Distributed Private Trust

Decentralised trust and reputation system

Why does this actually matter to end users?

When we read some news on the internet, how do we know that someone we don't know is not a fake. Can we somehow distinguish between 20.000 likes for a fake "Black Lives Matter" or "Gilets jaunes" social media account created for political subversion with a pyramid of fake accounts, and a network of real humans concerned about real issues? If we get a technically valid email message with all proper technical assurances from europaa.eu from a hacker (don't worry, we claimed it), is there a proper way to distinguish it from europa.eu - a domain that has been active for nearly two decades and which has sent out billions of email messages? The answer is of course that we would need a globally scalable reputation system. And that is a really hard problem to solve.

We actually have some reputation systems in the commercial world, but these give us a lot of questions as well. What does it mean if a hotel or a taxi driver gets an average "2 out of 5" stars for their service through some online service? Will they ever do business again? How many people get blackmailed with such a threat? Who actually sets the criteria, and who vets that all the responses and numbers are real? Does a user giving a really positive valuation give it to the virtual taxi company running a website or to the individual driver? What if that driver wants to work somewhere else, or is unhappy about the policies and high fees charged the website? Can a competing website use the data?

Outside of a single context, it is hard to agree on criteria and policies for reputation. One countries political activist or dissident is another countries public enemy. A privacy-invasive commercial business that is perfectly legit in the USA may be illegal in Europe. And yet we want to be able to delegate trust and accept trustworthy information from others. The individual human brain does not scale to real-world trust knowledge about billions of people, companies and resources at internet scale. There is unlikely to ever be a single system, and if there ever would be it would be too powerful. This is why decentralised reputation systems are probably among some of the most anticipated technologies for the NGI.

Decentralised reputation would add scalability to trust delegation, which is required for any social system to scale to internet size. This is not easy, in many way. Very little is more private than the trust conveyed in others, especially when trust has been damaged but there is still a professional or social dependency. There is a taboo on saying a colleague is horrible, and should never be allowed to work with something important ever again. Yet, if that person asks, social pressure will kick in. Incoming negative trust affects outgoing trust.

If trust delegation is too naive, people will try to game the system. If you probe around a little, you will find ways online to buy likes, mentions, SEO links. This projects wants to create a mechanism that isn't so easy to game. This is a small, exploratory project that is confident it can build a first prototype. The project will use something called "secure multi-party computation" to calculate aggregate ratings without having to reveal individual users ratings to any other party.