Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these any clear border between them?

share|improve this question
3  
There aren't really consistent definitions of either word. There are several quite different concepts behind the word trust. For example trusting to get payed is different from trusting to not get logged. My favourite definition of to trust is zooko's suggestion to read it as vulnerable to. –  CodesInChaos Nov 10 '13 at 10:13
1  
Be more specific. Which papers? Which contexts? Otherwise your question risks to be closed. –  ceving Nov 10 '13 at 10:31
    
@ceving All papers related to computational trust and reputation, named soft security too. –  PHPst Nov 10 '13 at 10:39
    
Did not find any in my kitchen. –  ceving Nov 10 '13 at 10:53
add comment

2 Answers

In a sociological context, these two concepts are similar, but separate.

Francis Fukuyama (Trust: The social virtues and the creation of prosperity, Free Press, 1995) defines trust as:

"the expectation that arises within a community of regular honest and coperative behaviour based on: commonly shared norms, on the part of the members of the community."

Barbara A. Misztal: (Trust in Modern Societies, Polity Press, 1996) offer the following definition in the case of interpersonal trust:

"the belief that the person, who has a degree of freedom to disappoint our expectations, will meet an obligation under all circumstances over which they have control."

and in the case of abstract systems, she refers to A. Giddens' notion of trust as something that is largely based upon non-contested experts' specialized knowledge.

In all the citated defintitions, "trust" entails predicting the outcome of some future action of the trusted party or trusted instrument, based upon a set of criterions. One of this criteria may be the history of interactions with the other part (i.e. we've experienced that the other party habitually fulfil his/her obligations, or we've experienced that paper money actually "works" when we want to buy stuff), another may be what Anthony Giddens calls "expert systems" (no relation to the computer science term) which is a measure of our willingness to trust the knowledge of experts (e.g. we also trust paper money because politicians and academics tell us it is OK to treat these pieces of paper as valuable, and nobody worth listening too contest this notion).

According to Misztal, reputation serves as a "warrant for trust", but differs from it by being a:

"publicly held opinion, [and therefore] open to manipulation and stereotyping."

In online communities, e-commerce and open collaborative applications, a large number of individuals that do not know each other personal may interact with each other and transact goods or knowledge, the individuals participants may not have the opportunity to know each other good enough to form the expectaions required for trust. Since trust usually is a prerequisite for a community to function (in particular if values are to be exchanged in the community), this is a problem.

Knowing the close links between "trust" and "reputation", the designers of these system usually provide some means to make public the "reputation" of its individual members.

These means may be in a form of a comment system, where each party in a transaction or interaction may leave a verbal comment on the experience they had with the other party (e.g. eBays's system for attaching a comment from both parties at the end of every transaction), or in the form of voting where members give a positive or negative vote on each other's ability to fulfil obligations (e.g. StackExchange's gamification of its members' ability to provide correct information, or LinkedIn's recommendation votes attached to skills listed by community members). Other public marker's such as honours, badges, etc. can also be used in an online community system to make public various aspect of members' reputation.

As noted by Miztal, these public markers of a member's reputation will often be used as warrants for trust (in particular in situation where one have no real knowledge of who the other person is, or personal history of interactions with him or her), but it is not the same as trust, and it may be manipulated (for instance by means of reputation comments and reputation votes from sockpuppet accounts).

In the context of hard computer science, I've only heard of "trusted system", which means a computer system that can be relied upon to implement a specified security policy.

Unlike in society, where trust to a large extent is based upon interactions (in the form of transactions with people and artefacts), a trusted system becomes trusted by passing formal tests that gives its testers the confidence that it is reliable.

AFAIK, the term "reputation" is not used in the context of hard computer science.

share|improve this answer
    
Thanks for the answer. "reputation" and "reputation" are relatively frequent terms in e-commerce and open collaborative applications. –  PHPst Nov 10 '13 at 15:56
    
Did you make a typo in that last quote? I think it should be stereotyping (you're missing an e). –  Michael Kjörling Nov 10 '13 at 22:22
    
@PHPst, these terms are used in a lot of different contexts. Your question should specified what context you're interested in. However, I've expandeed the answer to cover e-commerce and open collaborative applications. –  Free Radical Nov 11 '13 at 5:08
add comment

Trust (in the technical, computer-security sense) refers to a state achieved via authentication, which is the process by which you achieve confidence in a party's identity.

Reputation (in the e-Commerce sense) refers to historical data which inform a consumer's subjective predictions about an (identified) party's future behavior.

For reputation to make any sense it must assume trust, i.e. when you are reading my reputation score on StackExchange you must trust that you are actually reading StackExchange and not a phishing site.

On the other hand, trust relies upon reputation of the trusted authority. The only reason you trust a server certificate is due to the reputation of the PKI.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.