Privacy Dashboard

"An open source browser extension for a privacy dashboard that will enable users to manage their identities, credentials, and privacy preferences, and enable them to track disclosures of personal data to websites"

• Illustrate what can be done with today's websites without modifications
• Demo the potential of new approaches that have yet to be deployed
• Implemented as Firefox add-on plus server modules as needed
  • Using Mozilla open source license to facilitate adoption
  • Will be available from early 2010

Under development by PrimeLife, a research project funded by the European Commission’s 7th Framework Programme

Privacy as the currency of the Web

Enabling people to spend it wisely!

• We're addicted to free content powered by advertising
• Untapped potential of micropayments
• Cookie tracking madness and linkability
  • IE, P3P and 3rd party cookies
  • Opt-outs, NAI and TACO

    // Google/Doubleclick
    ".doubleclick.net" : [ { path: "/", name: "id", value: "OPT_OUT" } ],

• Unchecked sale of personal details
• Addressing fears - identity theft, personally embarassing revelations
  • whether to or by parents, friends, or employers, etc.
• Rebalancing needs of citizens, State and mega corporations

Tracking disclosures and data mining

• Firefox add-on observes all HTTP requests and responses
• These are logged to an SQLite database in the browser profile folder
• What data did I disclose to this site?
• Which sites did I disclose my email address to and when?
• Which sites have I used my OpenID URIs with?
• What would be of most interest to users?
• Data mining techniques, turning the tables on the ad sites

Better control over Privacy

• Good cookies and bad cookies
• Greater selectivity in blocking cookies
• Web bug sniffing
• Optional use of proxies to mask IP address
• White lists, P3P and beyond
• Importance of machine interpretable policies
• HTTP Link header, safe zone, and privacy enhanced search
• Aggregating information about web site practices

Right to subject access

This EU right allows a data subject to be informed of the information held about them and to discover to whom it has been disclosed. The request for access must be made in writing (including fax and email) and an institution must respond to the request within a period of 40 calendar days.

• Surely, we can do better than paper mail, fax and email?
• Websites could provide an online means for users to exercise their right to be informed of the information held about them, etc.
• Necessitate some form of authentication to ensure that only legitimate requests are handled
• Cost to an institution for handling requests could be further reduced by using some kind of semantic model of personal data and a standard way to query for it
• Such an interface could then be used by a privacy dashboard to facilitate users wishing to view the personal data that is held on them by different organizations and to make any necessary corrections
  • Legal right to correct errors in PII but not to delete it except when unlawful use can be proved

Personal Dashboard for the Social Web

Liz Ganne's blog "My wish for 2010"

• Privacy: a better idea of what's publicly known about me
• Analytics: checking my stats and trends as a content publisher

This led me to Knx.to, a web app using OAuth to access your profile and social contacts on Twitter, facebook, LinkedIn, Flickr, GoogleMail and Yahoo! Mail.

• The app makes it easy for you to log into each of above sites and grant knx.to temporary access to your personal information
• This is stored locally on your browser and not on the Knx.to site
• Provides a proof of concept for how a privacy dashboard could access your social websites and present information about specific friends.

Possibility of 3rd party dashboard extensions (dashboard apps).

Notifications

• Privacy Policies may include obligations to notify the data subject when various events occur, e.g.
  • when personal data is used for specific purposes
  • When personal data is passed to third parties
  • when personal data is deleted at the end of the retention period
• Paper and Email may not be the best way to deliver notifications
  • Easy for data controller, but inconvenient for users to manage lots of notifications
  • May be perceived as "spam"
• Possibility for including notifications as part of the Dashboard
  • Integrated with data track UI for holistic view
  • User preferences for controlling when UI signals new notifications
  • Notifications sent via web service to agent acting on user's behalf
  • URI for this is provided by user along with her personal data

Identity Management and Credentials

• OpenID and email addresses popular with websites as identifiers
• But provide yet another way to track users across the Web
• Identity manager can help users to fight back
  • Choose whether an identity is for this session only, for this website only or whether it is shared across selected sites according to your needs
  • Browser remembers your choices and manages things accordingly
  • No need to have to remember and type user name and password
• Use of credentials as alternative to typing in personal details
  • Credentials generated by trusted 3rd party
  • Credentials generated by trusted smart card (id cards)
  • Signed against session id, and no need for user name/password
  • Disclose your identity provider, but not necessarily your own identity

Support for Credentials

A simple credential system

• Website X trusts identity providers who have valid certificates from example.com
• The web page from site X includes metadata stating
  • example.com is a trusted certification agency
  • requirements on which properties need credentials
  • the session id that the credential needs to bind to
• Dashboard recognizes the metadata
  • Checks if user's identity provider has matching certificate
  • Asks user for permission for the identity provider to generate a credential for the requested user properties
  • Passes an authorization token to website X enabling it to get the corresponding credential from the identity provider

Locally Generated Credentials

• Smart card issued by trusted party, e.g. national government
• Holds list of attributes, e.g. your age, address, drivers license, ...
• Generates credentials on selected attributes as needed
• Can make use of advanced crypto, e.g. zero-knowledge proofs
• Greater privacy than with dynamic generation of credentials by remote party

Planned proof of concept using IBM's Idemix smart card

Privacy and the Cloud

• Cloud as a safe haven for our personal data
• FCC plans for oversight of identity providers
  • FDIC for data banks?
• Mozilla Weave example
• User agents in the cloud, moving beyond OAuth
  • server-based apps running 24x7 on behalf of users
• Impact of the Web of Things
  • identity, privacy and trust in a World where everything is interconnected and the Web reaches out into the physical world of sensors and effectors

Hybrid approaches

• Use of smart card (SIM cards) for partial identities
• Cloud holds encrypted personal data, but not the keys
• Retrieval of personal data from cloud, client-side decryption
• Legally binding machine interpretable site policies on handling of personal data
• Client-mediated site to site disclosures
  (client encrypts personal data with target site's public key)
• Data mining for assessing risks of linkability

Closing Remarks

• Web dominated by tiny number of mega-corporations
  • Likelihood of abuses by monopolistic powers
  • Or laziness on behalf of websites, e.g. limiting who they will accept as identity and credential providers
  • Broadening trust through legal mandates, audits, certificate chains
• Public debate on redressing the balance
• Empowering people to manage their privacy
• Demonstrators as precursors to further legislation
• Global challenges for the Web
  • National approaches are weak when the world is just a click away
  • International agreements needed akin to Berne Convention on copyright
• Rebalancing needs of citizens, State and mega corporations