Fake websites pretending to be legitimate websites in order to steal your passwords was considered a HUGE problem. That's why TLS includes website certificates. The implementation is kind of a mess with commercial Certificate Authorities (CAs) being too expensive for small businesses to use, CAs getting hacked, or downright shady CAs that couldn't be trusted. A lot of websites didn't use TLS because of these problems. It took decades to get to the point we are at today where we have Let's Encrypt and all websites using TLS. Yet phishing still works because fake websites can use a URL that looks legit and they can get a certificate for that URL.
We need to get away from shared secrets for authentication. Passkeys are fundamentally a way to do that, but they aren't perfect. Personally I wish TLS and Passkeys both were way less complicated. I think we could use asymmetric encryption for authentication without certificate authorities and secure enclaves and all that and still be more secure in general than we are today. Think ssh keys. But no browser or webserver does that.
I think our best bet is probably to aggressively use passkeys and work (as was done with with TLS) to make them better until it mostly fades into the background like TLS has.
The best solution I've found is yubikeys. I keep them on my keychain with my car's key fob. If I lose that key fob I don't know how I get my car started. It's not like the old days where you could pick the lock or get a few copies of the key made for cheap. Same with yubikeys. I worry about losing my yubikeys about as much as I worry about losing my car keys. A little, but not too much. I use both so often that it's not too hard to keep track of them.
Physical keys can easily be copied, and physical locks can easily be picked. That might be fine for your house or storage unit, but for your bank account or your car (newer cars no longer have simple physical keys/locks), we've moved beyond that tech.
That any and all physical security measures can be defeated is a feature, not a bug. Almost no human beings actually need that level of security, and the tradeoffs are absolutely not worth it for those of us without Mossad as a threat.
How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.
Not the same thing. The kindle ebook you "purchased" could have different text each time you open it up. A movie you stream could be different every time.
Reading your comment I wonder if the parent comment is different each time, because "does the ebook text change reading-to-reading" is not the question being discussed.
I don't know, people. We still really don't know how OpenAI or others are producing these results. It's all very hand wavy and trust-me-bro. How much money/time/compute have they really thrown at these problems? How much human involvement was there? What LLM did they even use? How much regular software was involved? They have given answers to some of those questions but no proof that that's actually what they did. I don't know if it's worth giving them this much credit (which is what we are doing by writing these essays and spending so much time debating). Anthropic wrote a C compiler that turned out to not really be a ready made replacement for GCC. Did they ever do any more work on it? Has anyone else produced a C compiler? It seems like that and these proofs are just demoware that are not (yet? Who knows?) production ready to turn the world upside down. Impressive one-off demos, yes, but companies have been pulling those off for centuries without ever going anywhere afterwards.
A very important point! In Tristan (NYU prof)’s write up he noted evidence of the OpenAI mathematician team doing a lot of correction and guidance along the way. We are never told about this with openness and clarity. At a minimum, complete disclosure and honesty is needed by the companies and about the precise role of their staff members.
We need to get away from shared secrets for authentication. Passkeys are fundamentally a way to do that, but they aren't perfect. Personally I wish TLS and Passkeys both were way less complicated. I think we could use asymmetric encryption for authentication without certificate authorities and secure enclaves and all that and still be more secure in general than we are today. Think ssh keys. But no browser or webserver does that.
I think our best bet is probably to aggressively use passkeys and work (as was done with with TLS) to make them better until it mostly fades into the background like TLS has.
The best solution I've found is yubikeys. I keep them on my keychain with my car's key fob. If I lose that key fob I don't know how I get my car started. It's not like the old days where you could pick the lock or get a few copies of the key made for cheap. Same with yubikeys. I worry about losing my yubikeys about as much as I worry about losing my car keys. A little, but not too much. I use both so often that it's not too hard to keep track of them.
reply