Things like "please type your credit card number here and pay a 1 cent fee".
Or "send us a selfie with your passport".
Or "Get 5 friends to vouch for you".
Or "please log into a government website and oauth this app"
Or "please log in with a gmail account that is at least 5 years old".
All of these might work today just because they aren’t widely used yet. Once they are and are understood they’ll be cracked.
The government oauth is maybe the most interesting; it probably just kicks the can to a government site which is going to have all the same problems, but could potentially benefit from a secure national id. But now the government has a database of all the sites you are logging into; forget privacy of library records, that’s a massive loss to the 4th amendment in practice. No need for prism or other NSA exploit nonsense when sites are literally pinging a government server to verify citizen network activity.
The only issue is that it could lead to cross-site tracking because you are reusing the same public key everywhere.
But maybe cryptography experts have a solution?
They do! The field of zero-knowledge cryptography targets exactly this sort of use case, proving things to a recipient without revealing other things.
In this case, you might send a zero-knowledge proof that you have the private key corresponding to a government-signed public key, without revealing either key and, importantly, without communicating with the government or sending correlatable information on each transaction. (If you were ok communicating with the government you could just get it to sign a random public key for each transaction without needing zero-knowledge cryptography).
You can do a lot more, for example proving "I am 18+ [attested by gov signature]" without revealing your age, birthday or identity, or "I have security clearance level 2 [attested by gov signature]" without revealing anything else, or "I have a driving license [attested by gov signature] and current paid-up insurance [attested by insurer signature]" etc.
The field has advanced technically a lot in the last few years, to the point that those sorts of zero-knowledge proofs are now easy to implement technically and reasonably fast to compute.
Then websites site rate limit each authenticated person.
Also, it could be made opt in so the people freaking out would have nothing to object to, and then whoever wants to participate, can.
You can also architect it so that the government doesn't know who is trying to authenticate you.
It does prevent you from making multiple accounts with the same company though.
Bet that's vulnerable to Stable Diffusion in-painting.
This approach is used by wechat, you can't make your own account and can only be invited by an existing user. I suspect that wechat has reached enough market penetration that this is now worth it.
There are tricky requirements for Americans
I have a feeling other humans verifying you mechanicalturk style one time is the future.
But imho, the payment route makes sense and also this is the problem as random paywalled sites and web monetization. A cash equivalent bearer of token payment method is what is needed.
1) verify+lock funds 2) get bearer to pay funds or funds unlock in x minutes, cancelling the payment 3) token is presented to payment processor who will revoke the token, issue funds to payee with a new token matching that value paid 4) anyone holding that token can pay for stuff, you can just email or move tokens with usb drives or store them im a secure vault service
I believe the main obstacle to solve so many web issues are KYC laws and lack of constitution amendment level laws that give the people right to trade using a bearer token (cash or not) and transfer funds peer-to-peer without a third party or disclosing their personal info (again, all like cash).
Probably <1 year away from beating automated detection of this reliably and 2-3 in fooling humans a high % of the time economically. I was at siggraph recently where I think I saw a whole room of papers of people’s approaches to doing just this problem of photorealistic faces saying arbitrary things.
Depends on how badly the given service wants to keep out bots as to whether they'll start requiring some kind of guaranteed identity check.
I don't know if that's feasible, but that's the premise.
>Unless you have a massive library of possible actions these can be pre-rendered too.
Combinatorial explosion gives you a massive amount of actions. Hold your right ring finger between your left thumb and pinky and move it around in a circle.
There's tools that you could use to limit what you had to prerender and it would be a cat and mouse game like captcha is today, but I think until we're at the point where you can completely replace an actor, and then you can do that in real time, picking out a real human will be possible.
People are working on generating animation on a rig from text prompts: https://www.motorica.ai/ It would be easier if we knew the prompts ahead of time and then we just render transitions.
Real time-ness and a good deal of rendering fidelity can be mitigated by pretending to have crappy network connection once the prompt is given, unless you are comfortable excluding people without reliable internet.
I think the bigger issue is probably with the premise though. This kind of video rendering is much more taxing but it’s also much more taxing on the verification side. I can’t imagine a company being able to do this at scale the way captchas are to defend against bots, you’d need an automated system on the frontline.
>Real time-ness and a good deal of rendering fidelity can be mitigated by pretending to have crappy network connection once the prompt is given,
Real timeless and rendering fidelity are the only part about this that isn't solved, so there's no real debate to have if those constraints aren't there.
>unless you are comfortable excluding people without reliable internet.
If this was a real thing, I will absolutely bet that companies would exclude people with unreliable internet once I becomes known that all scammers are pretending to have unreliable connections.
"Please find a more reliable connection, or stop by the nearest Identity Check facility to authenticate yourself."
>I think the bigger issue is probably with the premise though.
I don't think this is likely to happen either. I think the most likely solution is trusted third party in person verification. Where I could see something like this working is if the third party verification service offered a 1 time remote verification process that functioned something like this.