Polaris: Reclaiming Social Privacy Through Smartphone-Centric Marketplaces

TL;DR

Polaris is a decentralized social network architecture that turns your smartphone into a private "identity kernel." Instead of one "Walled Garden" (like Facebook) owning all your data, Polaris distributes your photos, posts, and profile across different specialized providers. By using standardized APIs, it ensures you remain in control of who sees what, while still allowing companies to show ads to remain profitable.

Background: The Price of "Free"

In the current OSN landscape, centralized control is the price we pay for 24/7 availability. Providers like LinkedIn or Facebook need your data to be unencrypted so they can mine it for advertisements. Previous academic attempts to solve this via Peer-to-Peer (P2P) networks or full encryption failed because:

1. Complexity: Normal users don't want to run home servers.
2. Cost: Users refuse to pay for what they perceive should be a free service.
3. Incentives: If a provider can't see the data, they can't monetize it, so they won't host it for free.

The Polaris Insight: The Smartphone as a Kernel

The authors propose a "middle ground." Since smartphones are always-on, highly personal, and increasingly powerful, they should act as the Identity Provider.

Polaris shifts the heavy lifting (storing 10GB of photos) to specialized third-party providers but keeps the keys to the kingdom on your phone.

Core Architecture

As shown in the architecture, the system is decoupled:

• User Device: Manages Access Control Lists (ACLs) and issues authorization tokens.
• Commoditized Providers: Host specific data domains (Photos, Blogs, Status). They see only the data you give them.
• Standardized APIs: Uses HTTP REST over SSL to ensure that players are interchangeable. If Flickr violates your privacy, you move to Picasa without losing your friends.

Methodology: How it Works

When Alice joins Polaris, she doesn't sign up for one site. She signs up for service modules.

1. Setting Up and Negotiation

Polaris leverages a standardized negotiation process. When Alice picks a photo provider, the phone and the service exchange tokens. Alice can see exactly what permissions the service is asking for before confirming.

2. Distributed Access Control

The genius of Polaris is how it handles "Friending." When Alice friends Bob:

1. They exchange tokens directly (via Phone number/OpenID).
2. Alice’s phone pushes an updated ACL to her providers (e.g., "Bob is now allowed to see my 'Vacation' album").
3. Bob’s phone retrieves the data directly from Alice’s provider using his own token.

Experimental Validation: The Android Prototype

The authors built a prototype on Android (back when it was at 28% market share!) to prove that mobile resource constraints (battery/bandwidth) wouldn't break the system.

Key Technical Solutions:

• Global Reachability: They used SMS/Data protocols to "wake up" phones and perform UDP hole punching to bypass cellular firewalls.
• Service Composition: They successfully demonstrated "Foursquare" posting to "Google Buzz" by passing specific sub-tokens, proving the modularity works.

Critical Insight & Conclusion

Polaris is a masterclass in Economic-Technical alignment. It acknowledges that "total privacy" via end-to-end encryption is often an economic dead end for free services. By allowing "Contextual Advertising" (ads based on the content of a specific post) while preventing "Data Profiling" (aggregating your entire life's history into one profile), Polaris offers a pragmatic path forward.

Limitations

• The Power Gap: If a provider is malicious, they could technically leak the data they do have access to. Polaris relies on "Social Competition" (users fleeing bad providers) rather than hard cryptographic proof.
• Graph Analysis: Modern "People You May Know" algorithms require seeing the global social graph, which is intentionally hidden in Polaris.

The Takeaway: Polaris proves that the "Walled Garden" isn't the only way to build a social network. By turning our phones into policy managers and the cloud into a commodity market, we can have our social cake and eat our privacy too.