Tag: security risks

Open API’s: Good for Syndication. Bad for Safety?

Posted by – February 18, 2010

Unearthing Another Reality

I’m usually not focused on writing about breaking news but being a regular user of Foursquare and then watching all the press and online noise yesterday about PleaseRobMe.com, I really started to think about open API’s, their possibilities, the good, the bad, and the bigger picture. While I’m not necessarily offended by what the PleaseRobMe.com guys have done (after all, we all have access to that data), it does remind us how a little creativity + ingenuity + behavioral data = influence. Regardless of how truthful or how it’s spun, we can essentially do whatever we want. I think the PleaseRobMe.com dudes used humor to reveal how ridiculous our assumptions are that we can just use all these tools so lackadaisically and believe that nothing bad could come of it.

It’s Just Data, Right?

There is a data collection procedure that they have done with small children when it comes to their exploratory behavior. I saw it on Discovery Channel years ago but I haven’t found a photo, video or article on it online yet. I will link out to it when I find it, or better yet if you know, send it to me and I’ll append it to this blog post and credit you with the find.

Basically, they would put a toddler in a big playroom full of toys. There would be a camera overhead in the center of the room. The child would also have a small concentrated red light affixed comfortably and safely to the child’s back on his/her shirt or overalls. For about an hour or so, as the child ran back and forth doing things, playing with different toys, hitting several different areas of the room every minute, the camera would capture the patterns of the child’s movements over a specified amount of time, drawing it’s movement patterns for the camera. Child psychologists would then analyze this crazy light pattern of movement to better understand attention spans and other developmental characteristics during playtime.

I think apps/sites like Foursquare are collecting the same type of data about adults and probably tech savvy teens too. I have two teenagers that are under my guidance with their data-enabled phones but it’s a little unnerving to think about how much easier it is now for the underbelly of society to learn about them. I’m not much of a conspiracy guy but there are some evil (and intelligent) mofos out there that see this kind of data as the framework for their silver platter of chaos that they can feast on to their heart’s content. API = Open book.

We Are A Giant Research Project

Think about all the sites and online tools that we love. Think about all those sites and online tools that we love and interact with often through multiple means that have open API’s. Think about the amount of data we are giving them about ourselves, friends and family. Just like when an MRI creates a 3D image scan of your noggin by collecting data, these types of sites are doing the same with your behavioral patterns and those you associate with. The funny (or odd) part about all of it is that we are voluntarily (and excitedly in some cases) providing this information to whoever wants access to it for whatever reason. More interesting is the fact that we are connecting apps like Foursquare to our Twitter accounts, which we sometimes connect to our Facebook accounts and other publicly available accounts like Tumblr, Identi.ca, etc.

Foursquare was designed to be a fun way for us to keep track of where are friends are (hopefully only the ones we truly trust), incorporating the fun/reward factor with badges, mayorship, etc. If you are diligent about using the app, it also is giving people an idea of what your daily routines are, good, bad, ugly and indifferent.

This behavioral data collection phenomenon is not just limited to Foursquare either. Think about all the areas now in which people make available data about themselves. MySpace, Facebook, Twitter, Flickr and the fairly recent wider opening of LinkedIn’s API channels can you give you all the info you need, a 95% heuristic view of a person’s life, just shy of physically hanging out with them in their own living room. If you are a social/tech guy like me using all these services, people can now know your name, your aliases/monikers used (47project for instance), your work history, your hobbies, your music interests, what you look like, your schedule, social and business affiliations and the convos you have within those circles…..all of this is pretty much excessible through API’s. They can also, after finding all that out about you, wormhole into your friend’s lists and find out all of those exact same details about them if they’ve posted it anywhere online. This is a really gnarly concept. The gnarliest part about it is that we are feeding it by choice. It’s not all bad but there’s awareness and responsibility that comes with the use of all these cool apps and sites.

Mindfulness

If you are like me at all, waiting hungrily on pins and needles for the next new social app phenomenon to grace your news feeds, so you can be the first to slam it onto your Blackberry, iPhone, or Android, plugging in your login creds, getting on yet another grid, remember that the more of these sites and apps you use, and the more info you choose to reveal about yourself publicly online, should be kept proportionately equal to the amount of vigilance and proactive awareness you should have about the possibilities of your data being used and/or misused.

Other Great Articles on The Subject

ZDNet: Please Rob Me: Ethical or not? [poll]

Mashable: Are We All Asking to Be Robbed?

CNET: The dark side of geo: PleaseRobMe.com

Information Week: PleaseRobMe.com Solicits Social Theft

Onward.