Finding people you know on DW

[denise]

I've been pondering this question for a bit (foregrounded in my mind again by the latest wave of newly-minted dwenizens brought to us by LJ's unavailability this week and as a reaction to the real-names fiasco of Google+) and, failing to come up with any real answers -- or rather, coming up with too many conflicting answers, and none of them good ones -- I realized that the best thing to do would be to take it to you all, lay out my reasoning, and see what kind of solutions we can come up with when we all brainstorm together. :)

The task: Make it easy for people to find their existing friends on Dreamwidth, either while they're registering or after they've signed up.

The problem: Preventing new-user-dropoff (someone who registers an account, pokes around a bit, and then never returns to your site) is a function of a lot of different factors, but one of the biggest ones, with a social networking site, is: are the people I care about already using this service, and if so, can I find them? If people don't find the group of people they care about using the service already, they're more likely to wander off and never come back.

Services try to deal with this in a lot of different ways. The most common is an "address book reading" function: the site asks for access to your email address book, searches its database, and coughs up a list of people with those email addresses using the site. If it's done well, this can be helpful. If it's done badly, it's a privacy disaster. It also requires you to provide the site with access to your email account, and in most cases, requires you to be using a) a web-based email provider b) that they have programmed into the system (so, pretty much Gmail, Yahoo Mail, and Hotmail).

Other methods are things like a "you may know" service -- like how Twitter suggests "similar users" (based, I believe, mostly on who follows whom), and Dreamwidth's popular subscriptions page (a paid feature on DW, since it's resource-intensive to calculate). That kind of thing is good at identifying people who are in your extended network (friends of friends) once you have a few people in your circle, but they don't help to prime the pump: if you don't subscribe to anybody up front, those tools don't return results.

There are other technical solutions that people have thought up over time; things like various data files and formats you can import into a new service and have it scan for people who match (much like the email address book, only slightly less privacy-invading). Problems with those include user education, the fact those standards aren't well-known and well-applied, the fact there are tons of competing standards ...

So everybody, everybody keeps coming back to the "share your email address book, scan the users database for accounts that match those email addresses, return the results". And I can find solutions to most of the massively problematic portions of that concept, and things that could make the function more useful and flexible:

* Problem: what if I don't want anyone who has my email address to be able to find me? Solution: Allow DW users to choose whether or not they can be "email matched" -- if they say "no, people shouldn't be able to find me", then we respect that. (And release the feature pegged initially to the privacy settings that users have put on their email address: if you don't display the email address on your profile, you don't get the email search turned on, which essentially only automates the existing 'search by email' function that's in the site-wide search bar.)

* Problem: what if one of my friends is using a different email address on DW than I have for them? Solution: Allow DW users to add "other email addresses I should be searchable by" to their accounts, so I could (for instance) confirm that I own the email rahaeli@livejournal.com (which is the email address I was using for a really long time) in addition to denise@dwscoalition.org (which is the email address I use with the site now). The other confirmed email addresses wouldn't display on the site, but it'd let people search and find you by. (You'd still run into the problem of people having outdated email addresses that you couldn't confirm anymore -- there are still people who know me by email addresses I haven't used in over a decade, I'm sure -- but we wouldn't want to allow people to use any arbitrary email address, lest I say that I'm billg@microsoft.com and hilarity ensues.)

* Problem: what if my address book is full of people I sent email to once and don't want to ever talk to again, or companies with whom I interacted but don't want to be social with (true, and amusing, story: webmaster@dreamwidth.org gets invited to new social networks all the freaking time), or (for instance) family members such as Aunt Margaret who would keel over and need smelling salts if she found out that I write porn about TV characters in my spare time? Solution: don't automatically add the people you find from an address book crawl, but instead just give people a list of the accounts returned by the address crawl, and let them choose whether or not to either a) add the person to their circle directly or b) send out an email saying "Hey, I'm on Dreamwidth now!" and let them choose whether or not to begin a relationship.

There are other problems I can think of, but those are the ones that immediately come to mind as the biggest concerns, and all of them are workable-around. You can also take the same idea behind "address book crawl" and extend it to other services: do things like letting people add/verify their Twitter account, for instance, and match it against other added/verified Twitter accounts, or add/verify their LJ account and match that, or really any other social network that has any form of automated function for returning "list the people I have relationships with". (And, of course, there's the method of building "places I have lived/worked/gone to school" fields into the profile or the site directory, so you can search for people who graduated school with you, or people who worked at $formerjob from 2002-2005, or people who lived in downtown Baltimore from 1997-2002, etc. But that requires a bunch of overhead in validating and sanitizing input, so you don't get eight thousand variations in spelling, which is what made the LJ schools directory so incredibly human-intensive and part of why we discontinued it on DW.)

I'm sure there are other possible awesome ideas that I'm just not thinking of, though, and I'm also sure there are other problems with the "mine your list of connections on other sites and match against the DW userbase" idea that I'm just not thinking of off the top of my head. So, I figured I'd throw it out to y'all at large, seeing as how you are a) extremely intelligent people b) who want to see DW succeed c) and are used to carefully thinking through an idea and evaluating it on privacy, security, and usability grounds.

So, the questions I have for y'all:

* What other ways can you think of to help a new user find their existing friends who have accounts on DW easily, quickly, and with minimal hassle?

* How can we best balance your privacy with your desire to find people you know?

* How can we help preserve the right not to be found by people you don't want to find you?

* What else am I forgetting to think of?

Comments

[mark]

I think that this is a good feature to have, but I would want us to implement it with some pretty strict privacy controls and good defaults. What you suggest for the default of respecting a user's current setting for visibility is good.

Further, I'd probably specify on the page and in our privacy policy:

* We do not retain the email addresses you choose to submit -- they are used once and immediately discarded.
* We will NEVER use the email addresses someone gives us for ANY purpose other than matching. (Reinforce the first point.)
* All information is submitted through secure methods (SSL required) so we never expose this data to MITM attacks.
* Hey, the code is open source, _check it out here_.

Maybe there are other things we should say, too. I think that if we make it clear what we do with this data and we make sure the code is available, that should make it easier for people to be comfortable with it.

Another thing we might consider is making it a little backwards -- when someone submits their address book, they already have an account. We can make it so that a user can select a privacy setting of "when someone submits my email, notify me, but don't tell them".

For example, if you log in to DW and submit your address book, and I have this setting on, you will NOT see me in the results list. However, I will get an email/notification that says "Denise has joined Dreamwidth, here is her account!" That puts the "exposure" penalty on you -- and gives me the choice on a one-by-one basis to expose my account or not, instead of just disabling the entire feature.

[matgb]

Another thing we might consider is making it a little backwards -- when someone submits their address book, they already have an account. We can make it so that a user can select a privacy setting of "when someone submits my email, notify me, but don't tell them".

I was trying to think of a way to word this but gave up, but yes. If I search and don't find people that can be frustrating, but if they get notified I found them and can them come get me if they want to, that can help.

[jumpuphigh]

Another thing we might consider is making it a little backwards -- when someone submits their address book, they already have an account. We can make it so that a user can select a privacy setting of "when someone submits my email, notify me, but don't tell them".

That was going to be my suggestion as well. If my aunt joins and searches for me with the email address my fucking brother outed me with, I don't want her to automatically be able to see that that email address is attached to jumpuphigh.

[kerravonsen]

I like this idea!

Another Thought

[jumpuphigh]

For example, if you log in to DW and submit your address book, and I have this setting on, you will NOT see me in the results list. However, I will get an email/notification that says "Denise has joined Dreamwidth, here is her account!" That puts the "exposure" penalty on you -- and gives me the choice on a one-by-one basis to expose my account or not, instead of just disabling the entire feature.

We would have to have pretty fine controls here as well, though. I, as the person doing the submitting of my address book may only want Joe, Delia and Jane to get notifications of my joining, not my grandmother, my boss and my upstairs neighbor.

Re: Another Thought

[ciaan]

A solution to that would be to not search all the addresses automatically, but rather for DW to show you a page saying "here is your address book from your email, please select the people you wish to search for on DW" and you could then check or uncheck the boxes on individual accounts.

Re: Another Thought

[fyreharper]

I like this refinement. Personally I'd never ever run an address-book search, but if I did, just because I've ever sent/received an email with someone doesn't mean I want to find them on here (or for them to be able to find me, if they had the reverse-notification option set).

Re: Another Thought

[queenbarwench]

+1 I like this idea and this level of control very much.

Re: Another Thought

[kyrielle]

This. I also think, if it's going to search for people who permit it and notify people who prefer that, that the person submitting their address book ought to indicate whether they want the person notified if that's their setting (that is, I might want to find someone but be hesitant to have them know who I am without my knowing who they are; if they're set with 'notify me instead of showing the searcher' and I said I didn't want that done, then neither of us would be told about the other).

Re: Another Thought

[fyreharper]

That's a good point. It'd probably be a good idea to make it clear (in the vicinity of the address-book-search function) that the reverse-notify option exists. Since when I run a search, I wouldn't even think of the possibility that it's notifying the searched-for individuals...

[sophie]

I like that idea, too.

[birguslatro]

"when someone submits my email, notify me, but don't tell them".

Yes - that's the way to do it.

[ironed_orchid]

I like your thoughts.

[akacat]

However, I will get an email/notification that says "Denise has joined Dreamwidth, here is her account!" That puts the "exposure" penalty on you -- and gives me the choice on a one-by-one basis to expose my account or not, instead of just disabling the entire feature.

That would be awesome. It would allow for a setting where people can be searched by email without showing their email address.

[vampwillow]

I will never *ever* submit any list of email addresses / handles / names *of other people* to any service whatsoever. Basically because it isn't my data to disseminate.

I massively hate the fact that G+ has done this without explicit authority (though I should not have been as surprised as I was, I suppose.)

On all services, I find that they way to locate others is to post _on the initial service_ that I also have an account somewhere else (eg. a private-to-friends post here that I can be found on G+ or FB or Twitter under the name/handles XXX) but the easier way is that of finding 'nodes' - people who are connecting points in the social groups I am a member of, and using the links from them to relocate others.

The whole 'naming of names' thing brings its own problems, for instance I have used this handle online since the mid-1990s yet although I have a (rarely-used) twitter handle of this name, my FB and G+ usage has to be under another 'less real to some' name.

[pauamma]

I think both approachs ("searcher notified" and "searchee notified") have failure modes in stalking/harassment cases. Consider the following 2 scenarios, in both of which Bob is stalking Alice across services.

Bob just got an account on Dreamwidth and wants to know whether (and under what name) Alice is there too. Here, Bob wants the searcher (himself) to be notified, not the searchee. Conversely, Alice (if she has a Dreamwidth account) wants the serchee (her) to be notified. Here, "notify searchee" is the right thing, qnd "notify searcher" could have serious consequences.

But now, Dave replied to a comment Alice left elsewhere, and Alice, who doesn't know Dave but suspects he might be Bob under an alias, decides to search for Bob's known email addresses to see if Dave pops up as a match. But obviously, Alice wants the match notifications for herself as the searcher, and Dave (if he's really Bob) wants them for himself as the searchee. There, the safe solution is reversed from the previous scenario, and notifying the searchee is bad.

[cesy]

It needs to be possible to turn it off from both sides - you need to be able to set your email address to a) "anyone can find me", or b) "just notify me", and you need to be able to run your search as 1) "find anyone publicly visible, tell me, don't tell the hidden ones" or as 2) "find anyone publicly visible and tell the hidden ones".

So the searcher should be able to search 1) those who have opted-in to make their email addresses searchable without notifying them, which is what Bob would do, and Alice would opt for b), knowing she has a stalker, so Bob would find nothing and Alice would never know that he searched. Then when Alice searches for Dave, she'd also pick 1), knowing that it didn't give 100% guarantee of proving he's not Bob (given Bob could have just created and used another email address anyway), but at least he can't tell she's checking, regardless of whether he picked a) or b). So Alice would be safe because she picked b) and 1), and Bob would be frustrated because he didn't find Alice, but satisfied that he is being suitably subtle by using the 1) option himself and setting "Dave" to b). And Dave's identity would still be a mystery to Alice, as it is at the moment.

Meanwhile over on some other area of the internet, Edna is happily set to b) because she's privacy-conscious, Charlie joins DW set to a) (the default for new users, with appropriate warning messages) and runs a 2) search (the default, with appropriate warnings), Edna gets notified, runs a little 1) search of her own to double-check it is the Charlie she knows, and they happily grant access and subscribe to each other.

It's slightly confusing having options on both sides, but it's the only way I can see to make it both safe and workable.

[pauamma]

Yeah. Since Dreamwidth can't read minds, I think that's the best we can do.