Decentralized Identification

"The reason cryptography is not in constant use in representing trust on the Web is that there is not, yet, a weblike, decentralized infrastructure."

   -- Tim Berners-Lee in "Weaving the Web"

The WWW is already tantalizingly close to providing a decentralized infrastructure for representing trust. Through the use of prose and hyperlinks, humans can express highly refined trust relationships between entities on the WWW. For example, "I've completed several satisfactory transactions through e-gold." Accurately expressing these relationships is one of the primary aims of human language. Software agents can similarly express trust relationships using their equivalent of prose, the application protocol.

Reliance upon the DNS is the stumbling block that prevents these trust relationship languages from achieving the "weblike, decentralized" qualifier. This point too was noted by Tim Berners-Lee in "Weaving the Web":

"For all its decentralized growth, the Web currently has one centralized Achilles' heel by which it can all be brought down or controlled."

When you dereference a URL, the keepers of the DNS and PKI determine which web server responds to your request. To make the WWW a "weblike, decentralized infrastructure" for representing trust, we need a way for WWW entities to directly link to each other. YURLs, such as httpsy URLs, enable linking without indirection through centralized authorities like the DNS or PKI.

Since referring to other entities is such a common task, its mechanisms are often overlooked. Many also assume that the vagaries and failings of existing identification mechanisms are intrinsic to the task and therefore inevitable. These assumptions are often wrong. For example, the "phishing" attacks that currently plague the WWW are not intrinsic to online communication; they are a symptom of a poorly conceived identification mechanism (see Trust Management for Humans). The documents presented here explore what referral is, and how the WWW can be adapted to do it well.

White papers

• Schneier's PalmPilot
• Naming vs. Pointing
• An Introduction to Introduction
• What Does the 'y' Refer to?
• Things that are Similar to YURLs
• Why Use YURLs?
• Trust Management for Humans
• Frequently Asked Questions
• W3C workshop paper "Petname Tool: Enabling web site recognition using the existing SSL infrastructure"

YURL schemes

For objects

In these schemes, the introduced subject is an active computing agent.

• cap specification (The E Language VLS)
• httpsy specification
• opencm specification

For files

In these schemes, the introduced subject is a bit-string.

• bitprint specification
• mnet specification
• sha1 specification
• tree specification

Implementation

Server

• Waterken^TM Server

Client

• Waterken^TM java.net.URL client

Application

• Petname Tool for Firefox
• Waterken^TM Browser

Redirectories

• yurl.net

Related news stories

• Steps that you can take to help identify and to help protect yourself from deceptive (spoofed) Web sites and malicious hyperlinks
• FTC Consumer Alert: How Not to Get Hooked by a Phishing Scam
• Gartner: Phishing on the rise in U.S.

Discussion

• cap-talk mailing list

Copyright 2000 - 2006 Waterken Inc. All rights reserved.