Prevent Deepfakes

Confirm

How do you protect against AI deepfake scams over the phone or even video calls? How can you be sure that the person you think you're talking to is really them? By mutual authentication using Confirm.

Note

to-do: add Github, Obtainium and Play Store links.

Imagine you receive a phone call from a friend or a relative who needs your assistance. Or perhaps you get a call from a co-worker or your boss asking for some sensitive information from a corporate system.

How can you be certain that it's really them?

So-called Social Engineering and Phishing attacks are real and are becoming easier and easier to execute with the advent of advanced AI models. In fact, these types of attack represent the biggest and most difficult problem to solve as AI becomes more prevalent.

You want to help, but you know that the scams are real.

Confirm

Using Confirm, you can authenticate and Confirm that another party is who they say they are. It works with standard telephone calls and video calls -- no need for special phones or apps to make the call.

So how does it work?

  1. Install the Android app, and it will have you create an Identity for yourself.
  2. Establish a trust with friends, family or co-workers by scanning each other's QR code.
  3. Whenever you need to check that they're real, you both open the app and click Confirm, you'll read each other a few short pieces of information, and the cryptographic magic does its thing and will Confirm that you're both who you claim to be.

This all works offline too, so if the emergency finds you in a situation without reliable internet access, the process still works. No private data is stored on servers anywhere. Other than some periodic synchronisation between you and the people you trust, the internet is not needed at all.

The Nuts and Bolts

For those interested in the technical details:

  • The Identity you create creates a chain of private keys and signed public keys.
  • Creating a trust copies and signs the keys of identities you trust, plus some P2P data synchronisation using Iroh.
  • Performing mutual authentication to Confirm each other, involves selecting a public key each, reading each other a nonce value, and letting ed25519 do the hard work at both ends, finally outputting either 4 SAS words or 4 SAS numbers. By reading each other two of the SAS outputs, and making the set of 4, both parties can be sure that the other party is legit.

Each device has its own key, with those keys being tied to the hardware using available hardware (such as a TPM) where possible. (Note: This isn't yet supported before v1.0)