Hi! I am a researcher at the CISPA-Helmholtz-Institute for information security (https://cispa.de/en/people/kuennemann). I would like to get some community feedback on a project we are working on. I am a Lemmy-user myself, but of course I use my other account for lurking; this account is for my research business.

My question taps into the age-verification debate, which I know is very controversial, and people are sceptical for very good reasons; I just ask everyone to stay polite and engage the topic.

In short, I am worried about the effect bots have on public discourse, which to a large part takes place in the Internet. I would like to propose cryptographic methods that allow an instance to attest that a poster or commenter are a real human being. I think the European Unified ID (euid.eu) provides good infrastructure to do that, at the cost of relying on the member countries to provide them with an ID. Crypto-magic can (potentially - I haven’t worked out the details yet) ensure that:

  • users from an instance that opted in are sure to belong to someone with an id, other instances may use this knowledge in their moderation tools
  • users from that instance can retain several pseudonyms that even this instance cannot link. Yet (configurable) policy can ensure that no users uses two pseudonyms in the same thread
  • we could cap how many posts or comments a user makes per day/week/month, across their pseudonyms
  • users who post on this instance but are not displayed (in the web or to other instances) can provide evidence that they are being censored, which the public may review to discredit that instance and chose a new one.
  • the infrastructure also happens to allow for age verification (EUID can attest to statements like “this anonymous person is > 18”), and it could be part of an instance’s policy. Thanks to lemmy’s federated infrastructure, multiple verifying instances with different policies can exist. It’s not a focus of mine, though – I think social networks should not exploit children or adults.

Some of these ideas we have worked out (and tested on) reddit in this article, which was before Lemmy became popular and EUID was on the horizon.

I am interested in practical advice about who to talk to about engineering and how to best involve the community – we’ve got a prototype fork of lemmy including end-user verifiable authentication. I am also interested in how the community feels about the burden of moderation and this as a potential remedy. When discussing age verification, some users say they will never accept any ID-based authentication. Are there some amongst those who would change their minds provided they had full pseudonymity and censorship could be detected and made public with cryptographically signed evidence?

  • Dessalines@lemmy.mlEnglish
    8·
    5 days ago

    I don’t know how that’d work without you giving some personal identifying info to some 3rd party of some kind to verify, and people aren’t going to want to do that.

    Anyways if bots are the concern there’s better ways of keeping them out. Lemmy is mostly free of bots due to registration applications, and user reports which can find and report them quickly.

    • rkunnema@lemmy.zipOPEnglish
      12·
      4 days ago

      I don’t understand how registration applications would stop a bot from registering, LLMs can just produce the registration text. Another concern is astroturfing by state actors, e.g, the famous Internet Research Agency, which might be human, but churning out propaganda en masse. They would have no problem overcoming these countermeasures.

      As for AI-generated content, which carries the danger of scaling up much more rapidly than paid human actors, a conservative estimate for Reddit in '22-'24 mentions percentage sometimes reaching 9%. As for how much the different “troll factories” produce, I don’t know how to even measure it, but surely the governments payrolling these people expect them to produce content. I’d hypothesise that

      (a) This will become worse in the future.

      (b) Lemmy is not as affected at the moment because it is not as commercially and politically relevant as Reddit or Twitter.

      So that’s why I am thinking about ways to counter this. Lemmy is a nice environment to test countermeasures because I can modify the source code and run an instance. For Reddit, we had to do some ugly JS trickery.

      Maybe there is some way to counter this without ID verification, but the related Sybel problem has been studied for a long time, with identity validation the method being most prevalent.

      I guess it boils down to: is astroturfing that much of a problem that we need all the risks that EUID introduces (from the practical perspective of a user, where the mathematical guarantees might not mean all that much).