3 ms·

Well of course we can't trust a single party for any information. That's why it's Public-Key-Infrastructure. I suppose the browser itself could validate content

Well of course we can't trust a single party for any information. That's why it's Public-Key-Infrastructure. I suppose the browser itself could validate content since it has a list of trusted root CAs. So then all we need is for each person to have a well-known domain.

chrisjj 3y ago
> Well of course we can't trust a single party for any information. > all we need is for each person to have a well-known domain Persons are single parties. So we have a problem....
- karmakaze 3y ago
  I was speaking in the context of a man-in-the-middle attack. Is it pedantic day or something? Did I miss the memo?
  - chrisjj 3y ago
    > I was speaking in the context of a man-in-the-middle attack. I can't imagine why, since that's not the attack in question.
    - karmakaze 3y ago
      Sorry, let me connect the dots. A voice message is digitally stored communication. If it was signed then the authenticity of the message source could be validated. When verifying signatures, we use PKI with pre-installed trusted root certificates so that any party (a MITM) in between you and any other party cannot alter the communication without corrupting it.
      - chrisjj 3y ago
        Still https://news.ycombinator.com/item?id=40189625 https://news.ycombinator.com/item?id=40189625 applies.
        karmakaze 3y ago
        > I've got some bad news. Could you elaborate on the reference?
        chrisjj 3y ago
        "convenient reference (to associate signatures) for famous people: Twitter/X profiles" is far from trustworthy.
        karmakaze 3y ago
        I wasn't meaning that the Twitter/X profile would be the source, rather that the source (e.g. owned domain) could be listed on their official T/X profile for convenience. The digital signature would be tied to their owned domain not T/X.
        chrisjj 3y ago
        That bad news is: "Starting April 1, 2023 we began winding down our legacy Verification program and accounts that were verified under the previous criteria (active, notable, and authentic) will not retain a blue checkmark unless they are subscribed to X Premium."
        deleted 3y ago
        [deleted]

chrisjj 3y ago

> Well of course we can't trust a single party for any information. > all we need is for each person to have a well-known domain Persons are single parties. So we have a problem....

karmakaze 3y ago
I was speaking in the context of a man-in-the-middle attack. Is it pedantic day or something? Did I miss the memo?
- chrisjj 3y ago
  > I was speaking in the context of a man-in-the-middle attack. I can't imagine why, since that's not the attack in question.
  - karmakaze 3y ago
    Sorry, let me connect the dots. A voice message is digitally stored communication. If it was signed then the authenticity of the message source could be validated. When verifying signatures, we use PKI with pre-installed trusted root certificates so that any party (a MITM) in between you and any other party cannot alter the communication without corrupting it.
    - chrisjj 3y ago
      Still https://news.ycombinator.com/item?id=40189625 https://news.ycombinator.com/item?id=40189625 applies.
      - karmakaze 3y ago
        > I've got some bad news. Could you elaborate on the reference?
        chrisjj 3y ago
        "convenient reference (to associate signatures) for famous people: Twitter/X profiles" is far from trustworthy.
        karmakaze 3y ago
        I wasn't meaning that the Twitter/X profile would be the source, rather that the source (e.g. owned domain) could be listed on their official T/X profile for convenience. The digital signature would be tied to their owned domain not T/X.
        chrisjj 3y ago
        That bad news is: "Starting April 1, 2023 we began winding down our legacy Verification program and accounts that were verified under the previous criteria (active, notable, and authentic) will not retain a blue checkmark unless they are subscribed to X Premium."
        deleted 3y ago
        [deleted]