Real IT and fake accounts

Revision Department: Since my Backspin column of last March I have had time to reflect.

I have pondered the oneness of the Internet, the eternal packet that transcends all routers and the Zen of spam. And I have realized one crucial thing: Computer monoculture is unavoidable.

There’s no way that any real IT organization can afford to create an IT infrastructure that isn’t a monoculture. If they did so – if they created some mixture of Macs and Windows and Linux – they would go broke trying to keep it all running.

The bottom line is that standards are the cornerstone of IT: The goal is based on standard applications running under standard operating systems that have standard configurations where everything can be audited and every action authenticated. That’s it. There is no other way to do it.

OK, on with the news.

A staggering number of Web sites now require you to have some kind of account with them. The reasons for this range from the site attempting to understand its readership to preventing spammers and other miscreants from loading the system with their crud and building mailing lists for spamvertising campaigns.

A new service has appeared that is bound to attract lots of attention and quite possibly some legal heat: bugmenot.com (https://www.bugmenot.com/), which uses the tag line “Common sense isn’t.”

The idea is really simple: When you enter the URL of a site that requires an account to gain access, bugmenot either returns an account name and password or, if an account for that site hasn’t been entered, suggests that you provide the details for one.

I tried looking up accounts for The Washington Post and several other sites and there they were, names and passwords for each that worked just fine. If this idea takes off, there will be scores of sites providing the same service, which is easy because all it requires is a simple database lookup.

Already there’s a Firefox plugin (https://extensions.roachfiend.com/index.php#bugmenot) that accesses the bugmenot database. With the plugin installed, all you have to do is right-click in a logon form on a site and have a name and password automatically filled in.

However, the consequences could be profound. Widespread use of this ploy will make site statistics and demographic analyses even more error-prone than they already are.

So what could site owners do? If they are brave, they could start using credit card verifications in much the same way the pornography community uses them for age verification. The downside of this is that there’s a huge cost and liability associated with storing credit card details and verifying them.

Site owners could start mining the account swapping sites and blocking the exposed accounts. Of course, the swapping sites will up the ante by making mining them require human beings to gain access.

But the tools could get even more interesting. Imagine combining a free utility such as Roboform (http://www.roboform.com/) with a distributed peer-to-peer version of the bugmenot database and you’ve got a major assault on the value of Web registration systems.

What this whole story illustrates is the growing tension between consumers and content providers. Consumers will accept the conditions on your offerings as long as they see value. When that value is not apparent, they view the conditions almost as an insult. They then do one of three things: They don’t bother to sign up, they sign up but with bad feelings, or they go out of their way to lie when they sign up.

The current generation of Internet consumers appears to favor signing up with bad feelings. The next generation will, I believe, be far more ready to use tools like bugmenot. The challenge for Web sites is to either offer real value or forget about collecting personal data when they don’t need it.

Real IDs only to backspin@gibbs.com.