5 ms·

Does this trend bring us into the promised "post-truth" world? ...or will it force humanity to finally acknowledge the very basic security concept of public/pr

Does this trend bring us into the promised "post-truth" world? ...or will it force humanity to finally acknowledge the very basic security concept of public/private keys for signing important shit?

yonixw 7y ago
Simple "Only act on official mail" policy can defeat this post-apocalypse deep-fake terminator.
- jjoonathan 7y ago
  Sure, so long as the official mail is set up to check public/private keys!
  - yonixw 7y ago
    My point is, even with quantum computing™, all you need is simple email server with 3 attempt before user lock. If you can't manage this, public key is not the answer. I Have seen only <10 scenarios when private key in the user hands solves the problem. None were scam related.
    - jjoonathan 7y ago
      > simple email server These days, DKIM is necessary for even the simplest of email servers that wants to interact with any of the major email platforms.
michannne 7y ago
I hope it does. I have for years thought about the two possible post-fake worlds we can end up with, either everyone learning gradually on their own how to tell truth from fiction and learning how to efficiently do their own research, or a mass-surveillance system designed to 'protect' those that 'cannot determine truth from fiction themselves'. I guess we'll see faster than I thought.
segfaultbuserr 7y ago
I recently chatted about the potential use of DeepFake in future propaganda with other HN readers, and apparently it's going to be here soon. You may want to follow this thread, https://news.ycombinator.com/item?id=21269150 https://news.ycombinator.com/item?id=21269150 But in short, Several observations... * A major threat is end-to-end VoIP/telephony encryption. Currently, the most common way to verify one's public key and ensure that no MITM wiretapping is going on, is reading a hash (encoded to words) aloud in a phone conversation. It's used to many protocols, such as Signal, or ZRTP by Phil Zimmermann et al. There is no real security, but it's considered a shortcut with reasonable security for most people, the assumption is that voice synthesis cannot be done in real-time yet. But with DeepFake it's disastrous for cryptography. Now, this shortcut is going to be blocked soon. Full verification, like signing your VoIP key with your long-term public key, or asking security questions (e.g. OTR's SMP algorithm) is needed (perhaps not to everyone, but it's now required for a lot of people to a greater extent). * KirinDave suggested that, in additional to signing, timestamping will also be important. If automatic synthesis of video and audio becomes widespread, one way to prove the authenticity of the material is to timestamp it as soon as it's recorded, or even timestamping it in real-time if real-time forgery is a serious threat (I hope not). This is one of few use cases that a blockchain actually makes sense if you want minimum trust over 3rd-parties. The final thought is that it's time to rewatch Ghost in The Shell (the TV animation series, not the movie). Released in 2000s, it portrayed and predicted our world remarkably well, and it'll give you a lot of inspirations of what would the future society look like. In one episode, the protagonists realized a government conspiracy aimed to intensify a military conflict that involves nuclear weapon, and they had the following dialogue. > "How do we stop it? Can we post the video footage online?" > "No. Video footage is seen as completely untrustworthy today."
- filoeleven 7y ago
  Your second observation regarding time stamps is something I’m really interested in. The broader topic is provenance: the ability to say “this AV stream came from this device at this time.” I just wrote a post echoing KirinDave’s idea but perhaps expanding the scope in this thread: https://news.ycombinator.com/item?id=21526278 https://news.ycombinator.com/item?id=21526278 The more verifiable pieces of data that you can associate with a recording, the more you can trust that it came from when/who it claims to. If I send a recording that can be tied to: - a timestamp service with my request for one stored in a blockchain, - a tamper-evident device that signs the data with its own private key, - my own private key then you can have a high degree of certainty that I am the one who recorded and sent the content and that it has not been altered. I could still be tied to a chair while a voice actor impersonates me and forces me to send it. This is after all basically the modern equivalent of a proof-of-life photo with the kidnapped victim holding today’s newspaper. But it’s a lot more effort for someone to go through compared to having none of those other guarantees. It’s a fascinating topic that will only become more relevant as deepfaking gets easier. Whoever makes the first device/system to do this, if it’s not a flawed premise, will make a pretty penny.
Avamander 7y ago
I think most countries can't solve the authenticity/signing problem until they admit that a central trust/PKI database is basically a requirement. Some countries vehemently seem to oppose such systems and will do so for a long long while, for a good reason with all these real issues without? We don't know yet. There is at least some hope for EU citizens, that they wouldn't have to worry about these authorization/identity issues, because the entire European Union just recently created the legislative framework required for solving this problem in the entire EU. With national trust/PKI services there isn't any need to resort to insecure ancient methods (phone calls, fax) that can be spoofed or intercepted, with increasing simplicity. It is somewhat sad how long it has taken, nearly 20 years later the EU is following Estonia's practice/example! I might be biased about how good such systems are as an Estonian, but it isn't bias speaking that the system seems to work - issues like identity theft and account takeovers generally don't exist here. The fact that we have to specifically teach people how to use mostly foreign services safely, because none of them can provide really secure authentication and identification together, says quite a lot about the differences.
thdrdt 7y ago
I think somtimes it's difficult to pin point how far we can go with not telling the truth. For example: I create photorealistic product pictures in 3D (Blender). This saves my customers a lot of money. But the thing is: we present fake pictures to the world looking very real. The products look perfect as render but in the real world this can be a little different. Another example is IKEA. Almost everything you see in their catalogs is 3D rendered. In those renders everything fits together perfectly. But when you build it at home you might see millimeter offsets. Maybe those are exteme examples but truth is not black and white.
- Barrin92 7y ago
  at least in advertisement people are aware that they're looking at curated content, even though it still might have a negative effect because you can't escape it altogether even if you know it. But these deepfake scams or fake news or what have you goes a step further because it intrudes into what is supposed to be authentic and genuine.
threwawasy1228 7y ago
I think it probably will, it is just a matter of time before political actors use this kind of thing to invent dirt on someone. We are probably going to get into an era where everyone deepfakes every politicians voice saying all sorts of wacky stuff and passes it off as real. "Oh why is the quality bad? I was recording it secretly on my phone in my pocket that's why it is muffled and sounds off" Will be the explanation for all of these, it will come to such a head that politicians will be able to say anything they want to people, racist, sexist, genocidal, whatever, and continuously claim that it was merely deepfake, and thus not their opinion. People will invent world events out of thin air with deepfake footage and audio. If the CIA cut off the internet access of a small island nation, and create a bunch of deepfakes of a politician stepping down, whilst covertly doing operations on them how would anyone in the west ever know it wasn't real?
misterdoubt 7y ago
Were we in a "pre-truth" world a century ago?
- ta999999171 7y ago
  Definitely. Remember when people used to let their kids fuckin play outside? =\ Sometimes for 12 hours! We're less violent as a planet/society than ever. But back then, the "gore" of all of humanity's everyday life wasn't smashed into our faces as a routine - only occasionally, as life dished it out to us personally.

Does this trend bring us into the promised "post-truth" world? ...or will it force humanity to finally acknowledge the very basic security concept of public/private keys for signing important shit?

yonixw 7y ago

Simple "Only act on official mail" policy can defeat this post-apocalypse deep-fake terminator.

jjoonathan 7y ago
Sure, so long as the official mail is set up to check public/private keys!
- yonixw 7y ago
  My point is, even with quantum computing™, all you need is simple email server with 3 attempt before user lock. If you can't manage this, public key is not the answer. I Have seen only <10 scenarios when private key in the user hands solves the problem. None were scam related.
  - jjoonathan 7y ago
    > simple email server These days, DKIM is necessary for even the simplest of email servers that wants to interact with any of the major email platforms.

michannne 7y ago

I hope it does. I have for years thought about the two possible post-fake worlds we can end up with, either everyone learning gradually on their own how to tell truth from fiction and learning how to efficiently do their own research, or a mass-surveillance system designed to 'protect' those that 'cannot determine truth from fiction themselves'. I guess we'll see faster than I thought.

segfaultbuserr 7y ago

I recently chatted about the potential use of DeepFake in future propaganda with other HN readers, and apparently it's going to be here soon. You may want to follow this thread, https://news.ycombinator.com/item?id=21269150 https://news.ycombinator.com/item?id=21269150 But in short, Several observations... * A major threat is end-to-end VoIP/telephony encryption. Currently, the most common way to verify one's public key and ensure that no MITM wiretapping is going on, is reading a hash (encoded to words) aloud in a phone conversation. It's used to many protocols, such as Signal, or ZRTP by Phil Zimmermann et al. There is no real security, but it's considered a shortcut with reasonable security for most people, the assumption is that voice synthesis cannot be done in real-time yet. But with DeepFake it's disastrous for cryptography. Now, this shortcut is going to be blocked soon. Full verification, like signing your VoIP key with your long-term public key, or asking security questions (e.g. OTR's SMP algorithm) is needed (perhaps not to everyone, but it's now required for a lot of people to a greater extent). * KirinDave suggested that, in additional to signing, timestamping will also be important. If automatic synthesis of video and audio becomes widespread, one way to prove the authenticity of the material is to timestamp it as soon as it's recorded, or even timestamping it in real-time if real-time forgery is a serious threat (I hope not). This is one of few use cases that a blockchain actually makes sense if you want minimum trust over 3rd-parties. The final thought is that it's time to rewatch Ghost in The Shell (the TV animation series, not the movie). Released in 2000s, it portrayed and predicted our world remarkably well, and it'll give you a lot of inspirations of what would the future society look like. In one episode, the protagonists realized a government conspiracy aimed to intensify a military conflict that involves nuclear weapon, and they had the following dialogue. > "How do we stop it? Can we post the video footage online?" > "No. Video footage is seen as completely untrustworthy today."

filoeleven 7y ago
Your second observation regarding time stamps is something I’m really interested in. The broader topic is provenance: the ability to say “this AV stream came from this device at this time.” I just wrote a post echoing KirinDave’s idea but perhaps expanding the scope in this thread: https://news.ycombinator.com/item?id=21526278 https://news.ycombinator.com/item?id=21526278 The more verifiable pieces of data that you can associate with a recording, the more you can trust that it came from when/who it claims to. If I send a recording that can be tied to: - a timestamp service with my request for one stored in a blockchain, - a tamper-evident device that signs the data with its own private key, - my own private key then you can have a high degree of certainty that I am the one who recorded and sent the content and that it has not been altered. I could still be tied to a chair while a voice actor impersonates me and forces me to send it. This is after all basically the modern equivalent of a proof-of-life photo with the kidnapped victim holding today’s newspaper. But it’s a lot more effort for someone to go through compared to having none of those other guarantees. It’s a fascinating topic that will only become more relevant as deepfaking gets easier. Whoever makes the first device/system to do this, if it’s not a flawed premise, will make a pretty penny.

Avamander 7y ago

I think most countries can't solve the authenticity/signing problem until they admit that a central trust/PKI database is basically a requirement. Some countries vehemently seem to oppose such systems and will do so for a long long while, for a good reason with all these real issues without? We don't know yet. There is at least some hope for EU citizens, that they wouldn't have to worry about these authorization/identity issues, because the entire European Union just recently created the legislative framework required for solving this problem in the entire EU. With national trust/PKI services there isn't any need to resort to insecure ancient methods (phone calls, fax) that can be spoofed or intercepted, with increasing simplicity. It is somewhat sad how long it has taken, nearly 20 years later the EU is following Estonia's practice/example! I might be biased about how good such systems are as an Estonian, but it isn't bias speaking that the system seems to work - issues like identity theft and account takeovers generally don't exist here. The fact that we have to specifically teach people how to use mostly foreign services safely, because none of them can provide really secure authentication and identification together, says quite a lot about the differences.

thdrdt 7y ago

I think somtimes it's difficult to pin point how far we can go with not telling the truth. For example: I create photorealistic product pictures in 3D (Blender). This saves my customers a lot of money. But the thing is: we present fake pictures to the world looking very real. The products look perfect as render but in the real world this can be a little different. Another example is IKEA. Almost everything you see in their catalogs is 3D rendered. In those renders everything fits together perfectly. But when you build it at home you might see millimeter offsets. Maybe those are exteme examples but truth is not black and white.

Barrin92 7y ago
at least in advertisement people are aware that they're looking at curated content, even though it still might have a negative effect because you can't escape it altogether even if you know it. But these deepfake scams or fake news or what have you goes a step further because it intrudes into what is supposed to be authentic and genuine.

threwawasy1228 7y ago

I think it probably will, it is just a matter of time before political actors use this kind of thing to invent dirt on someone. We are probably going to get into an era where everyone deepfakes every politicians voice saying all sorts of wacky stuff and passes it off as real. "Oh why is the quality bad? I was recording it secretly on my phone in my pocket that's why it is muffled and sounds off" Will be the explanation for all of these, it will come to such a head that politicians will be able to say anything they want to people, racist, sexist, genocidal, whatever, and continuously claim that it was merely deepfake, and thus not their opinion. People will invent world events out of thin air with deepfake footage and audio. If the CIA cut off the internet access of a small island nation, and create a bunch of deepfakes of a politician stepping down, whilst covertly doing operations on them how would anyone in the west ever know it wasn't real?

misterdoubt 7y ago

Were we in a "pre-truth" world a century ago?

ta999999171 7y ago
Definitely. Remember when people used to let their kids fuckin play outside? =\ Sometimes for 12 hours! We're less violent as a planet/society than ever. But back then, the "gore" of all of humanity's everyday life wasn't smashed into our faces as a routine - only occasionally, as life dished it out to us personally.