4 ms·
I don’t understand the fascination with DKIM on this thread. Yes, journalists verified it. But they consider it supporting data, just as they wouldn’t automati
by beagle3 6y ago
I don’t understand the fascination with DKIM on this thread.
Yes, journalists verified it. But they consider it supporting data, just as they wouldn’t automatically ignore any email that had no DKIM signature.
Phone calls are never authenticated. Does anyone automatically believe or disbelieve recorded phone calls?
I mean, “conspiracy theorists” (in the common usage of that terms) already believe only what they want to believe.
- woodruffw 6y agoI don't think it's a fascination, it's what the OP is about. We're talking about the subject of a blog post, no? I think the point boils down to expectation management: journalists (and ...) barely understand non-repudiation, much less why each of the following scenarios pans out: * 2006 email + 512-bit RSA, leaked in 2006: probably authentic * 2008 email + 512-bit RSA, leaked in 2012: potentially inauthentic * 2008 email + 1024-bit RSA, leaked in 2008: probably authentic * 2008 email + 1024-bit RSA, leaked in 2016: potentially inauthentic ...and so on. In sum: we're making life harder for the people doing real investigative work (since they're not technical), and we're giving fodder to the people who want to conspiracize. All because we're using a spam mitigation technique to provide properties that it was never intended to provide.
- beagle3 6y agoThe right solution in this case is to educate journalists - they are up to date on things like deep fakes and should be on DKIM. The wrong solution is to make previously private keys public to make any reasoning about past data impossible in the name of “hut journalists might get a wrong impression”
- couchand 6y agoThe OP is looking for a systemic solution to the problem, somewhat akin to the way establishing a bug bounty program aligns incentives. Your solution is like asking your team to please work harder to not release exploitable bugs.
- whoisburbansky 6y agoAgreed, grandparents proposed solution is basically the same as pushing for users to be better trained to protect themselves from phishing, which has shown to be ineffective time and again and is downright masochistic when an easier system solution exists.
- beagle3 6y agoWhat I don't understand is why it is clear to almost everyone but myself that DKIM-truth incentives are different than deepfake-truth incentives. And yet, the deepfake equivalent to the suggested solution is one of "start showing deepfake as news" or "stop showing any video as news", neither of which anyone would consider a reasonable response to deepfakes. I just don't understand how DKIM is suddenly so revered as truth when almost no one knows what it is.
- Quekid5 6y agoThat is... naive. The incentives for journalists don't necessarily align the the interests of the general public (transparency, thorough research, etc. etc.). The point is that DKIM can be abused to lend undue credibility to falsified data... not that it can credibly attest true data. These is absolutely no way you're going be able to educate the general public on the nuances of this. I mean, there are lots and lots of people who doubt the efficacy of vaccines and masks...
- beagle3 6y ago> The point is that DKIM can be abused to lend undue credibility to falsified data... not that it can credibly attest true data. So can deep fakes. What makes deep fakes explainable and DKIM unexplainable? If the journalists interests do not align about DKIM, how come they align about deepfakes? I'm not saying journalists have any integrity. I'm just wondering why specifically for DKIM a "throw the baby out with the bathwater" solution is advocated, whereas for things like deep fake it isn't -- where the underlying truth is the same: "You can't trust what you see/hear".
- Quekid5 6y agoEDIT: Apologies probably wrong name of the phallacy, so I removed that. Regardless, the fact that deep-fakes exist has absolutely no impact on whether DKIM has problems or not.