The first issue is the most serious one. Imagine that the domain name registries found a way to have non-unique domain names, by somehow redirecting them to the original names. In fact, something like that was actually introduced when Unicode domain names became standard. Since some browsers, depending on the country (but usually on English-speaking countries) are probably not configured to accept Unicode domain names in the URLs, the trick is to use a short redirect code (like bit.ly for example). Most countries that have accented characters in Europe will apply to the Unicode name the same guidelines: i.e. you have to present proof of ownership of a name (either it’s a trademark or a company name) to be allowed to use this feature, so the problem is minimised (trademark regulations long since have dealt with this problem in those countries). But sometimes there is no other alternative but litigation, when the domain names are actually differently spelt but look visually similar, a process known as homograph spoofing. An example: at first glance, looking at the following two domains, which one links to a popular software development company? rnicrosoft.com and microsoft.com (click on them to find out!).
When your business depends on customers correctly identifying your brand name, you have to make sure the brand name is unique and is (theoretically) hard to spoof. We all remember how aggressive LL was a few years back about their own trademarks, and pretty much wiped out most (if not all) illegitimate uses of their brand names in resident websites, products, and services.
Now imagine how easily Display Names will be exploited in Second Life. Consider the picture illustrating this article. What prevents anyone from using CopyBot to get my full avatar & shape and use “Gwyneth Llewelyn” as their display name? A LL representative might say, “well yes, but the username will be different, and yours will remain gwyneth.llewelyn and will be easily verifiable by other residents”. Oh really? What if someone simply registers a username of gwyneth.llewe1yn? Visually looks pretty much the same, doesn’t it? (Even I had to check twice on my screen to make sure I hadn’t just copied & pasted, but changed one of the lowercase Ls to the number 1)
So a combination of CopyBot and homeograph spoofing can pretty easily ruin someone’s reputation in a pinch. LL guarantees they’ll be alert to Abuse Reports regarding Display Name spoofing, but the truth is — and you can see their attitude on the official blog post announcing Display Names — that they don’t think this will be really abused. They are still stuck to the IRC/chatroom mentality, when the joke of using the same nickname easily gets old. They’re right — it does. However, Second Life is not only about joking and chatting. It’s still about resident business and a thriving economy, and we’re talking US$ 0.6 billion here, not a handful of coins. Making a fake account to tarnish a merchant’s reputation, or copy their content but appear to be legitimate when selling it, is a serious problem that requires addressing. Linden Lab made it quite clear that they will not pro-actively prevent things from happen, just deal with abuse reports.
Perhaps they’ll revert their position when someone registers the philip.1inden account and starts impersonating their CEO.
Of course, insane people like me have trademarked their avatar names (and additionally I’ve registered it as a legitimate literary pseudonym, which will cover copyrights as well). But registration doesn’t mean automatic protection. It just gives me an extra edge in litigation. If the moment LL introduces Display Names, a malicious group of residents poised to ruin my reputation register 5,000 avatars with usernames similar to mine and Display Names exactly like mine, and starts spreading havoc around, specially if those avatars come from all over the world (meaning: different jurisdictions to file trademark lawsuits — my own trademark doesn’t cover many countries, because world-wide trademarks are very expensive), I wouldn’t be able to afford litigation against all of them. Probably, right now, I might not even be able to afford litigation against one, if it were someone outside my country! The best I could do is to file DMCA claims, which LL accepts, combined with an Abuse Report on grounds of illegitimate impersonation (which apparently is still mentioned in the ToS). After a year or two, I might have managed to track down all those 5,000 culprits… while, of course, in the mean time, 5,000 new ones would pop up every day.
Now of course I’m a bad example, because I’m not a huge landowner, merchant, or live musician, and my reputation is limited to a small circle of business contacts, who would obviously contact me through other ways. I can afford that residents search for “Gwyneth Llewelyn” (correctly spelled and with no homeography spoofing!) on the in-world Search and find 5,000 avatar profile entries, all looking exacrly the same, and not knowing which one is the real Gwyn. If the reason for the contact is legitimate, they would find alternatives — email, for instance, or looking me up on the many social/business networking sites. But what about the dozens of thousands of content creators and business owners in SL, that have established their avatar name as a brand name, and rely on unique identification, visually and on Search, to make business? How will they deal with hordes upon hordes of malicious residents spoofing their names? Also remember that the inherent complexity of the system will work against residents that are in a hurry — figuring out the many key click combinations that reveals the username (and copying and pasting it to a separate window and applying a different font to see if that’s the real username or just a homeograph spoof) is not really suitable for casual shoppers. In truth, you might never again know if you’re really buying from the legitimate seller any longer.
Over time, it will get even worse. Right now, the 20 million registered users will all start with Display Names as they are, and usernames of the form FirstName.LastName. So for a while at least you’ll be able to do some checking. But from next year onwards, a large part of the SL resident population will have completely different usernames — e.g. james1234 for instance — and use as their Display Names (and shop brand!) something like Crafty Designer. Among a thousand entries for Crafty Designer, all looking the same, all having completely different usernames, how cana resident “know” that the legitimate username is, in fact, james1234, and not someone else? Imagine that people actually claim that on the profile: “Customers, be warned of spoofing, my legitimate username is james1234” Well, all the hackers have to do is to copy the exact Profile information but just change the “legitimate username” as “proof”. The point is, you will have absolutely no way to know any longer who is the legitimate owner of a brand or a shop — unless, of course, you go out of SL to do some extra checking. However, what will you do if your favourite fashion designer in SL just has a site in… Japanese?
Linden Lab, to avoid this problem, could have implemented two suggestions. One, that they already have rejected, and which would neatly solve the problem, is that the system could automatically block Display Names set to someone else’s username. That would, by far, be the better choice, and one that would fix all issues about spoofing except homeograph spoofing (note: there is a resident called Gwyneth Llewellyn [note the extra L] in SL, who is not me; she doesn’t use her account frequently, the last time we chatted was two years ago, but I’m quite aware that she gets a lot of IMs and notecards that are meant for me — since I often get complaints that “I never reply to IMs”. There is nothing I can do about it short of filing a lawsuit against her). But we already have LL’s answer to this rather reasonable request: they will not implement it, period. The reason given was that among those 20 million registrations there are a lot of usernames for celebrities that were picked once, and they would be in an awkward position if a celebrity logs in to SL and finds they cannot change their Display Name to their celebrity name.
