“Personhood Credentials”: The Next Big Thing in online security?
“I’m a human” credentials, intended to combat fraud, would likely start out voluntary but then, by degrees, become mandatoryRather than simplifying our lives, the internet has made our lives more complicated, what with having to continually change passwords, the use of multiple security levels, the threat of hacking, and the like. Now, with the threat of AI creating fraudulent content, some technologists are proposing “personhood credentials” to thwart incursions and impersonations.
From the MIT Technology Review story:
Personhood credentials work by doing two things AI systems still cannot do: bypassing state-of-the-art cryptographic systems, and passing as a person in the offline, real world.
To request credentials, a human would have to physically go to one of a number of issuers, which could be a government or other kind of trusted organization, where they would be asked to provide evidence that they’re a real human, such as a passport, or volunteer biometric data. Once they’ve been approved, they’d receive a single credential to store on their devices like users are currently able to store credit and debit cards in smartphones’ Wallet apps.
I’m already exhausted. But that isn’t all:
To use these credentials online, a user could present it to a third party digital service provider who could then verify them using zero-knowledge proofs, a cryptographic protocol that would confirm the holder was in possession of a personhood credential without disclosing any further unnecessary information.
Supposedly, that would “allow people to choose not to see anything that hasn’t definitely been posted by a human on social media or filter out Tinder matches that don’t come with personhood credentials.”
Just what we need: more bureaucracy. Besides, why would we trust that system any more than the current one? Governments have proven themselves quite incapable of keeping information private, as have the largest corporations.
If personhood credentials were voluntary, it would be one thing. But you just know that, at some point, mandates would become part of the picture. Sure enough:
But the biggest challenge the credentials will face is getting enough adoption from platforms, digital services and governments, who may feel uncomfortable conforming to a standard they don’t control. “For this to work effectively, it would have to be something which is universally adopted,” he [one of the idea’s developers] says. “In principle the technology is quite compelling, but in practice and the messy world of humans and institutions, I think there would be quite a lot of resistance.”
It sure would from me.