“The” IP Address

As elaborated in a prior post, sites and services often try to use an IP address as an input into protection (e.g. blocking a spammer) or customization (providing local weather info) algorithms.

Commonly, software would like to know “What is this device’s IP address?” Unfortunately, this is not a trivial question to answer, because it makes several incorrect assumptions:

  1. That the client device only has one IP address
  2. That network packets received by a service from the client device will have that IP address as the remote_addr.

Both of these assumptions are incorrect, in several ways.

Not One Address

Devices may have multiple network adapters, each with their own address. Those adapters may be “physical” (e.g. a network card) or “virtual” (e.g. a VPN adapter). Each network adapter may itself have multiple addresses, which is almost universally true for modern devices that support both IPv4 and IPv6.

Client Perspective != Remote Perspective

It is commonly the case that client requests are sent from networks that change the source address as the traffic flows (e.g. “Network Address Translation”). For example, many home users connect to the Internet from behind a WiFi router linked to their Internet Service Provider over a fiberoptic connection. In such cases, the web server will commonly see the IP address of the router, not the “private” address of the user’s PC.

Similarly, users may use VPNs, Tor, proxies, iCloud Private Relay, Oblivious HTTP, or other networking features that result in the server having a different perspective of the client’s network address.

In cases where a scenario requires a client to understand the “Internet’s perspective” of the client’s IP address, technologies like STUN may be used.

IPv6 Background

The vast majority of relevant internet traffic reaches its destination by way of Internet Protocol addresses. These numeric addresses exist in one of two families: IPv4 addresses are 32-bits in length and can reference around 3.7 billion routable endpoints, while IPv6 addresses are 128 bits long and can reference approximately 42 undecillion endpoints.

To accommodate the public internet which uses both IPv4 and IPv6 addresses, most clients and servers support both IPv4 and IPv6 simultaneously (“Dual Stack”), such that a given client device will have multiple addresses, at least one from each family. Web servers that offer support for both families will register both addresses in DNS. An A query for the fully-qualified domain name will return the IPv4 address, while an AAAA query will return the IPv6 address.

For example, sending both A and AAAA queries to DNS for example.com returns 104.18.27.120 and 2606:4700::6812:1a78 respectively.

Address family choice applies to the connection: when connecting to an IPv4 server address, the client uses its IPv4 client address, and when an IPv6 server is connected, the connection originates from a client’s IPv6 address.

There is usually no direct relationship between a client’s IPv4 and IPv6 addresses.

A given client may be configured to support both address families or only one. It may be designed to prefer a given family, or “race” parallel connections to both families to prefer whichever works more quickly. On Windows, the decision about whether IPv6 or IPv4 is used varies based on:

  1. Device Configuration (RFC 6724, prefix table, adapters)
  2. DNS results (RFC 3596, A, AAAA records)
  3. Happy Eyeballs (RFC 8305, which is timing and blocked connection fallback)
  4. Network QOS fallback (latency, packet loss, etc)

For example, when navigating a browser to Bing.com, a Microsoft service that supports both IPv4 and IPv6:

  • The browser DNS query returns records for both AAAA (IPv6) and A (IPv4) queries
  • Windows TCP/IP “prefers” IPv6 and that’s what Windows will try first
  • The TCP/IP stack starts IPv6 connection attempt
  • The TCP/IP stack waits ~300 ms, and will then try establishing an IPv4 connection
  • Whichever connection succeeds first wins, the other is abandoned

Today, approximately half of Internet traffic occurs over IPv6:

Understanding Address Family Preference

The command netsh interface ipv6 show prefixpolicies displays the IPv6 Prefix Policy Table, which determines the order in which a computer selects IP addresses when multiple options are available (e.g., deciding whether to prefer IPv6 over IPv4). The table is a set of rules to rank destination and source addresses.

By default, Windows prefers IPv6 (::/0 at precedence 40) over IPv4-mapped (::ffff:0:0/96 at precedence 35).

  • Precedence: The “weight” or priority. A higher number means a higher priority. For example, ::1/128 (Loopback) has a precedence of 50.
  • Label: A value used to match source addresses with destination addresses. If a source and destination have the same label, they are preferred for each other.
  • Prefix: The specific IP range the rule applies to.
    • ::1/128: The local machine (Loopback).
    • ::/0: Default IPv6 unicast.
    • ::ffff:0:0/96: This represents IPv4 addresses mapped into IPv6.

To change the priority of IPv4 so that it is preferred over IPv6, adjust the precedence of the IPv4-mapped IPv6 prefix (::ffff:0:0/96).

Preventing Tracking

When looking at your IPv6 address in Windows, you might find something surprising: there are several described as Temporary IPv6 Address, and they change.

The Temporary IPv6 Address feature in Windows (technically known as Privacy Extensions for SLAAC) is a security mechanism designed to prevent third parties from tracking your device’s activity across the internet as you move between networks or over long periods of time.

1. The Problem: The “EUI-64” Privacy Leak

In the early days of IPv6, addresses were typically generated using Stateless Address Autoconfiguration (SLAAC). To ensure every device on a network had a unique address, SLAAC often used the device’s MAC address to fill in the second half (the Interface Identifier) of the 128-bit IPv6 address.

This method, called EUI-64, created two major privacy risks:

  • Device Fingerprinting: Since your MAC address is globally unique and burnt into your hardware, your device could be identified regardless of which network you joined (home, coffee shop, or office).
  • Activity Tracking: Websites could correlate your traffic over days or weeks because your IPv6 address remained constant.

2. The Solution: RFC 4941 (Privacy Extensions)

To solve this, the IETF introduced RFC 4941, which Windows implements as the “Temporary IPv6 Address.” Instead of using your hardware’s MAC address, Windows generates a random 64-bit number for the interface identifier.

How Windows Generates the Address

  1. Randomization: Windows uses a pseudo-random algorithm to create the interface ID.
  2. Uniqueness Check: Before using it, Windows sends a “Neighbor Solicitation” message to ensure no one else on the local network is using that specific random ID.
  3. Hiding the MAC: Your actual MAC address is never exposed to the outside world in these packets.

3. The Lifecycle of a Temporary Address

Windows doesn’t just create one temporary address; it manages a rotating pool of them based on specific timers. This ensures that even if one temporary address is tracked, it will soon “expire” and be replaced.

StateDescription
PreferredThe address is active and will be used for all new outgoing connections (e.g., opening a new website).
DeprecatedThe address is no longer used for new connections, but existing connections (e.g., a file download in progress) can continue using it until they finish.
Expired/InvalidThe address is deleted from the system entirely.

By default, Windows follows these intervals:

  • New Temporary Address: Generated every 24 hours.
  • Preferred Lifetime: 24 hours (after which it becomes Deprecated).
  • Valid Lifetime: 7 days (after which it is Deleted).

4. Temporary vs. Public (Stable) Addresses

When you run ipconfig, you will often see both a Temporary IPv6 Address and a Link-local IPv6 Address. You might also see a “Public” or “Stable” IPv6 address.

  • Temporary Address: Used for outgoing traffic (web browsing, streaming). This is your “privacy mask.”
  • Public/Stable Address: Used for incoming traffic. If you are hosting a service (like a local web server) and need a consistent address that doesn’t change every 24 hours, this is the address you would point a DNS record toward. In modern Windows, even this “Stable” address is randomized (RFC 7217) so it doesn’t reveal your MAC address, but it remains constant as long as you are on the same network.

You can view and manage these settings using PowerShell or the Command Prompt.

View current addresses:

ipconfig /all

Look for the line labeled Temporary IPv6 Address. Alternatively, from PowerShell, Get-NetIPAddress -AddressFamily IPv6 will show the PreferredLifetime and ValidLifetime for every IPv6 address on your interface.

netsh interface ipv6 show privacy

If for some reason you need to disable this feature (e.g., for strict network troubleshooting), you can use: Set-NetIPv6Protocol -UseTemporaryAddresses Disabled

Messing Around with IPv6 Temporary Addresses in Windows

IPv6 For Microsoft Services

Today, many Microsoft services are exposed over IPv4 only. This is broadly true for the internet as well, where only 19% (71M of 370M) domains support IPv6 connectivity and the remaining 81% are exposed over IPv4 only.

This configuration is generally not problematic because “pure” IPv6 environments (which cannot reach IPv4 services) are rare on the public internet. Virtually all IPv6 capable clients can still connect over IPv4 as needed (“Dual Stack”). Only a tiny fraction of one percent of Windows devices have IPv4 disabled.

Numerous Microsoft cloud services, including Defender’s Cloud Services are currently exposed only over IPv4, meaning that they cannot be reached from pure IPv6 environments.

Defender Cloud Services

  • SmartScreen (Web Protection & AppRep): The URL and application reputation checks in Windows, which contact cloud services (e.g. “check if this website or downloaded file is malicious”).
  • Defender “Cloud Protection“: Cloud-based file and threat lookups.
  • Defender Antivirus Telemetry: Data sent from Windows endpoints (e.g. passive sensor data, heartbeats, inspection results)

Experimentation: Just Try It!

I’ve now been working in tech for 25 years, and in that time I’ve developed some wisdom. One theme I’ve discovered and blogged about repeatedly over the years is profound despite its simplicity:

In many cases, the best way to know whether something will work is to just try it.

I’ve written numerous posts making fundamentally the same point:

While I believe experimentation is usually the best approach, it’s not always practical to try things out — you might not have the time, resources, or expertise required to experiment. And sometimes your experiment might be flawed and talking to an expert or reading the spec or code might reveal hidden complexities you didn’t foresee.

Beyond that, unfortunately some systems weren’t designed to facilitate experimentation.

Experimentation vs. Trapdoors

In this short clip, Jeff Bezos talks about decision making and the importance of recognizing the difference between a “two-way door” decision and a “one-way door” (trapdoor) decision. Put simply: If a decision can be easily reversed, you should make it quickly and without too much thought, avoiding analysis paralysis. Just try it!

In contrast, making a trapdoor decision requires much more thought: when a mistake would be very costly or unrecoverable, it is worthwhile to invest significant energy in making sure that your first choice is the best one.

In my experience, there are relatively few trapdoor actions in the real-world: yes, it’s often worthwhile to “measure twice and cut once“, but the number of actions with unrecoverable outcomes is small and such circumstances are typically obvious.

Design for Experimentation

To the extent possible, designers should strive to build products and standards that facilitate experimentation, allowing easy recovery if the user makes a mistake.

Why? Customers prefer products where they can “just play with it” without fear of consequences. Fearless experimentation helps smooth over other product shortcomings, including inadequate/outdated documentation, excessive complexity, or confusing UX.

Observability

An experiment is risky if the outcome cannot be determined.

One important characteristic of experiment-friendly designs is that the experimenter can determine the result of the experiment. In some cases, the user can directly observe the result– desktop publishing software got much easier to use with the invention of “print preview” and what-you-see-is-what-you-get (WYSIWYG). In others, the product needs instrumentation and telemetry to determine the outcome (e.g. “With the new compositor feature flag enabled, our crash rate increased by 4%).

Sometimes the best way to make an experiment safe is to allow observation of the outcome without actually making the change (e.g. “print preview” shows the outcome without actually wasting paper); some products offer a “simulation” mode.

Revertability

An experiment is risky if getting back to the default or prior state is impossible or difficult.

If getting back to the prior or default state requires that the user keep track of everything they changed and manually undo each operation, users will be reluctant to touch anything for fear of breaking a working configuration. You should strive to make it simple to go back to the prior configuration, or, at the very least offer a single click “Reset to defaults” button.

Latency

An experiment is risky if undoing the experiment takes too much time.

For example, the Web Platform’s Strict Transport Security feature allows a site to announce that it is only loadable over HTTPS, refusing to load over HTTP. A site owner can even decree that browsers should “pre-load” this enforcement to protect every visitor’s first visit. The problem is that the browser’s HSTS Preload list only updates every few weeks, meaning a common mistake is that a site owner preloads their entire domain but quickly learns that some overlooked subdomains only support HTTP. Then they panic and beg the browser vendors for help, but it’s too late — it’ll be weeks before their domain can be removed from the preload list. Oops.

Timeline of misery (Browsers now ship even faster, but the time-to-recover is still very long)

The Web Platform’s HTTP Public Key Pinning feature was so often a source of self-inflicted outages that the feature was removed from Chrome entirely in version 72.

As a less extreme example, Microsoft Defender’s Network Protection Indicators feature allows an organization to block any “indicator” (domain, IP address, code-signing certificate or executable file’s hash). When the Security Operation Center adds a block against an indicator, Defender will prevent access to the resource. For example, if your IT department configures a Defender Custom Certificate Indicator to forbid use of Notepad++ inside your enterprise, attempting to download or run the installer will result in a block:

But what happens if the SOC administrator read some threat intelligence and naively decided to block s3.amazonaws.com via a network indicator? They would very quickly find that a huge number of websites that use Amazon S3 storage fail to load correctly, preventing their colleagues from loading mission-critical web applications. The SOC admin would immediately delete the errant indicator, but because changes to Defender’s indicators typically take two hours to propagate to all devices, they’ve just created an expensive outage.

Custom Indicators are an extremely powerful feature, but to experiment with them safely the admin cannot blindly “set it and forget it.”

Audit/ReportOnly Mode

An experiment is safe if running the experiment is harmless.

Defender’s Indicators feature allows the admin to specify that the indicator should run in audit mode. While an indicator is in Audit mode, the SOC will receive a notice if the indicator would have triggered in warn/block mode. To safely deploy an indicator, admins should always first deploy the indicator in audit mode and wait, watching for any alerts that indicate unexpected blocking. Only after a successful trial period should an IOC be set to warn/block mode.

System designers can design systems that encourage safe experimentation, for instance, by not allowing an Indicator to directly be set to block mode until an audit period has elapsed.

Audit/Report modes don’t just exist for Defender Indicators, of course. Web Platform features like Content-Security-Policy allow a report only mode where content that violates the directives results in a telemetry report that can be logged for validation before moving into enforcement mode.

“Careful This Thing’s Loaded!“

When it’s not possible to make decisions easily reversible, there should be prominent warnings to alert the user to the risk.

The HSTSPreload website requires that the admin undertake a number of technical steps, and warns (although arguably not sufficiently prominently) of the implications of preloading:

Constant Vigilence

I’ve previously argued “The definition of insanity is doing the same thing over and over again, and expecting the same results” and my linked blog post explains why. You cannot assume that just because you’ve carefully experimented and tuned before setting a policy that the resulting behavior will never cause you problems. Over time, your devices will get software updates, your users will try out new scenarios, and you will probably even get new employees that exercise new functionality. Even if you follow best practices to stay ahead of your users, you will always need to have appropriate monitoring in place to get notice of any behavioral breakages that slip by your testing.

Thanks for your help in building better products and using them more effectively!

-Eric

Simple Browser Security Improvements

Security Engineering is all about tradeoffs:

Web Browsers attempt to achieve an absolutely bananas goal: Allow safe execution of untrusted content on a user’s device.

Browsers are a huge vector for compromise of users’ devices and personal information, owing to the power and complexity. Much of the vulnerability induced by browsers occur where tradeoffs were either made poorly initially, or where the tradeoff would be made differently knowing what we know now.

So, what should we do? Here’s a modest list of proposals, many of which could be achieved in less than one dev day:

  1. Disallow random websites from going fullscreen without permission
  2. Allow simple Enterprise control of what types of files are allowed to download — current controls are comically underpowered. (https://issues.chromium.org/issues/40265750)
  3. Block download UI launch of high-risk file types that the OS has inexplicably failed to secure
  4. Introduce a pre-fetch security check to allow security software to block malicious requests (similar to this)
  5. Call AMSI to detect malicious content copied to the clipboard (https://issues.chromium.org/issues/440381280)
  6. Call AMSI when installing a new browser extension or restarting the browser to allow local security software insight of what code can impact the user’s browsing experience
  7. Stop supporting UserInfo in URLs or introduce a warning
  8. Disallow user-navigation to javascript: URLs or introduce a warning (https://issues.chromium.org/issues/559142626)
  9. Further restrict notification permissions to prevent scams and spam
  10. more to come, I’m sure

The Windows Security App

Going back as far as the 2004 release of Windows XP SP2, Windows has offered various GUIs to help users understand the security state of their PC. In modern Windows 10 (RS2+) and Windows 11, the latest version of this graphical user interface is called the “Windows Security Center/App“.

The Windows Security App (WSA) is a surface upon which Windows exposes various settings and information, including lightweight status for antivirus and firewall products (including those built by third-parties) and entry points to those products’ user-experiences.

The WSA can be launched via the Start Menu, or by clicking on various toast notifications sent by features within the app.

The default view aims to provide a “single status screen” showing the state of the system’s security components:

This UI provides entry points into configuring SmartScreen network reputation, SmartScreen Application Reputation, Smart App Control, controlled folder access, ransomware recovery, exploit protection, Windows Firewall, and the device’s hardware security features.

Defender Antivirus

By default, Windows includes Microsoft Defender Antivirus (MDAV) and the “Virus and Threat Protection” section of the WSA shows the state of MDAV, including details about the most recent scan, any previously-allowed threats, and the “Protection history” which outlines any threats previously encountered.

Notably, the WSA is also the only client graphical user-interface for Microsoft Defender Antivirus and Microsoft Defender for Endpoint security products: unlike all third-party security products on Windows there is not today a separate Defender app (except our D4I product; keep reading).

The Quick scan button allows invoking a quick scan of sensitive system locations (primarily, locations used by malware to establish persistence), while the Scan options link allows invoking other types of scans:

With that said, as outlined previously in my post about Understanding Defender AV Scans, there is rarely any need to manually kick off an AV Scan.

Defender for Endpoint

Until recently, the WSA would not show anything special if a device was onboarded to Microsoft Defender for Endpoint (MDE), the corporate version of Defender that adds numerous additional protection features beyond the free MDAV included with Windows. As I explained last month, it was previously non-trivial to determine whether a PC was onboarded to Defender for Endpoint’s XDR and monitored by a Security Operations Center.

Fortunately, this has recently changed, and the WSA now shows specific information when a device is onboarded, including which MDE features are enabled:

The Device Details link in the footer reveals more information, including status and version numbers of the protection components:

Third Party Antivirus

When a 3rd party security product installs on a client version of Windows, it calls the Windows Security Center API to announce its presence and status. Supported products include Virus and Threat Protection products and Firewall products. WSA previously showed a Web Protection category intended to indicate the status of any Edge Legacy browser protection extensions, but this section was removed in a recent update because Edge Legacy was removed years ago.

Registering a product in the Virus and Threat Protection category causes MDAV to either enter “passive mode”1 (disabling real-time protection and other features) or disable entirely1, allowing the 3rd party product to be the active protection component of the system. The product in question has short window after each system startup to register with the API: if it fails to do so, or if it indicates that it is not working properly, MDAV resumes Active protection. The APIs for registering with the Windows Security Center are not fully public, and only callable by members of the MVI program.

When a 3P security product registers, the UI of the Windows Security Center is updated to show lightweight status information from that product and offer an Open app entry point into the 3P product’s (typically) richer user-interface.

Windows Security App behind the 3P Sophos Home application spawned from the “Open app” button.

Multiple 3P products (AV and Firewall) may be installed at one time, although it’s generally recommended to only have one product of each time active to avoid conflicts and performance impact.

Notably, many consumers who buy PCs from major vendors may find that they have a “time-limited trial” of a 3rd party antivirus product pre-installed on their PC, leaving Defender in passive mode. Antivirus product vendors commonly pay PC vendors for such installations as a way to acquire customers for their security product subscriptions. As mentioned, uninstalling the trial product should automatically move MDAV back into “Active” mode.

Defender Antivirus’ Passive Mode

You may wonder what MDAV’s “Passive Mode” is used for– if MDAV is not providing its normal threat protection (with active filesystem minifilters, network monitoring, AMSI, IOfficeAntivirus, behavior monitoring, etc), then what is it doing?

In Passive Mode, MDAV can evaluate file trust/reputation for Smart App Control, AppControl. For MDE onboarded devices, EDR in Block Mode can use MDAV to block and remediate detected threats. While in Passive mode, MDAV can also provide services to other products, like Purview DLP. Defender’s filter drivers also remain active to prevent tampering.

End users can also optionally enable “limited periodic scans” to provide additional protections on top of their third-party product.

Navigating the WSA Programmatically

Individual pages of the WSA can be accessed via commands to the windowsdefender:// App Protocol:

home, threat, quarantinehistory, threatsettings, network,
perfhealth, appbrowser, family, fullhistory, history,
accountprotection, devicesecurity, updateandquickscan,
customscan, samples, settings, protectedfolders, allowedapps,
allowappthroughfolder, exploitprotection, ransomwareprotection,
coreisolation, securityprocessor, securityprocessortroubleshooting

For example, windowsdefender://appbrowser/ opens the App & Browser control page of the app:

Defender for Individuals app

Above, I mentioned that Defender does not have its own app, relying on WSA for all of its graphical user-interface. That’s generally true with the exception of the Defender for Individuals (D4I) product bundled into Microsoft 365 subscriptions for individuals and families. When installing D4I, you get a new app named “Microsoft Defender” that exposes the additional capabilities provided by your subscription, which include a unified dashboard across multiple devices (e.g. to see your kids’ PC’s status) and other features which vary per-market (e.g. identity protections and dark web scanning services).

Even when a D4I subscription is active, the underlying Virus and Threat Protections are provided by MDAV included in Windows. Entry points for antivirus-related activities in the D4I Microsoft Defender app ultimately navigate to the appropriate pages in the WSA.

Windows Server

The underlying Windows Security Center APIs that would allow 3P security products to register with Windows are not present on Windows Server. Instead, if a third-party product is installed on a Windows Server being onboarded to Microsoft Defender for Endpoint, the ForceDefenderPassiveMode registry key must be set explicitly to put Defender in passive mode.

On servers, Windows Security features are typically configured via PowerShell, Group Policy, the MDE Security Portal, or similar management mechanisms. For Server 2019 and later, WSA is present when the Desktop Experience Installation option is chosen. For Server 2016, it can be enabled via Install-WindowsFeature -Name Windows-Defender-GUI.

Stay safe out there!

-Eric

1 Technically, if Smart App Control is enabled, Defender’s status will be:

  • Active Mode if the Device is MDE-onboarded
  • Hybrid mode if not onboarded but MDAV is the primary AV
  • Passive mode if not onboarded and a 3P AV has replaced MDAV.

Yes, this stuff is incredibly subtle and intricate.

Attack Technique: AI Clones

Attackers are adept at using new technologies to enhance their attacks. Earlier this afternoon, for example, I got call from “American Express” suggesting that I needed to “verify a transaction.” The caller used a robotic voice similar to the one used by American Express’ automated systems, and only obvious signals that it was a scam were a) they didn’t have my name or card number, b) I have been using my Visa exclusively for the past few weeks, and c) I have their app, and I get push notifications from it.

Recently, there’s been some excited press about attackers abusing AI-powered “deepfake” technology to persuade users to take unsafe actions (for instance, sending money or sharing secrets) by using a trusted person’s voice or appearance to make the pitch more compelling. Attackers no longer need to limit themselves to spoofed phone numbers or names, they now can use a real-looking voice or video.

But is cloning still an advanced technique, or are we soon going to see it everywhere?

Free Voice Cloning

The best AI models require money to use and I don’t have the time or attention span to fully explore them, but as a browser lover/enthusiast, I’m intrigued to look at how convincing a spoof I can do using an in-browser speech cloning tool.

Beyond being free, such a tool will allow an attacker to generate speech without calling a web service that might keep logs that could be used to catch the attacker. Behold SoundTools.io. It’s free, trivial to use, and is very upfront about its market position and level of quality vs. competitors:

Throughout, the tool includes clear explanations of how it works:

To use it, you can either feed it previously recorded audio, or (preferably) a live recording of a paragraph of text:

After collecting the audio sample, the page downloads several large models (just over a gigabyte, cached for later use), to generate a cloned voice. It then allows the user to provide text that should be read aloud, and a desired quality level (lower-quality reproduction is faster):

The time required depends on the quality chosen and the performance of the browser on your device. In my quick test, the “High quality” level, which requires 60 to 150 seconds per sentence, seems to generate pretty good results. If it’s enabled, you’ll definitely want to turn off Edge’s “Enhanced Security Mode” for this site because its WebAssembly runs much more slowly in interpreted mode. The site makes heavy use of the system GPU:

…and surprisingly to me, doesn’t seem to work on Windows ARM devices like Surface Laptop 7.

Finally, when the generation completes, the recording is available to play or download.

Folks who have heard me speak would probably agree that the results are pretty plausible. While my real voice has more “ums”, “uhs”, variable pauses, and animation, careful preparation of the source text would yield even more compelling output. (For example, the web app doesn’t currently handle “smart quotes” properly, voicing contractions like “Can’t” as “Can Tee”.)

High Quality example (text from this post):

Ultra Quality example (text from this post):

Both of these are pretty solid, and attackers who worry about the quality of the clone would also likely simulate the speaker being in a noisy environment or suffering from a poor phone signal.

Not just voice, obviously

Don’t even get me started about how trivial photo editing has gotten:

Dating profiles where guys hold a giant fish will never be believable again 🤣
Running with my buddy

Even today’s high schools can afford to generate sizzle videos for marching bands that would’ve cost millions of dollars to render when I was high school.

Exciting stuff! But scary in the hands of bad guys. I don’t even know what to suggest folks do to stay safe, other than slow down and think, be extra skeptical of situations where someone unexpectedly contacts you, and be cautious of all non-in-person interactions, especially when it’s not a real-time conversation (which can still be faked, but it’s harder).

For years, it’s been easy to fake an entire company, but today it’s not too hard to shallowly fake a family member or close friend. Perhaps in the future, we will all share a Shibboleth with close friends, or demand out-of-band confirmations of all requests?

Stay safe out there, and don’t believe everything you hear, or see!

-Eric