question about reputation

In an economy based on positive reputations, how does one acquire a 
reputation capital?  One way may be to initially perform services at a 
price below cost, but this has some problems.

For example, Alice starts a anonymous consulting service, and announces 
that she will answer the first ten queries for free.  Upon hearing this, 
Mallet immediately starts another consulting service, and announces the 
same offer.  At this point Mallet can simply forward his customers' 
queries to Alice and Alice's answers back to his customers.  Thus, he gains 
reputation at no cost.

On the other hand, this "man-in-the-middle" attack can also work against
conventional True Name based services, but perhaps with less effect.  Has
anyone ever heard of this being done? 

Is there a better way to acquire a good reputation?

Wei Dai

Wei wrote:

|> In an economy based on positive reputations, how does one acquire a 
|> reputation capital?  One way may be to initially perform services at a 
|> price below cost, but this has some problems.

|> For example, Alice starts a anonymous consulting service, and announces 
|> that she will answer the first ten queries for free.  Upon hearing this, 
|> Mallet immediately starts another consulting service, and announces the 
|> same offer.  At this point Mallet can simply forward his customers' 
|> queries to Alice and Alice's answers back to his customers.  Thus, he gains 
|> reputation at no cost.

A) There is a real cost (some combination of reputation and other capital)
   involved in attracting customers.

B) This is emphatically _not_ an "abuse" of reputation capital. Mallet will
   acquire a reputation based on the quality of the service he provides.
   Suppose that Bob also set up a service like Alice. Some people would
   go directly to Alice, some to Bob, and some to Mallet who chooses
   which ever of Alice and Bob offers the best deal for the customer.
   By choosing intelligently, Mallet could acquire a better reputation
   than either Alice or Bob. This would not be inaccurate. By using Mallet,
   (now a consulting services broker) the customers are geting a better deal.
   (i.e. MAX(A(x),B(x)) is greater than or equal to both A(x) and B(x)).

JWS

Good question, but a quick modification allows for effective
bootstrapping.  If I want to start consulting for Amalgameted
Consolodated, I can offer them a 10 free questions deal to bootstrap
things with.  Mallet can only cheat if my offer was broadcast.  (I 
presume that Amalagated' keys are somehow strongly verified, and the
negotiantions are kept secret from Eve and Mallet.)

	There might also be fingerprinting technologies that allow me
to embed a signature in the documents returned to clients that would
allow me to show that Mallet stole them.  (Which might, incidentally,
get Mallet a job in some circles...If thats known, Bob and Alice can
collude to make it appear that Bob was Mallet, and thus forge a
reputation.


Wei wrote:
| In an economy based on positive reputations, how does one acquire a 
| reputation capital?  One way may be to initially perform services at a 
| price below cost, but this has some problems.
| 
| For example, Alice starts a anonymous consulting service, and announces 
| that she will answer the first ten queries for free.  Upon hearing this, 
| Mallet immediately starts another consulting service, and announces the 
| same offer.  At this point Mallet can simply forward his customers' 
| queries to Alice and Alice's answers back to his customers.  Thus, he gains 
| reputation at no cost.
| 
| On the other hand, this "man-in-the-middle" attack can also work against
| conventional True Name based services, but perhaps with less effect.  Has
| anyone ever heard of this being done? 
| 
| Is there a better way to acquire a good reputation?
| 
| Wei Dai
| 

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

On Sun, 10 Sep 1995, Adam Shostack wrote:

> 	Good question, but a quick modification allows for effective
> bootstrapping.  If I want to start consulting for Amalgameted
> Consolodated, I can offer them a 10 free questions deal to bootstrap
> things with.  Mallet can only cheat if my offer was broadcast.  (I 
> presume that Amalagated' keys are somehow strongly verified, and the
> negotiantions are kept secret from Eve and Mallet.)

This scheme doesn't quite work.  (Let's call Amalgameted Bob, to keep
names short.)  Bob can create a new, unlinkable pseudonym and give the same
offer to Carol under the new pseudonym.  Then, Bob acts as Mallet and
passes messages back and forth between Alice and Carol.  At the end of the
10 free questions, Bob terminates its contract with Alice, leaving Alice
with nothing and Bob's pseudonym a certain amount of reputation with
Carol. 

> 	There might also be fingerprinting technologies that allow me
> to embed a signature in the documents returned to clients that would
> allow me to show that Mallet stole them.  (Which might, incidentally,
> get Mallet a job in some circles...If thats known, Bob and Alice can
> collude to make it appear that Bob was Mallet, and thus forge a
> reputation.

Fingerprinting may be useful in some situations, but is clearly not a
perfect solution to this problem.  Alice may be able to prove to Mallet's
customers that she originally wrote the answers, but if their
communications with Mallet are private, how does Alice even know who those
customers are?  Also, I'm not too familiar with fingerprinting
technologies, but Mallet may be able to remove the identifying marks by
translating the answers to a different form while preserving the meaning.

Wei Dai

Adam Shostack writes:
# Good question, but a quick modification allows for effective
# bootstrapping.  If I want to start consulting for Amalgameted
# Consolodated, I can offer them a 10 free questions deal to bootstrap
# things with.  Mallet can only cheat if my offer was broadcast.

Wei Dai writes:
> This scheme doesn't quite work.  (Let's call Amalgameted Bob, to keep
> names short.)  Bob can create a new, unlinkable pseudonym and give the same
> offer to Carol under the new pseudonym.  Then, Bob acts as Mallet and
> passes messages back and forth between Alice and Carol.  

If all Alice's prospective customers are also resellers on the side, then I
agree that she has a problem. But how realistic is a market scenario in which
a new supplier cannot positively identify some legitimate end consumers of a
product or service ?  (I'm ignoring cases in which the market for the
product or service is only just being forged.)  This strikes me as rather
implausible, although I don't claim to have devoted a great deal of thought
to it.

-Futplex <futplex@pseudonym.com>

Wei Dai writes:
> On the other hand, this "man-in-the-middle" attack can also work against
> conventional True Name based services, but perhaps with less effect.  Has
> anyone ever heard of this being done? 

Undoubtedly -- this is a factor in the abundance of "no sales to dealers"
and "limit N per customer" in sales advertisements. 

-Futplex <futplex@pseudonym.com>