5 ms·

Sounds like it would be a good idea for authors to start providing checksums for their papers

by bnj 5y ago

jazzyjackson 5y ago
Right it’s not insurmountable, authors can publish public keys and sign the files - it’s a UI/UX problem like everything else in crypto. Keybase makes it fairly easy, but people still have to learn what it means and why it’s trustworthy - my bet is things don’t change, there is a small percentage of people who understand how to verify the source, and the general population who either believes anything or nothing. In the context of scientists and professionals tho maybe it is achievable to do some outreach and get people on eg keybase, something user friendly
- ithkuil 5y ago
  Most people I've been advocating Keybase to, just assumed it's yet another place where you create an account and hence you must trust them (now owned by zoom, boo-hoo). I found it well explained etc, but it's hard to reach everybody.
  - toomuchtodo 5y ago
    Lets say Zoom wanted to sell Keybase. Lets say they wanted to sell it to someone like myself, who would run it in a non profit like a utility, similar to Let's Encrypt. Lets say I'd then integrate it with Stripe Identity and gov IDP providers (US: login.gov, UK: gov.uk verify). This would then allow you to publicly sign damn near everything with an identity you could choose to (but not be required to!) connect to your IRL identity. That sounds what's needed, an extension of your IRL identity with top notch tooling to manage signatures (what PGP/GPG should've been) instead of docusign and similar that are charging an arm and a leg to "sign" PDFs with generated initials and signatures. We could go further; the signature is human readable in the rendered PDF (or whatever), and the Internet Archive takes a snapshot as an oracle notary when published, similar to Certificate Transparency for certs, but for all sorts of digital artifacts (the Internet Archive's snapshots have been used by a court of law for evidence authentication, so it's a trusted system [1]). It ain't hard, it's just work. [1] https://www.theregister.com/2018/09/04/wayback_machine_legit/ https://www.theregister.com/2018/09/04/wayback_machine_legit...
viraptor 5y ago
Unfortunately that's not practical. When you download from a uni gateway, pdfs are often auto-watermarked with the source. That way the authors have no idea what checksum you see. And the places which don't do that yet could easily start padding the end of the pdf with a random number of spaces to stop verification efforts.
- sli 5y ago
  It would be kind of neat if that could be layered so that one could not only verify that their source-provided copy is legit, but also that the underlying paper itself has also not been modified.
  - johnisgood 5y ago
    It should be pretty easy to do, to be fair. There are many ways. The easiest would be to have a compressed file (or whatever) that is signed with the source you downloaded it from (and the digest published), and the PDF itself would be signed with the authors' private key. It is not the best way to do it, but it could work.
vbezhenar 5y ago
Torrent file is a checksum.
- 6510 5y ago
  Yes, the price we pay for the exploitation of stupid movies? Torrents should be the standard way to distribute anything.
user3939382 5y ago
Checksums are for error correction, I think you’re referring to digital signing, unless I’m misunderstanding the issue being referred to
- marcosdumay 5y ago
  In the context of sharing data between people, people use checksums with the same meaning as cryptographic hashes, as anything else would break for nearly all use-cases. Digital signatures are actually overkill. The same infrastructure one uses to discover the authorship of a paper can distribute file hashes without any loss of autentiction, and I don't think anybody needs the non-refutation feature they bring. Maybe there is a nice use case for a paper authorship database with a PKI, but to my view the idea goes against an open scientific community that I think is much more valuable. (But again, maybe there is a way to have both.)
johnisgood 5y ago
You can store revisions in a Merkle tree, too.

Sounds like it would be a good idea for authors to start providing checksums for their papers

by bnj 5y ago

Sounds like it would be a good idea for authors to start providing checksums for their papers

Right it’s not insurmountable, authors can publish public keys and sign the files - it’s a UI/UX problem like everything else in crypto. Keybase makes it fairly easy, but people still have to learn what it means and why it’s trustworthy - my bet is things don’t change, there is a small percentage of people who understand how to verify the source, and the general population who either believes anything or nothing. In the context of scientists and professionals tho maybe it is achievable to do some outreach and get people on eg keybase, something user friendly

ithkuil 5y ago
Most people I've been advocating Keybase to, just assumed it's yet another place where you create an account and hence you must trust them (now owned by zoom, boo-hoo). I found it well explained etc, but it's hard to reach everybody.
- toomuchtodo 5y ago
  Lets say Zoom wanted to sell Keybase. Lets say they wanted to sell it to someone like myself, who would run it in a non profit like a utility, similar to Let's Encrypt. Lets say I'd then integrate it with Stripe Identity and gov IDP providers (US: login.gov, UK: gov.uk verify). This would then allow you to publicly sign damn near everything with an identity you could choose to (but not be required to!) connect to your IRL identity. That sounds what's needed, an extension of your IRL identity with top notch tooling to manage signatures (what PGP/GPG should've been) instead of docusign and similar that are charging an arm and a leg to "sign" PDFs with generated initials and signatures. We could go further; the signature is human readable in the rendered PDF (or whatever), and the Internet Archive takes a snapshot as an oracle notary when published, similar to Certificate Transparency for certs, but for all sorts of digital artifacts (the Internet Archive's snapshots have been used by a court of law for evidence authentication, so it's a trusted system [1]). It ain't hard, it's just work. [1] https://www.theregister.com/2018/09/04/wayback_machine_legit/ https://www.theregister.com/2018/09/04/wayback_machine_legit...

viraptor 5y ago

Unfortunately that's not practical. When you download from a uni gateway, pdfs are often auto-watermarked with the source. That way the authors have no idea what checksum you see. And the places which don't do that yet could easily start padding the end of the pdf with a random number of spaces to stop verification efforts.

sli 5y ago
It would be kind of neat if that could be layered so that one could not only verify that their source-provided copy is legit, but also that the underlying paper itself has also not been modified.
- johnisgood 5y ago
  It should be pretty easy to do, to be fair. There are many ways. The easiest would be to have a compressed file (or whatever) that is signed with the source you downloaded it from (and the digest published), and the PDF itself would be signed with the authors' private key. It is not the best way to do it, but it could work.

vbezhenar 5y ago

Torrent file is a checksum.

6510 5y ago
Yes, the price we pay for the exploitation of stupid movies? Torrents should be the standard way to distribute anything.

user3939382 5y ago

Checksums are for error correction, I think you’re referring to digital signing, unless I’m misunderstanding the issue being referred to

marcosdumay 5y ago
In the context of sharing data between people, people use checksums with the same meaning as cryptographic hashes, as anything else would break for nearly all use-cases. Digital signatures are actually overkill. The same infrastructure one uses to discover the authorship of a paper can distribute file hashes without any loss of autentiction, and I don't think anybody needs the non-refutation feature they bring. Maybe there is a nice use case for a paper authorship database with a PKI, but to my view the idea goes against an open scientific community that I think is much more valuable. (But again, maybe there is a way to have both.)

johnisgood 5y ago

You can store revisions in a Merkle tree, too.