Yeah, a little ridiculous that Microsoft can't even convince people to stop using RC4/MD5, since AES/SHA was available since like Windows Server 2008?
Both methods suffer from the same issues of offline attack.
Passwords can be protected from MITM by a secure implementation. Passkeys are protected from MITM by standard and their nature.
Passwords are a concept just as PKI is a concept. Both require implementation to exist in the real world. In the case of passwords an example of an implementation is strcmp or a ZKP like TLS-SRP. In the case of PKI examples are client certs or their poorly re-implemented cousin passkeys.
It's true that with additional layers such as TLS passwords can be protected from MITM, but you can't always control how the other end of a connection behaves. It's better to use a mechanism that's stronger from the ground up.
Again passwords are not the issue, it is only the current ubiquitous misuse of technology that is the problem. The argument it is better to deploy something "stronger" by changing all clients and servers anyway doesn't make any sense because it is the same work either way.
The knowledge factor is useful and worth protecting regardless of other technology such as client certs (e.g. passkeys)
If you do not read what I wrote but instead hallucinate something that sounds similar, you will obviously reach flawed conclusions. As you just demonstrated.
Table pounding is pointless. I read what you wrote. If you disagree with my assessment state what you are disagreeing with and the basis of the disagreement. You are most welcome to correct me and explain what I got wrong in my assessment of your statements.
Do you disagree you have presumed without evidence computer + software + data cannot embody consciousness?
Do you disagree you asserted computer + software + data != computer + software + data + consciousness?
Do you disagree your premise is simply begging the question?
Please provide your definition of consciousness. If you can't define it, then what's the point of your replies?
I have no interest in defining consciousness. What I am interested in is what consciousness has to do with determinism. I see quite a lot of people making statements about determinism and have no clue what the point of it is. I am quite frustrated by the total universal lack of any coherent explanation.
FYI, I made so such correlation. Someone claimed LLM's are nondeterministic. I simply provided evidence to the contrary. Can you at least agree, or disagree, on whether LLM's are nondeterministic?
Unless you are also gweihir I think there might be a mistake. This wasn't even addressed to you. To answer your question if the output of an LLM is nondeterministic then of course it is by definition nondeterministic.
If you are quibbling about technical details such as logits only being influenced by randomness and not themselves being random then randomly perturb the weights of the model or introduce noise into the calculations until you are satisfied. If there is some technical detail to quibble about please explain why the quibbling is relevant to assertions related to consciousness.
Apparently, some people consider nondeterminism to be a requirement for consciousness.
What is the basis for such an assumption?
If that is part of its definition, then the question of whether or not LLM's are deterministic is quite important.
So you are saying this is purely a self sealing argument? I define that consciousness requires nondeterminism therefore LLMs are not conscious because I deem them to be deterministic. This is completely worthless.
Passwords are subject to Man In The Middle. Passkeys are not. A passkey handshake verifies both you AND the server you are connecting to.
This is not the case. Passwords are protected from man in the middle attacks when secure authentication algorithm such as zero knowledge proofs are used.
Part of the reason I recommend use of asymmetric encryption
You misunderstand the argument. The argument is that the computer + software + data is a fully deterministic automaton. The claim is that you could find out that it has consciousness. But finding that out would mean that computer + software + data would need to behave differently than computer + software + data + consciousness. If they behave the same, you cannot detect consciousness because it makes no difference.
You presume without evidence computer + software + data cannot embody consciousness. Then you complete the circular argument by asserting computer + software + data != computer + software + data + consciousness.
But computer + software + data is already fully deterministic and would immediately crash if consciousness were to change its behavior. Computers are like that on a very extreme level.
The only thing that has crashed here is basic logic.
If it is deterministic, it is an automaton.
What is the point of labeling something an automaton?
No consciousness in there that could be detected, perfect repeatability, everything determined by hardware, software and data.
How do you know consciousness requires nondeterminism? What is the basis for this assertion?
Consciousness can only manifest (be detected) if it makes a difference.
What is the point of saying something can only be detected if it is detectable?
Obviously so.
That's an understatement.
If it makes a difference, the machine is not an the basic automaton anymore and it will behave different than determined by the hardware, software and data.
This is self sealing gibberish.
Note that whether consciousness is deterministic or not does not matter at all to this argument.
I'm asking what the relevance of determinism is WRT consciousness arguments and you are saying the issue itself is irrelevant? WTF is up with this crap?
MFA on top of user/password is still helpful though. Obviously, if someone gets phished, that's difference. But phishing is social engineering and not actually defeating the encryption.
I doubt we'll ever solve phishing unless we get rid of the human element but without the human element, what's the point?
The solution to phishing is SAS + secure authentication (e.g. ZKP)
What passes for security on the Internet (cleartext password transmission over "secure" channels) is the reason phishing is the worlds number one security threat. The worlds users have been trained to accept insanely dangerous behavior as normal.
What is especially pathetic many of the "MFA" schemes employed today are not even resistant to verifier impersonation.
A traditional login system throttles based on the endpoint (ie, the IP address or a specific browser cookie.)
I've never implemented a system like this where throttling would be based on anything other than login.
And if you lock an account after a certain number of incorrect guesses... we're back to the DoS situation, where anyone who knows or can guess your login name (often your email address) can lock you out of your account.
Throttling requests means if someone knows your username and has sufficient access to attempt login then yes they absolutely can keep you from logging in. Doing otherwise is insecure. If denial of service is a problem guard usernames.
As Tablizer mentioned there should be single purpose authenticators isolated from app servers for handling user authentication. It is unrealistic to expect passwords to contain required entropy to survive an offline brute force campaign regardless of algorithm or amplification scheme.
What is the point of these arguments?
"This CANNOT be overstated. LLMs are software, they execute on machines that are entirely deterministic and do not work unless they are. Non-determinism is literally simulated in AI. This must be said over and over." - dfghjk
IE: introducing a "real nondeterministic random number generator" does not change the fact that the entire system is dependent on its deterministic nature. Setting that to a static value proves that the system is deterministic. That's why I showed the example.
When you get around to answering the question why determinism is even relevant please do let me know.
Are there capabilities something that is conscious has that something that isn't doesn't? If so care to enumerate them?
Consciousness can influence physical reality...
Seriously. Got any other dumb questions that show you did not even read the definition?
I have several.
1. WHY are you PRESUMING consciousness **REQUIRES** nondeterminism?
2. If one presumes for the sake of argument consciousness requires nondeterminism so what? Lots of nondeterministic things "influence physical reality". Who cares? How is your statement at all responsive to my question? What capabilities does something that is conscious have that something which is not conscious does not? Why can't you answer the question?
Wrong. The deterministic behavior means there is no consciousness in there with any effect at all.
What is the objective basis for the assertion consciousness requires nondeterminism?
Consciousness with no effect cannot be detected.
Can consciousness be detected? Is there an objective test for its presence of absence?
FALSE (assuming same prompt means they're passing the same initialization seed).
"options": {
"seed": 32988
},
That will print the same random numbers on subsequent calls. It's faking it to make you think it's nondeterministic, and it seems to have fooled you (and maybe even Dawkins).
What is the point of these arguments?
All you have done was seeded a PRNG with a known value to make it deterministic. The system could be driven by a real nondeterministic random number generator derived by real thermal noise. What difference does it make? This is a pointless implementation detail that isn't relevant to anything.
Why is "determinism" relevant?
They don't? They must be hiring from the very bottom then. Because it is completely clear that LLMs are not conscious, unless that consciousness has no effects.
Are there capabilities something that is conscious has that something that isn't doesn't? If so care to enumerate them?
The price one pays for pursuing any profession, or calling, is an intimate knowledge of its ugly side. -- James Baldwin
