new social attack vector

[dsrtao]

Let us suppose that our target, Tom, is a habitual user of an RSS aggregator. Early on Tom used the service as a fast browser selector, making filtering decisions but ultimately viewing the content by clicking the links. Soon, however, he starts reading some sources right in the aggregator. Eventually Tom relies on the aggregator for leads, filtering and the majority of reading.

Now Mallory gains control of the aggregator in such a fashion that she can insert, edit and delete stories. Tom has a high degree of unwarranted trust in his news source. I don't see any standard verification mechanisms in place for Tom to assure authenticity...

Google is perfectly positioned to be Mallory.

Comments

Prior Art

[metahacker.livejournal.com]

...is called "television news".

[dlevey.livejournal.com]

ANY news outlet is positioned, in some way, like this. As you point out, the issue is trust - do you trust your source? There are some news sources known to be biased (known by some, anyway), and to many that lessens the trust because there is distinct chance that an editorial Mallory will come along and alter the facts or the implication of the story. An RSS aggregator simply adds another layer to that already complicated news onion. Unless you are able to get all of your news first-hand, you must trust someone; it's simply a question of who you trust. A reputation helps to make the decision, but some might say that those with good reputations simply haven't been caught yet...

[sareena99.livejournal.com]

But news given first hand carries the reporter's biases. Even when we see something for ourselves we automatically run it through our own filters, don't we? For example, we see a person stumble and fall. Did he trip accidently? Was he pushed by an unseen assailant? Was he drunk or ill?
Which brings up a whole new question: is there any such thing as an unbiased witness?

[dlevey.livejournal.com]

Well, yes, and that takes it to the very extreme. A first-hand observer will see something and *know* it happened, and how - even though their own glasses colour their observations. At least that way they also *know* that no-one else's biases are altering the story.

I'd say that a completely unbiased witness is also a completely uninterested witnesses; so uninterested that they aren't really paying attention anyway. But now we're getting into solipsism.

[jducoeur]

While true, I find it hard to believe that any serious manipulation would go unnoticed for more than, oh, about ten minutes before it was all over the Net. So unless you got *all* your information through the aggregator (a possibility, admittedly, but a dumb move), you're likely to find out fairly fast.

And the reality is that Google doesn't have a particularly secure lock on this space. I've fallen into Google Reader as my principal source for tech news, but its hold there is insecure: there are a bunch of other well-reviewed options. So if they did piss people off, they could lose much of their audience with great speed.

So I'm not *too* worried about this particular danger. Frankly, it's a fair ways down on my list of "Things about Google that worry me"...

[dsrtao]

So... everyone has missed my intended point, which means I didn't phrase it properly.

Google is ideally positioned, not to influence everyone's opinions by feeding them false information, because that would be crosschecked... but to selectively poison the information source for one person at a time. And I do not think Google has a particular desire to do so, but the CIA or NSA or FBI or CID or... might well want to target people selectively.

[metahacker.livejournal.com]

Well, if you say it in a comment we mostly won't notice.

I'd had this thought. It's one reason I like LJ; it gives me a larger blob of people and opinions and viewpoints to check up on the world. It's still quite the echo-chamber, but better than just me and the news.