When I visit an HTTPS URL I see content and some authenticity (of the server, at least) tied with the transport mechanism.
IPFS provides the content and a distributed transport. Does the protocol include authentication of the author? Is it up to the content author to include their own signature protocol outside of IPFS?
[If you post an ipfs:// link claiming it is a New York Times article, how do I know it’s real?]
But this is just another way of authenticating the "author". You can also use dns (if you can trust it), or you can use signed content, or you can get the ipfs hash through a channel you trust.
The main idea though, is that IPFS content is authenticated by default because it is referenced by its own hash. The problem on obtaining a hash you can trust is just a layer above and solvable in multiple ways, as needed.
As far as I’m aware every resolver on every system I use will silently fail open to non-DNSSEC DNS. It feels like that’s going to be the case for a long time yet, so maybe the rely on DNS you can trust route isn’t the best option.
To be clear: I’m not worried about malicious nodes on the IPFS network corrupting data which I’ve asked for. It’s more about how to avoid being phished with ipfs:// links I find posted online whose contents claim to be something they are not.
I hadn’t realised how much I relied on the safety of the padlocked domain name at the top of my browser, and on the domain name in links over which I hover. With plain IPFS every click feels like a new website?
All that said, IPNS likely bridges the content/authorship gap you're asking about.
> A name in IPNS is the hash of a public key. It is associated with a record containing information about the hash it links to that is signed by the corresponding private key. New records can be signed and published at any time.
https://docs.ipfs.io/concepts/ipns/
In this context, that key would be held by the author, allowing the author to publish different content by signing it with the key.
If for example NYT tweeted an IPFS hash, you could trust the content was from them.
(‘hecturchi’s response hints at how IPFS achieves this, I think.)