Identity crisis!

Fun days are ahead of us, as Linden Lab rolls out a much-awaited feature: the ability to change one’s avatar name at will, just like on every other platform, and to decouple the username (which is unique in the system) from the Display Name (which is what other users will see displayed on the screen), as announced by Jack Linden on the Official Second Life Blogs last week. Interestingly enough, the amount of drama it generated was almost as bad as the one surrounding the merger of the Teen Grid with the Main Grid — over a thousand angry comments were made on that article.

And not by the same people, either, so, no, it’s not a resident conspiracy attacking Linden Lab’s latest projects. This time, the biggest complains come mostly from all sorts of content creators. And this is where the issue is: avatar names, so far, have been unique, and that meant for the content creators (remember, live music and performing weddings are content too!) that one’s reputation is closely tied to a name that is unique. Remove that uniqueness, and all of the sudden the avatar name loses value.

To explore this further, we have to see some analogies on other platforms.

Let’s start with the simplest analogy. Pretty much every social networking site out there allow a registration login — which is unique; popular ones are, these days, email addresses or OpenID URLs, which are guaranteed to be unique on all the Internet — but often a display name as well. Most services never check if the display name is unique or not; if the unique registration token is the email address, most sites won’t even display it, but just the user-created display name. Except for very ancient sites (where your username was also the display name), this is pretty much what we expect these days to happen.

Changing display names is routine — people had their laughs back in the early IRC days as everybody had fun pretending to be someone else in a room. Some IRC admins did limit this to a degree — you might need to “register” first to prevent your nickname to be used, and it was dealt out on a first-come, first-served basis. Other types of chatrooms never imposed any limitations whatsoever. To the best of my knowledge, MSN, Yahoo, AOL, Skype, Gmail don’t check what people use as nicknames (except perhaps for lists of offensive English words). This was carried over to MMOGs and virtual worlds as well. The point is that with over a billion regular Internet users in the world, nicknames, due to their nature, will inevitably clash, and restricting them is not a choice.

However, as said, some things are unique. IP addresses are unique and centrally managed for the whole Internet. Since an IP address doesn’t convey a lot of opportunity for personalisation, but are just a technical way to uniquely identify Internet nodes with a sequence of numbers, the question never arose. Domain names, on the other hand, are a completely different matter: they’re also centrally managed (at least, each Top-Level Domain has a central authority for it) and all domain names have to be unique (email addresses and URLs, building on top of domain names, have to be unique as well).

Different top-level domain (TLD) registries have different rules. Probably the reason why the .com domain is so popular (it has the largest number of entries) was its policy of handing out domain names first-come, first-served. Remember that originally the Internet was mostly academic, and even the few companies on the Internet used it for research purposes; nobody would seriously consider registering or (both as old as at least 1986) for their nodes. It was just a small, tightly-knit community, where everybody pretty much knew everybody else.

With the boom of the Internet in 1990, some rules changed. In many non-US countries, domain name registration was (and still is!) limited to companies operating in those countries, so it means that the company had to send a proof of existence to a central registry. In some cases, the central registry was a techie group, run from a Government computer lab, but still had to do the validation manually. Countries like Germany very early on implemented the registration of a domain name as part of their own governmental registries — the very same ones that were in charge of trademarks.

Indeed, throughout Europe, it’s not infrequent to see that the country’s registration authority is either the national trademark registration office, or works closely with them. The reason is that a domain name is a valuable asset: it identifies a company, product, or service, and, as such, European governments have to make sure that only the legitimate owners are entitled to use their own brands as a domain name.

The popular .com or .net domains, however, run under a different policy. The idea is that most people will not pick a trademark as their domain name, and, if they do, the legitimate owner can just simply sue to get the domain name assigned to them. So instead of domain name protection, you fight it in court. Makes lawyers more happy and deals with the issue nicely, too 🙂

Why are domain names handled so differently than the rest of the “names” on the Internet? The reason is simple: domain names are really valuable. You can take a look at the many sites auctioning domain names to see how much they’re worth. Short names are more valuable than longer ones (because people will remember them more easily). Names describing a generic product or service are incredibly valuable;, for instance, is such a good name that it was often resold… and of course I’m sure you can imagine your own examples. In fact, at some point in time, when Linden Lab started enforcing their trademark Second Life® more aggressively, there were, if I’m not mistaken, around 2,000 registered domains with “SL” or “secondlife” as part of the name. So, yes, getting a domain name that can somehow be immediately associated with a product or service that is in itself valuable, is also very valuable.

Thus, of course, they have to be unique — and in some cases, regulated.

Now let’s get back to Second Life. Sure, a lot of people are frustrated because they registered a name like “john12876 Avatar” hoping to change their name later — just to find out this is impossible to do, and that after having befriended a few hundred friends, spent a lot of money with their avatars, bought land, build things, and acquiring 20,000 items on inventory… dropping that silly name was not an option. Being able to turn their Display Name into something more sensible, like “John Smith”, is quite more interesting and user-friendly.

A lot of possibilities will also be open with this new feature. Non-English speakers can now finally use their own character sets to display their names; also, they will not be limited to FirstName/LastName but have no limitation on how many names, prefixes, and so forth you can add. You could certainly set your name as “Right Hon. William Smith, Esq.” or something silly like that — fun for the roleplayers in SL! While it might make it harder for people to figure out who is speaking, LL is keeping the ability to always check for the username (on search, profile, and object creator/owner tags), so it’s not as if you can “hide” your username away.

Two things, however, were not considered by Linden Lab. The first is what happens when two people pick the same Display Name. And the second is how often the Display Name can be changed — just once per week.

The first issue is the most serious one. Imagine that the domain name registries found a way to have non-unique domain names, by somehow redirecting them to the original names. In fact, something like that was actually introduced when Unicode domain names became standard. Since some browsers, depending on the country (but usually on English-speaking countries) are probably not configured to accept Unicode domain names in the URLs, the trick is to use a short redirect code (like for example). Most countries that have accented characters in Europe will apply to the Unicode name the same guidelines: i.e. you have to present proof of ownership of a name (either it’s a trademark or a company name) to be allowed to use this feature, so the problem is minimised (trademark regulations long since have dealt with this problem in those countries). But sometimes there is no other alternative but litigation, when the domain names are actually differently spelt but look visually similar, a process known as homograph spoofing. An example: at first glance, looking at the following two domains, which one links to a popular software development company? and (click on them to find out!).

When your business depends on customers correctly identifying your brand name, you have to make sure the brand name is unique and is (theoretically) hard to spoof. We all remember how aggressive LL was a few years back about their own trademarks, and pretty much wiped out most (if not all) illegitimate uses of their brand names in resident websites, products, and services.

Now imagine how easily Display Names will be exploited in Second Life. Consider the picture illustrating this article. What prevents anyone from using CopyBot to get my full avatar & shape and use “Gwyneth Llewelyn” as their display name? A LL representative might say, “well yes, but the username will be different, and yours will remain gwyneth.llewelyn and will be easily verifiable by other residents”. Oh really? What if someone simply registers a username of gwyneth.llewe1yn? Visually looks pretty much the same, doesn’t it? (Even I had to check twice on my screen to make sure I hadn’t just copied & pasted, but changed one of the lowercase Ls to the number 1)

So a combination of CopyBot and homeograph spoofing can pretty easily ruin someone’s reputation in a pinch. LL guarantees they’ll be alert to Abuse Reports regarding Display Name spoofing, but the truth is — and you can see their attitude on the official blog post announcing Display Names — that they don’t think this will be really abused. They are still stuck to the IRC/chatroom mentality, when the joke of using the same nickname easily gets old. They’re right — it does. However, Second Life is not only about joking and chatting. It’s still about resident business and a thriving economy, and we’re talking US$ 0.6 billion here, not a handful of coins. Making a fake account to tarnish a merchant’s reputation, or copy their content but appear to be legitimate when selling it, is a serious problem that requires addressing. Linden Lab made it quite clear that they will not pro-actively prevent things from happen, just deal with abuse reports.

Perhaps they’ll revert their position when someone registers the philip.1inden account and starts impersonating their CEO.

Of course, insane people like me have trademarked their avatar names (and additionally I’ve registered it as a legitimate literary pseudonym, which will cover copyrights as well). But registration doesn’t mean automatic protection. It just gives me an extra edge in litigation. If the moment LL introduces Display Names, a malicious group of residents poised to ruin my reputation register 5,000 avatars with usernames similar to mine and Display Names exactly like mine, and starts spreading havoc around, specially if those avatars come from all over the world (meaning: different jurisdictions to file trademark lawsuits — my own trademark doesn’t cover many countries, because world-wide trademarks are very expensive), I wouldn’t be able to afford litigation against all of them. Probably, right now, I might not even be able to afford litigation against one, if it were someone outside my country! The best I could do is to file DMCA claims, which LL accepts, combined with an Abuse Report on grounds of illegitimate impersonation (which apparently is still mentioned in the ToS). After a year or two, I might have managed to track down all those 5,000 culprits… while, of course, in the mean time, 5,000 new ones would pop up every day.

Now of course I’m a bad example, because I’m not a huge landowner, merchant, or live musician, and my reputation is limited to a small circle of business contacts, who would obviously contact me through other ways. I can afford that residents search for “Gwyneth Llewelyn” (correctly spelled and with no homeography spoofing!) on the in-world Search and find 5,000 avatar profile entries, all looking exacrly the same, and not knowing which one is the real Gwyn. If the reason for the contact is legitimate, they would find alternatives — email, for instance, or looking me up on the many social/business networking sites. But what about the dozens of thousands of content creators and business owners in SL, that have established their avatar name as a brand name, and rely on unique identification, visually and on Search, to make business? How will they deal with hordes upon hordes of malicious residents spoofing their names? Also remember that the inherent complexity of the system will work against residents that are in a hurry — figuring out the many key click combinations that reveals the username (and copying and pasting it to a separate window and applying a different font to see if that’s the real username or just a homeograph spoof) is not really suitable for casual shoppers. In truth, you might never again know if you’re really buying from the legitimate seller any longer.

Over time, it will get even worse. Right now, the 20 million registered users will all start with Display Names as they are, and usernames of the form FirstName.LastName. So for a while at least you’ll be able to do some checking. But from next year onwards, a large part of the SL resident population will have completely different usernames — e.g. james1234 for instance — and use as their Display Names (and shop brand!) something like Crafty Designer. Among a thousand entries for Crafty Designer, all looking the same, all having completely different usernames, how cana resident “know” that the legitimate username is, in fact, james1234, and not someone else? Imagine that people actually claim that on the profile: “Customers, be warned of spoofing, my legitimate username is james1234” Well, all the hackers have to do is to copy the exact Profile information but just change the “legitimate username” as “proof”. The point is, you will have absolutely no way to know any longer who is the legitimate owner of a brand or a shop — unless, of course, you go out of SL to do some extra checking. However, what will you do if your favourite fashion designer in SL just has a site in… Japanese?

Linden Lab, to avoid this problem, could have implemented two suggestions. One, that they already have rejected, and which would neatly solve the problem, is that the system could automatically block Display Names set to someone else’s username. That would, by far, be the better choice, and one that would fix all issues about spoofing except homeograph spoofing (note: there is a resident called Gwyneth Llewellyn [note the extra L] in SL, who is not me; she doesn’t use her account frequently, the last time we chatted was two years ago, but I’m quite aware that she gets a lot of IMs and notecards that are meant for me — since I often get complaints that “I never reply to IMs”. There is nothing I can do about it short of filing a lawsuit against her). But we already have LL’s answer to this rather reasonable request: they will not implement it, period. The reason given was that among those 20 million registrations there are a lot of usernames for celebrities that were picked once, and they would be in an awkward position if a celebrity logs in to SL and finds they cannot change their Display Name to their celebrity name.

There is a second suggestion, and LL is silent about it (but will also probably not implement it). Make Display Names registrable, exactly like domain names, for a fee. Whatever the price is, it might be cheaper than litigation. And I’m sure that at least the dozens of thousands of merchants, landowners, and event hosters and performers will be willing to pay something to make sure their Display Name isn’t spoofed. It feels unfair — after all, for seven years LL has ensured us, via ToS, that we would have a unique in-world identification, and they’re removing that — but it might be a reasonable compromise. In fact, it’s not an unheard-of solution. I’ve read a few articles where in some virtual worlds (IMVU comes to mind) you get a “temporary” name while you’re a free user, and have to pay to get a definitive name. I’m actually used to that on some chatrooms too, where your display name becomes “guest” until you register and pay a fee. Or, for instance, they could make this service included in a Premium account (another great suggestion) but not for Basic users — an excellent idea to encourage more Premium accounts! A side-effect would be that Display Names, once registered, could be easily traded — just like domain names — on a “name exchange”, where names might be up for auction, as some people would most certainly start registering names like crazy (if the fee is low enough) hoping to resell them later. Depending on your views, this might actually be a good idea (like license plate numbers on the Anglo-Saxon world — or, well, domain names) or a horrible idea, but in either case, it would be far better than the free-for-all identity usurpation feature that LL will implement.

And make no mistake, they will implement it. It’s not “under discussion”, it’s a feature announcement. The best we can hope for is that some good, common sense is triggered on some Linden mind and that at least they include a way of protection.

So far, the only thing they came up with is the limitation that Display Names can only be changed once a week. This will limit the silliness of people joining a chat and starting to change their Display Names to match the names of other avatars — e.g. a measure that is also commonly used on some IRC servers and several chatrooms. Ok, it’s a start, but… it completely fails to address one of the largest group of residents that will use Display Name changes profusely: role-players. RP fans — and there are hundreds of thousands in SL! — love the ability to change their avatar name to someone more fitting to the role they play, and this is a very appealing feature for them. But… most of them play several RP games during the week, and they won’t be able to change their names to match the setting they’re in. So, in fact, this continues to be useless for them, and they will have to resort to the usual trick of having different alts, each for a RP area they’re active in, but still keeping no connection between the alts (except what they claim on the profiles). For them, a better solution would be to have a list of potential Display Names (say, 5 or 10 — with some reasonable limit) and be able to switch between them at will. Combine that with the limitation that nobody can use a registered Display Name and it would definitely suit both the merchants and landowners as well as the role-players.

Nevertheless, I feel that LL has already closed the door on this discussion. As is usual for them, they don’t actually think that the impact of spoofing, harassment, identity theft, and trademark violation will affect more than a tiny part of the resident population. They don’t fear the consequences. They also won’t be liable to litigation for improperly protecting resident’s names, since they’re so keen to make changes on ToS that you have to agree with or terminate your account — keeping their own lawyers happy, and making our claims of changing the rules without our permission void and null (we have to enter a new agreement when we click to accept the ToS changes…). So unless some dramatic thing happens — a sudden drop of the economy, or Philip Linden’s avatar being spoofed on a fake Town Hall meeting — I don’t see any reason for LL to change anything.

It’s ironic that for years people have been struggling with the issue of real life validation and identity. But the truth is, our virtual identity, tied to the value of the in-world economy, is far more important — because it ties to real value, not merely “perceived” importance (e.g. who cares if I’m Jane Doe or Helen Smith in RL; will either of those RL names make me sell more Dance HUDs? No!). I would expect that a Linden Lab which has shifted their focus towards the residential market and the in-world economy would understand this better, but I guess they simply don’t.

Print Friendly, PDF & Email
%d bloggers like this: