3 ms·

> The way out is authenticity. Signed content is the only way to get that. This is the real play IMO. With the push for identity systems that support attestat

> The way out is authenticity. Signed content is the only way to get that. This is the real play IMO. With the push for identity systems that support attestation [1], it doesn't matter if AI is successful at producing high quality results or if it only ever produces massive amounts of pure garbage. In the latter case, it's a huge win for platform owners like Apple, Google, or Microsoft (via TPM) because they're the ones that can attest to you being "not a bot". I wouldn't be surprised if 5 years from now you need a relationship with one of those 3 companies to participate online in any meaningful way. So, even if AI "fails", they'll keep pushing it because it's going to allow them to shift a large portion of internet users to a subscription model for identity and attestation. If you don't pay, your content won't ever get surfaced because the default will be to assume it's generated trash. On the business side we could see schemes that make old-school SSL and code signing systems look like charities. Imagine something like BIMI [2], but for all content you publish, with a pay-per-something scheme. There could even be price discrimination in those systems (similar to OV, EV SSL) where the more you pay the more "trustworthy" you are. My fear is that eventually you'll start seeing government services where identity and auth are handed off to private companies like Google and Apple. Imagine having your real identity tied to an attestation by one of those companies. 1. https://www.w3.org/TR/webauthn/#sctn-defined-attestation-formats https://www.w3.org/TR/webauthn/#sctn-defined-attestation-for... 2. https://bimigroup.org/ https://bimigroup.org/

deleted 3y ago
[deleted]
seabass-labrax 3y ago
I'm glad to see someone else on the Web who's concerned about this. Remote attestation is a triumph of 21st-century cryptography with all kinds of security benefits, but never before in my lifetime have I seen a technology be misappropriated so quickly for dubious purposes. My country (the UK) is one of the worst right now, with the current government on a crusade to make the internet 'safer' by adding checkpoints[1] at various stage to tie your internet usage to your real-world identity. Unlike some other technically advanced countries, though, the UK doesn't have the constitutional robustness to ensure civil liberties under such a regime, nor does the population have what I like to think of as the 'continental temperament' to complain about it. I'd like to make a shout-out to a project in which I participate: the Verifiable Credentials Working Group[2] at the World Wide Web Consortium is the steward of a standard for 'Self-Sovereign Identity' (SSI). This won't be able to fix all the issues with authenticity online, but it will at least provide a way of vouching for others without disclosing personal information. It's a bit like the GPG/PGP 'Web of Trust' idea, but with more sophisticated cryptography such as Zero-Knowledge Proofs. [1]: https://www.eff.org/deeplinks/2023/09/uk-online-safety-bill-will-mandate-dangerous-age-verification-much-web https://www.eff.org/deeplinks/2023/09/uk-online-safety-bill-... [2]: https://www.w3.org/2017/vc/WG/ https://www.w3.org/2017/vc/WG/
l33t7332273 3y ago
> My fear is that eventually you'll start seeing government services where identity and auth are handed off to private companies like Google and Apple One enticing alternative (for the government!) is to require you to upload your actual documents and use some government sanctioned attestation service.
- swiftcoder 3y ago
  And this is how it works in many countries. Here in Spain you physically go down to the social security office, present your photo ID, and they sign your private key - thus providing access to all government websites... In theory. in practice there are 3 competing online ID systems within the Spanish government, which is pretty typical beaurocratic bullshit
espe 3y ago
> My fear is that eventually you'll start seeing government services where identity and auth are handed off to private companies like Google and Apple. Imagine having your real identity tied to an attestation by one of those companies. a general taste for dysfunctional public-private partnerships and the fact that auth is a seriously hard problem at scale, make this scenario a few percentage points more likely than anyone should feel comfortable with.

deleted 3y ago

[deleted]

seabass-labrax 3y ago

I'm glad to see someone else on the Web who's concerned about this. Remote attestation is a triumph of 21st-century cryptography with all kinds of security benefits, but never before in my lifetime have I seen a technology be misappropriated so quickly for dubious purposes. My country (the UK) is one of the worst right now, with the current government on a crusade to make the internet 'safer' by adding checkpoints[1] at various stage to tie your internet usage to your real-world identity. Unlike some other technically advanced countries, though, the UK doesn't have the constitutional robustness to ensure civil liberties under such a regime, nor does the population have what I like to think of as the 'continental temperament' to complain about it. I'd like to make a shout-out to a project in which I participate: the Verifiable Credentials Working Group[2] at the World Wide Web Consortium is the steward of a standard for 'Self-Sovereign Identity' (SSI). This won't be able to fix all the issues with authenticity online, but it will at least provide a way of vouching for others without disclosing personal information. It's a bit like the GPG/PGP 'Web of Trust' idea, but with more sophisticated cryptography such as Zero-Knowledge Proofs. [1]: https://www.eff.org/deeplinks/2023/09/uk-online-safety-bill-will-mandate-dangerous-age-verification-much-web https://www.eff.org/deeplinks/2023/09/uk-online-safety-bill-... [2]: https://www.w3.org/2017/vc/WG/ https://www.w3.org/2017/vc/WG/

l33t7332273 3y ago

> My fear is that eventually you'll start seeing government services where identity and auth are handed off to private companies like Google and Apple One enticing alternative (for the government!) is to require you to upload your actual documents and use some government sanctioned attestation service.

swiftcoder 3y ago
And this is how it works in many countries. Here in Spain you physically go down to the social security office, present your photo ID, and they sign your private key - thus providing access to all government websites... In theory. in practice there are 3 competing online ID systems within the Spanish government, which is pretty typical beaurocratic bullshit

espe 3y ago

> My fear is that eventually you'll start seeing government services where identity and auth are handed off to private companies like Google and Apple. Imagine having your real identity tied to an attestation by one of those companies. a general taste for dysfunctional public-private partnerships and the fact that auth is a seriously hard problem at scale, make this scenario a few percentage points more likely than anyone should feel comfortable with.