Title:             Bootstrapping Online Trust: Timeline Activity Proofs over Public Ledgers
Authors:           Constantin Catalin Dragan; Mark Manulis
Key words:         trust online, timeline activities, distributed public ledgers, data confidentiality, authenticated policy compliance

Abstract:
Establishing initial trust between a new user and an online service, is being
generally facilitated by centralized social media platforms, i.e., Facebook,
Google, by allowing users to use their social profiles to prove
``trustworthiness'' to a new service which has some verification policy with
regard to the information that it retrieves from the profiles. Typically, only
static information, e.g., name, age, contact details, number of friends, are
being used to establish the initial trust. However, such information provides
only weak trust guarantees, as (malicious) users can trivially create new
profiles and populate them with static data fast to convince the new service.

We argue that the way the profiles are used over (longer) periods of time
should play a more prominent role in the initial trust establishment.
Intuitively, verification policies, in addition to static data, could check
whether profiles are being used on a regular basis and have a convincing
footprint of activities over various periods of time to be perceived as more
trustworthy.

In this paper, we introduce \emph{Timeline Activity Proofs} (TAP) as a new
trust factor. TAP allows online users to manage their timeline activities in a
privacy-preserving way and use them to bootstrap online trust, e.g., as part
of registration to a new service. In our model we do not rely on any
centralized social media platform. Instead, users are given full control over
the activities that they wish to use as part of TAP proofs. A distributed
\emph{public ledger} is used to provide the crucial integrity guarantees,
i.e., that activities cannot be tampered with retrospectively. Our TAP
construction adopts standard cryptographic techniques to enable authorized
access to encrypted activities of a user for the purpose of policy
verification and is proven to provide {\em data confidentiality} protecting
the privacy of user's activities and {\em authenticated policy compliance}
protecting verifiers from users who cannot show the required footprint of past
activities.