This document provides an overview of topics to be covered in a week of an online course on Web 2.0 and online communities, including privacy, terms, and identity management. It outlines the schedule for the week, noting sessions on privacy, terms and conditions, social plugins, and a special session. It also lists assignment deadlines and details the requirements for an assignment evaluating an online conference session. The document then covers issues relating to privacy policies, terms of service, types of user data collected, and challenges managing identity across multiple online accounts and services.

1. Web 2.0 & Online Communities, Summer School 2011
Day 10: Privacy, terms, & identity

2. This week (Week 4)
Tuesday (day 10):
– Privacy, terms & identity management
Wednesday (day 11):
– Social plugins & project work
Thursday (day 12):
– It’s Prajesh’s very own special day!
Miscellany:
– Wiki software upgraded
– Blog assignment 2 marks (same as last week)
– Blog assignment 3 due Friday (IRGO!)
– Project: Research almost done, page & content
started, user recruitment begun
2

3. 3

4. Blog assignment 3 (4 th February by 5:00pm)
For the last blog assignment, students will be
required to go to at least one session of
the IRGO unConference 2.
Your task is to participate at a session of your
choice (check the programme for the full range
of topics) and then critique this session.
Please feel free to include other media such as
photos etc. of the session in question to augment
your writing.
Read the unConference programme for sessions
of interest and the FAQ page for answers to
common questions.
4

5. Part 1: Terms of
privacy
5

6. TOS and privacy policies
Provided by all community‐driven websites
– E.g., Facebook, Twitter, Ning, etc.
Governs collection, storage, transfer, usage, etc.
of user data by operators (services)
Sets expectations of behaviour and
responsibilities of both parties
Users agree to adhere to TOS and privacy policy
Lays out consequences of breaching TOS or
privacy guidelines

7. How many of you just click “accept”?
7

8. Types of data collection
Mandatory personal information:
– Collected on registration
– Name, email address, password
Optional personal information:
– Identity driven
– Biography, photos, tags, location, interests, ...
Log information:
– Automatic (IP address, browser, visited pages, ...)
– 3rd party services (Google analytics)
– Cookies (file stored on your machine)

9. Google knows all
9

10. Privacy
Typically legal requirement to provide a
privacy (data usage) policy:
– e.g., privacy act 1993 NZ
Issues:
– Implicit agreement
– Jurisdictions
– Policy relating to children (min. age)
– Business acquisitions, bankruptcy, ...
– Disclosure to law enforcement

11. 11

12. 12

13. 13

14. 14

15. danah boyd says ...
“As social media become more embedded in
everyday society, the mismatch between the
rule‐based privacy that software offers and
the subtler, intuitive ways that humans
understand the concept will increasingly
cause cultural collisions and social slips.”
15

16. [Source: http://online.wsj.com/] 16

17. Facebook Like button
Used on 3rd party websites
Clicks send information to user’s profiles & to Facebook
Does not require click!
But what else: “... assemble a vast amount of data
about Internet users' browsing habits.”
Soon: ‘... for a brand or check in at a store could find
those actions appearing on their friends' pages as a
"Sponsored Story" paid for by advertisers.’
17

18. Facebook says ...
“We do not share or sell the information we see
when you visit a website with a Facebook social
plugin to third parties and we do not use it to deliver
ads to you. In addition, we will delete the data (i.e.,
data we receive when you see social plugins)
associated with users in 90 days. We may keep
aggregated and anonymized data (not associated
with specific users) after 90 days for improving our
products and services. This is consistent with
standard industry practice.”
18

19. 19

20. 20

21. UNCOMMERCIAL BREAK
21

22. Time for you to get busy
Compare Facebook and Twitter privacy policies
and answer these questions:
1. Which privacy policy is easiest to locate?
2. Which is the most onerous and why?
3. Which (if any) appears to hold user’s interests as
paramount?
4. Which service do you trust more?
5. Anything in the policies that you find especially
troubling?
6. Are there any other privacy issues that these
services can’t control?
22

23. END OF PART 1
23

24. Part 2: Identity
management
24

25. 25

26. What do people do to manage accounts?
Use the same username/password for multiple
sites
Use their browser's ability to remember their
password (enabled by default)
Don't register for the new site
Don't ever log in to the site
Log in once, click "remember me"
Click the back button on their browser and never
come back to the site
Maintain a list of user IDs and passwords in an
offline document
26

27. Other more secure methods
Store account details in a “password vault”:
– On your PC (e.g., protected by fingerprint recognition)
– In a portable USB device, protected by a strong pass
phrase
– On a trustworthy online service, e.g., mashedlife.com
Login using an OpenID account where possible
Use popular online service (e.g., Facebook Connect,
Twitter OAuth, ...)

28. 28

29. OpenID
OpenIDs are URLs (i.e., your identities)
Find a provider (e.g., MyOpenID, Yahoo, ...)
Log into any site that supports OpenID
Not overly successful

30. Facebook Connect
What happens?
– Login into 3rd party
websites
– Approve level of data
access between Facebook
and website
– See if your friends have
also connected to the
website
– Publish content to
Facebook through the
website
30

31. 31

32. The End
32