Personal Data

By Johannes Ernst

https://reb00ted.org/personaldata/

• 2021-06-20

  Everybody has our data ... except us

  • big picture
  • privacy

  Google has all my e-mail. (And I don’t. They merely let me access it with a browser.)

  Facebook has the list of all of my friends and what I said to them. (And I don’t.)

  LinkedIn has all of my business contacts. (Repeat after me: and I don’t.)

  Instagram has all my photos. Well, the Instagram department of Meta does. (Chorus now: and I don’t.)

  Amazon has the list of all my purchases, and knows what products I was interested in but didn’t buy after all. (AND I DON’T.)

  The list goes on.

  Does this sound right to you? It sounds quite wrong to me.

  But maybe it doesn’t matter. Things go well in this arrangement, don’t they?

  Not so fast. Let’s start with losing access to my accounts. Maybe I forgot my password and failed to reset it. Or maybe I managed to get a password reset e-mail but my primary e-mail account was hacked, and now the attacker controls my Facebook account and I don’t. Maybe Google decided to disable my account, as they sometimes do, and given that there is no appeals process, that’s the end of me and my e-mail. The end of a 20-year-long record of all important things I wrote to others and they wrote to me. In the blink of an eye, all gone, because they have my data and I don’t.

  But even if I don’t forget my passwords and I don’t get hacked and I won’t get locked out: it’s a bit like being a really unimportant guest living in a fancy hotel on a short-term lease. They can kick me out any time, and keep all my furniture and other possessions, no questions asked. Thank you, I prefer my very own home, where nobody can kick me out, or at least renter protection laws, which don’t exist online.

  We’ve got to get our data back.

  Slightly edited June 2022 for better readability.

• Longer version:

  But some of you may be interested in the longer history because all of what we do here sounds soooo deja vous:

  I’m Johannes Ernst. I accidentally fell into this entire area because back in 2004, after an enterprise customer visit, driving home in the car and pondering the web app we had built for them, I realized that what it needed was people as a first-class entity in the system, not just “data”, so each user could tell other users about themselves at a URL in a place of their liking, “see” what each other user was doing in real-time, securely identify each other with that universal cross-side username (my personal LID URL), and send/receive rich data to/from them strongly authenticated and encrypted through GPG key pairs associated with every user. Public keys were distributed straight from their personal LID URLs. I thought of it as an “identity” system which is why I called it “Light-Weight Identity” (LID).

  I didn’t have much time, and decided it should be possible to build such a light-weight identity system in an afternoon. Turned out to be a bit of a stretch, but not by much at least initially. LID V1 started with securely publishing communication endpoints (like phone numbers) and other profile data ACL-protected through public key-based auth (think HTTP Signatures with GPG keys), then we added web single-sign-on, authenticated and encrypted person-to-person (URL-to-URL) messaging with arbitrary payloads etc.

  Needless to say, it was before its time. So when OpenID V0.9 showed up on the scene, I got together with Brad, and Dave from Livejournal, Drummond and others from XRI, set my sights a bit lower, agreed on a bunch of protocols and our collaborative project grew and became the OpenID movement. We were tremendously successful in signing up most of the large internet companies at the time — and in process lost the P2P symmetry and user-centricity of early OpenID. (Which is why I dropped out of the community for a while starting ca 2010).

  A side effect was that for identifier metadata discovery web got XRD from XRI and Drummond, under the label “Yadis” (reused from before OpenID was OpenID). Which replaced my light-weight URL?lid=meta discovery and Brad’s openid.provider Link tag, with an XRDS file discoverable via 3 separate methods. Some people thought that was too complicated, and created Webfinger instead.

  In the meantime, I created a Linux distro for self-hosting (https://ubos.net/), an “App Store” for server-side apps, been selling personal cloud servers with Nextcloud-preinstalled, some IoT stuff.