Trust vs Reputation

Question

There is a lot of academic papers that use trust and reputation in an interchangeably manner. Is there any clear and concrete definition to distinguish these two terms in various contexts? Is these any clear border between them?

Answer 1

In a sociological context, these two concepts are similar, but separate.

Francis Fukuyama (Trust: The social virtues and the creation of prosperity, Free Press, 1995) defines trust as:

"the expectation that arises within a community of regular honest and coperative behaviour based on: commonly shared norms, on the part of the members of the community."

Barbara A. Misztal: (Trust in Modern Societies, Polity Press, 1996) offer the following definition in the case of interpersonal trust:

"the belief that the person, who has a degree of freedom to disappoint our expectations, will meet an obligation under all circumstances over which they have control."

and in the case of abstract systems, she refers to A. Giddens' notion of trust as something that is largely based upon non-contested experts' specialized knowledge.

In all the citated defintitions, "trust" entails predicting the outcome of some future action of the trusted party or trusted instrument, based upon a set of criterions. One of this criteria may be the history of interactions with the other part (i.e. we've experienced that the other party habitually fulfil his/her obligations, or we've experienced that paper money actually "works" when we want to buy stuff), another may be what Anthony Giddens calls "expert systems" (no relation to the computer science term) which is a measure of our willingness to trust the knowledge of experts (e.g. we also trust paper money because politicians and academics tell us it is OK to treat these pieces of paper as valuable, and nobody worth listening too contest this notion).

According to Misztal, reputation serves as a "warrant for trust", but differs from it by being a:

"publicly held opinion, [and therefore] open to manipulation and stereotyping."

In online communities, e-commerce and open collaborative applications, a large number of individuals that do not know each other personal may interact with each other and transact goods or knowledge, the individuals participants may not have the opportunity to know each other good enough to form the expectaions required for trust. Since trust usually is a prerequisite for a community to function (in particular if values are to be exchanged in the community), this is a problem.

Knowing the close links between "trust" and "reputation", the designers of these system usually provide some means to make public the "reputation" of its individual members.

These means may be in a form of a comment system, where each party in a transaction or interaction may leave a verbal comment on the experience they had with the other party (e.g. eBays's system for attaching a comment from both parties at the end of every transaction), or in the form of voting where members give a positive or negative vote on each other's ability to fulfil obligations (e.g. StackExchange's gamification of its members' ability to provide correct information, or LinkedIn's recommendation votes attached to skills listed by community members). Other public marker's such as honours, badges, etc. can also be used in an online community system to make public various aspect of members' reputation.

As noted by Miztal, these public markers of a member's reputation will often be used as warrants for trust (in particular in situation where one have no real knowledge of who the other person is, or personal history of interactions with him or her), but it is not the same as trust, and it may be manipulated (for instance by means of reputation comments and reputation votes from sockpuppet accounts).

In the context of hard computer science, I've only heard of "trusted system", which means a computer system that can be relied upon to implement a specified security policy.

Unlike in society, where trust to a large extent is based upon interactions (in the form of transactions with people and artefacts), a trusted system becomes trusted by passing formal tests that gives its testers the confidence that it is reliable.

AFAIK, the term "reputation" is not used in the context of hard computer science.

Answer 2

Trust (in the technical, computer-security sense) refers to a state achieved via authentication, which is the process by which you achieve confidence in a party's identity.

Reputation (in the e-Commerce sense) refers to historical data which inform a consumer's subjective predictions about an (identified) party's future behavior.

For reputation to make any sense it must assume trust, i.e. when you are reading my reputation score on StackExchange you must trust that you are actually reading StackExchange and not a phishing site.

On the other hand, trust relies upon reputation of the trusted authority. The only reason you trust a server certificate is due to the reputation of the PKI.