All right. Let's unpack this today. You know
that that weird feeling when you get a text from
a number you don't recognize? Oh, yeah, the generic
ones. Right. Exactly. It says something super
generic like, hey, it's me. I lost my phone.
And for a split second, your brain does this
this little calculation like, is this my mom?
Is this, you know, a buddy from college or is
this a scammer sitting in a basement halfway
across the world? It's that is this real calculation.
And I mean, we are doing it dozens, maybe hundreds
of times a day now. Exactly. And that split second
of hesitation, that is the sound of trust breaking.
Because we are living in a moment where the line
between human and machine isn't just blurring,
it's actively dissolving. We're seeing CEOs in
videos saying things they never said. We're hearing
voices of family members that are actually AI
clones. It really just feels overwhelming. It
feels overwhelming because the tools we use to
navigate the world are eyes, our ears, our gut
instincts. they are suddenly totally unreliable.
We are operating in this digital environment
that has zero native way to verify who or what
is on the other end of the connection. We're
just flying blind. So today's deep dive is really
about fixing that. We're unpacking a presentation
by Daniela Barbosa from the Linux Foundation.
And usually, when we talk about AI and security,
it's all doom and gloom. Yeah, the robots are
coming. Run for the hills. Run for the hills,
exactly. But this source is different. This is
about the architectures of trust, like the actual
blueprints being drawn up right now to rebuild
the internet's foundation. And it's a massive
topic. But I love how Barbosa grounds it immediately
with an analogy that I think we need to start
with this because it reframes the whole problem.
She talks about driving on a highway. Oh, the
car analogy. Let's visualize this for everyone
listening. Say I'm doing 70 miles an hour on
the freeway. There is a two -ton metal box three
feet to my left. I don't know the driver at all.
No idea who they are. I don't know if they're
angry or tired, drunk, texting. But I don't swerve
off the road in a panic every time a car passes
me. Why is that? because of infrastructure. You
aren't trusting the person inside that car. You're
trusting the system that put them there. You
trust that they had to pass a test to get a license.
You trust the car had to be registered, had to
pass safety inspections. You trust the painted
lines on the road and the threat of traffic enforcement
if they cross those lines. There is this layered
architecture of rules and credentials that makes
the chaos manageable. And her entire point is
that the internet just doesn't have that. Not
at all. I mean, the internet was built on the
principle of move fast and break things. It was
designed for connectivity, not security. It's
like a highway with no lanes, no licenses, no
speed limits, and everyone was wearing a mask
so you can't even see who they are. And for a
long time, we just patched over that with passwords
and databases. Which brings us to the first really
major insight from the source material. We got
to talk about why the old way, the password way,
the database way, why it's failing so spectacularly.
Barbosa dropped a stat that honestly made my
jaw hit the floor. Oh, you're talking about the
2024 health data breach statistic. Yeah. 275
million people. It is staggering. In just one
single year approximately 275 million individuals
had their protected health information compromised.
Wow. That averages out to about 750 ,000 records
stolen every single day. That's effectively the
entire adult population of the United States,
give or take. But let's go a bit deeper than
the number. Why is this happening now? Is it
just that hackers are getting smarter? Hackers
are getting smarter, yes. But the architecture
itself is practically hitting them. We currently
store data in centralized databases, these massive
servers held by hospitals, banks, social media
companies. In security terms, we call these honeypots.
Honeypots. I actually really like that image.
It's perfect because it explains the whole If
you're a hacker, why would you try to rob 1 ,000
individual houses to get a little bit of cash
when you can just rob one bank vault and get
everyone's gold at once? Right. It's a single
point of failure. Exactly. Centralized databases
are sitting ducks. And we, meaning the users,
we aren't exactly helping, are we? I felt personally
attacked by that password stat she cited. The
Forbes report. Yes. She said 78 % of people use
the same password across multiple accounts. And
look, I am completely guilty. I have like 100
accounts. I can't remember 100 complex codes.
So I use variations of the same thing. And that
is the human error fiction point. But here is
the new variable that changes everything, AI.
Barbosa describes AI as a threat multiplier.
In the past, hacking a password took time. You
had to type it in, guess it, brute force it.
Now, AI can guess passwords at lightning speed.
But even worse, it can bypass the human verification
layer entirely. This is the deep fake issue.
Correct. If I call your bank and I sound exactly
like you because I've cloned your voice from
the three -second video you posted online, the
bank teller's trust radar is totally useless.
Because they think it's me. Right. The old system
relied on something you know, like a password,
or something you are, like your voice. AI can
now fake both of those things effortlessly. If
we can't trust our eyes and we can't trust the
centralized databases, we clearly need a completely
new model. And this is where the deep dive gets
really sci -fi, but in a highly practical way.
Barbosa uses the example of autonomous cars,
specifically those Waymo taxis in San Francisco,
to explain how trust actually should work. This
is such a brilliant visualization of machine
to machine trust. Picture an intersection in
San Francisco. It's foggy. There are no stop
signs, no traffic lights. Just two robot cars
approaching each other at speed. It's a digital
game of chicken. In a way, yeah. But think about
the constraints here. They can't hesitate. They
can't roll down the window and wave the other
guy through. They can't make eye contact. Right.
No human cues at all. None. In milliseconds,
car A has to tell car B, I am a certified Wemo
vehicle. My software is up to date. I am traveling
at 30 miles per hour. I intend to turn left.
And car B has to believe it instantly. Instantly.
Because if car A is lying, If it's actually a
hacked car trying to cause a crash or it's a
malfunctioned peaceful, people die. So they don't
rely on looking at each other. They exchange
cryptographic proofs. They verify credentials
mathematically. And this all happens faster than
a human could ever blink. Much faster. And this
right here is the North Star for the new internet.
We need to treat every interaction, logging into
email, buying shoes, reading the news, with that
exact same level of cryptographic certainty.
So moving away from just taking someone's word
for it. Exactly. We need to move from, trust
me, I'm a doctor, to... Here is a mathematically
unforgeable token proving I am a doctor. OK,
so let's get into the toolkit here. How do we
actually build this? The presentation threw around
some acronyms that we really need to decode for
everyone listening. DDs and VCs. Let's start
with a DDI. OK, so DD stands for decentralized
identifier. Think of it as a permanent digital
name tag that you completely control. How is
that different from my email address, like hostname
at gmail .com? Your email address is rented.
It belongs to Google. If Google decides they
don't like you tomorrow, or if they shut down
the service, your identity just vanishes. You
are essentially a digital serf living on their
land. The DID is entirely different. It's anchored
on a decentralized network, like a blockchain
or a distributed ledger. No company controls
it. It's yours. So it's like owning your own
house instead of renting an apartment. The landlord
can't just kick you out. Yeah, exactly. You hold
the keys. Okay, so I have the name tag, I have
the house, but a name tag doesn't really prove
anything. I can write astronaut on a nametag,
but that doesn't let me fly the space shuttle.
I need actual proof. Right. And that is where
the VCs come in. Verifiable Prudentials. These
are the digital equivalents of the plastic cards
in your physical wallet. Your driver's license,
your university diploma, your Costco membership,
your gym pass. But digitized. Digitized. But
strictly better than digitized. See, right now,
if you take a photo of your driver's license
and email it to someone to prove who you are,
that's just a dumb image. Right. It can be faked.
It can be photoshopped. It can be intercepted.
A verifiable credential is a piece of code signed
by the issuer. So the DMV cryptographically signs
your digital license and you store that in a
digital wallet on your phone. And this leads
to my absolute favorite part of the presentation
because it solves a problem I think we've all
had, the student discount problem. This really
clicked for me when she explained it. It's the
perfect example of what the industry calls selective
disclosure. Walk us through it. Okay, so In the
old world, the way we do it right now, say you
want to discount on some software. The site asks
for proof you're a student. You upload a picture
of your student ID card. What did you just give
them? Well, I gave them everything on the card,
my full name, my student ID number, my campus
address, the expiration date, and probably my
date of birth. Now ask yourself, does the software
company actually need to know your birthday to
give you 10 % off? Do they need your campus address?
No. They just need to know, is this person a
student? Precisely. In the new world, using verifiable
credentials, your digital wallet talks to their
site. The site asks, are you a student? Your
wallet checks your credential, sees the university's
signature, and sends back what we call a zero
-knowledge proof. It essentially says yes. Just
yes, nothing else. Just yes. It proves the statement
is true without revealing the underlying data.
The vendor knows you're a student, but they don't
know your name, your age, or your address. You
get the discount. They get the assurance, and
nobody gets to hoard your private data. That
is a massive shift. We go from data hoarding,
where companies collect everything just in case,
to actual data minimization. And think about
the security implication here. If that software
company gets hacked next week, what do the hackers
steal about you? Nothing. Just a log saying this
user was verified. Exactly. The honeypot is empty.
There was nothing to steal. Now, I can hear the
skeptics listening right now thinking, you know,
this sounds great in theory. But is anyone actually
doing this? It sounds like some futuristic concept.
And that is where the Bhutan case study comes
in. This isn't just a pilot program in a lab
somewhere, is it? No, this is actual national
policy. In October 2023, the Kingdom of Bhutan
launched the National Digital Identity Wallet,
or NDI. Why Bhutan? Smaller nations can often
pivot a lot faster on infrastructure. They looked
at the landscape and decided to basically skip
the centralized database phase entirely and go
straight to self -sovereign identity. So how
does it actually work for the average citizen
in Bhutan right now? They download the wallet
app, they secure it with biometric, so a face
scan or a fingerprint, and once they're in, the
government issues their credentials directly
to that phone, their tax ID, their national status,
banking details. So the data physically lives
on the phone? That's the key. It's at the edge
of the network, not in the center. If a citizen
needs to prove to a bank that they are tax compliant,
they beam that specific credential from their
phone to the bank. The bank verifies the government's
digital signature and the transaction is done.
No central database was pinged and no physical
papers were handed over. It's flipping the whole
model upside down. Instead of the government
holding my data and me asking permission to see
it, I hold my data and I grant permission for
them to see it. It is a fundamental shift in
power dynamics. And frankly, it's the only way
to secure data in an AI world. You can't breach.
275 million records if they are stored on 275
million separate devices protected by biometrics
because you'd have to you'd have to hack 275
million individual phones right economically
impossible for hackers okay so we've solved or
at least we have a really good blueprint for
identity proving who I am but we still have the
other side of the AI coin deepfakes Content.
Because if I see a photo of a war zone or a video
of a politician accepting a bribe, how do I know
that is real? A digital wallet doesn't really
help me there. Right. And this is the second
pillar of the architecture, content provenance.
We are moving from identifying people to identifying
the history of media itself. Barbosa highlighted
the C2PA standard. The Coalition for Content
Provenance and Authenticity. Which is a bit of
a mouthful. It is, but the tech is completely
revolutionary. The best example she gave was
the Leica camera, specifically the Leica SL3S.
She said it has authenticity built in. What does
that actually mean? Is it just like a digital
watermark? No, watermarks are easily cropped
out or faked. This happens at the hardware level.
Inside the camera, there's a secure cryptographic
chip. As soon as light hits the sensor and the
image is captured, the camera cryptographically
signs the file. Almost like a digital wax seal.
Exactly like that. It stamps the file with metadata.
Who took it, when, where, using GPS, and with
what specific camera model. And if you take that
file and open it in Photoshop to, say, add a
tank or remove a person, the seal breaks. Well,
it doesn't just break though, right? It updates.
Right. That's a really important distinction.
It creates a manifest. If you edit the photo,
the file history will say, original taken by
Leica at 2 p .m., edited in Adobe Photoshop at
4 p .m. So as a viewer, I could theoretically
click a little info icon on the image and see
that entire journey. That's the vision. Imagine
scrolling through your news feed. You see a shocking
photo from a conflict zone. You hover over it.
If it has the C2PA credentials, you can see the
chain of custody from the photojournalist's camera
to your screen. And if it doesn't have it, you
should be extremely skeptical. It's like an ingredients
label for digital content. We know what's in
our food. We absolutely should know what's in
our news. And it extends to AI too. She briefly
mentioned the Hedera AI Studio. If an AI generates
an image or even makes a decision on a loan application,
we need an audit trail. We need a public ledger
that permanently timestamps it so we know, this
was made by a machine. Transparency really seems
to be the recurring theme here, but there is
a snag. And Barbosa was very honest about this
in her presentation. The world is a massive place.
There are hundreds of countries, thousands of
companies. If Bhutan has one wallet system and
the EU has another, and Google builds a third,
do they actually talk to each other? The interoperability
challenge, yes. This is by far the biggest hurdle.
If my digital driver's license only works in
my home state, it's useless for travel. We cannot
afford to have these walled gardens of trust
where your identity gets stuck inside one corporate
or government ecosystem. So what's the fix? She
used an analogy I use every day but never really
think about? Email? The SMTP analogy. Think about
it. You can be on Gmail. I can be on Outlook.
Someone else can be on a corporate Yahoo server.
We can all email each other perfectly seamlessly.
We don't need to be on the same platform to communicate.
Because there is a shared underlying language.
A protocol. SMTP. Or Simple Mail Transfer Protocol.
Barbosa argues we desperately need an SMTP for
trust. She calls it the Trust Spanning Protocol,
or TSP. She gave a really heavy emotional example
of why this matters, the refugee scenario. I
think this is so important because it takes this
out of the realm of just cool tech and puts it
firmly into human rights. This really brings
it home. Imagine a refugee fleeing a conflict
zone. They have to leave their home quickly,
their physical papers are burned or lost. But
they have a digital wallet issued by a UN agency
right on their phone. So they have a VC, a verifiable
credential that says, I'm a refugee. I have these
skills. This is my medical history. Right. Now
they cross a border into a European country.
The border control agent is using a completely
different software system. Maybe it's a proprietary
government system. If those two systems can't
talk to each other, that refugee is basically
back to square one. They are undocumented. They
can't prove who they are. But with a trust spanning
protocol? With TSP, the EU system can ping the
UN credential, verify the cryptographic signature
across different platforms, and instantly accept
it. It acts as a universal translator for trust.
That's not just convenience. That's dignity.
That is the literal difference between being
a ghost in the system and being a recognized
human being who can access services. It allows
trust to travel. And in a global economy, trust
has to travel. If your credentials die at the
border, you aren't truly free. So let's recap
the stack here for everyone listening. We have
the wallets, the DIDs, to hold our data. We have
the credentials, the VCs, to actually prove who
we are. We have the provenance, the C2PA standards
to prove what content is real. And we have the
protocol, the TSP, to make sure everyone speaks
the same language. The blueprints are absolutely
there. The foundation is being poured right now.
But Barbosa's final point is that this isn't
a spectator sport. Yeah, she listed a lot of
organizations. Hyperledger, the Open Wallet Foundation.
She's basically looking at all the developers
and business leaders in the room and telling
them, you have to build this. Because if we don't
build it, or if we let one single big corporation
build it just for themselves, we end up right
back where we started. Centralized, vulnerable,
and controlled by a very few people. This infrastructure
needs to be open source. It needs to be a public
utility. It needs to be exactly like the physical
roads we drive on, available to everyone, owned
by no one. There was one last concept she left
us with, and I think it's the perfect place to
land this deep dive. It's an idea that sounds
so simple, but is actually totally mind -bending.
First -person credentials. Oh, this is the ultimate
paradox of the AI age. Explain what it is for
the listener. It is simply the ability to cryptographically
prove that you are a human being. Not who you
are. Not, I am John Smith. Just what you are.
Exactly. Just, I am not a bot. Think about it.
In a future where 90, maybe 95 percent of all
internet traffic is AI agents talking to other
AI agents, spamming each other, generating endless
content. human attention is going to be the absolute
scarcest resource on the planet. So being able
to raise your digital hand and say, hey, I actually
have a pulse is going to be incredibly valuable.
It's going to be the ultimate premium status.
Being able to verify I am a biological human
allows you to access spaces, communities or services
that are designated humans only. It prevents
swarms of bots from influencing elections or
crashing stock markets or just overwhelming social
networks with noise. It's wild to think that
proving your humanity is going to be a technical
feature. We used to worry so much about the Turing
test. You know, can a machine pass as a human?
Now we have the reverse Turing test. Can a human
prove they aren't a machine? We need more technology
to preserve our humanity. That is the great irony
of all this. But it's also the hope. These tools,
these architectures of trust, they aren't about
controlling people. They are about empowering
people to own their digital lives in a world
that is becoming increasingly artificial. So
for you listening right now, next time you unlock
your phone with your face or you use a digital
boarding pass at the airport or even just drive
down the highway, I want you to think about the
infrastructure behind it. Think about the invisible
lines of trust that keep everything moving safely.
and realize that the Wild West era of the internet
is finally ending. The roads are being paved.
The real question now is, who is deciding where
those roads go? And if you are in a position
to influence that, if you write code, if you
lead a team, if you make policy, you should really
look into the Open Wallet Foundation and Hyperledger.
Look into C2PA. Because as Daniela Barbosa made
so clear, trust is the only currency that actually
matters in the age of AI. It's the one thing
we just can't automate. It really is. That's
a great point to end on. That's it for this deep
dive. Stay curious, stay skeptical, and most
importantly, stay human. We'll see you in the
next one. Thanks for listening.