FaceTrust: assessing the credibility of online personas via social networks

The success of the Internet has significantly changed how people interact with each other. Rich social interactions nowadays take place online. Users read, shop, chat, work, and play on the Internet. However, unlike many social interactions in the physical world, the Internet has largely hidden the identity attributes of online users. “On the Internet, nobody knows you are a dog,” says the famous Peter Steiner cartoon. While anonymity has brought much benefit, including protecting user privacy and free speech, it also poses considerable security threats to online activities. What to believe and whom to believe on the Internet remains extremely challenging. Naive users may easily become victims of online scams by individuals that hide their real identity. There have been numerous incidents where scammers defrauded users [1,6] through email or online social networks. Users with vested interest in a company have been caught creating fake positive reviews for the company’s products or services [5]. Pedophiles and underage users may lie about their ages during online chat sessions and to gain access to age-restricted sites. This problem largely stems from the fact that there is currently no lightweight and effective way to verify the identity attributes (such as age and location) of online personas. The typical approaches for establishing online identities involve offline manual verification of users. For instance, a bank may require a user to bring a government-issued ID before opening an online account. Additionally, users may purchase digital certificates that are verified and issued by trustworthy authorities such as VeriSign. These approaches, albeit effective, are heavyweight and often an overkill for many online interactions. Manual verification is slow and costly. It can become the bottleneck that prevents an online service from scaling to hundreds of millions of users. In addition, strict user authentication typically controls access to sensitive or critical resources such as bank accounts or internal networks. Instead in many realistic Internet settings, services or users do not require strong authentication, yet they may benefit greatly from partial or likely-to-be-true user identity information. For example, it suffices for an age-restricted site to know whether a user belongs to an age group, not who the user is or his exact age. Similarly, an online dating service user may desire to know whether another user’s location or profession information is likely to be credible before initiating contact. These examples motivate the design of FaceTrust, a system that enables online personas to cost-effectively obtain credentials that verify the credibility of their identity statements. In this paper, we refer to credibility as a measure of the likelihood that a user’s assertion is correct or true. FaceTrust achieves this goal by mining and enriching information embedded in Online Social Networks (OSNs), and extends an OSN to provide lightweight, extensible, and relaxed digital credentials. We observe that OSNs already allow users to express a limited form of trust relationships using friend links. We propose to extend this ability by allowing users to tag how credible they consider their friends’ assertions, such as the identity information they post on their profiles. This process is similar to real-world background check employed by government agencies but is greatly automated by using online social networks. As an example, a user that wishes to obtain an age certificate from his OSN provider may post on his profile that he is above 18. The user would request from his friends to tag his assertion as true or false. The OSN provider would analyze the annotated social graph to obtain the credibility of the user’s friends and subsequently compute the credibility of the user’s assertion. It would then issue to the user a credential in the form of {assertion, credibility}. Online services or users could use this OSN-issued relaxed credential to inform their interactions with the user. We face several main challenges in realizing the above vision. First, how can the OSN reliably verify assertions made by users (§ 3.1, § 3.2, § 3.3)? Second, how can an OSN provider export the credibility information of assertions to verifiers without violating a user’s privacy (§ 3.4)? Lastly, how can we evaluate the effectiveness of our design (§4)? The main body of this paper describes our initial approaches towards addressing these challenges. We begin with a high-level overview of FaceTrust and several of its motivating examples.