FaceTrust : Assessing the Credibility of Online Personas via Social Networks

1. Michael Sirivianos, Kyungbaek Kim and XiaoweiYang in collaboration with J.W. Gan, C. Carlon and D. Jiang Duke University and UC Irvine Aug 11 @ HotSec 2009 FaceTrust: Assessing the Credibility of Online Personas via Social Networks

2. Motivation • Online world without identity credentials: • Makes determining who and what to believe • difficult

3. Outline • Why do we need a stronger online identity? • Design • Social Tagging • Assessing Credibility • OSN-issued Credentials • Evaluation • Conclusions and work in progress

5. How can Identity Credentials help? • Trustworthy online communication: • Dating websites, Craigslist, Amazon reviews, eBay transactions, first contact in OSNs • “I work in ...”, “I am a good seller”, “My name is ...” • Access control • Age-restricted sites • “I am over 18 years old” • Malware defence • “I am a reputable software author”

6. Our Solution • Relaxed (not absolutely verified) credentials • bind an online statement (assertion) to • the probability this assertion is true • for not very critical applications, but they • can help users or apps make informed decisions • Online social network users verify their friends’ • verifiable identity assertions • OSN providers issue credentials on a user’s • assertions using his friends feedback

7. Outline • Why do we need stronger online identity? • Design • Social Tagging • Assessing Credibility • OSN-issued Credentials • Evaluation • Conclusions and work in progress

8. Design: Social Tagging • Users post facts/assertions on their OSN profiles: • “Am I really over 18 years old?” • Friends tag those facts as TRUE or FALSE • OSN-based crowd-vetting

9. Challenges: • Friends can collude and lie for each other • Dishonest users may create many fake OSN • accounts, aka Sybil attack • Our approach: assess the credibility of taggers • using a trust metric

10. Design: Assessing Credibility (1) • Advogato Trust Metric: • Attack-resistant [Levien et al., Security ’98] • Input:Graph with trust edges that indicate a trust • level X between nodes. • Output: The nodes that can be trusted by at least X.

11. Design: Assessing Credibility (1) • Advogato Trust Metric: • Input:Graph with trust edges indicating trust level X between nodes. • Output: The nodes that can be trusted by at least X. 100% trusted node 75% trusted node 25% 75% 100% 50% 75%

12. Design: Assessing Credibility (2) • Trust edges annotated with tagging similarity • between friends • #same-tags / #common-tags • e.g., if two friends have tagged 2 common facts • of the same user and agree on only one tag, • they have similarity 50%

13. Design: Assessing Credibility (3) • Use Advogato to compute the tagging credibility • (or weight) in [0, 1] of tags made by each user i : wi • Use weighted average of tags by friends iof j on • j’s assertion (dij = +1 if TRUE, -1 if FALSE) to • compute credibility of j’sassertion: • max(iwi * dij/ iwi, 0)

14. Design: OSN-issued Credentials • Relaxed credentials issued by the OSN provider: • {assertion type, assertion, credibility} • idemix [Camenisch et al. EuroCrypt 01, CCS 02] • Obtain cryptographic credential from credential authority • Prove possession of credential to verifying authority • without revealing identity • Verifying authorities cannot link credential showings • Firefox plugin based on idemix Java code • If unlinkability (surveillance-resistance) not required or • if required but the user does not mind creating multiple • credentials for the same assertion: • use simple web based credential, e.g.,

17. An Age Example

18. An Age Example

19. An Age Example

20. Outline • Why do we need a stronger online identity? • Design • Social Tagging • Assessing Credibility • OSN-issued Credentials • Evaluation • Conclusions and work in progress

21. Evaluation • How well do credibility scores correlate with truth? • Can the design withstand dishonest user tagging and • Sybil attacks? • Experimental Setting: • Honest and dishonest users make one assertion each • Dishonest users tag both dishonest and honest • assertions as TRUE • Obtain average credibility of honest and dishonest • assertions

22. The #tags per user matters • 10% dishonest • As #tags increase, honest users have more credibility • Dishonest users always have low credibility • Sybils have slightly more credibility than dishonest

23. Credibility is robust as %dishonest increases • at most 20 tags per user • Honest users always have high credibility • Dishonest user credibility not high even when 50% • Sybils have slightly more credibility than dishonest

24. Conclusions • FaceTrust is: • An OSN-based approach to identity verification: • crowd-vetting through social tagging • relaxed and lightweight credentials • Employs robust trust metric for attack resistance • Employs anonymous credentials to preserve privacy

25. Work in Progress • Need to validate our hypotheses: • That users are willing to tag • do they find tagging fun and useful? • That users mostly tag accurately • are there many honest taggers? • Facebook application up and running • we are collecting usage data, tags and social graph • Exploring other trust metrics: • TrustRank [Gyongyi et al. VLDB 04]

26. Thank You! Facebook application “Am I really?” at: http://apps.facebook.com/am-i-really Questions?