7 ms·

Aren't digital signatures the best solution we have for this problem? Commercial entities want to have the priviledge of being able to modify the content submi

Aren't digital signatures the best solution we have for this problem? Commercial entities want to have the priviledge of being able to modify the content submitted by content creators, but the culture of trusting i.e. Twitter over client verification needs to change.

korla 6y ago
If the technology is too hard to understand for the masses it's unlikely to provide much resistance to desinformation campaigns.
- TheSpiceIsLife 6y ago
  The technology isn't hard to understand, but even if it were so what? How many people who watch a streaming video know... anything at all about how that content is delivered, at all, at any layer. The problem is, as OP noted, the existing gate keeps profit from being able to manipulate us, so convincing them to deliver signed content is extraordinarily unlikely.
  - deleted 6y ago
    [deleted]
gruez 6y ago
Digital signatures would only match of the contents match bit for bit. This means that you can't recompress/remux/resize the video. This will probably provide a very poor ux for mobile or other bandwidth limited users. Also, if the video was used as part of another video (eg. TV broadcast), you'd either have to splice the digitally signed video into your existing stream (not modifying the bits at all), or provide the digitally signed original as an appendix. In either case, you'll need tooling to make verification easy, which doesn't exist today.
- xiphias2 6y ago
  Fingerprinting can take care of the recompression problems. Remuxing is a hard problem, as it can easily take people out of context, at the same time it's very important to summarize the videos, as people have limited time. Right now what I see though is that Facebook/Google/Twitter aren't even trying to do the bare minimum end-to-end authentication that Whatsapp/Telegram/Signal already does (create a private key on the end devices, and sign the content to verify the authenticity of the publisher). Requiring HTTPS was a great first step for tech companies to protect people and from ISPs. But they do nothing to protect people from themselves being compromised (the Twitter incident was a great proof for this).
  - gruez 6y ago
    > Fingerprinting can take care of the recompression problems. That only opens another problem: adversarial attacks that look totally different, but has a similar fingerprint >Right now what I see though is that Facebook/Google/Twitter aren't even trying to do the bare minimum end-to-end authentication that Whatsapp/Telegram/Signal already does (create a private key on the end devices, and sign the content to verify the authenticity of the publisher). >Requiring HTTPS was a great first step for tech companies to protect people and from ISPs. But they do nothing to protect people from themselves being compromised (the Twitter incident was a great proof for this). Mainly because to 99.9% of users, there's no difference between a message that's signed by the author, and a link to a tweet that's made by the author. Even if you're the 0.1% that do care about public key cryptography it doesn't matter because you're trusting the site to do the verification and key management. It's not like PGP where you can get the public keys and verify yourself. There's also the problem that people simply don't care. Have you seen how many photoshopped tweets end up on social media? If people are willing believe a screenshot without a link (which is trivially easy to add and verify), what makes you think they won't believe a screenshot without a signature?
- vlovich123 6y ago
  Why can't you have digital signatures of the original and have an ML model that can evaluate whether or not it matches? You could run a cloud service to host the signed originals and continuously update the model.
- doomrobo 6y ago
  There's some cryptographic work in this direction. PhotoProof allows a photographer to prove that the image they're presenting is, e.g., the cropped version of the true original image they took. Video is still way out there, but at least people are thinking about this. https://www.cs.tau.ac.il/~tromer/papers/photoproof-oakland16.pdf https://www.cs.tau.ac.il/~tromer/papers/photoproof-oakland16...
- lallysingh 6y ago
  Signature chain for the transformations. The video host signs the pre-recompressed video and provides the original signature.
Nasrudith 6y ago
Signing it doesn't mean it wasn't altered at some point and does nothing to actually verify the content - only if a source is who they say they are. And the key distribution is another issue.
nl 6y ago
Digital signatures are so far away from a solution for this problem they might as well be in a different universe. One of the main ways people share content is by screenshotting it on their phone, or literally taking a photo of a computer screen with their mobile. Good luck using a digital signature to solve that.

korla 6y ago

If the technology is too hard to understand for the masses it's unlikely to provide much resistance to desinformation campaigns.

TheSpiceIsLife 6y ago
The technology isn't hard to understand, but even if it were so what? How many people who watch a streaming video know... anything at all about how that content is delivered, at all, at any layer. The problem is, as OP noted, the existing gate keeps profit from being able to manipulate us, so convincing them to deliver signed content is extraordinarily unlikely.
- deleted 6y ago
  [deleted]

gruez 6y ago

Digital signatures would only match of the contents match bit for bit. This means that you can't recompress/remux/resize the video. This will probably provide a very poor ux for mobile or other bandwidth limited users. Also, if the video was used as part of another video (eg. TV broadcast), you'd either have to splice the digitally signed video into your existing stream (not modifying the bits at all), or provide the digitally signed original as an appendix. In either case, you'll need tooling to make verification easy, which doesn't exist today.

xiphias2 6y ago
Fingerprinting can take care of the recompression problems. Remuxing is a hard problem, as it can easily take people out of context, at the same time it's very important to summarize the videos, as people have limited time. Right now what I see though is that Facebook/Google/Twitter aren't even trying to do the bare minimum end-to-end authentication that Whatsapp/Telegram/Signal already does (create a private key on the end devices, and sign the content to verify the authenticity of the publisher). Requiring HTTPS was a great first step for tech companies to protect people and from ISPs. But they do nothing to protect people from themselves being compromised (the Twitter incident was a great proof for this).
- gruez 6y ago
  > Fingerprinting can take care of the recompression problems. That only opens another problem: adversarial attacks that look totally different, but has a similar fingerprint >Right now what I see though is that Facebook/Google/Twitter aren't even trying to do the bare minimum end-to-end authentication that Whatsapp/Telegram/Signal already does (create a private key on the end devices, and sign the content to verify the authenticity of the publisher). >Requiring HTTPS was a great first step for tech companies to protect people and from ISPs. But they do nothing to protect people from themselves being compromised (the Twitter incident was a great proof for this). Mainly because to 99.9% of users, there's no difference between a message that's signed by the author, and a link to a tweet that's made by the author. Even if you're the 0.1% that do care about public key cryptography it doesn't matter because you're trusting the site to do the verification and key management. It's not like PGP where you can get the public keys and verify yourself. There's also the problem that people simply don't care. Have you seen how many photoshopped tweets end up on social media? If people are willing believe a screenshot without a link (which is trivially easy to add and verify), what makes you think they won't believe a screenshot without a signature?
vlovich123 6y ago
Why can't you have digital signatures of the original and have an ML model that can evaluate whether or not it matches? You could run a cloud service to host the signed originals and continuously update the model.
doomrobo 6y ago
There's some cryptographic work in this direction. PhotoProof allows a photographer to prove that the image they're presenting is, e.g., the cropped version of the true original image they took. Video is still way out there, but at least people are thinking about this. https://www.cs.tau.ac.il/~tromer/papers/photoproof-oakland16.pdf https://www.cs.tau.ac.il/~tromer/papers/photoproof-oakland16...
lallysingh 6y ago
Signature chain for the transformations. The video host signs the pre-recompressed video and provides the original signature.

Nasrudith 6y ago

Signing it doesn't mean it wasn't altered at some point and does nothing to actually verify the content - only if a source is who they say they are. And the key distribution is another issue.

nl 6y ago

Digital signatures are so far away from a solution for this problem they might as well be in a different universe. One of the main ways people share content is by screenshotting it on their phone, or literally taking a photo of a computer screen with their mobile. Good luck using a digital signature to solve that.