4 ms·

There's another huge problem, Facebook currently gives you legitimacy -- people will believe it's you. However, does little to nothing in terms of verifying you

by readme 12y ago

There's another huge problem, Facebook currently gives you legitimacy -- people will believe it's you. However, does little to nothing in terms of verifying your identity. I think the DEA could have faked it, even if there were strict measures. But think of what average people are doing right now using similar techniques... The public is blind to this but the technology (GPG) exists to authenticate people's identities.

pjc50 12y ago
GPG authenticates that a particular key was used to sign a message. Key signing authenticates that a particular person claimed control of that key at some point. It does not prevent (although it does make it much harder) impersonation through key theft.
- readme 12y ago
  No security measure can completely prevent anything.
fossuser 12y ago
That's why I think it's really cool that there are a couple people working on https://keybase.io/ https://keybase.io/ to try and get public keys main stream without the need for unrealistic keysigning parties and web of trust. If this idea of identity was integrated with FB I think that would be a huge win and a ton of different programs could hook into the keybase API for automatic behind the scenes encryption that would prevent a lot of issues surrounding dragnet surveillance.
vertex-four 12y ago
> The public is blind to this but the technology (GPG) exists to authenticate people's identities. There's also the technology to make it far simpler, in the form of Namecoin. I've registered a NameID (in the id/ namespace), and I can tell anyone in the world that my NameID is vshell. They can look me up, find my GPG key, my website, and whatever other information I want to put in there. Nobody can fake it. The main issue is going to be revocation - if someone manages to take control of my NameID, I can't get it back. I can use multi-factor authentication like BitGo provide for Bitcoin, but that's not a 100% guarantee. I could sign "I am no longer this person" with my NameID key and my GPG key and distribute that, but there'd be no safe way to say "I am now this other person", because they might've taken my GPG key as well and they could say that. You're essentially going to have to build up your web of trust from near-scratch, starting with physical trust (i.e. people who can verify who you are physically).
eneveu 12y ago
I reported two fake profiles* a few weeks ago, but Facebook did nothing to remove them. I guess fake profiles boost the "user" count for FB :) *: profiles adding 100 "friends" the first day, using pictures from obscure russian models (which can be found using Google image search)...

by readme 12y ago

pjc50 12y ago

GPG authenticates that a particular key was used to sign a message. Key signing authenticates that a particular person claimed control of that key at some point. It does not prevent (although it does make it much harder) impersonation through key theft.

readme 12y ago
No security measure can completely prevent anything.

fossuser 12y ago

That's why I think it's really cool that there are a couple people working on https://keybase.io/ https://keybase.io/ to try and get public keys main stream without the need for unrealistic keysigning parties and web of trust. If this idea of identity was integrated with FB I think that would be a huge win and a ton of different programs could hook into the keybase API for automatic behind the scenes encryption that would prevent a lot of issues surrounding dragnet surveillance.

vertex-four 12y ago

> The public is blind to this but the technology (GPG) exists to authenticate people's identities. There's also the technology to make it far simpler, in the form of Namecoin. I've registered a NameID (in the id/ namespace), and I can tell anyone in the world that my NameID is vshell. They can look me up, find my GPG key, my website, and whatever other information I want to put in there. Nobody can fake it. The main issue is going to be revocation - if someone manages to take control of my NameID, I can't get it back. I can use multi-factor authentication like BitGo provide for Bitcoin, but that's not a 100% guarantee. I could sign "I am no longer this person" with my NameID key and my GPG key and distribute that, but there'd be no safe way to say "I am now this other person", because they might've taken my GPG key as well and they could say that. You're essentially going to have to build up your web of trust from near-scratch, starting with physical trust (i.e. people who can verify who you are physically).

eneveu 12y ago

I reported two fake profiles* a few weeks ago, but Facebook did nothing to remove them. I guess fake profiles boost the "user" count for FB :) *: profiles adding 100 "friends" the first day, using pictures from obscure russian models (which can be found using Google image search)...