23AndMe, and Geni

So I just visited the http://23andme.com site, a personal genome service which

"... is intended to help people understand their inherited traits and to allow them
to compare themselves with friends and family."

At first i thought WHAT?! OK, so I thought it was a gentic based dating site (perhaps that's in their future plans ;) ) but once i looked around i thought - COOL !

It's not cheap at $1k per person but based on the extremely qualified backers and advisors of this site i'd more likely believe it actually works pretty well. I think we'd need educated as to exactly what to take and understand from any results we were given - as well as perhaps some clue as to what to do with it (other than - "i told you you had your fathers stubborness"). Could it be beneficial in education, sports and health?? Even a marginal improvement here can only be a good thing (especially as a father with two kids)!

Now, imagine this.... They do a deal with Geni (one of my fav sites) and over time (as things get slightly cheaper) you get larger percentages of families getting involved. Imagine the kind of searches you could do - even within your own family.

I don't know how far this will extend from the family but clearly their are huge opportunities - with a whole set of new privacy issues to watch over. But clearly this is a direction these kind of services will move into.

Has anyone used the service? If so please let me know.

A startup idea to make £56 Million in one week

Here is my idea to making £56 million in one week. Any investors out there?

1. Start a Credit Reference Agency

2. Get loads of people's credit information.

3. Wait 'til the government loses 28 million items of personal information.

4. Charge two pounds per reference check.

5. After one week, sell to someone else who can make cash the next time it happens.

6. Check the bank account to see your lovely £56 Million.

Oh crap, someone stole it when they got your credit details. Doh!


This is obvously tounge-in-cheek but this is what they are asking you to do. Credit Agencies must be loving it!

Alastair Darling - we have technology to fix this

Having worked on a project for schools in Scotland that required the export and trasportation of some personal information I cannot believe the basic flaws that have been made by the "technical people" at HM Revenue and Customs.

Here is it in one line.

DO NOT ALLOW CLEAR TEXT EXPORT OF PERSONAL INFORMATION !!

This is not difficult. The technologies are far enough advanced. In an attempt to save the trillions of consultancy fees, here is how to fix this.

1. Give every member of staff a certificate and/or smart card.

2. Ensure they use a very strong password when using that certificate

3. Any EXPORT routine MUST ask for the private key of the user exporting the data and signs that data. This ensure you know who exported the data.

4. Additionally, any export routine MUST ask for the public key of the EXACT user you intend to send the data to and encrypt that data. Now only that person can read that data as only they have the private key for that certificate.

5. Now, with the IMPORT routine, when the person wants to read the data they need their own private key to decrypt the data.

6. The IMPORT routine should also check the signature an alert the user as to confirm who SENT them the data.

Additional steps should be :

7 .Use Key Revocation to ensure that should any key be lost, that key becomes IMMEDIATELY invalid and hence can't be used to view the data.

8. Know and ensure that every application that uses this data has a common import/export routine with encryption and logging as standard.

9. Log every interaction with that data. You don't even need the personal data to do this - just an identifier for the user (say the certificate hash) and an identifier for the data items.

This stuff sounds tricker than it is. I have now done this with the Government, Barclays and a few other places.... in short - you CANNOT just allow people to export this kind of data.

Now we are all checking our bank accounts - i have an additional post coming next on the business side of this ...

YouTube for Parents - you have it the wrong way around

Update : Ian Hayward the founder of Glubble corrected me below in that you CAN indeed restrict on a page basis. We both agree the comments (and links with previews) by others can be quite unfortunate. Tricker to deal with outside of YouTube.

I've just spent 15 minutes trying to find a video for my 4 year old son to watch on YouTube. It's not the fist time. Simply put due to some idiotic and outdated rules on the US site which says only kids in the US can see a certain 5 minute cartoon, it leaves him asking why and me hunting for an equivalent on YouTube.

However, I would never let him use that site himself as some of the "cartoons" content and comments aren't stuff i want him to see. So i can't even use software like Glubble as it works on a site by site basis. In any case - this is for YouTube to sort out. Oh, and YouTube is not alone, please read on if you have any mixed content with some intended for kids.

Here is my guide:

1. Everything should be opt out
Yes, if i say i am under X years of age or go into "parent mode" (doesn't exist but should) then plesae make EVERYTHING opt in. That means when *I* hit the site there are NO videos. Well, perhaps you can suggest some that have been vetted. *I* will then decide precisely what my kids can see. PRECISELY. I will choose what comments and what content- and you will like to other stuff i have suggested. So that means NO previews of stuff you THINK may be suitable and no "That was fucking awsome. The older stuff was shit but this is good." comments.

2. Let you and your friends decide which moves you wish to set as opt in
OK, so i am willing to go one further step and I should be able to specify what friends i have who i also trust to recommend kids material (no offence to any friends :)). If i say my sons Grandma can recommend a kids video to him then i expect you to respect that.... but just because i may be friends with "womanizer77" (i made that up completely btw) does NOT mean i trust his movies by proxy for my kids.

3. Don't recommend clips from the Exorcist when showing a Ben 10 clip to a 4 year old
I really don't think much needs said here. It happened.

OpenID provider fitness

I'm adding OpenID support to a site i am working on, but came up with an interesting question.

Typically i have the username/password/email and email verification process. Alternatively you enter your OpenID.... but this is where i started to think. Do I limit the OpenID to trusted OpenID providers or do i just accept ANY OpenID? How do i know they haven't juset set up their own provider and how do i know whether the email is valid??

Do I request their email and ask them for yet another verification before they can use the site.... something that could get quite annoying overall.

Would be nice to have an online service which you can query every so often to check the "fitness" of providers so you can decide whether a provider is valid or not. Similar to the certificate lists you get in your browser. This could be managed and be very beneficial for the community i would have thought!? Anyone working on such a service?

If you are reading and have implemened an openid client on your site, how have you gotten round this?