Latest / Chief in Tech Deep Dive Shortcast / Chief in Tech S1E16 - Daniela Barbosa : Authenticity in the Age of AI: A Guide to Decentralized Identity, Verification, and Trust
Transcript
- 0:00All right. Let's unpack this today. You know
- 0:03that that weird feeling when you get a text from
- 0:05a number you don't recognize? Oh, yeah, the generic
- 0:07ones. Right. Exactly. It says something super
- 0:09generic like, hey, it's me. I lost my phone.
- 0:13And for a split second, your brain does this
- 0:16this little calculation like, is this my mom?
- 0:19Is this, you know, a buddy from college or is
- 0:22this a scammer sitting in a basement halfway
- 0:24across the world? It's that is this real calculation.
- 0:27And I mean, we are doing it dozens, maybe hundreds
- 0:32of times a day now. Exactly. And that split second
- 0:34of hesitation, that is the sound of trust breaking.
- 0:37Because we are living in a moment where the line
- 0:40between human and machine isn't just blurring,
- 0:42it's actively dissolving. We're seeing CEOs in
- 0:46videos saying things they never said. We're hearing
- 0:49voices of family members that are actually AI
- 0:51clones. It really just feels overwhelming. It
- 0:53feels overwhelming because the tools we use to
- 0:56navigate the world are eyes, our ears, our gut
- 0:59instincts. they are suddenly totally unreliable.
- 1:02We are operating in this digital environment
- 1:04that has zero native way to verify who or what
- 1:08is on the other end of the connection. We're
- 1:09just flying blind. So today's deep dive is really
- 1:12about fixing that. We're unpacking a presentation
- 1:15by Daniela Barbosa from the Linux Foundation.
- 1:18And usually, when we talk about AI and security,
- 1:20it's all doom and gloom. Yeah, the robots are
- 1:22coming. Run for the hills. Run for the hills,
- 1:24exactly. But this source is different. This is
- 1:27about the architectures of trust, like the actual
- 1:30blueprints being drawn up right now to rebuild
- 1:32the internet's foundation. And it's a massive
- 1:35topic. But I love how Barbosa grounds it immediately
- 1:38with an analogy that I think we need to start
- 1:41with this because it reframes the whole problem.
- 1:43She talks about driving on a highway. Oh, the
- 1:45car analogy. Let's visualize this for everyone
- 1:47listening. Say I'm doing 70 miles an hour on
- 1:50the freeway. There is a two -ton metal box three
- 1:54feet to my left. I don't know the driver at all.
- 1:57No idea who they are. I don't know if they're
- 1:59angry or tired, drunk, texting. But I don't swerve
- 2:02off the road in a panic every time a car passes
- 2:04me. Why is that? because of infrastructure. You
- 2:07aren't trusting the person inside that car. You're
- 2:10trusting the system that put them there. You
- 2:13trust that they had to pass a test to get a license.
- 2:15You trust the car had to be registered, had to
- 2:17pass safety inspections. You trust the painted
- 2:20lines on the road and the threat of traffic enforcement
- 2:24if they cross those lines. There is this layered
- 2:27architecture of rules and credentials that makes
- 2:31the chaos manageable. And her entire point is
- 2:34that the internet just doesn't have that. Not
- 2:36at all. I mean, the internet was built on the
- 2:39principle of move fast and break things. It was
- 2:42designed for connectivity, not security. It's
- 2:44like a highway with no lanes, no licenses, no
- 2:47speed limits, and everyone was wearing a mask
- 2:49so you can't even see who they are. And for a
- 2:52long time, we just patched over that with passwords
- 2:54and databases. Which brings us to the first really
- 2:57major insight from the source material. We got
- 2:59to talk about why the old way, the password way,
- 3:01the database way, why it's failing so spectacularly.
- 3:06Barbosa dropped a stat that honestly made my
- 3:08jaw hit the floor. Oh, you're talking about the
- 3:102024 health data breach statistic. Yeah. 275
- 3:14million people. It is staggering. In just one
- 3:17single year approximately 275 million individuals
- 3:22had their protected health information compromised.
- 3:24Wow. That averages out to about 750 ,000 records
- 3:28stolen every single day. That's effectively the
- 3:31entire adult population of the United States,
- 3:33give or take. But let's go a bit deeper than
- 3:35the number. Why is this happening now? Is it
- 3:38just that hackers are getting smarter? Hackers
- 3:40are getting smarter, yes. But the architecture
- 3:42itself is practically hitting them. We currently
- 3:45store data in centralized databases, these massive
- 3:48servers held by hospitals, banks, social media
- 3:52companies. In security terms, we call these honeypots.
- 3:55Honeypots. I actually really like that image.
- 3:57It's perfect because it explains the whole If
- 4:00you're a hacker, why would you try to rob 1 ,000
- 4:03individual houses to get a little bit of cash
- 4:05when you can just rob one bank vault and get
- 4:07everyone's gold at once? Right. It's a single
- 4:09point of failure. Exactly. Centralized databases
- 4:12are sitting ducks. And we, meaning the users,
- 4:15we aren't exactly helping, are we? I felt personally
- 4:17attacked by that password stat she cited. The
- 4:20Forbes report. Yes. She said 78 % of people use
- 4:23the same password across multiple accounts. And
- 4:26look, I am completely guilty. I have like 100
- 4:29accounts. I can't remember 100 complex codes.
- 4:32So I use variations of the same thing. And that
- 4:34is the human error fiction point. But here is
- 4:37the new variable that changes everything, AI.
- 4:40Barbosa describes AI as a threat multiplier.
- 4:43In the past, hacking a password took time. You
- 4:46had to type it in, guess it, brute force it.
- 4:48Now, AI can guess passwords at lightning speed.
- 4:52But even worse, it can bypass the human verification
- 4:55layer entirely. This is the deep fake issue.
- 4:57Correct. If I call your bank and I sound exactly
- 5:00like you because I've cloned your voice from
- 5:01the three -second video you posted online, the
- 5:04bank teller's trust radar is totally useless.
- 5:06Because they think it's me. Right. The old system
- 5:08relied on something you know, like a password,
- 5:11or something you are, like your voice. AI can
- 5:15now fake both of those things effortlessly. If
- 5:18we can't trust our eyes and we can't trust the
- 5:21centralized databases, we clearly need a completely
- 5:23new model. And this is where the deep dive gets
- 5:26really sci -fi, but in a highly practical way.
- 5:29Barbosa uses the example of autonomous cars,
- 5:32specifically those Waymo taxis in San Francisco,
- 5:35to explain how trust actually should work. This
- 5:37is such a brilliant visualization of machine
- 5:40to machine trust. Picture an intersection in
- 5:42San Francisco. It's foggy. There are no stop
- 5:45signs, no traffic lights. Just two robot cars
- 5:48approaching each other at speed. It's a digital
- 5:50game of chicken. In a way, yeah. But think about
- 5:53the constraints here. They can't hesitate. They
- 5:56can't roll down the window and wave the other
- 5:58guy through. They can't make eye contact. Right.
- 6:00No human cues at all. None. In milliseconds,
- 6:03car A has to tell car B, I am a certified Wemo
- 6:06vehicle. My software is up to date. I am traveling
- 6:09at 30 miles per hour. I intend to turn left.
- 6:11And car B has to believe it instantly. Instantly.
- 6:14Because if car A is lying, If it's actually a
- 6:17hacked car trying to cause a crash or it's a
- 6:20malfunctioned peaceful, people die. So they don't
- 6:23rely on looking at each other. They exchange
- 6:25cryptographic proofs. They verify credentials
- 6:28mathematically. And this all happens faster than
- 6:31a human could ever blink. Much faster. And this
- 6:34right here is the North Star for the new internet.
- 6:36We need to treat every interaction, logging into
- 6:39email, buying shoes, reading the news, with that
- 6:41exact same level of cryptographic certainty.
- 6:43So moving away from just taking someone's word
- 6:45for it. Exactly. We need to move from, trust
- 6:48me, I'm a doctor, to... Here is a mathematically
- 6:51unforgeable token proving I am a doctor. OK,
- 6:54so let's get into the toolkit here. How do we
- 6:56actually build this? The presentation threw around
- 6:58some acronyms that we really need to decode for
- 7:00everyone listening. DDs and VCs. Let's start
- 7:03with a DDI. OK, so DD stands for decentralized
- 7:06identifier. Think of it as a permanent digital
- 7:09name tag that you completely control. How is
- 7:11that different from my email address, like hostname
- 7:13at gmail .com? Your email address is rented.
- 7:17It belongs to Google. If Google decides they
- 7:19don't like you tomorrow, or if they shut down
- 7:21the service, your identity just vanishes. You
- 7:25are essentially a digital serf living on their
- 7:27land. The DID is entirely different. It's anchored
- 7:32on a decentralized network, like a blockchain
- 7:34or a distributed ledger. No company controls
- 7:36it. It's yours. So it's like owning your own
- 7:39house instead of renting an apartment. The landlord
- 7:41can't just kick you out. Yeah, exactly. You hold
- 7:43the keys. Okay, so I have the name tag, I have
- 7:46the house, but a name tag doesn't really prove
- 7:49anything. I can write astronaut on a nametag,
- 7:52but that doesn't let me fly the space shuttle.
- 7:54I need actual proof. Right. And that is where
- 7:56the VCs come in. Verifiable Prudentials. These
- 7:59are the digital equivalents of the plastic cards
- 8:02in your physical wallet. Your driver's license,
- 8:04your university diploma, your Costco membership,
- 8:07your gym pass. But digitized. Digitized. But
- 8:10strictly better than digitized. See, right now,
- 8:13if you take a photo of your driver's license
- 8:14and email it to someone to prove who you are,
- 8:16that's just a dumb image. Right. It can be faked.
- 8:19It can be photoshopped. It can be intercepted.
- 8:22A verifiable credential is a piece of code signed
- 8:25by the issuer. So the DMV cryptographically signs
- 8:30your digital license and you store that in a
- 8:33digital wallet on your phone. And this leads
- 8:35to my absolute favorite part of the presentation
- 8:37because it solves a problem I think we've all
- 8:39had, the student discount problem. This really
- 8:42clicked for me when she explained it. It's the
- 8:44perfect example of what the industry calls selective
- 8:46disclosure. Walk us through it. Okay, so In the
- 8:49old world, the way we do it right now, say you
- 8:51want to discount on some software. The site asks
- 8:54for proof you're a student. You upload a picture
- 8:56of your student ID card. What did you just give
- 8:58them? Well, I gave them everything on the card,
- 9:00my full name, my student ID number, my campus
- 9:03address, the expiration date, and probably my
- 9:06date of birth. Now ask yourself, does the software
- 9:08company actually need to know your birthday to
- 9:11give you 10 % off? Do they need your campus address?
- 9:14No. They just need to know, is this person a
- 9:16student? Precisely. In the new world, using verifiable
- 9:20credentials, your digital wallet talks to their
- 9:23site. The site asks, are you a student? Your
- 9:26wallet checks your credential, sees the university's
- 9:29signature, and sends back what we call a zero
- 9:31-knowledge proof. It essentially says yes. Just
- 9:34yes, nothing else. Just yes. It proves the statement
- 9:37is true without revealing the underlying data.
- 9:40The vendor knows you're a student, but they don't
- 9:43know your name, your age, or your address. You
- 9:46get the discount. They get the assurance, and
- 9:48nobody gets to hoard your private data. That
- 9:50is a massive shift. We go from data hoarding,
- 9:53where companies collect everything just in case,
- 9:55to actual data minimization. And think about
- 9:58the security implication here. If that software
- 10:00company gets hacked next week, what do the hackers
- 10:03steal about you? Nothing. Just a log saying this
- 10:06user was verified. Exactly. The honeypot is empty.
- 10:09There was nothing to steal. Now, I can hear the
- 10:11skeptics listening right now thinking, you know,
- 10:13this sounds great in theory. But is anyone actually
- 10:16doing this? It sounds like some futuristic concept.
- 10:19And that is where the Bhutan case study comes
- 10:21in. This isn't just a pilot program in a lab
- 10:23somewhere, is it? No, this is actual national
- 10:26policy. In October 2023, the Kingdom of Bhutan
- 10:30launched the National Digital Identity Wallet,
- 10:33or NDI. Why Bhutan? Smaller nations can often
- 10:36pivot a lot faster on infrastructure. They looked
- 10:38at the landscape and decided to basically skip
- 10:41the centralized database phase entirely and go
- 10:44straight to self -sovereign identity. So how
- 10:46does it actually work for the average citizen
- 10:48in Bhutan right now? They download the wallet
- 10:50app, they secure it with biometric, so a face
- 10:52scan or a fingerprint, and once they're in, the
- 10:56government issues their credentials directly
- 10:57to that phone, their tax ID, their national status,
- 11:02banking details. So the data physically lives
- 11:04on the phone? That's the key. It's at the edge
- 11:06of the network, not in the center. If a citizen
- 11:09needs to prove to a bank that they are tax compliant,
- 11:12they beam that specific credential from their
- 11:14phone to the bank. The bank verifies the government's
- 11:17digital signature and the transaction is done.
- 11:21No central database was pinged and no physical
- 11:23papers were handed over. It's flipping the whole
- 11:26model upside down. Instead of the government
- 11:28holding my data and me asking permission to see
- 11:31it, I hold my data and I grant permission for
- 11:34them to see it. It is a fundamental shift in
- 11:36power dynamics. And frankly, it's the only way
- 11:39to secure data in an AI world. You can't breach.
- 11:43275 million records if they are stored on 275
- 11:47million separate devices protected by biometrics
- 11:50because you'd have to you'd have to hack 275
- 11:52million individual phones right economically
- 11:54impossible for hackers okay so we've solved or
- 11:56at least we have a really good blueprint for
- 11:59identity proving who I am but we still have the
- 12:02other side of the AI coin deepfakes Content.
- 12:05Because if I see a photo of a war zone or a video
- 12:08of a politician accepting a bribe, how do I know
- 12:10that is real? A digital wallet doesn't really
- 12:12help me there. Right. And this is the second
- 12:14pillar of the architecture, content provenance.
- 12:16We are moving from identifying people to identifying
- 12:19the history of media itself. Barbosa highlighted
- 12:22the C2PA standard. The Coalition for Content
- 12:25Provenance and Authenticity. Which is a bit of
- 12:29a mouthful. It is, but the tech is completely
- 12:31revolutionary. The best example she gave was
- 12:34the Leica camera, specifically the Leica SL3S.
- 12:37She said it has authenticity built in. What does
- 12:40that actually mean? Is it just like a digital
- 12:42watermark? No, watermarks are easily cropped
- 12:44out or faked. This happens at the hardware level.
- 12:47Inside the camera, there's a secure cryptographic
- 12:50chip. As soon as light hits the sensor and the
- 12:53image is captured, the camera cryptographically
- 12:55signs the file. Almost like a digital wax seal.
- 12:59Exactly like that. It stamps the file with metadata.
- 13:01Who took it, when, where, using GPS, and with
- 13:04what specific camera model. And if you take that
- 13:07file and open it in Photoshop to, say, add a
- 13:09tank or remove a person, the seal breaks. Well,
- 13:11it doesn't just break though, right? It updates.
- 13:13Right. That's a really important distinction.
- 13:15It creates a manifest. If you edit the photo,
- 13:17the file history will say, original taken by
- 13:19Leica at 2 p .m., edited in Adobe Photoshop at
- 13:234 p .m. So as a viewer, I could theoretically
- 13:25click a little info icon on the image and see
- 13:28that entire journey. That's the vision. Imagine
- 13:31scrolling through your news feed. You see a shocking
- 13:34photo from a conflict zone. You hover over it.
- 13:37If it has the C2PA credentials, you can see the
- 13:40chain of custody from the photojournalist's camera
- 13:42to your screen. And if it doesn't have it, you
- 13:45should be extremely skeptical. It's like an ingredients
- 13:47label for digital content. We know what's in
- 13:50our food. We absolutely should know what's in
- 13:52our news. And it extends to AI too. She briefly
- 13:55mentioned the Hedera AI Studio. If an AI generates
- 13:58an image or even makes a decision on a loan application,
- 14:02we need an audit trail. We need a public ledger
- 14:05that permanently timestamps it so we know, this
- 14:07was made by a machine. Transparency really seems
- 14:10to be the recurring theme here, but there is
- 14:12a snag. And Barbosa was very honest about this
- 14:14in her presentation. The world is a massive place.
- 14:17There are hundreds of countries, thousands of
- 14:19companies. If Bhutan has one wallet system and
- 14:22the EU has another, and Google builds a third,
- 14:24do they actually talk to each other? The interoperability
- 14:27challenge, yes. This is by far the biggest hurdle.
- 14:30If my digital driver's license only works in
- 14:33my home state, it's useless for travel. We cannot
- 14:36afford to have these walled gardens of trust
- 14:39where your identity gets stuck inside one corporate
- 14:42or government ecosystem. So what's the fix? She
- 14:44used an analogy I use every day but never really
- 14:46think about? Email? The SMTP analogy. Think about
- 14:49it. You can be on Gmail. I can be on Outlook.
- 14:51Someone else can be on a corporate Yahoo server.
- 14:53We can all email each other perfectly seamlessly.
- 14:56We don't need to be on the same platform to communicate.
- 14:58Because there is a shared underlying language.
- 15:00A protocol. SMTP. Or Simple Mail Transfer Protocol.
- 15:04Barbosa argues we desperately need an SMTP for
- 15:07trust. She calls it the Trust Spanning Protocol,
- 15:10or TSP. She gave a really heavy emotional example
- 15:13of why this matters, the refugee scenario. I
- 15:15think this is so important because it takes this
- 15:17out of the realm of just cool tech and puts it
- 15:20firmly into human rights. This really brings
- 15:22it home. Imagine a refugee fleeing a conflict
- 15:26zone. They have to leave their home quickly,
- 15:28their physical papers are burned or lost. But
- 15:31they have a digital wallet issued by a UN agency
- 15:34right on their phone. So they have a VC, a verifiable
- 15:38credential that says, I'm a refugee. I have these
- 15:40skills. This is my medical history. Right. Now
- 15:43they cross a border into a European country.
- 15:46The border control agent is using a completely
- 15:48different software system. Maybe it's a proprietary
- 15:50government system. If those two systems can't
- 15:53talk to each other, that refugee is basically
- 15:55back to square one. They are undocumented. They
- 15:58can't prove who they are. But with a trust spanning
- 16:00protocol? With TSP, the EU system can ping the
- 16:04UN credential, verify the cryptographic signature
- 16:07across different platforms, and instantly accept
- 16:09it. It acts as a universal translator for trust.
- 16:12That's not just convenience. That's dignity.
- 16:15That is the literal difference between being
- 16:17a ghost in the system and being a recognized
- 16:19human being who can access services. It allows
- 16:22trust to travel. And in a global economy, trust
- 16:25has to travel. If your credentials die at the
- 16:27border, you aren't truly free. So let's recap
- 16:30the stack here for everyone listening. We have
- 16:32the wallets, the DIDs, to hold our data. We have
- 16:34the credentials, the VCs, to actually prove who
- 16:36we are. We have the provenance, the C2PA standards
- 16:40to prove what content is real. And we have the
- 16:43protocol, the TSP, to make sure everyone speaks
- 16:45the same language. The blueprints are absolutely
- 16:47there. The foundation is being poured right now.
- 16:50But Barbosa's final point is that this isn't
- 16:53a spectator sport. Yeah, she listed a lot of
- 16:56organizations. Hyperledger, the Open Wallet Foundation.
- 16:59She's basically looking at all the developers
- 17:01and business leaders in the room and telling
- 17:02them, you have to build this. Because if we don't
- 17:05build it, or if we let one single big corporation
- 17:08build it just for themselves, we end up right
- 17:11back where we started. Centralized, vulnerable,
- 17:15and controlled by a very few people. This infrastructure
- 17:18needs to be open source. It needs to be a public
- 17:21utility. It needs to be exactly like the physical
- 17:24roads we drive on, available to everyone, owned
- 17:26by no one. There was one last concept she left
- 17:29us with, and I think it's the perfect place to
- 17:31land this deep dive. It's an idea that sounds
- 17:33so simple, but is actually totally mind -bending.
- 17:36First -person credentials. Oh, this is the ultimate
- 17:39paradox of the AI age. Explain what it is for
- 17:42the listener. It is simply the ability to cryptographically
- 17:45prove that you are a human being. Not who you
- 17:47are. Not, I am John Smith. Just what you are.
- 17:51Exactly. Just, I am not a bot. Think about it.
- 17:54In a future where 90, maybe 95 percent of all
- 17:58internet traffic is AI agents talking to other
- 18:01AI agents, spamming each other, generating endless
- 18:04content. human attention is going to be the absolute
- 18:08scarcest resource on the planet. So being able
- 18:10to raise your digital hand and say, hey, I actually
- 18:12have a pulse is going to be incredibly valuable.
- 18:15It's going to be the ultimate premium status.
- 18:17Being able to verify I am a biological human
- 18:19allows you to access spaces, communities or services
- 18:22that are designated humans only. It prevents
- 18:24swarms of bots from influencing elections or
- 18:27crashing stock markets or just overwhelming social
- 18:29networks with noise. It's wild to think that
- 18:32proving your humanity is going to be a technical
- 18:34feature. We used to worry so much about the Turing
- 18:36test. You know, can a machine pass as a human?
- 18:39Now we have the reverse Turing test. Can a human
- 18:41prove they aren't a machine? We need more technology
- 18:44to preserve our humanity. That is the great irony
- 18:47of all this. But it's also the hope. These tools,
- 18:51these architectures of trust, they aren't about
- 18:53controlling people. They are about empowering
- 18:56people to own their digital lives in a world
- 18:59that is becoming increasingly artificial. So
- 19:01for you listening right now, next time you unlock
- 19:04your phone with your face or you use a digital
- 19:06boarding pass at the airport or even just drive
- 19:09down the highway, I want you to think about the
- 19:11infrastructure behind it. Think about the invisible
- 19:13lines of trust that keep everything moving safely.
- 19:16and realize that the Wild West era of the internet
- 19:19is finally ending. The roads are being paved.
- 19:22The real question now is, who is deciding where
- 19:25those roads go? And if you are in a position
- 19:28to influence that, if you write code, if you
- 19:31lead a team, if you make policy, you should really
- 19:34look into the Open Wallet Foundation and Hyperledger.
- 19:37Look into C2PA. Because as Daniela Barbosa made
- 19:40so clear, trust is the only currency that actually
- 19:43matters in the age of AI. It's the one thing
- 19:45we just can't automate. It really is. That's
- 19:48a great point to end on. That's it for this deep
- 19:50dive. Stay curious, stay skeptical, and most
- 19:53importantly, stay human. We'll see you in the
- 19:55next one. Thanks for listening.