News for hackers. Stuff that matters.
Re:The immediate victims of the con would rather act as if t... by godelski on Sunday January 07, 2024 @07:16PM (#38906645)
I really wish there was a certificate authority run by the government. In the past we didn't have the capacity to do a lot of these things but now we can make many improvements, even if incomplete.

Can we not have something like a CA but for, at minimum, officials? Or something like keybase for identity proofs? This seems quite invaluable. Couldn't this even be done within the phone, mail, and email systems? I don't think this should be for everyone, because we should have some anonymity existing, but at least for government officials? What's preventing us from having public/private keys that are verifiable by general citizens? Even if it was as bad as PGP used to be (before tools to make it easier developed) there would be at least some form of verification. But right now it's far too easy to spoof and honestly I don't even know how one would perform verification other than hanging up and calling back. But that doesn't solve your example.

Note: I am not a security expert.

Re:The immediate victims of the con would rather act as if t... by alexpotato on Sunday January 07, 2024 @08:34PM (#38907233)
You can call 911 or your local police station and they can verify if there is a law enforcement officer at your front door.

I guess someone could run a Stingray and re-route your 911 call to a hostile party but at that point, I don't think a CA would help you given that they are right outside your front door.

Re:The immediate victims of the con would rather act as if t... by harimau777 on Sunday January 07, 2024 @09:46PM (#38907670)
My fear would be that that would piss off the police officer and motivate them to make up some reason to injure me, plant evidence, or destroy my property.
Re:The immediate victims of the con would rather act as if t... by godelski on Monday January 08, 2024 @12:56PM (#38915603)
I don't really feel this is an option. And it still is a weak signal. Who knows their local police phone number? Do you know that for the area you're traveling through? 911 is flooded enough. Can I get an image of the officer's face to verify?
Re:The immediate victims of the con would rather act as if t... by jstarfish on Monday January 08, 2024 @03:47PM (#38917869)
What the hell are you talking about? If there's a stranger at your door claiming to be a cop, and there is cause for suspicion, just fucking call 911.

If it's neither safe nor convenient to look up the non-emergency number, it's an emergency. Any armed stranger at your door will only wait so long before forcing escalation.

The alternative is: while you're ringing the non-emergency line, he sticks a gun in your face, "arrests" you, and helpfully hangs up the phone. You didn't transmit E911 data-- and nobody will come check on you.

If your iPhone is allowed to call 911 over bogus telemetry, it's good faith enough for two humans to use it to verify officer credentials.

Re:The immediate victims of the con would rather act as if t... by godelski on Monday January 08, 2024 @04:20PM (#38918317)
What I'm talking about is that you haven't solved the verification problem by calling 911. They likely aren't aware of all dispatched units, especially in your district. Supposing they did, it also doesn't let me know that the person I'm taking to is an officer, but just that there is an officer dispatched. How do I verify that these are the same?

The system I want is basically something simple citizens can use and can become common practice. Such as cop shows up and you scan their badge with your phone. Why? Because such procedure can kill police impersonation before it starts. It creates a high level of difficulty to perform that impersonation. Honestly, this should even be possible without an Internet connection. There is also an added benefit for both parties. The scanning of the badge logs an interaction and can make both parties accountable.

That's the alternative. The alternative isn't do nothing when I'm literally asking for something else. Get the context of the thread before replying. It's like you're pretending my original cert question doesn't exist.

Re:The immediate victims of the con would rather act as if t... by plussed_reader on Sunday January 07, 2024 @08:09PM (#38907039)
A certificate authority; like a sitting judge?
Re:The immediate victims of the con would rather act as if t... by godelski on Monday January 08, 2024 @12:58PM (#38915624)
Hello judge, sorry for calling you at 2am, but there's a police officer at my door. Can you verify their badge number and then describe to me what they look like so I can verify that this is indeed the person they say they are? K thx bye

Sounds like a great solution....

Re:The immediate victims of the con would rather act as if t... by plussed_reader on Monday January 22, 2024 @12:03PM (#39091904)
Sounds like a solution with accountability.
Re:The immediate victims of the con would rather act as if t... by pimlottc on Sunday January 07, 2024 @10:43PM (#38907993)
> I really wish there was a certificate authority run by the government.

There are several US federal root CAs [0]. Among other things, they are used for signing the certificates on government employee PIV cards [1]

0: https://pki.treas.gov/crl_certs.htm

1: https://www.idmanagement.gov/university/piv/