Last session of the conference. And yes, another Schill recommendation. But this one I wanted to go to as well. We always have this problem — how to let people know something is private without the fear of “unauthorised” access.

Sadly, Kellan’s slides exploded just prior to the session, so we see an Apple-like presentation sans imagery.

Presenter: Kellan Elliott-McCrea, Flickr

  • Sharing/privacy two sides of the same coin

  • Casual privacy is a design pattern for doing sharing - Can’t replicate the human experience in software, so we’re not even going to try

  • Software needs to have the experience of whispering at a party

  • Security through Obscurity++ - It’s make of (unguessable) URLs

  • Sharing vs. Privacy — why do we care? - We’re on information overload

  • We share to try get over all that

  • “Outboard brain”

  • Participate in the wisdom of crowds; collective wisdom

  • Basic models: - Share nothing - Total privacy is a fire suppression technique (aka it doesn’t work; one minor spark and you’re screwed)

  • We need a leaky privacy model (for the 99.5% of us who don’t need total privacy)

  • Share everything - There are some things people should not be sharing (kids, home, last night’s party)

  • Manage a crowd - Signing up people, adding people, assigning permissions

  • Leads to social fatigue

  • Massive cognitive burden

  • Human internal patterns are incompatible with the web

  • Casual privacy - Unguessable (but unprotected) URL for the purposes of sharing

  • Only the author can create one for their own content

  • URLs are neat (have neat properties); email, blog, IM, list, etc.

  • Whispers are forwardable, which means the URL is effectively the same

  • Whispers are deniable, so how do you do this with URLs? - “Beneficial hypocracy”

  • URLs need to be opaque, non-identifiable and unable to map it

  • No identifying error messages

  • No obvious gaps

  • Casual privacy works because of context - Leaks happen not maliciously

  • Give enough people enough information, and they’ll understand why it’s important

  • Deniability also supported through revoking - Removes the guest pass to see something previously allowed

  • GPs could be used as REST targets

  • Possible to pre-sign URLs and expiry (less casual privacy, BTW)