Why Every Website Knows Too Much About You

Welcome back developers and web trotters! Today I want to talk a bit about authentication online. This topic is very broad and comes in many flavors. That's why I've elected to just focus on your run of the mill, vanilla authentication methods for this post. But don't worry, more niche and better solutions will be covered in the fututre.

why do we need authentication?

Now, this might seems obvious to all of us but seeing how a thing started, what it was solving, and how it evolved helps me identify flaws and pain-points with modern itterations. Now, I'm not gonna go into a full history lesson but I do want to go over some changes the basic username and password combo went through and why they might have happened. So, the username and password auth idea predates the internet. This is probably not a big shock to most of you since computers existed and were heavily used bore they could connect to it. Usernames were a way for a system to distinguish different operators using the machine. To these usernames could be granted different permisions and the system could log activity admins could see who had performed certain actions based on usernames. The password was just a way for the systems to enforce the restraints and permissions onto a operator. A password made sure a user could only do their permitted actions because they only knew their own password.

Staying in touch

Now the need for authentications is well justified, even nowadays. The internet however, adds a new need to systems. The need for connection. With the internet computer were able to communicate. This connected not only computer with other computer, but also businesses with customers. Forums, chat sites, and email allowed us to reach out to anyone near instandly. Many of these services started to introduce profiles. A profile allowes users to compile info about themselves in a fun and engaging way. It allowes users to get to know eachother better or find people with similar interests without having to interact all that much. It's an fun enrichment of an online identity and it got adopted everywhere. Businesses and services always evolve to the user's needs, and the popularity of profiles didn't get ignored. Nowadays a profile and authentication are almost inseperable. But in my option, this entanglement of auth and profiles is one of the biggest missteps for online authentication and privacy.

Why businesses like profiles

For businesses, profiles had some cool benefits. From some basic thinks like, sending a coupon as a birthday wish to being able to adress customers by there names in messages directed to them. But it also allows them insights to demographic and other more personal information allowing them to target users more specific and finding ways to track and abuse our behaviour online. Modern services still use public profiles, but hidden profiles filled with data collected thoughout your web trot are where the real money lays for businesses. Which makes it difficult to see what they track and what that data is being used for. Terrible for online privacy and transparency.

Do we need usernames?

Now, another misstep in inline authentication evolution is the replacement of usernames. Everyone has probably noticed it. Sometime in the last decade we stopped signing in with usernames and started using email or phone numbers. Now, on some level this evolution makes sense. A username is a unique identifier, and so are emails and phone numbers. Especially since businesses would also for these after sign up anyway. However with this transition a liberty that users had started to vanish. Before this shift users were able to sign up and use the services without having given away any personally indentifiable information. Now, the case for swithing to email is stronger than phone numbers. Because without an email, a business has no way of reaching a user. Of course they could build a communication system into their service but this would take a lot for a company to set up, especially smaller businesses. And make no mistake, this communication is usually very beneficial for both sides. There is another reason for the move away from usernames, though. Businesses started to experience quite a bit of robot traffic to their services. This caused a bunch of problems. From review/view botting to scalping. So, by intertwining authentication with a basic profile, they were able to deal with this robot traffic better. By forcing accounts to have a email or phone number they were able to significantly decrease the "fake" users. But did it really have to be an email or phone number? It's such a decrease in privacy that I don't believe it worth it for users. For businesses, these choices are very logical. But for users it led to exposure to spam and phising, even deeper insights into users thanks to country and region codes in phone numbers, and this identifying data is stored on the business's server which might not be as secure as we hope.

So, are we screwed?

Authentication didn't evolve around user privacy. It evolved around business convenience. Email addresses became usernames because they solved multiple problems at once. Businesses could identify users, communicate with them, recover accounts, and reduce spam. This all with a single piece of information. The question is whether that's still the best trade-off today. In my next post I'll look at what an authentication system designed around privacy might actually look like. Thanks for reading!