Trustbook: Decentralized Reputation System

[BrightAnarchist]

What if I wanted to use my internet name "BrightAnarchist" widely in trade, to protect my state-sanctioned identity? The trust accumulated through the usage of my internet name is real and helps greatly for trade -- for example, if people recognize "BrightAnarchist" and know that he's "trustworthy", then I've built up a useful asset (trust) into an alias. I can then sell things on biddingpond and people will trust me, and a reputation builds up.
 
My thinking is, what if I could register this alias with a public/private key pair, so that when I post on this forum -- or other websites -- everyone knows that this is the *same* BrightAnarchist that you already trust? Basically, the idea is that a name could be registered somehow with a public key and shared over a P2P network. Then, when you browse the net, forum posts (etc) could include a signature by the poster than you could verify with their public key. That way, I'm the *real* BrightAnarchist that you already trust.

Then, similar to facebook, each person could build a web of trust. By including another person in their own web (a "friend", but it would really be more like a "trustworthy/honest trader"), you could gain access to "second tier" trustworthy people. Basically, people that BrightAnarchist believes are trustyworth.

This type of system could certainly help when trading. You could even dynamically view a "Trust distance" to your own friends (that is, is this person a friend of one of my friends, or is this person 3 people away, etc).

This system wouldn't be reliant on actual scores or any centralized system. It would be distributed and anonymous. "Trustbook" or something like that

[FreeMoney]

I like.

[nelisky]

Wow, a trust linking system that doesn't require any personal data, that is freakin' awesome. Kudos to you for thinking of that

It does sound a little daunting at implementation. You mention p2p distribution, which makes it somewhat complex. A centralized, community controlled site would work too, no?

[BrightAnarchist]

Wow, a trust linking system that doesn't require any personal data, that is freakin' awesome. Kudos to you for thinking of that

It does sound a little daunting at implementation. You mention p2p distribution, which makes it somewhat complex. A centralized, community controlled site would work too, no?

Sorry dude, no way! It must be decentralized. That's the key to keeping the system alive for eternity since it would be an extremely important component to a crypto-anarchist network.

[BrightAnarchist]

My thinking is that it would operate similiarly to bitcoin -- each user would have a little client app that they run which stores a database for public key/name pairs (for the users). To friend another user, you simply broadcast a "friendship link" from your public key to theirs signed with your private key, and then everyone updates their database.

[chaord]

Wow, a trust linking system that doesn't require any personal data, that is freakin' awesome. Kudos to you for thinking of that

It does sound a little daunting at implementation. You mention p2p distribution, which makes it somewhat complex. A centralized, community controlled site would work too, no?

I like this idea a lot.  I've been trying to think along these lines too and keep getting stuck with actual implementation.  Is there a framework out there for a true centralized, yet community controlled site? Theoretically if we were to build the Trustbook, it could eat its own dog food and the most trusted members could be elected to have access to sensitive things like DB's, servers and such.  I think this would help considerably as we set up more and more bitcoin websites/exchanges/businesses, as it would give a way to both verify the trustworthiness of the owner/operator but also the authenticity of that person as well.

[jgarzik]

My thinking is, what if I could register this alias with a public/private key pair, so that when I post on this forum -- or other websites -- everyone knows that this is the *same* BrightAnarchist that you already trust? Basically, the idea is that a name could be registered somehow with a public key and shared over a P2P network. Then, when you browse the net, forum posts (etc) could include a signature by the poster than you could verify with their public key. That way, I'm the *real* BrightAnarchist that you already trust.

PGP keyservers already exist, and you can associate any identity or alias or name with a PGP public key.  Most of the infrastructure to do this already exists, and has for decades.  People PGP-sign posts to the global peer-to-peer network known as Usenet news, for example, so that you may electronically verify a poster's identity.

[BrightAnarchist]

My thinking is, what if I could register this alias with a public/private key pair, so that when I post on this forum -- or other websites -- everyone knows that this is the *same* BrightAnarchist that you already trust? Basically, the idea is that a name could be registered somehow with a public key and shared over a P2P network. Then, when you browse the net, forum posts (etc) could include a signature by the poster than you could verify with their public key. That way, I'm the *real* BrightAnarchist that you already trust.

PGP keyservers already exist, and you can associate any identity or alias or name with a PGP public key.  Most of the infrastructure to do this already exists, and has for decades.  People PGP-sign posts to the global peer-to-peer network known as Usenet news, for example, so that you may electronically verify a poster's identity.

Right, but no networked friendship / reputation system based off of this.

[nelisky]

Wow, a trust linking system that doesn't require any personal data, that is freakin' awesome. Kudos to you for thinking of that

It does sound a little daunting at implementation. You mention p2p distribution, which makes it somewhat complex. A centralized, community controlled site would work too, no?

I like this idea a lot.  I've been trying to think along these lines too and keep getting stuck with actual implementation.  Is there a framework out there for a true centralized, yet community controlled site? Theoretically if we were to build the Trustbook, it could eat its own dog food and the most trusted members could be elected to have access to sensitive things like DB's, servers and such.  I think this would help considerably as we set up more and more bitcoin websites/exchanges/businesses, as it would give a way to both verify the trustworthiness of the owner/operator but also the authenticity of that person as well.

The most important feature in 'community controlled' is, imo, trust. And trust is gained through disclosure. Think about my lottery site, I am actively preventing suspicion by providing everyone with as much information as possible, including the distribution of bets, so when I say there were 5x2nd prizes, that information can be checked against data that existed before the winning result was chosen.

On the same train of thought we could do accounts based on alias + public key, and allow people to choose their trusted parties (or untrusted, +1/0/-1). If we then disclose the alias trust linkage, I'm sure that all the smart people around here could detect suspicious movements. How could this system be broken? If I create 100 users that all trust my real user, then that user has +100, but none of the 100 fake users is trusted by anyone, so no profit there. But if my real user get trust points from the community, and I trust the 100 that trust me back, this would be slightly different, unless I don't care about who else trusts you, unless they are already in my web of trust.

But I digress, and I need to work

[FreeMoney]

Yeah, a million recommendations is worth nothing if no one you trust trusts anyone in their group.

I think a thing that would need to be learned is that while you may trust someone enough to do business or more with them you can't necessarily trust their judgement.

[Red]

You know this is what the PGP web-of-trust is right?

Trust in the PGP sense means, I have personally verified that this "public key" belongs to the guy stated in the PGP key. For varying senses of the words "personally verified".

It is quite reasonable that if I transact with you BrightAnarchist that I might sign your public key, so that my friends would know you are the specific BrightAnarchist I traded with. Even if I only know you pseudonymously.

[singpolyma]

Yeah, this sounds basically exactly like how OpenPGP works.

[LZ]

Interesting idea, but I think it would be more useful for DNS authentication.

[grondilu]

You know this is what the PGP web-of-trust is right?

Trust in the PGP sense means, I have personally verified that this "public key" belongs to the guy stated in the PGP key. For varying senses of the words "personally verified".

It is quite reasonable that if I transact with you BrightAnarchist that I might sign your public key, so that my friends would know you are the specific BrightAnarchist I traded with. Even if I only know you pseudonymously.

After some thinking it seems to me that BrightAnarchist was adressing a different issue.

PGP web-of-trust deals with making sure that a certain PGP fingerprint belongs to a certain person.

the kind of trust that is relevant in commercial exchange is not about who people are, but whether or not one can trust them to perform a transaction honnestly.  This is a different fonction, I guess.

[sirius]

This needs to be integrated with social networking to be a breakthrough product. There are existing distributed social networks, but I'm most interested in Diaspora because of its media potential and the funding they've managed to gather, from mr. Zuckerberg among others. Diaspora accounts are based on PGP, so the integration shouldn't be too difficult.

[grondilu]

This needs to be integrated with social networking to be a breakthrough product. There are existing distributed social networks, but I'm most interested in Diaspora because of its media potential and the funding they've managed to gather, from mr. Zuckerberg among others. Diaspora accounts are based on PGP, so the integration shouldn't be too difficult.

Oh, using diaspora in conjonction with bitcoin seems like a pretty good idea.

[Anonymous]

This needs to be integrated with social networking to be a breakthrough product. There are existing distributed social networks, but I'm most interested in Diaspora because of its media potential and the funding they've managed to gather, from mr. Zuckerberg among others. Diaspora accounts are based on PGP, so the integration shouldn't be too difficult.

Apparently since they released it people have gone through the code and its not secure at all.....

[tyler]

This needs to be integrated with social networking to be a breakthrough product. There are existing distributed social networks, but I'm most interested in Diaspora because of its media potential and the funding they've managed to gather, from mr. Zuckerberg among others. Diaspora accounts are based on PGP, so the integration shouldn't be too difficult.

Apparently since they released it people have gone through the code and its not secure at all.....

But its open source, so eventually if it *does* get popular it will *becomes* secure

plus you could patch if yourself if you really wanted to use it and it wasn't secure enough

btw, what does "not secure at all" even mean?

[asdf]

I suppose you want the system enable you to sign your friends public keys and then store this on the network. Cool idea, but how would you prevent spam?

Do you know about the Freenet Messaging System (FMS)? It's a spam and censorship resistant messaging system that runs on top of Freenet. It uses this trust system with "trust lists", you can trust identities and also trust their "list" on a scale between 0 and 100. Then you set a trust threshold for receiving messages from any given identity, thus preventing spam. It's pretty clever. Perhaps you could steal some ideas form this system.

[ChluNetwork]

Wow, a trust linking system that doesn't require any personal data, that is freakin' awesome. Kudos to you for thinking of that

It does sound a little daunting at implementation. You mention p2p distribution, which makes it somewhat complex. A centralized, community controlled site would work too, no?

I like this idea a lot.  I've been trying to think along these lines too and keep getting stuck with actual implementation.  Is there a framework out there for a true centralized, yet community controlled site? Theoretically if we were to build the Trustbook, it could eat its own dog food and the most trusted members could be elected to have access to sensitive things like DB's, servers and such.  I think this would help considerably as we set up more and more bitcoin websites/exchanges/businesses, as it would give a way to both verify the trustworthiness of the owner/operator but also the authenticity of that person as well.

The most important feature in 'community controlled' is, imo, trust. And trust is gained through disclosure. Think about my lottery site, I am actively preventing suspicion by providing everyone with as much information as possible, including the distribution of bets, so when I say there were 5x2nd prizes, that information can be checked against data that existed before the winning result was chosen.

On the same train of thought we could do accounts based on alias + public key, and allow people to choose their trusted parties (or untrusted, +1/0/-1). If we then disclose the alias trust linkage, I'm sure that all the smart people around here could detect suspicious movements. How could this system be broken? If I create 100 users that all trust my real user, then that user has +100, but none of the 100 fake users is trusted by anyone, so no profit there. But if my real user get trust points from the community, and I trust the 100 that trust me back, this would be slightly different, unless I don't care about who else trusts you, unless they are already in my web of trust.

But I digress, and I need to work

We agree with you nelisky that full disclosure is important for trust - that's why it is one of the foundational parts of the new type of reputation platform we are building. But we disagree with you chaord in that we think this type of system should be decentralized - no third party should have control over your reputation. Decentralized reputation is something our team has been thinking long and hard about -and we think we have found a solution. Check out our white paper at chlu.io and see what you think, would be really interested to hear your thoughts on it.

We will be posting an announcement on bitcointalk soon with more details