Это видео недоступно.
Сожалеем об этом.
Allum Bokhari Explains What Harbor is and How it Works
HTML-код
- Опубликовано: 10 июн 2024
- This was recorded during our Don't Be Evil Summit during SXSW.
Download Harbor here: harbor.social/
Our website: futo.org/
Are there any plans for a Linux version so Apple or Google aren't required to use Harbor?
Sounds like it could also be susceptible to a 51-percent style attack.
I support the spirit of FUTO though so I'll stay tuned.
How? The point I believe of this program is to go to persons in real life to verify whether or not some claim some anonymous person is making is real or not. Can you give an example?
The only way how I can imagine it proving wrong is when you claim something, tell the journalist to interview at the wrong place with only malicious people where they all verified your 'fake' claim and can confirm the claim you're making. Concrete: I would say the water is poisoned as "water lab technician" to journalist, tell or convince the journalist where my fake working place is, them going there and verifying my fake claim (being a water lab technician) against a lot of other malicious actors.
If I understand correctly each account doesn't get the same level of trust so a simple 51% of the accounts isn't enough like it would be on the blockchain. Furthermore I believe each individual creates their own network of trust.
Some problems here:
- The focus on anonymity seems like a mismatch. How anonymous can I be if I am listing my workplace, credentials, etc and can only use people I associate with to verify those claims? Any Joe on the street can verify I'm human but only another IBMer can verify that I work at IBM. But how would she verify me without needing my identity?
- On that note: finding other users, especially trusted users, seems like a big pain right now. I don't see any way to browse a list of users. Don't we need some sort of tool for browsing accounts or claims?
I went to sign up when I first downloaded GrayJay.
Didn't bother, because as you point out I have to prove an awful lot in order to be anon
Seems like any serious company or state could still quite easily determine who you are based on the credentials and verifications?
It seems that to remain anonymous you would need to have as few verification's as possible to accomplish the task at hand. Those verification would also need to be verifiable by as wide a group as possible to avoid direct connections back. You would probably create an ID for whatever the purpose was and use it only for that purpose. That said if they want you bad enough they usually find you.
How does it protect from a network of bots recreating existing networks and claims of users in order to impersonate?
And in the case of anonymity, the company can then put pressure on the trusted verifier (who cannot be anonymous to be trusted) to break the anonymity.
I see the use case, absolutely, but also some potential flaws in the system. When I first heard about it, I didn't think anonymity was the focus.
You would need a monero-style multiple public key system so verifiers can't oust you
I think if employed using Freenet style nodes it could bolster the decentralized but secure nature
Ok, you may be able to flag one bot with this setup, however, I have some questions
1) Does that mean presumption of guilt for newcomers unless someone verifies their identity?
2) How do you distinguish a bot network or even worse, a malicious actor network like they have in advanced persistent threat facilities in our beloved countries from a, say, small local community of a distant town?
3) If an employer can verify identity of an (ex-)employee, how is it any safer for said (ex-)employee to speak up knowing their (ex-)employer has verified their account? Since verifications are public, using a throwaway account to voice claims and then verifying with the main account to have credibility is just producing direct evidence of an attempt of concealing a disclosure. Not having this verification at all is even safer if said disclosure breaks terms of an NDA, which it does for most whistleblowers.
4) How this verification system is different to user graphs you build in, say, LinkedIn network?
Do you have plans to add more Platforms? Like being able to add fediverse profiles.
When do you plan on releasing it, for the French iOS App Store?
Do you need language contributors? I claim that my French is more than decent! 😅
How do you find people near you to verify? :)
ah yes
Sybil resistant? Key rotation?
I think it's essential to be able to vouch for a claim without knowing the profile under which the person is currently acting!
It still sounds like a single point of failure. What happens if the Harbor app disappears? The domain is seized, hacked, or taken over? Is the protocol open? Will it be federated?
5:27 WTF
Sounds very cool. And have already downloaded it. I just wonder whats stopping the 'Trusted Verifier' circle to be compromised, one bad actor gets verified and say they own a botnet. What stopping them from then verifying bots?
Just because someone is "verified" (as a human? You did not specify) does not mean I trust that person to verify others. That trust is up to me.
I don't see any means to repudiate a vouch. Or even a list of claims I vouch for.
Im not sure if investing in edge case programs like this would be ideal, granted we need the infrastructure there to even begin, but until we have large companies or governments who are willing to join these programs they'll be dead in the water, I think FUTO might better vested in taking out the big guys by investing in things where whole industries can be disrupted, like the wheelchair company, that I think was a much needed investment, I would personally like to see more things like that, companies that disrupt the entire ecosystem of exploitation
It's hard to search for that 'wheelchair company' - all I get is, well, wheelchairs. Do you have a better keyword?
There was an interview with Louis. They didn't have a great business plan, mostly charity.