4 ms·

sooner or later, everyone's gonna have to have some sort of passphrase that you authenticate with before acknowledging it's the real person.

by chii 2y ago

TheBozzCL 2y ago
Whatever it is we do, I predict that trust of internet communications will go down significantly. Maybe we will pivot back to in-person meetings for important transactions.
- rwmj 2y ago
  You learned nothing from Crowdstrike? Some large company will claim to invent a product that solves the problem. It will fail some of the time, but that doesn't matter as customers of the product will have someone to blame. No one will ever be actually held accountable for failures as some combination of lawsuits and "you're holding it wrong" will be sufficient to deflect liability from the large company. And anyway there's no real choice as all the other large companies who also have solutions in this area are equally as bad.
  - HPsquared 2y ago
    And that company will have a huge library of deepfake models stored on a poorly-secured server, which will leak.
- kreetx 2y ago
  How we already authenticate is cryptography, we just need to use it more.
  - moooo99 2y ago
    The problem is that crypto is hard. When something is hard, people tend to pay someone else to do it. It only takes that one party to commit a private key to a public GitHub for the whole house of cards to come crashing down.
    - intended 2y ago
      Ah. There’s the sentence I was looking for! There’s many hopes riding on decentralized options. But verification is hard. Which is why all information networks tend to concentrate in some form or the other - to reduce the effort needed to authenticate
    - Muromec 2y ago
      HTTPS is not hard, it's not even expensive anymore. Nothing stops us from using the same X509 rails backed by the same government that issued your id or driving license (or corporate access card) to do the client certs too. We even have hardware keys that are capable of that in most big corp techworkers pockets already.
      - chii 2y ago
        the problem is that these are all trusted side channels (or regular channels that have been vetted). When an "emergency" happens, and the caller claims they're not able to use the regular channels of communication, how do you authenticate them?
      - kreetx 2y ago
        When I say cryptography, I mean some means of end-to-end encryption (i.e, something which can't be faked or MITMed). What is hard is getting this implemented in consumer apps in a way that user doesn't need to know nor fully understand it, but only understand it to a degree to differenciate unsafe channels from safe.
masklinn 2y ago
That has a long history in spycraft (and milint): sign/countersign, challenge/response, recognition signals, paroles…
euroderf 2y ago
I predict that when the person being challenged forgets the passphrase for the current time period, "Yo Mama" will often work.
trte9343r4 2y ago
PGP solved this problem decades ago!
- moooo99 2y ago
  Unfortunately PGP still has to solve to problem of how to use it properly without requiring a PhD
  - MaxBarraclough 2y ago
    All major VOIP solutions are already cryptographically secured. In this case the attacker was not able to pull off anything akin to a caller ID impersonation, they made the call from an unknown number and tried to explain it away: > The Vigna deepfaker began explaining that he was calling from a different mobile phone number because he needed to discuss something confidential
    - JumpCrisscross 2y ago
      > they made the call from an unknown number and tried to explain it away Also, phones get stolen and people lose their phones. This is fundamentally a social problem. Technology can help but not solve it.
  - fragmede 2y ago
    ChatGPT's read the manual for you and you can ask it for the correct incantation to use.
    - Am4TIfIsER0ppos 2y ago
      Chapgpt doesn't read shit, doesn't remember shit, and can't tell you shit. It will repeat a common string of words which would probably be "pgp is too hard to use".
      - fragmede 2y ago
        https://chatgpt.com/share/d1f05726-8d41-4c3e-9c82-56a02aaea465 https://chatgpt.com/share/d1f05726-8d41-4c3e-9c82-56a02aaea4...
dredmorbius 2y ago
Shibboleth: <https://en.wikipedia.org/wiki/Shibboleth https://en.wikipedia.org/wiki/Shibboleth>
NFVLCP 2y ago
We'll all need Inception-style totems soon.

sooner or later, everyone's gonna have to have some sort of passphrase that you authenticate with before acknowledging it's the real person.

by chii 2y ago

sooner or later, everyone's gonna have to have some sort of passphrase that you authenticate with before acknowledging it's the real person.

TheBozzCL 2y ago

Whatever it is we do, I predict that trust of internet communications will go down significantly. Maybe we will pivot back to in-person meetings for important transactions.

rwmj 2y ago
You learned nothing from Crowdstrike? Some large company will claim to invent a product that solves the problem. It will fail some of the time, but that doesn't matter as customers of the product will have someone to blame. No one will ever be actually held accountable for failures as some combination of lawsuits and "you're holding it wrong" will be sufficient to deflect liability from the large company. And anyway there's no real choice as all the other large companies who also have solutions in this area are equally as bad.
- HPsquared 2y ago
  And that company will have a huge library of deepfake models stored on a poorly-secured server, which will leak.
kreetx 2y ago
How we already authenticate is cryptography, we just need to use it more.
- moooo99 2y ago
  The problem is that crypto is hard. When something is hard, people tend to pay someone else to do it. It only takes that one party to commit a private key to a public GitHub for the whole house of cards to come crashing down.
  - intended 2y ago
    Ah. There’s the sentence I was looking for! There’s many hopes riding on decentralized options. But verification is hard. Which is why all information networks tend to concentrate in some form or the other - to reduce the effort needed to authenticate
  - Muromec 2y ago
    HTTPS is not hard, it's not even expensive anymore. Nothing stops us from using the same X509 rails backed by the same government that issued your id or driving license (or corporate access card) to do the client certs too. We even have hardware keys that are capable of that in most big corp techworkers pockets already.
    - chii 2y ago
      the problem is that these are all trusted side channels (or regular channels that have been vetted). When an "emergency" happens, and the caller claims they're not able to use the regular channels of communication, how do you authenticate them?
    - kreetx 2y ago
      When I say cryptography, I mean some means of end-to-end encryption (i.e, something which can't be faked or MITMed). What is hard is getting this implemented in consumer apps in a way that user doesn't need to know nor fully understand it, but only understand it to a degree to differenciate unsafe channels from safe.

masklinn 2y ago

That has a long history in spycraft (and milint): sign/countersign, challenge/response, recognition signals, paroles…

euroderf 2y ago

I predict that when the person being challenged forgets the passphrase for the current time period, "Yo Mama" will often work.

trte9343r4 2y ago

PGP solved this problem decades ago!

moooo99 2y ago
Unfortunately PGP still has to solve to problem of how to use it properly without requiring a PhD
- MaxBarraclough 2y ago
  All major VOIP solutions are already cryptographically secured. In this case the attacker was not able to pull off anything akin to a caller ID impersonation, they made the call from an unknown number and tried to explain it away: > The Vigna deepfaker began explaining that he was calling from a different mobile phone number because he needed to discuss something confidential
  - JumpCrisscross 2y ago
    > they made the call from an unknown number and tried to explain it away Also, phones get stolen and people lose their phones. This is fundamentally a social problem. Technology can help but not solve it.
- fragmede 2y ago
  ChatGPT's read the manual for you and you can ask it for the correct incantation to use.
  - Am4TIfIsER0ppos 2y ago
    Chapgpt doesn't read shit, doesn't remember shit, and can't tell you shit. It will repeat a common string of words which would probably be "pgp is too hard to use".
    - fragmede 2y ago
      https://chatgpt.com/share/d1f05726-8d41-4c3e-9c82-56a02aaea465 https://chatgpt.com/share/d1f05726-8d41-4c3e-9c82-56a02aaea4...

dredmorbius 2y ago

Shibboleth: <https://en.wikipedia.org/wiki/Shibboleth https://en.wikipedia.org/wiki/Shibboleth>

NFVLCP 2y ago

We'll all need Inception-style totems soon.