I really wish there was a certificate authority run by the government. In the past we didn't have the capacity to do a lot of these things but now we can make many improvements, even if incomplete.

Can we not have something like a CA but for, at minimum, officials? Or something like keybase for identity proofs? This seems quite invaluable. Couldn't this even be done within the phone, mail, and email systems? I don't think this should be for everyone, because we should have some anonymity existing, but at least for government officials? What's preventing us from having public/private keys that are verifiable by general citizens? Even if it was as bad as PGP used to be (before tools to make it easier developed) there would be at least some form of verification. But right now it's far too easy to spoof and honestly I don't even know how one would perform verification other than hanging up and calling back. But that doesn't solve your example.

Note: I am not a security expert.

You can call 911 or your local police station and they can verify if there is a law enforcement officer at your front door.

I guess someone could run a Stingray and re-route your 911 call to a hostile party but at that point, I don't think a CA would help you given that they are right outside your front door.

My fear would be that that would piss off the police officer and motivate them to make up some reason to injure me, plant evidence, or destroy my property.

I don't really feel this is an option. And it still is a weak signal. Who knows their local police phone number? Do you know that for the area you're traveling through? 911 is flooded enough. Can I get an image of the officer's face to verify?

What the hell are you talking about? If there's a stranger at your door claiming to be a cop, and there is cause for suspicion, just fucking call 911.

If it's neither safe nor convenient to look up the non-emergency number, it's an emergency. Any armed stranger at your door will only wait so long before forcing escalation.

The alternative is: while you're ringing the non-emergency line, he sticks a gun in your face, "arrests" you, and helpfully hangs up the phone. You didn't transmit E911 data-- and nobody will come check on you.

If your iPhone is allowed to call 911 over bogus telemetry, it's good faith enough for two humans to use it to verify officer credentials.

What I'm talking about is that you haven't solved the verification problem by calling 911. They likely aren't aware of all dispatched units, especially in your district. Supposing they did, it also doesn't let me know that the person I'm taking to is an officer, but just that there is an officer dispatched. How do I verify that these are the same?

The system I want is basically something simple citizens can use and can become common practice. Such as cop shows up and you scan their badge with your phone. Why? Because such procedure can kill police impersonation before it starts. It creates a high level of difficulty to perform that impersonation. Honestly, this should even be possible without an Internet connection. There is also an added benefit for both parties. The scanning of the badge logs an interaction and can make both parties accountable.

That's the alternative. The alternative isn't do nothing when I'm literally asking for something else. Get the context of the thread before replying. It's like you're pretending my original cert question doesn't exist.

A certificate authority; like a sitting judge?

Hello judge, sorry for calling you at 2am, but there's a police officer at my door. Can you verify their badge number and then describe to me what they look like so I can verify that this is indeed the person they say they are? K thx bye

Sounds like a great solution....

Sounds like a solution with accountability.

> I really wish there was a certificate authority run by the government.

There are several US federal root CAs [0]. Among other things, they are used for signing the certificates on government employee PIV cards [1]

0: https://pki.treas.gov/crl_certs.htm

1: https://www.idmanagement.gov/university/piv/

I have absolutely gotten legitimate phone calls from a sheriff/marshal in the stats of texas to let me know I had two warrants out for my arrest (failure to pay wrong left turn ticket, failure to show up at court for said ticket).

I called him back at the published phone number for his division. He let me know he wasn't going to be bothered driving 45 minutes across the metro area to find me and arrest me, and if I just stopped by court and got it taken care of in next three months that would be great.

You get arrested for simple traffic ticket? That doesn't sound right. Usually you would just be unable to renew your car registration the following year until you pay said ticket.

I grew up in a different state, and was very surprised that nearly everything in Texas is an actual crime (misdemeanor). So yes, you get arrested for them here, because you committed a misdemeanor. Other differences that surprised me: It's legal to drive through the intersection as long as you entered before the light turned red. Pedestrians don't automatically have the right of way. It's legal to change lanes in the middle of an intersection, even while turning.

I've had to re-learn a lot of legal things since moving here.

Hmmm, when living in California I got a speeding ticket late night in Kingman, AZ, sent in a personal check, they only took money orders, I never followed up. It's been thirty years.

I visit family in Arizona frequently. I wonder whether statute of limitations has run out. I've been fortunate to not get pulled over so far. Maybe I do see gitmo in my near future after all.

An uncle who lived in the Kansas City suburbs was careless about parking and did not pay his parking tickets. Then one day he was pulled over by the police. They checked his information and took him to jail. My aunt showed up to pay his tickets, and discovered that the city did not take checks. A grocer kindly cashed a check for her.

I don't trust anyone to be a police officer unless there's another police officer present certifying that they are in fact a police officer, and another police officer present certifying that that person is a police officer, and so on, up to a piece of paper listing hundreds of "root" police officers around the world that was prepared in an unspecified way by an unknown programmer involved in making whichever browser I happen to be using, and which I have not even glanced at.

Funny, but to be clear, the actual practical advice is to call the police department and verify it. That's what the woman in the article did, and it most likely saved her life.

If you ask to see their badge and they show you a metal one it's probably a scammer, most real cops these days carry the plastic ones you can get at a Halloween store because budget cuts. IANAL etc etc

Hilbert, calm down!

That's insane. I hand-check my root certs at least twice a day.

When you're looking at the disk, do you use a handheld magnifying glass and go by sight, or are you running your fingers over the disk to feel the position of each electron?

I convert my root certs from digital to proteomic storage and inject it directly into my veins. I've programmed my immune system to go into total systemic shock if the certs have been compromised.

lol, point taken, but your metaphor fell apart in the end.

Good point