Comments on: Granular Privacy Control (GPC) http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/ More than just a blog. Fri, 18 Jul 2008 22:35:50 +0000 http://wordpress.org/?v=2.6 By: Climb to the Stars (Stephanie Booth) » Désinformation en 20 secondes: Google Reader http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-364195 Climb to the Stars (Stephanie Booth) » Désinformation en 20 secondes: Google Reader Fri, 04 Jan 2008 17:15:09 +0000 http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-364195 <p>[...] brief note about the Google Reader Shared Items problem in a local free newspaper gives the impression that Google is sharing all subscribed feeds with our [...]</p> [...] brief note about the Google Reader Shared Items problem in a local free newspaper gives the impression that Google is sharing all subscribed feeds with our [...]

]]> By: Olivier Tripet http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-355834 Olivier Tripet Thu, 27 Dec 2007 09:06:59 +0000 http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-355834 <p>Steve Rubel proposes a solution: <a href="http://www.micropersuasion.com/2007/12/how-to-share-it.html" rel="nofollow">http://www.micropersuasion.com/2007/12/how-to-share-it.html</a></p> Steve Rubel proposes a solution: http://www.micropersuasion.com/2007/12/how-to-share-it.html

]]> By: Stephanie http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-354790 Stephanie Wed, 26 Dec 2007 11:32:45 +0000 http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-354790 <p>I have the impression that if you can tag people (ie, create "easy" lists like that) and then define access rights per tag ("relationship status on Facebook: not for people tagged 'co-workers'), it shouldn't be too cumbersome. People who want to make it complex can make it complex, and people who want to keep it simple can keep it simple (maybe with some help from the system).</p> <p>Do you think this is already too complicated for most people to use?</p> I have the impression that if you can tag people (ie, create “easy” lists like that) and then define access rights per tag (”relationship status on Facebook: not for people tagged ‘co-workers’), it shouldn’t be too cumbersome. People who want to make it complex can make it complex, and people who want to keep it simple can keep it simple (maybe with some help from the system).

Do you think this is already too complicated for most people to use?

]]> By: blacky http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-354773 blacky Wed, 26 Dec 2007 11:11:04 +0000 http://climbtothestars.org/archives/2007/12/26/granular-privacy-control-gpc/#comment-354773 <p>This really reminds me of the permission troubles Unix had (rather has) a few years ago. It turned out, that the classic model (user, group, everyone else could each have read, write and execute rights) works for about 90% of the cases. With some hacks like the so-called sticky bit, it extended to 95%. But due to other limits (the user can only be in so many groups) it doesn't work for everybody.</p> <p>So the powers that be invented ACLs, access control lists. This way, you can nearly reach 100% (I think it's matematically provable that can't reach 100%). Anyway, this turned out to be nice and all, but people didn't use it - they used classic permissions 90% of the time and were unwilling or unable to learn ACLs.</p> <p>Bottom line: fine-grained access control for anything, be it files or personal info has to always keep in mind that it must be easy and straightforward to use. What good is a security feature that nobody uses?</p> This really reminds me of the permission troubles Unix had (rather has) a few years ago. It turned out, that the classic model (user, group, everyone else could each have read, write and execute rights) works for about 90% of the cases. With some hacks like the so-called sticky bit, it extended to 95%. But due to other limits (the user can only be in so many groups) it doesn’t work for everybody.

So the powers that be invented ACLs, access control lists. This way, you can nearly reach 100% (I think it’s matematically provable that can’t reach 100%). Anyway, this turned out to be nice and all, but people didn’t use it - they used classic permissions 90% of the time and were unwilling or unable to learn ACLs.

Bottom line: fine-grained access control for anything, be it files or personal info has to always keep in mind that it must be easy and straightforward to use. What good is a security feature that nobody uses?

]]>