2 ms·

How do you prove the signature isn't fake? Ultimately ID requires either a government ID service, a third party corporate ID service, or some kind of open hybr

How do you prove the signature isn't fake? Ultimately ID requires either a government ID service, a third party corporate ID service, or some kind of open hybrid - which doesn't exist. All of those have their issues.

olmo23 7mo ago
I think he was referring to a cryptographic signature, possibly using the "web of trust" to get the key. I'm not convinced we need central authority to solve this.
tenacious_tuna 7mo ago
people at my org were gleeful when they learned they could hook LLMs into Slack. Even if we had some reliable, well-used signature system, I think people would just let AI use it to send emails on their behalf.
- bigfishrunning 7mo ago
  If the AI age has taught me anything, it's that most people do not care what their output is. They'll put their name on anything, taste or quality does not matter in the least. It's incredibly depressing.
  - daheza 7mo ago
    Enshittification never stopped we just stopped talking about it because it became normal. Quality does not matter anymore. I agree its depressing, seeing AI Slop being pushed and no one even putting the time or effort in to say this is bad and you should feel bad.
- Ajedi32 7mo ago
  That's a different problem though. It's doing it on their behalf, not on behalf of a scammer who's impersonating them.
  - pixl97 7mo ago
    Until their computer is taken over....
- MarsIronPI 7mo ago
  Well we should treat that as their own output. If it's crap, treat it the same way you would if they produced the crap themselves.
SirMaster 7mo ago
Same way security cameras prove that they are authentic camera recordings that have not been modified. If modified, the video will no longer match the signature that was generated with it.
ordu 7mo ago
> Ultimately ID requires either a government ID service, a third party corporate ID service, These are valid approaches to the problem, but they are not necessary. > or some kind of open hybrid - which doesn't exist. PGP exists for decades. It doesn't have a great UX, it isn't used outside of its narrow niches, but it exists and does exactly this.
- KurSix 7mo ago
  Picture this: your grandma calls you in a panic, and you tell her, "Drop me your public PGP key so I can verify the signature".. PGP is dead outside of niche geek circles exactly because key management is basically an unsolvable problem for the average person
  - ordu 7mo ago
    > PGP is dead outside of niche geek circles exactly because key management is basically an unsolvable problem for the average person Can this problem be solved with better software? I believe it can, it is just average person doesn't need PGP. No demand for software solving this problem, therefore no software for that. The problem can be solved, like a storage for known PGP public keys with their history: like where the key was acquired, and a simple algo that calculated trust to the key as a probability of it being valid (or what adjective cryptographers would use in this case?). You can start with PGP keys of people you know, getting them as QR codes offline, marking them as "high trust" and then pull from them keys stored at their devices (lowering their trust levels by the way). There are some issues how to calculate probability, because when we pull some keys from different sources we can't know are their reported trust levels are independent variables or not, but I believe you can deal with it, by pulling the whole chain of transfers of the key, starting from the owner of the key and ending at your device. It is just a rough idea, how it can be made. Maybe other solutions are possible. My point is: the ugliness of PGP is a result of PGP was made by nerds and for the nerds. There is no demand for PGP-like solutions outside of nerd communities. But maybe LLM induced corrosion of trust will create demand?
    - KurSix 7mo ago

olmo23 7mo ago

I think he was referring to a cryptographic signature, possibly using the "web of trust" to get the key. I'm not convinced we need central authority to solve this.

tenacious_tuna 7mo ago

people at my org were gleeful when they learned they could hook LLMs into Slack. Even if we had some reliable, well-used signature system, I think people would just let AI use it to send emails on their behalf.

bigfishrunning 7mo ago
If the AI age has taught me anything, it's that most people do not care what their output is. They'll put their name on anything, taste or quality does not matter in the least. It's incredibly depressing.
- daheza 7mo ago
  Enshittification never stopped we just stopped talking about it because it became normal. Quality does not matter anymore. I agree its depressing, seeing AI Slop being pushed and no one even putting the time or effort in to say this is bad and you should feel bad.
Ajedi32 7mo ago
That's a different problem though. It's doing it on their behalf, not on behalf of a scammer who's impersonating them.
- pixl97 7mo ago
  Until their computer is taken over....
MarsIronPI 7mo ago
Well we should treat that as their own output. If it's crap, treat it the same way you would if they produced the crap themselves.

SirMaster 7mo ago

Same way security cameras prove that they are authentic camera recordings that have not been modified. If modified, the video will no longer match the signature that was generated with it.

ordu 7mo ago

> Ultimately ID requires either a government ID service, a third party corporate ID service, These are valid approaches to the problem, but they are not necessary. > or some kind of open hybrid - which doesn't exist. PGP exists for decades. It doesn't have a great UX, it isn't used outside of its narrow niches, but it exists and does exactly this.

KurSix 7mo ago
Picture this: your grandma calls you in a panic, and you tell her, "Drop me your public PGP key so I can verify the signature".. PGP is dead outside of niche geek circles exactly because key management is basically an unsolvable problem for the average person
- ordu 7mo ago
  > PGP is dead outside of niche geek circles exactly because key management is basically an unsolvable problem for the average person Can this problem be solved with better software? I believe it can, it is just average person doesn't need PGP. No demand for software solving this problem, therefore no software for that. The problem can be solved, like a storage for known PGP public keys with their history: like where the key was acquired, and a simple algo that calculated trust to the key as a probability of it being valid (or what adjective cryptographers would use in this case?). You can start with PGP keys of people you know, getting them as QR codes offline, marking them as "high trust" and then pull from them keys stored at their devices (lowering their trust levels by the way). There are some issues how to calculate probability, because when we pull some keys from different sources we can't know are their reported trust levels are independent variables or not, but I believe you can deal with it, by pulling the whole chain of transfers of the key, starting from the owner of the key and ending at your device. It is just a rough idea, how it can be made. Maybe other solutions are possible. My point is: the ugliness of PGP is a result of PGP was made by nerds and for the nerds. There is no demand for PGP-like solutions outside of nerd communities. But maybe LLM induced corrosion of trust will create demand?
  - KurSix 7mo ago