doxing, as discussed in the next section). Their views are supported by laws in some nations (such as Canada) that guarantee citizens a right to speak using a pseudonym. This right does not, however, give citizens the right to demand publication of pseudonymous speech on equipment they do not own. Confidentiality Most Web sites that offer pseudonymity retain information about users. These sites are often susceptible to unauthorized intrusions into their non-public database systems. For example, in 2000, a Welsh teenager obtained information about more than 26,000 credit card accounts, including that of Bill Gates. In 2003, VISA and MasterCard announced that intruders obtained information about 5.6 million credit cards. Sites that offer pseudonymity are also vulnerable to confidentiality breaches. In a study of a Web dating service and a pseudonymous remailer, University of Cambridge researchers discovered that the systems used by these Web sites to protect user data could be easily compromised, even if the pseudonymous channel is protected by strong encryption. Typically, the protected pseudonymous channel exists within a broader framework in which multiple vulnerabilities exist. Pseudonym users should bear in mind that, given the current state of Web security engineering, their true names may be revealed at any time. Online reputations Pseudonymity is an important component of the reputation systems found in online auction services (such as eBay), discussion sites (such as Slashdot), and collaborative knowledge development sites (such as Wikipedia). A pseudonymous user who has acquired a favorable reputation gains the trust of other users. When users believe that they will be rewarded by acquiring a favorable reputation, they are more likely to behave in accordance with the site's policies. If users can obtain new pseudonymous identities freely or at a very low cost, reputation-based systems are vulnerable to whitewashing attacks, also called serial pseudonymity, in which abusive users continuously discard their old identities and acquire new ones in order to escape the consequences of their behavior: "On the Internet, nobody knows that yesterday you were a dog, and therefore should be in the doghouse today." Users of Internet communities who have been banned only to return with new identities are called sock puppets. Whitewashing is one specific form of Sybil attack on distributed systems. The social cost of cheaply discarded pseudonyms is that experienced users lose confidence in new users, and may subject new users to abuse until they establish a good reputation. System operators