure that nobody is tracking us while we walk around.

So can we really ever have our "cake and eat it to?"

Well yes - I think we can. I wrote about how in a previous blog (A Contextual Approach to Online Privacy - It's all about Me) but it bears repeating. What's going to be needed is a way to placate both "stakeholders" - Me the consumer and You the content provider.

What I want is:

Convenience
Privacy
Control

What the Content Provider wants is:

Control
Commerce ($$$)

What we have to do is "align" those two sides and give them away to resolve the differences - when we align those sides you'll see the real power of the Internet realized for the first time.

So instead of trying to create more complexity, instead look for more simplicity. Alignment vs disorder. And as usual the answer will be staring us in the face.

Do NoT Track - Cui Bono?

noreply@blogger.com (Peter Cranstone) — Fri, 27 Apr 2012 17:44:00 +0000

Cui Bono - or in other words, Who Benefits?

Well I'm not really sure. I've been doing lots and lots of research into this, and I still can't figure out how this is going to really benefit anyone other than the programmers who stay employed to try and implement everything.

Lets start with the definition of Privacy. There are a lot of them but for this blog let's use the one I came up with:

"Privacy is: My ability to control the collection, flow, and use of My personal information".

That's pretty simple. I want a convenient easy way to control what I share online. If someone abuses the data then I want an easy way to "un-share" that information. So lets see how DNT enables that.

After launching my browser I go to the Preferences and then the Privacy tab. There I select the check box which says "Tell Websites that I don't wish to be tracked". So far so good. Now what is meant to happen is that automagically every Web site I go to will start looking for this incoming message and automatically disable any tracking capability that they may be using.

Ok, lets stop right here. Can you imagine the amount of code they'll have to wade through to check A) to see what they're doing as it relates to tracking and then B) disable that or re-program it in the case that I haven't actually checked the Do Not Track box in the browser. This is an incredible amount of work and as the saying goes "what's in it for me?"

Well not a lot actually. You'll have to spend time, money, effort to rebuild your site so that it supports this new capability. You'll have to publish new terms of service, new privacy policies and finally make sure all of it works perfectly. And after doing all of this you may lose ad revenue because you're no longer sharing customer information.

So lets sum all this up - spend money, and see a drop in revenue. Hmmm not what I really wanted.

However that's only one side of the equation - what about "Me"… what's in it for me?

Well not a lot really. You have no way to actually know whether or not you're being tracked. There's no change in the amount of data you're sending - the Web site can still see everything as before. There's no granular control over what you're sending and no way to change any of it - or - even add to it. In short it's a check box with little or no meaning.

Returning to the question: Do Not Track - Cui Bono?

As far as I can tell - no one. It's more work for the Web content provider, if they implement it could result in a loss of revenue, and it's only a recommendation so there's no enforcement. For the consumer there's zero benefit. There's no improvement to the Web experience and no way to verify if the content provider is actually honoring the browser setting.

What about an alternative approach?

For that to work you have to look at the stakeholders, and in this case there are 2. The user and the content provider. What's needed is a simple way to share more context with the content provider so they can provide an "enhanced service". Enhanced services drive new revenue which is something they want. The "cost" of this is "Trust". The more I trust the more I share. The more I share the greater the potential for revenue.

So for DNT to really succeed it has to provide new revenue opportunities for the content providers who are currently trading the cost of supporting the free service by selling your data. The current approach to DNT does not do this.