Petnames: A humane approach to secure, decentralized naming

The existing design of domain names does have one important property, though. When someone successfully registers a name, they're guaranteed that they can pay a renewal fee - small, all things considered - and keep the name as long as they want - perhaps modulo legal and ToS concerns. This gives them assurances that they can invest into the branding of the name and keep the benefits.

Compare that with search engine results. I mentioned elsewhere in this thread that I watched numerous non-technical users treat their browser nav bar as a name resolution mechanism - effectively delegating name resolution to their default search engine. Search engine results should change over time. If someone starts a FooBar Inc. in one industry, and someone else starts a bigger FooBar Corp. in another, who gets the "foobar" name?

A sort of "pin on first use" would save existing users of FooBar Inc. New users trying to find FooBar Inc. might get confused though. FooBar Inc. would understandably be hesitant to print the "foobar" petname on their business cards and billboards.

In WhatsApp, when you join a "community" (sort of like a giant, moderated group), all members of the community are visible to all other members. You can see their phone numbers and their self-chosen nickname. Note that very frequently people will have their names or a shortened version of their name as their nickname.

In emerging markets, people use WhatsApp for everything and many people will naturally join a few communities. Things like:

- A community for your kid's school

- A community for your neighborhood's safety alerts.

- A community for a club or hobby.

So a scammer's workflow is as follows:

1. Infiltrate a community or a group.

2. Check all of the members and find those whose names are publicly shared or you can deduce.

3. Use their name, phone and--crucially--information about the community itself to craft a targeted phishing phone call.

Example:

Sandra is a part of a community for neighborhood safety news. The community is called "Hillsborough safety." Her whatsapp nickname is "Sandy Williams."

A scammer will join the community and see her contact. They will then call her with a message like "Hi, is this Sandra Williams? Yes, I'm calling from the Hillsborough police department. Unfortunately there's been an accident with your husband...".

You can imagine how the simple fact of knowing someoen's name and some sort of "proprietary knowledge" (they know I live at Hillside!) can be enought to for a victim to lower their defenses.

An additional layer to this is that often the scammer will social-engineer their way into gaining access to the victim's Whatsapp account itself. They can then access all of the groups that victim was a member of, including "tight" friend groups, etc.

IMHO contact broadcasting is an inexcusable design decision by WhatsApp.

There is an example of moderation: the bizdir business directory. This is really useful, since Dr. Jane Nym is able to find an explicitly trusted contact for Pizza Piano. The problem is that she isn't able to implicitly share either the contact itself (Pizza Piano) or its source of trustworthiness (bizdir) with Ben Bitdiddle. In practice, this forces Ben to fallback on Caller ID, which is precisely the system we intend to replace!

This is the failure of moderation in decentralized networks. Traditional moderation is founded on authoritative hierarchy, which is exactly what decentralization removes from the system. To replace it, we need a decentralized alternative to moderation. I propose curation: each user curates their list of trusted contacts, and publishes it as a list of attestations. The bizdir business directory could actually be a good example of this, so long as we clarify some particulars.

Consider "bizdir" as a participating user of the decentralized network. The bizdir user has published a list of attestations, including the contact for Pizza Piano. There is an opportunity here for Dr. Jane Nym to replicate bizdir's attestation of Pizza Piano, thereby solving the problem for Ben Bitdiddle without requiring his involvement. When Dr. Jane Nym calls Pizza Piano, she is implicitly validating it as a genuine contact. Why not make that explicit? At the end of the call, her petname/contacts app may ask if she trusts the number she just called; or she may have it configured to do so automatically. If she ever finds a reason to distrust the Pizza Piano contact, then she can tell the app to publicly attest her distrust.

So what's the difference here? Isn't bizdir functionally identical, whether presented as a curating user or an authoritative moderator? The difference is that, as a curator, bizdir is explicitly redundant. Ben Bitdiddle doesn't need to interact with bizdir at all. He can benefit from it secondhand via Dr. Jane Nym's redundant "bizdir => Pizza Piano" attestation. On top of that, the validity of Pizza Piano's contact info has been attested to Ben twice, which can only help to drown out any potential outdated or fraudulent Pizza Piano listings. This pattern can feed back into itself, such that Dr. Jane Nym would never have actually relied on bizdir alone as a source of trust, because many of Pizza Piano's customers will have already publicly verified the same attestation.

---

The utility of curation can extend anywhere we expect moderation. The greatest struggle for decentralized social networks is that they are immediately overcrowded by taboo content. Anyone who has been banned from traditional moderated platforms will try to build their home on your decentralized one; after all, one of the core features of decentralization is the circumvention of censorship. The problem is that most of the content that gets banned from centralized platforms is content that the average person is genuinely disinterested in. Just because we want to welcome free speech, doesn't mean we want to spend our time reading hate, watching trauma, or arguing with bullshitters. In order to make a space where regular people willingly participate, we must give users equal power to not participate. We can accomplish this with curation.

Essentially, curation is a shift in strategy. Rather than demanding everyone accept the blatantly false attestation, "this content does not exist" (a moderator ban), we can collectively attest, "this content is garbage", and get back to sharing the rest.

That's a critical implementation detail, but I think it can be done. All we need to do is make contact-sharing an explicit feature.

> But that's essentially re-inventing social networks with a narrow focus.

Yes it is. That's the utility of decentralized networks: by removing the hierarchy from the network, we have removed the explicitly drawn context. Instead, the context is implicit and flexible. There are pros and cons to this feature. Instead of segmenting "twitterverse", "facebookverse", etc.; we simply have "the universe". The same boundaries can be replicated, but the lines are drawn by the users instead of by the platform, all while preserving compatibility across those lines.

My answer to this change is to replace moderation with curation. I get into this distinction more in my comment here: https://news.ycombinator.com/item?id=42238201

As far as privacy in curated networks goes, I think we could find some interesting strategies to accomplish it. One could be anonymous pseudonyms: publish the attestations you don't want traced back to you as an explicitly not-you user. Another could be attestation laundering: provide a publicly available user (that anyone can use) that publishes a collection of attestations as if it was the original publisher, and let collaborators vote on that user's overall validity via attestation.

Essentially, we must contend with the inverted hierarchy that decentralized networks are made of. It's definitely a change, but I think can provide a lot more utility than centralized networks provide today.