Re: Deep Fakes, Phishing & Epistemological War - how we can help combat these.

> On 6 Jun 2019, at 14:41, David Booth <david@dbooth.org> wrote:
> 
> On 6/5/19 4:50 PM, Henry Story wrote:
> > It is easy to make web sites that look like existing
> > news agencies, university, church, or even government web
> > site. Such institutions used to have large buildings that
> > could not be built overnight and that were visible to all
> > and recognizable.
> 
> Great comparison!  Perhaps the non-physical "location" and "size" of a web site could be other helpful cues about its probable authenticity:
> 
> - "Location" of a web site translates into who else (web sites, institutions, people) links to it.  This might be a useful proxy for trust, in the absence of more authoritative web-of-trust data.  This is closely related to PageRank
> https://en.wikipedia.org/wiki/PageRank
> though it could be enhanced by actual web-of-trust data.

That indeed is the principle on which the web started, and it was a all we needed
for a very long time.  At first it was good because there were few financial 
incentives: the principal value was sharing information.  Futhermore
one could only find a page by following links. This put a lot of value on a
link and made made keeping one's link ecosystem healthy an important task.

Search engines, such as the long dominant AltaVista, could only find pages
by follow these links. They would fetch pages, extract links, send the
pages to the to the indexer, and follow the new links.  Google's main 
innovation was in taking into account the vote-value of each link, and 
soon overtook AltaVista as first search engine for that reason.

Then the web grew and became a pillar of global commerce, government
communication, news, media, and pretty much everything. Incentives shifted
dramatically, at the same time as it became easier to share content and
others started sending content directly to the search engines bypassing
peer evaluation.

So the above does explain why we got so far without an institutional web
of trust (iWoT), but based our network on individual peer webs of trust.

The idea behind the iWoT [1] is to make visible the official institutional
links on which all trade depends, so that these can be used effectively
by browsers.

Until now these have been in the background hidden by conventions such as
top level domains (TLD) ending in .gov, .edu, .com, .gov.uk, .gouv.fr,
etc.  But who really knows these all by heart? Many here may know our own
countries TLDs , but few know conventions beyond our border, and even fewer
of those on the other side of the world. TLD numbers have exploded since
then, and in any case building an ontology of types of businesses on
something like this is way too inflexible for what we need, and the
information much too poor.

With high quality translators such as deepl making us able to read pages
in distant languages we are more often exposed to cultural conventions we
really have no chance of ever really getting to know. How can we Europeans
commerce correctly with Asian cultures where very few of us know anything
about their alphabet. For the aim is not just for the iWoT to reduce the
effectiveness of Phishing, but to also improve global commerce by helping
us know when we are dealing with remote research institutes, drivers licence
registrars, hospitals, companies, etc…

But you are right the iWoT is just a continuation of the peer to peer link
value philosophy of the web, but now semanticizing the institutional links
in order to allow browsers to coherently show information across langauge
boundaries about the legal status of organizations. 

 
> - "Size" of a web site translates into the amount of traffic it gets over a long enough time period -- especially if that traffic was referred by other trusted sites as opposed to email messages that might be phishing.  This data could be collected anonymously by browsers, or possibly by network carriers.

That could be an extra piece of information, to tie into a rich iWoT,
and could help give us some clues when dealing with web sites not tied 
into it. iWot should be opt in.

Just as schools help us form children into a culture by teaching them
to speak, write, etc… so the iWoT can help new companies emerge by
giving them a legal status that size and age by itself cannot give them.
Furthermore it would make change of ownership of companies more visible,
closing a vector of attack that change of ownership can brings.

Henry


> 
> David Booth
> 


[1] I described this in detail and in relation to digital sovereignty first here
https://medium.com/cybersoton/from-digital-sovereignty-to-the-web-of-nations-61fbc28d79cd

Received on Thursday, 6 June 2019 14:04:17 UTC