News for hackers. Stuff that matters.
Re:DEA impersonates real person on Facebook by readme on Wednesday October 08, 2014 @09:46AM (#8426815)
There's another huge problem, Facebook currently gives you legitimacy -- people will believe it's you. However, does little to nothing in terms of verifying your identity.

I think the DEA could have faked it, even if there were strict measures.

But think of what average people are doing right now using similar techniques... The public is blind to this but the technology (GPG) exists to authenticate people's identities.

Re:DEA impersonates real person on Facebook by fossuser on Wednesday October 08, 2014 @10:37AM (#8427071)
That's why I think it's really cool that there are a couple people working on https://keybase.io/ to try and get public keys main stream without the need for unrealistic keysigning parties and web of trust.

If this idea of identity was integrated with FB I think that would be a huge win and a ton of different programs could hook into the keybase API for automatic behind the scenes encryption that would prevent a lot of issues surrounding dragnet surveillance.

Re:DEA impersonates real person on Facebook by vertex-four on Wednesday October 08, 2014 @10:44AM (#8427109)
> The public is blind to this but the technology (GPG) exists to authenticate people's identities.

There's also the technology to make it far simpler, in the form of Namecoin. I've registered a NameID (in the id/ namespace), and I can tell anyone in the world that my NameID is vshell. They can look me up, find my GPG key, my website, and whatever other information I want to put in there. Nobody can fake it.

The main issue is going to be revocation - if someone manages to take control of my NameID, I can't get it back. I can use multi-factor authentication like BitGo provide for Bitcoin, but that's not a 100% guarantee. I could sign "I am no longer this person" with my NameID key and my GPG key and distribute that, but there'd be no safe way to say "I am now this other person", because they might've taken my GPG key as well and they could say that. You're essentially going to have to build up your web of trust from near-scratch, starting with physical trust (i.e. people who can verify who you are physically).

Re:DEA impersonates real person on Facebook by pjc50 on Wednesday October 08, 2014 @10:15AM (#8426950)
GPG authenticates that a particular key was used to sign a message. Key signing authenticates that a particular person claimed control of that key at some point.

It does not prevent (although it does make it much harder) impersonation through key theft.

Re:DEA impersonates real person on Facebook by readme on Wednesday October 08, 2014 @12:47PM (#8427879)
No security measure can completely prevent anything.
Re:DEA impersonates real person on Facebook by eneveu on Wednesday October 08, 2014 @02:35PM (#8428611)
I reported two fake profiles* a few weeks ago, but Facebook did nothing to remove them. I guess fake profiles boost the "user" count for FB :)

*: profiles adding 100 "friends" the first day, using pictures from obscure russian models (which can be found using Google image search)...