Tuesday, July 15, 2008

Can Commenter Anonymity Lead To Identity Theft

Yesterday I wrote about the downside of anonymity on the web. I received some great comments pro and con, but one that caught my eye was comment over on FriendFeed. The comment reminded me about something that I saw happen on TechCrunch that I suspect happens all the time all over the Internet. The issue: people pretending to be other people. In the case mentioned in the comment, someone was pretending to be entrepreneur Loic Lemur and founder of video service Seesmic.

And so my question here is simple. Is there anything that can be done about identity theft, and is it a big deal?

I don’t think it is a big deal yet, but you don’t have to be particularly imaginative to see that it could be. It seems to me that one of the most troubling aspects of this is the potential for someone to say something in your name, which is indelibly searchable and attributable to you. The issue regarding Loic was particularly significant because the remarks were anti-semitic. Imagine *that* in your “permanent record” next time you look for a new job. Luckily for Loic, TechCrunch comments support his Seesmic service, and so he was able to put a video in the comments which demonstrated that he was the real Loic and what his views actually are.

But is that what it has come to? The only way to establish your identity and to prove that you *didn’t* make some statement is to make a video of yourself? And in any case, does a video contradicting something you supposedly said in writing *really* prove you didn’t say it?

Interestingly, the site owner may have a bit more insight into the provenance of a comment than the general readers of the site, since analytics software will usually indicate the IP address of the commenter. This will generally indicate the ISP and likely physical location of the commenter. But even here, if obfuscation is your intent, your real IP address can easily be masked.

One person suggested that perhaps we should have “verified” commenters, so that people cannot pretend to be other people and then say bad things in their name. This is an interesting idea, as it would at least help to allow us to take with a grain of salt, unverified comments. But unless everyone did it, it would, I think, be fairly unconvincing to say that “if it had been me who said that I would have used a verified identity.” That just sounds like the kind of guiltly thing you say when you get busted, and I am not sure it helps save your job.

The bottom line is all of these issues around anonymity have me thinking a lot about bigger picture issues. It seems to me that the Internet crowd easily dismisses the potentially negative societal impact of Internet technology. I love the technology, but as I see it, there are real social, ethical, and moral issues that need to be explored, from identity theft to music piracy, to many others. And though some have made convincing arguments to the contrary, I am not sure all of these things just fix themselves via competition and the natural progress.

3 comments:

Anonymous said...

There's a lousy country singer out there pretending to be you!

Anonymous said...

Seriously, though, blog comments are repudiable, and shouldn't be treated as if they were made by the person whose name is used as a pseudonym by the comment author.

If people even contemplate attaching blog comments to their purported authors, then any attention-seeking blogger could post an offensive comment on his own blog under some popular victim's name, and then demand a video. The blogger could even, effectively, hold the victim's reputation hostage in exchange for money or service.

I would go so far as to say that any blog with an unauthenticated field that is presented as if it were the commenter's actual name is being unscrupulous. The authorship of an unauthenticated comment should be clearly marked as a pseudonym; pretending more is dishonest and possibly libelous.

paragraft said...

"But is that what it has come to? The only way to establish your identity and to prove that you *didn’t* make some statement is to make a video of yourself?"

I think the sheer hassle involved in this is a good case for why OpenID's time has come (and the not-quite-OpenID-yet services provided by Google et al). The downside is that this requires a web identity of some sort, but that's still less effort than retroactively recording a video pleading your innocence...

Post a Comment