In principle, true, but if this happens at scale, it will be detectable (not by our protocol, but outside of it) and a state has a much bigger problem if people (other states) lose trust in their IDs.

As lemmy is federated, nations/groups/blocs/whatever, can come up with their own system or adopt this system. What matters is who (instances or even end users) is recognizing the identity provider’s authority and willingless to ensure each person has just one identity.

If I am convinced your local ML group is making a good job ensuring everybody just registers once, I can display this along with the message.

Hi! Sorry just saw the question now.

In the TrollThrottle paper, we used Direct Anonymous Attestation (https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation#Privacy_properties); the EU ID proposal is different but there are techniques to achieve a similiar property. At a high-level, the issuer provides a value that can be turned into pseudonym by randomizing it. The verifier (essentially everybody) can see that the result is a randomized version of something provided by the issuer, but the issuer cannot tell one user’s pseudonym from another.

I don’t understand how registration applications would stop a bot from registering, LLMs can just produce the registration text. Another concern is astroturfing by state actors, e.g, the famous Internet Research Agency, which might be human, but churning out propaganda en masse. They would have no problem overcoming these countermeasures.

As for AI-generated content, which carries the danger of scaling up much more rapidly than paid human actors, a conservative estimate for Reddit in '22-'24 mentions percentage sometimes reaching 9%. As for how much the different “troll factories” produce, I don’t know how to even measure it, but surely the governments payrolling these people expect them to produce content. I’d hypothesise that

(a) This will become worse in the future.

(b) Lemmy is not as affected at the moment because it is not as commercially and politically relevant as Reddit or Twitter.

So that’s why I am thinking about ways to counter this. Lemmy is a nice environment to test countermeasures because I can modify the source code and run an instance. For Reddit, we had to do some ugly JS trickery.

Maybe there is some way to counter this without ID verification, but the related Sybel problem has been studied for a long time, with identity validation the method being most prevalent.

I guess it boils down to: is astroturfing that much of a problem that we need all the risks that EUID introduces (from the practical perspective of a user, where the mathematical guarantees might not mean all that much).

This discussion is already shaping/changing my perspective. I plan to have a closer look into the moderation panel, but for a scientist to have years of experience in all application contexts they might apply their techniques is just unrealistic. We have to make do with reading and communication (that’s why I am doing this) or team up with people that have this experience.

Yeah, not a fan of ID verification services either. I think that’s a government’s job. In contrast to big companies deciding on the policy, there is democratic oversight. (In countries that have working democracies.)

EUID’s design allows(*) to derive unlinkable pseudonyms from the identity, which in turn can be used with the third parties so neither they (nor the issuer, e.g., the government) know which pseudonym belongs to whom. So for me this is mostly about the government potentially limiting access.

(*) Caveat at the moment: cryptographic unlinkable pseudonyms are not yet standardized and we have to see how to create them with EUID’s current status. In the old article, we built this on DAAD, which provides this feature, but similiar techniques should apply here. Anyway, this strong unlinkability is a requirement for the system for me.

Yes, I can see that it is hard to trust the system is correct, the crypto involved is very opaque, even if you understand it, you need to trust it is correctly implemented. Software verification is still very difficult to use (so unlikely to be used for this kind of project) and then you still need a distribution mechanism that checks the software is verified.

Thanks for going into detail!

Don’t you think sabotage goes a bit far? I don’t have any project funding that requires me to work on this, I do this on my own accord and with the goal of fighting astro turfing, especially in political forums. (The article details this motivation in the introduction.) You may disagree with this approach, and I can see that ID authentication is really bothering a lot of people. But I am taking in feedback at an early stage. Isn’t that worth something? I might even drop the project!

Yeah, I know that instances are run by volunteers. Our prototype instance has EUID as an additional OAuth provider and embeds cryptographic evidence that a poster has a real identity (but not which it is). This information is shared via ActivityPub, even to instances that don’t know what to do with it. The instance can be run by anyone but publishes a policy, e.g., “all users on this instance are pseudonyms of a real identity, real identities cannot appear under different pseudonyms in the same thread, and post at most N per week”. The ID issuer must be trusted by end users who use the modified software to see if the instance adheres to its own policy. End users with the normal software don’t, they just see where the user is from and might trust that instance to uphold its policy, or not care at all.

I need to think (and read) more about how to validate the behavior of spammers. It is well possible that spammers don’t spam that often, but they might as well create new accounts after some N and operate in parallel with multiple accounts. I think the cap needs to be seen in combination with pseudonyms that are tied to identities.

Every post is federated to every other instance. My home instance could purge my posts, but all other instances would still have a copy that can’t be deleted by my admins. So the modlog is resilient by virtue of being distributed copies.

Ah, if your instance is honest. And if it is dishonest, you … switch to a different instance and live with the fact that you lose your “reputation”, i.e., tags at other user’s accounts, post history. Maybe it would be cool to be able to prove that you are the same person?

If the post was dropped upon submission, then nothing is seen, but thats hardly a silent censorship either, I can immediately see that it wasn’t created.

I was about to write "but you cannot prove that’, but if I get your drift, you’d just switch and not bother with making this public.

I dunno, but I think you need a much stronger selling point to get people on board with this, it just seems at odds with reality.

That’s why I am talking with you guys. ;) Thanks for your input btw. Despite using lemmy for a couple of years now, I’ve never seen the moderation panel … and then my perspective is very protocol-centric, although much about moderation seems to take place out-of-band.

In your personal view, does it change matters if the instance does not obtain the real identity, just the mathematical assurance that you have an ID and are not using your pseudonyms in the same thread?

A type of repression that this particular approach cannot protect against is that the ID provider might refuse to attest somebody’s identity – just like how a government could refuse to issue an ID. But we could provide accountability: tangible proof that somebody was refused to login. I think this would be a big deal, like government refusing somebody their physical ID, but it relies on the rule of law and a democratic society producing pressure.

What’s your main concern, privacy or censorship (or something else)?

That’s the goal. Our analysis assumes a heterogenous network with instances that have this feature and other’s that are unmodified.

The difference to reddit would be that in a federated network, this could be decided on a per-instance basis. I assume this is not mainly a convenience problem for you, is it? But more distrust towards Reddit (and what they would do with your data) or the ID issuer (and if they would use this to lock out dissent)?

For the record, I am starting from the premise “we need to limit the amount of astro turfing” because it distorts political discourse. There’s also other ways to recognize bots, but they are not very reliable. The goal is that the issuer does not learn what you do in lemmy and that lemmy (including that magic instance) does not learn who you are. Would it be a bigger problem for you that such a complicated system could be flawed, or that the issuers gets too much power over who can speak (or something else entirely)?

Good point – where do I find the admins? Preferably an open forum, like a community.

You are on point regarding spinning up an instance. Other countries / blocks will have different ideas about whether to do this and how, so this would be a demonstration that this is possible. I assume such an instance has less spam (tbh that’s just a guess), so admins may be happier federating with such instances.

Admittedly, once big countries or blocks provide attested identities and should it be true that they have less spam / bots, other instance might be under pressure. So this could still be seen as dangerous to folks that do not like to be forced to derive digital identities from centralized authorities and lead to fragmentation in the network.

Post/comment limits per account would either be too low, and annoying for some users, or too high, and completely ineffective for combatting spam posts. Spammers will typically only send 1-3 posts per day.

In the linked trollthrottle paper we ran some analysis on reddit data, and it turns out that football / cricket posters have incredible commenting frequency and the cap might be a big problem for them. But does it actually fight spam / astroturfing? Do you know a good source about spammer behavior, or are the 1-3 posts per days from experience?

I’m not sure what your bringing to the table for censorship either, the modlog is public, and federated, how does one get silently censored?

Your instance just silently drops your post after you have written it.

I need to have a closer look at what the modlog actually covers, but afaik it does not cover every deletion (permanent purges are mentioned? not sure). Moreover, in our super paranoid threat models, we usually consider the whole instance untrusted, not only some moderators, meaning that a malicious instance ought not to be able to alter the mod log (more precisely, the view of third parties) without this being detectable. In trollthtrolle, we achieved this with an append-only log and a cryptographic receipt, but there are other, more modern ways to achieve this.