5 ms·

At some point natural people are going to use cryptographic signatures just to authenticate themselves in daily life. No video, audio, or text can be presumed r

At some point natural people are going to use cryptographic signatures just to authenticate themselves in daily life. No video, audio, or text can be presumed real unless signed by the human subject.

zigman1 4y ago
But... That's good no? > No video, audio, or text can be presumed real unless signed by the human subject. Where is the controversy in that?
- rippercushions 4y ago
  It would be nice if we were at 100% signing, but currently we're at ~0%, and the transition is going to be rough.
  - willnonya 4y ago
    Why would that be nice? Follow the thou g ht through to how it would work and what it would mean in terms of privacy for the average person. Your niceties seem dystopian to me.
- jddj 4y ago
  Agreed. The time between now and then is much scarier. Companies can't even wrap their heads around sim swapping scams and social engineering of secret questions.
- Someone 4y ago
  Those subjects could lie. Journalists would have a hard time showing that an interviewee actually said what claim they said. Wire-tapping by the police also would become useless in court. ⇒ I would adjust it to “unless it has a reliably chain of trust”. That would mean that people could judge differently about whether to accept some things as true, but I think that’s unavoidable.
TeMPOraL 4y ago
To do that, any meaningful communication will have to be recorded to be signed by the person, on a device provided to them by their Trust Authority company. Can't be just any device, because the chain of custody is as strong as its weakest link. Depending on the country, the Trust Authorities will be private companies with large regulatory exposure, like banks, or just governments themselves. But hey, at least this will solve the problem of journalists quoting people out of context: they won't be able to claim you've said something without you personally signing off on it with your cryptographic key.
- acdha 4y ago
  There’d be a variable scale of trust: for many people, a signature from a generic phone would be fine since nobody is going to attack the secure element just to forge a valid signature. National level politics, or a billionaire’s divorce, could be a very different story, however.
- 323 4y ago
  Or maybe it will be like today - if it's reported by Reuters/... it's trusted, if it's reported by DailyStar, maybe not.
- Asraelite 4y ago
  > Can't be just any device, because the chain of custody is as strong as its weakest link I don't quite understand what you mean. We already trust phones and computers not to be compromised for things like online banking, so why not allow these devices to sign recordings using keys lent to them by the main trust device? You could allow revocation of these keys.
  - TeMPOraL 4y ago
    > We already trust phones and computers not to be compromised for things like online banking Sorta, kinda. "We already trust phones and computers" because we have no better alternatives yet. There's a reason online banking is at the front of the push for device attestation, and thanks for Google happily obliging, rooting your Android phone is pretty much pointless now. This is coupled with a parallel push to do your banking through a mobile app, or at least to use it as a second authentication factor, which makes the app necessary just as much. This means we're already undergoing the transition I'm talking about: in the nearby future, you'll have to use a pristine, unrooted, unmodded phone from a blessed corporate vendor, to perform basic functions like paying for things and managing your account. And yes, such device will be appropriate for signing everything else too - and the vendor owning the key will be your Trust Authority.
lxgr 4y ago
Given that digital signatures have been around for decades, yet banks, the government, and the legal system still treat signed (and potentially notarized) physical paper or scans of it as the gold standard, and SMS-OTP as a close second, I wouldn‘t hold my breath. All digitally approved contracts I‘ve ever encountered were e-"signed" (i.e. me emulating a paper signature at a computer), not digitally signed, due to lack of a mutually trusted public key infrastructure. In that sense, I would be sad but not surprised if we instead moved to a system of "trusted recording devices", where scanners, cameras and microphones by some vendors are defined to be trusted, signing their outputs and leaving the underlying workflows (signatures, recordings of verbal affirmations etc.) largely untouched.
- Semaphor 4y ago
  With all the (deserved) ridicule Germany gets for our failed digitalization efforts, we use public/private key pairs for our taxes, and IIRC even our national ID supports some PKI thing (not sure how that works exactly, never had any use for my ID’s online features, doesn’t seem widespread)
  - lxgr 4y ago
    > not sure how that works exactly, never had any use for my ID’s online features I think that's a pretty apt summary of the state of digital ID in Germany: Commendable technical basis (with some privacy-preserving aspects too, including selective assertions, e.g. "older than 18" or "EU citizen"). When I called about actually getting such an ID card (several times) as a non-citizen, which is explicitly mentioned as a feature of the scheme, I only received the acoustic equivalent of blank stares.
    - Semaphor 4y ago
      When my wife got her temporary residence permit in 2018, it came with exactly the same online features as our national ID card. Yours might have been too old.
      - 4y ago

At some point natural people are going to use cryptographic signatures just to authenticate themselves in daily life. No video, audio, or text can be presumed real unless signed by the human subject.

zigman1 4y ago

But... That's good no? > No video, audio, or text can be presumed real unless signed by the human subject. Where is the controversy in that?

rippercushions 4y ago
It would be nice if we were at 100% signing, but currently we're at ~0%, and the transition is going to be rough.
- willnonya 4y ago
  Why would that be nice? Follow the thou g ht through to how it would work and what it would mean in terms of privacy for the average person. Your niceties seem dystopian to me.
jddj 4y ago
Agreed. The time between now and then is much scarier. Companies can't even wrap their heads around sim swapping scams and social engineering of secret questions.
Someone 4y ago
Those subjects could lie. Journalists would have a hard time showing that an interviewee actually said what claim they said. Wire-tapping by the police also would become useless in court. ⇒ I would adjust it to “unless it has a reliably chain of trust”. That would mean that people could judge differently about whether to accept some things as true, but I think that’s unavoidable.

TeMPOraL 4y ago

To do that, any meaningful communication will have to be recorded to be signed by the person, on a device provided to them by their Trust Authority company. Can't be just any device, because the chain of custody is as strong as its weakest link. Depending on the country, the Trust Authorities will be private companies with large regulatory exposure, like banks, or just governments themselves. But hey, at least this will solve the problem of journalists quoting people out of context: they won't be able to claim you've said something without you personally signing off on it with your cryptographic key.

acdha 4y ago
There’d be a variable scale of trust: for many people, a signature from a generic phone would be fine since nobody is going to attack the secure element just to forge a valid signature. National level politics, or a billionaire’s divorce, could be a very different story, however.
323 4y ago
Or maybe it will be like today - if it's reported by Reuters/... it's trusted, if it's reported by DailyStar, maybe not.
Asraelite 4y ago
> Can't be just any device, because the chain of custody is as strong as its weakest link I don't quite understand what you mean. We already trust phones and computers not to be compromised for things like online banking, so why not allow these devices to sign recordings using keys lent to them by the main trust device? You could allow revocation of these keys.
- TeMPOraL 4y ago
  > We already trust phones and computers not to be compromised for things like online banking Sorta, kinda. "We already trust phones and computers" because we have no better alternatives yet. There's a reason online banking is at the front of the push for device attestation, and thanks for Google happily obliging, rooting your Android phone is pretty much pointless now. This is coupled with a parallel push to do your banking through a mobile app, or at least to use it as a second authentication factor, which makes the app necessary just as much. This means we're already undergoing the transition I'm talking about: in the nearby future, you'll have to use a pristine, unrooted, unmodded phone from a blessed corporate vendor, to perform basic functions like paying for things and managing your account. And yes, such device will be appropriate for signing everything else too - and the vendor owning the key will be your Trust Authority.

lxgr 4y ago

Given that digital signatures have been around for decades, yet banks, the government, and the legal system still treat signed (and potentially notarized) physical paper or scans of it as the gold standard, and SMS-OTP as a close second, I wouldn‘t hold my breath. All digitally approved contracts I‘ve ever encountered were e-"signed" (i.e. me emulating a paper signature at a computer), not digitally signed, due to lack of a mutually trusted public key infrastructure. In that sense, I would be sad but not surprised if we instead moved to a system of "trusted recording devices", where scanners, cameras and microphones by some vendors are defined to be trusted, signing their outputs and leaving the underlying workflows (signatures, recordings of verbal affirmations etc.) largely untouched.

Semaphor 4y ago
With all the (deserved) ridicule Germany gets for our failed digitalization efforts, we use public/private key pairs for our taxes, and IIRC even our national ID supports some PKI thing (not sure how that works exactly, never had any use for my ID’s online features, doesn’t seem widespread)
- lxgr 4y ago
  > not sure how that works exactly, never had any use for my ID’s online features I think that's a pretty apt summary of the state of digital ID in Germany: Commendable technical basis (with some privacy-preserving aspects too, including selective assertions, e.g. "older than 18" or "EU citizen"). When I called about actually getting such an ID card (several times) as a non-citizen, which is explicitly mentioned as a feature of the scheme, I only received the acoustic equivalent of blank stares.
  - Semaphor 4y ago
    When my wife got her temporary residence permit in 2018, it came with exactly the same online features as our national ID card. Yours might have been too old.
    - 4y ago