Skip to main content

How to prevent being scammed via phone calls using Certisfy

Just as we are plagued by data breaches because of our reliance on secrecy as our model of trust assertion instead of just-in-time information verification, we are similarly plagued by scams related to our inability to verify unknown contacts. 

Calls, text messages, emails, etc from unknown sources are now a major source of scams, cyber extortion and such. As was demonstrated here, Certisfy stickers backed by cryptographic certificate signatures can address this type of trust problem too.

If for instance your doctor's office or other place of business that you have a legitimate business relationship with calls you, they can simply begin the message with a sticker code such as below. You can put that sticker code in the Certisfy app and verify the identity and related information, including for the contact source identifier (phone number, email address...etc). 

If a message doesn't start with a verifiable sticker code, you drop it immediately, this effectively kills all such scams!! 

A legitimate sticker will include the certificate-verified phone number that should match the number you received the call on; similarly if it is an email it should match the message source email address (email clients now generally prevent spoofing).


The sticker approach not only prevent scams but greatly unburdens the receiver since they simply need to use a code and the Certisfy web app to verify the contact, no elaborate internet sleuthing required.


Comments

Post a Comment

Popular posts from this blog

Trusted URLs Via Cryptographic Signatures

With Certisfy sticker functionality, ie the ability to publish cryptographic signatures as claims, users can share trusted URLs by leveraging the verification tied to trustworthy claims. URLs can be included in trustworthy claims and posted for anything for which a user wants to project trust. They can also be restricted to sources(ie referrer) so that the link can't be fraudulently reposted elsewhere. When you include links in a claim that you want to associate trust with, users will first be able to verify the link provider via the claim and then decide whether the link and associated information is trustworthy. In an AI saturated online space, there is significant value in a link/url being able to provide a strong signal of authenticity or trust. A trusted creator or a journalist can post links tied to a Certisfy verification as a means to project trust and expand reach. With verification links backed by high quality trust projection, we can have in essence a verified web. Here...
Post a Comment
Read more

Using .gov Email Addresses For Age And Information Verification

Over the years we've experimented with ideas that leverage what can be thought of as civic trust infrastructure to address trust related problems on the Internet.  Previously we created a browser extension and proxy service that allowed users to use access to their IRS  Get Transcript ONLINE  access as a way to procure trustworthy cryptographic ID certificates.  Essentially treating access to the Get Transcript ONLINE service as automatic ID verification and using that to issue (via a web proxy) ID certificates.  We also developed the trust relay protocol , a similar approach that leverages existing sources of trust as a means to address internet trust challenges. These experiments ultimately lead to the development of the Certisfy app and service. We have launched another significant experimental approach, leveraging .gov email addresses as a mechanism for bootstrapping a cryptographic trust chain . Think of this as a sort of  web of trust implementa...
Post a Comment
Read more

Using Keybase and PGP To Build Certificate Trust Chains

We are expanding our previous experiment to include people who posses PGP keys hosted at certain domains. For now we are whitelisting Keybase.io, meaning if you have a Keybase PGP key it can be used to procure a trust anchor certificate via the Certisfy app. It should be noted that this is strictly experimental, meaning most certificates will likely at some point be suspended or out right revoked if it seems they are being used to issue untrustworthy certificates.  The allowance of Keybase is not ideal since there is no id proofing and there is no reason to assume the person behind the Keybase key is a suitable trust anchor. It is however something used by folks interested in cryptographic solutions related to internet trust and security, so at least for experimentation it is appropriate. To validate a certificate request with your Keybase PGP key, first use your Keybase key to sign the following text (no trailing or leading spaces): Using public key hosted at ${PGPPubkeyURL} , ...
Post a Comment
Read more