Comment on The White House wants to 'cryptographically verify' videos of Joe Biden so viewers don't mistake them for AI deepfakes

ryannathans@aussie.zone ⁨8⁩ ⁨months⁩ ago

• NateNate60@lemmy.world ⁨8⁩ ⁨months⁩ ago

  Very few people understand why a GPG signature is reliable or how to check it. Malicious actors will add a “GPG Signed” watermark to their fake videos and call it a day, and 90% of victims will believe it.

  source

  • optissima@lemmy.world ⁨8⁩ ⁨months⁩ ago

    As soon as VLC adds the gpg sig feature, it’s over.

    source

    • NateNate60@lemmy.world ⁨8⁩ ⁨months⁩ ago

      No, it’s not. People don’t use VLC to watch misinformation videos. They see it on Reddit, Facebook, YouTube, or TikTok.

      source
    • QuaternionsRock@lemmy.world ⁨8⁩ ⁨months⁩ ago

      …how popular do you think VLC is among those who don’t understand cryptographic signatures?

      source
    • TheKingBee@lemmy.world ⁨8⁩ ⁨months⁩ ago

      And that will in no way be the first step on the road to VLC deciding which videos it allows you to play…

      source
  • PhlubbaDubba@lemm.ee ⁨8⁩ ⁨months⁩ ago

    Yeah but all it takes is proving it doesn’t have the right signature and you can make the Social Media corpo take every piece of media with that signature just for that alone.

    What’s even better is that you can attack entities that try to maliciously let people get away with misusing their look and fake being signed for failing to defend their IP, basically declaring you intend to take them to court to Public Domainify literally everything that makes them any money at all.

    If billionaires were willing to allow disinformation as a service then they wouldn’t have gone to war against news as a service to make it profitable to begin with.

    source
• captain_aggravated@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

  I just mentioned this in another comment tonight; cryptographic verification has existed for years but basically no one has adopted it for anything. Some people still seem to think pasting an image of your handwriting on a document is “signing” a document somehow.

  source

  • wizardbeard@lemmy.dbzer0.com ⁨8⁩ ⁨months⁩ ago

    It doesn’t help that in a lot of cases, this is actually accepted by a shit ton of important institutions that should be better, but aren’t.

    source
  • ryannathans@aussie.zone ⁨8⁩ ⁨months⁩ ago

    Still trying to get people to sign their emails lol

    source

    • captain_aggravated@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

      I mean, part of it is PGP is the exact opposite of streamlined and you’ve got to be NSA levels of paranoid to bother with it.

      source

      • ryannathans@aussie.zone ⁨8⁩ ⁨months⁩ ago

        It’s automated in all mainstream email clients, you don’t even have to think about it if a contact has it set up

        source

        • -> View More Comments
• bionicjoey@lemmy.ca ⁨8⁩ ⁨months⁩ ago

  The average Joe won’t know what any of what you just said means. Hell, the Joe in the OP doesn’t know what any of you just said means. There’s no way (IMO) of simultaneously creating a cryptographic assurance and having it be accessible to the layman.

  source

  • NateNate60@lemmy.world ⁨8⁩ ⁨months⁩ ago

    There is, but only if you can implement a layer of abstraction and get them to trust that layer of abstraction.

    Few laymen understand why Bitcoin is secure. They just trust that their wallet software works and because they were told by smarter people that it is secure.

    Few laymen understand why TLS is secure. They just trust that their browser tells them it is secure.

    Few laymen understand why biometric authentication on their phone apps is secure. They just trust that their device tells them it is secure.

    source

    • bionicjoey@lemmy.ca ⁨8⁩ ⁨months⁩ ago

      Each of those perfectly illustrates the problem with adding in a layer of abstraction though:

      Bitcoin is a perfect example of the problem. Since almost nobody understands how it works, they keep their coins in an exchange instead of a wallet and have completely defeated the point of cryptocurrency in the first place by reintroducing blind trust into the system.

      Similarly, the TLS ecosystem is problematic. Because even though it is theoretically supposed to verify the identity of the other party, most people aren’t savvy enough to check the name on the cert and instead just trust that if their browser doesn’t warn them, they must be okay. Blind trust one again is introduced alongside the necessary abstraction layers needed to make cryptography palatable to the masses.

      Lastly, people have put so much trust in the face scanning biometrics to wake their phone that they don’t realize they may have given their face to a facial recognition company who will use it to help bring about the cyberpunk dystopia that we are all moving toward.

      source