Something's not right with the web.

No matter which version of it you believe we're currently on, the situation ain't ideal. We're missing fundamental pieces.

https://depatchedmode.mirror.xyz/4t_7BUzz5q3XlPtH7EgtGL61nh9U8plsfH23i7x5_lU

🧵

Rated 💯 by multiple networks. Fluent in /unglish. Unbothered by /whatday of the week it is.

Allegedly a designer.

We've hit the limits of our current IT stack. And it's severely limiting how we can interact with each other.

To quote punk6529: You get the society your IT stack enables.

Not saying progress has halted. So many communities continue to contribute so much! 

But we often overstate our position on the roadmap. There has not been a Web 1, Web 2, or Web 3. Instead, there has been a Web 0.1, Web 0.2, and Web 0.3.

We're still incrementing on Web 0.x

How do we know? Let's test a claim: "Regardless of my data literacy or technical proficiency, I must be empowered to make my own decisions with my data. To make the right decisions for me and for the communities I inhabit."

Does this claim hold true today? 

No.

In the worst case, it is not even possible for me to make the right decisions with my data (e.g. moving the personal relationships I've built on Facebook to another platform).

Simply making a secure outcome possible does not make it probable.

Secure means so much more than just “security at the technical layer.” It means enabling an environment and set of relations between individuals, that empowers communities to operate as they wish or need to.

The broken systems we rely on today must do more. They must ensure our experiences are secure: designed thoughtfully enough to provide us with the agency we deserve. From concept, all the way down to code, and back up again: into the interfaces that govern our interactions.

The experience of our digital existence must place every person, regardless of ability, in a position to be secure with their data. 

I've got a draft of 7 principles a truly secure system should adhere to.

A secure system should be:

🔴 Easy & Obvious: Most vulnerabilities in a system occur when we find insecure workarounds, so the secure path must be the easiest and most obvious path for us to take.

🔴 Maximally De-risked: It is not realistic to expect us to be experts in keeping things secure. Therefore, systems must take the responsibility to reduce our risk by default as much as possible.

🔴 Just Granular Enough: We should have control over what we permit other systems, individuals, and organizations to see and do with our data. However, this control should not be so granular that it becomes overwhelming and burdensome for us to set up and maintain.

🔴 Sufficiently Legible: Informed consent is critical. We must be able to understand the actions and outcomes before we take those actions. Actors and objects in the system should also be labeled clearly and in a way that we can quickly understand.

🔴 Sufficiently Auditable: Mistakes will be made. All actions taken on our data should be auditable & reversible. All permissions we delegate should be revokable. Parts of our history should be ejectable.

🔴 Aware Things Change: Nothing is forever. Our circumstances may change; the world may change. We need optionality to move our data, adjust our threat models, and rotate our security factors.

🔴 Reflective of Our Intentions: Most critically, the system must still enable us do what we intend to do. It must allow us to present ourselves to the world in the many ways we desire or need to be presented.

If this resonates with you, positively or critically, I invite your feedback. I encourage you to join our Secure Design Working Group.

And, of course, it'd always help to share this thread. 

🤝👀

In the best case, it may be possible but is far from obvious to most how they would do it (e.g. moving my email history from Gmail to a new client).

We have failed to meet an acceptable standard.