3 ms·

But those certs can come with reputations attached, and it prevents people from claiming that they're representatives of well known companies.

by ericd 4y ago

MattPalmer1086 4y ago
Well, that would create strong financial incentives to compromise company certificates, which I'm sure would then happen. And you still don't know if your taking to a human or an AI.
- lukevp 4y ago
  Like the strong financial incentives to compromise certificates owned by banking websites? Securing voice communications the same as website communications is an awesome idea, and the fact that it’s possible to steal some piece of data and compromise it shouldn’t prevent us from moving in that direction.
  - MattPalmer1086 4y ago
    It has happened, but there has to be a big pay off to make it worthwhile. Smaller companies would likely be more frequent targets given they would be easier to compromise. By the way, I'm not suggesting that the idea is useless. I'm just pointing out it isn't a panacea, and it still doesn't address the core problem raised in the article that you don't know if you are speaking to a human or not.
    - XorNot 4y ago
      But the point is that the pay off itself is limited. Smaller companies have a much smaller pool of people who would have any reason to accept unsolicited calls. This is evident in how scams work today: you either get explicitly targeted, or you dragnet using some service which everyone has i.e. a bank, the tax office, or a telecom company. Compromising "Joe's BBQ Emporium" might be easier, but it's still (1) something you have to do (and maybe get caught then) and (2) the number of people who are going to pick up, or not immediately blacklist unsolicited calls from "Joe's BBQ Emporium" is tiny.
- ericd 4y ago
  Does it matter if you’re talking to a human or an AI? The main thing is its intent - is it helpful, or malicious? And attaching communications to persistent reputations via certs can help guess at that.
  - MattPalmer1086 4y ago
    It matters because an AI can contact many more potential victims that a human can. It makes the cost of attack much lower.
pixl97 4y ago
Where does the reputation come from? Is it going to work like our already questionable anti-spam systems?
- XorNot 4y ago
  You don't need reputation systems: I can count on two hands the number of organizations that have any reason to be contacting me unsolicited. Add a minor tie-in with my bank, and my reputation list would essentially be "the government, my bank, my doctor, my insurer + any company I've done monetary transactions with recently". And realistically in a world with this system, this is all already implemented by my phone's contact list - no more phone numbers would mean that there's no reason to think that any organization would be contacting me from a totally unique (or anonymous) identity. Instead I'd just have a contact book whitelist entry for "bank.com.au" or whatever scheme we ended up with. As it is right now, actual government services call people from Caller ID blocked numbers, and don't widely publish allowable contact origins. Which is ridiculous.

But those certs can come with reputations attached, and it prevents people from claiming that they're representatives of well known companies.

by ericd 4y ago

But those certs can come with reputations attached, and it prevents people from claiming that they're representatives of well known companies.

MattPalmer1086 4y ago

Well, that would create strong financial incentives to compromise company certificates, which I'm sure would then happen. And you still don't know if your taking to a human or an AI.

lukevp 4y ago
Like the strong financial incentives to compromise certificates owned by banking websites? Securing voice communications the same as website communications is an awesome idea, and the fact that it’s possible to steal some piece of data and compromise it shouldn’t prevent us from moving in that direction.
- MattPalmer1086 4y ago
  It has happened, but there has to be a big pay off to make it worthwhile. Smaller companies would likely be more frequent targets given they would be easier to compromise. By the way, I'm not suggesting that the idea is useless. I'm just pointing out it isn't a panacea, and it still doesn't address the core problem raised in the article that you don't know if you are speaking to a human or not.
  - XorNot 4y ago
    But the point is that the pay off itself is limited. Smaller companies have a much smaller pool of people who would have any reason to accept unsolicited calls. This is evident in how scams work today: you either get explicitly targeted, or you dragnet using some service which everyone has i.e. a bank, the tax office, or a telecom company. Compromising "Joe's BBQ Emporium" might be easier, but it's still (1) something you have to do (and maybe get caught then) and (2) the number of people who are going to pick up, or not immediately blacklist unsolicited calls from "Joe's BBQ Emporium" is tiny.
ericd 4y ago
Does it matter if you’re talking to a human or an AI? The main thing is its intent - is it helpful, or malicious? And attaching communications to persistent reputations via certs can help guess at that.
- MattPalmer1086 4y ago
  It matters because an AI can contact many more potential victims that a human can. It makes the cost of attack much lower.

pixl97 4y ago

Where does the reputation come from? Is it going to work like our already questionable anti-spam systems?

XorNot 4y ago
You don't need reputation systems: I can count on two hands the number of organizations that have any reason to be contacting me unsolicited. Add a minor tie-in with my bank, and my reputation list would essentially be "the government, my bank, my doctor, my insurer + any company I've done monetary transactions with recently". And realistically in a world with this system, this is all already implemented by my phone's contact list - no more phone numbers would mean that there's no reason to think that any organization would be contacting me from a totally unique (or anonymous) identity. Instead I'd just have a contact book whitelist entry for "bank.com.au" or whatever scheme we ended up with. As it is right now, actual government services call people from Caller ID blocked numbers, and don't widely publish allowable contact origins. Which is ridiculous.