7 ms·

> Are we really approaching the reality where we need 2FA to trust the other person is really who they are? Yes we are. We are approaching a world where people

> Are we really approaching the reality where we need 2FA to trust the other person is really who they are? Yes we are. We are approaching a world where people will not want to invest their time, energy, and emotion engaging with other supposed humans remotely unless they have verified their personhood / identity. I'm actually surprised we have not yet seen an entire industry built around human authentication. Seems like Apple is the only company taking this seriously. The standard of human interaction will either be meeting IRL or signing communications biometrically.

NickC25 3y ago
>I'm actually surprised we have not yet seen an entire industry built around human authentication. Seems like Apple is the only company taking this seriously. Completely agree - but to that - with how quickly AI voice cloning is improving, and how quickly image creation tools are improving, how long will it be until someone can sample my voice well enough to command Siri to do something and Siri won't be able to tell the difference? How long will it be until an AI generated photo of me is so realistic that it can unlock my phone via FaceID? I have a feeling that's going to happen in a shorter timeframe than we all think it will. I mean, my voice is somewhat similar to my father's, and if I'm around his phone, I can say "Hey Siri" and his phone will think it's his voice, not mine.
- confoundcofound 3y ago
  We're going to see an arms race between AI and biometrics / authentication technology. My hope is that the latter outpaces the former, but it doesn't seem to be panning out that way. In the future, we might be only able to unlock our phone or command Siri when hooked up to a continuous biometrics sensor.
  - NickC25 3y ago
    You're probably not too far off from what will eventually become reality. Perhaps that's Apple's angle with the AR/VR headset it supposedly has in the works - if you've got your headset on, you can unlock your devices, and if you don't, you have to manually unlock devices via a password or PIN or whatever.
    - hef19898 3y ago
      PIN all the way to the end of times. Preferably without any device being connected to the cloud.
- weaksauce 3y ago
  i mean you'd have to recreate the facial structure in 3d space for that. it's not a flat picture that would do it but lasers and the like.
dmix 3y ago
The bulk of this remains a solvable security issue almost entirely centred around telecom. Spoofing caller IDs is way too easy. SIM swapping is also another issue that can be addressed with better security practices by phone companies. Most young people these days aren't even using phone numbers/SMS these days except when forced to, so the threat will remain with the older generation and either die off with them or until the phone companies solve this problem... Or some digital voice system replaces it. Otherwise it's just email phishing. Anything involving money transfers is already locked down and mostly a matter of fooling people... Which again is mostly older people with a poor grasp of technology and common threats (modern street smarts).
- Hizonner 3y ago
  Read the story. Notice that the call came from an unknown number, and the scammer was playing the role of a kidnapper calling from the kidnapper's phone, and the "authentication" was the daughter's faked voice. There's nothing the telecom system could have done about that. This particular attack circumvented any possibility of "telecom security" being useful. And if "telecom security" gets better, there's more incentive for scammers to keep finding ways to make it irrelevant. If you want a technical solution, you have to demand that a person always contact you from their own device as "2FA", or at least that they some kind of 2FA device on them... except there are a billion ways that somebody might lose access to such a device when they were in genuine trouble, and scammers are totally capable of making it look like one of those scenarios has happened. You're really down to the point where people have to do "mind to mind" authentication with shared secret knowledge... while under extreme stress... in a case that's uncommon enough that most people will not have practiced it. This is not so great.
  - jackothy 3y ago
    This is just what GP called "modern street smarts". People won't keep getting fooled like this for long. Just like people had to learn to stop trusting everything they heard on TV, and learn to stop trusting every pop-up on every website. We will develop new habits, such as what you call "mind to mind authentication" or verifying through a separate trusted channel.
pempem 3y ago
This is starting to happen when you engage with the state (small "s" in the US). Things like pictures of your drivers license and 180degree videos of your face further coupled with a quick facetime video with a real person reviewing the data. It feels horrible, invasive and like the state has outsourced it to a third party you dont know and have no control/direct engagement with. Every single time historically that we've had this level of authentication, there is a 'strong man' type that uses this information against the population. Whether its simple strong societal shame in smaller communities or its a massive program to track and/or persecute a group of people.
david_allison 3y ago
> We are approaching a world where people will not want to invest their time, energy, and emotion engaging with other supposed humans remotely unless they have verified their personhood / identity. We were past it years ago in some domains. I used to do a lot of language exchanges, and there is/was a need to screen for people who are solely using machine translation. It's pointless correcting someone using machine-generated output.
varrock 3y ago
> The standard of human interaction will either be meeting IRL or signing communications biometrically. From a convenience standpoint, it seems like we've gotten so technologically advanced that we are starting to move backwards. Is there a name for this type of phenomenon?
- confoundcofound 3y ago
  I see it as a step forward. The physical world is what we are fully integrated into as embodied beings along dimensions we do not yet and may never understand. It is the only space that has an inherently scarce quality, which seems to be something we need as humans. IMO technology should enable us to deepen our connection in the "real world," not isolate us in piss poor representations built on the belief that we are merely mind-bearing mechanical vessels to be manipulated. AI is going to drive us back to fully-embodied living, and that's good.
  - mikrotikker 3y ago
    The next generation are already ditching smartphones
- layer8 3y ago
  Sigmoid curve (or the derivative of it).
pixl97 3y ago
>signing communications biometrically. Um, you do see the problems with using biometrics, right?
hef19898 3y ago
>> The standard of human interaction will either be meeting IRL or signing communications biometrically. Isn't Sam Altman involved in some Crypto company trying to collect biometrical data, using some orb thing, in exchange for worthless crypto? No idea if he still is, but I am more and more convinced that some folks took every single cyber punk story not as a satire or warning, but as a playbook and something to strife for.

NickC25 3y ago

>I'm actually surprised we have not yet seen an entire industry built around human authentication. Seems like Apple is the only company taking this seriously. Completely agree - but to that - with how quickly AI voice cloning is improving, and how quickly image creation tools are improving, how long will it be until someone can sample my voice well enough to command Siri to do something and Siri won't be able to tell the difference? How long will it be until an AI generated photo of me is so realistic that it can unlock my phone via FaceID? I have a feeling that's going to happen in a shorter timeframe than we all think it will. I mean, my voice is somewhat similar to my father's, and if I'm around his phone, I can say "Hey Siri" and his phone will think it's his voice, not mine.

confoundcofound 3y ago
We're going to see an arms race between AI and biometrics / authentication technology. My hope is that the latter outpaces the former, but it doesn't seem to be panning out that way. In the future, we might be only able to unlock our phone or command Siri when hooked up to a continuous biometrics sensor.
- NickC25 3y ago
  You're probably not too far off from what will eventually become reality. Perhaps that's Apple's angle with the AR/VR headset it supposedly has in the works - if you've got your headset on, you can unlock your devices, and if you don't, you have to manually unlock devices via a password or PIN or whatever.
  - hef19898 3y ago
    PIN all the way to the end of times. Preferably without any device being connected to the cloud.
weaksauce 3y ago
i mean you'd have to recreate the facial structure in 3d space for that. it's not a flat picture that would do it but lasers and the like.

dmix 3y ago

The bulk of this remains a solvable security issue almost entirely centred around telecom. Spoofing caller IDs is way too easy. SIM swapping is also another issue that can be addressed with better security practices by phone companies. Most young people these days aren't even using phone numbers/SMS these days except when forced to, so the threat will remain with the older generation and either die off with them or until the phone companies solve this problem... Or some digital voice system replaces it. Otherwise it's just email phishing. Anything involving money transfers is already locked down and mostly a matter of fooling people... Which again is mostly older people with a poor grasp of technology and common threats (modern street smarts).

Hizonner 3y ago
Read the story. Notice that the call came from an unknown number, and the scammer was playing the role of a kidnapper calling from the kidnapper's phone, and the "authentication" was the daughter's faked voice. There's nothing the telecom system could have done about that. This particular attack circumvented any possibility of "telecom security" being useful. And if "telecom security" gets better, there's more incentive for scammers to keep finding ways to make it irrelevant. If you want a technical solution, you have to demand that a person always contact you from their own device as "2FA", or at least that they some kind of 2FA device on them... except there are a billion ways that somebody might lose access to such a device when they were in genuine trouble, and scammers are totally capable of making it look like one of those scenarios has happened. You're really down to the point where people have to do "mind to mind" authentication with shared secret knowledge... while under extreme stress... in a case that's uncommon enough that most people will not have practiced it. This is not so great.
- jackothy 3y ago
  This is just what GP called "modern street smarts". People won't keep getting fooled like this for long. Just like people had to learn to stop trusting everything they heard on TV, and learn to stop trusting every pop-up on every website. We will develop new habits, such as what you call "mind to mind authentication" or verifying through a separate trusted channel.

pempem 3y ago

This is starting to happen when you engage with the state (small "s" in the US). Things like pictures of your drivers license and 180degree videos of your face further coupled with a quick facetime video with a real person reviewing the data. It feels horrible, invasive and like the state has outsourced it to a third party you dont know and have no control/direct engagement with. Every single time historically that we've had this level of authentication, there is a 'strong man' type that uses this information against the population. Whether its simple strong societal shame in smaller communities or its a massive program to track and/or persecute a group of people.

david_allison 3y ago

> We are approaching a world where people will not want to invest their time, energy, and emotion engaging with other supposed humans remotely unless they have verified their personhood / identity. We were past it years ago in some domains. I used to do a lot of language exchanges, and there is/was a need to screen for people who are solely using machine translation. It's pointless correcting someone using machine-generated output.

varrock 3y ago

> The standard of human interaction will either be meeting IRL or signing communications biometrically. From a convenience standpoint, it seems like we've gotten so technologically advanced that we are starting to move backwards. Is there a name for this type of phenomenon?

confoundcofound 3y ago
I see it as a step forward. The physical world is what we are fully integrated into as embodied beings along dimensions we do not yet and may never understand. It is the only space that has an inherently scarce quality, which seems to be something we need as humans. IMO technology should enable us to deepen our connection in the "real world," not isolate us in piss poor representations built on the belief that we are merely mind-bearing mechanical vessels to be manipulated. AI is going to drive us back to fully-embodied living, and that's good.
- mikrotikker 3y ago
  The next generation are already ditching smartphones
layer8 3y ago
Sigmoid curve (or the derivative of it).

pixl97 3y ago

>signing communications biometrically. Um, you do see the problems with using biometrics, right?

hef19898 3y ago

>> The standard of human interaction will either be meeting IRL or signing communications biometrically. Isn't Sam Altman involved in some Crypto company trying to collect biometrical data, using some orb thing, in exchange for worthless crypto? No idea if he still is, but I am more and more convinced that some folks took every single cyber punk story not as a satire or warning, but as a playbook and something to strife for.