News for hackers. Stuff that matters.
Re:Cross-signing and end-to-end encryption by default by nimbius on Thursday May 07, 2020 @05:50PM (#23108771)
Signal has publicly threatened to shutter their US operations if EARN IT passes, so id say its relatively resilient. https://www.wired.com/story/signal-earn-it-ransomware-securi...

regardless, the e2e encryption debate seems largely settled by the key players at this point. I think any legislation that makes its way through is likely to see brinkmanship again. Theres no reason these services cant use darknets. At the risk of sounding like a cryptobro, theres also no reason they have to use a server at all with blockchain.

Re:Cross-signing and end-to-end encryption by default by KingMachiavelli on Thursday May 07, 2020 @05:59PM (#23108863)
Having to leave a country is pretty much the opposite of 'resilient' in this context. They have to leave because it is a centrialized system and can be regulated like any other entitiy.

Matrix is federated and individual servers can be run by volunteers/individuals for whom EARN IT would not apply.

Re:Cross-signing and end-to-end encryption by default by StavrosK on Thursday May 07, 2020 @08:58PM (#23110251)
> Matrix is federated and individual servers can be run by volunteers/individuals for whom EARN IT would not apply.

It would apply to them if they were or served US citizens, which would mean that nobody in the US could get encryption, which is exactly what might happen with Signal.

Re:Cross-signing and end-to-end encryption by default by mirimir on Friday May 08, 2020 @12:06AM (#23111290)
> It would apply to them if they were or served US citizens, ...

Sure, but only if they could be identified. So obviously any such volunteers would make sure that they remained anonymous. Otherwise, they would suffer the consequences.

Re:Cross-signing and end-to-end encryption by default by godelski on Friday May 08, 2020 @12:45AM (#23111471)
> At the risk of sounding like a cryptobro, theres also no reason they have to use a server at all with blockchain.

Can we stop saying blockchain for everything? You don't always need to, nor want to, audit your entire history.

Re:Cross-signing and end-to-end encryption by default by ekianjo on Thursday May 07, 2020 @08:18PM (#23109934)
> Signal has publicly threatened to shutter their US operations if EARN IT passes, so id say its relatively resilient.

So if every country passes something like EARN IT, Signal shuts down, how is that resilient?

Re:Cross-signing and end-to-end encryption by default by isbjorn16 on Thursday May 07, 2020 @10:39PM (#23110861)
I don't know how helpful it is to use the word resilient at all if we're talking about catastrophies like this. I mean, the International Space Station is pretty resilient, but if the population of earth is wiped out in a super volcano, it doesn't matter anymore, right? I'd still call the ISS resilient though.
Re:Cross-signing and end-to-end encryption by default by mirimir on Friday May 08, 2020 @12:14AM (#23111327)
> So if every country passes something like EARN IT, Signal shuts down, how is that resilient?

That's not a forgone conclusion. Maybe it is for Signal, but not for chat overall. There's this thing called Tor. If you're careful, you can remain anonymous. And there's the new onion routing network Loki, which backs the Session chat app.

If things got bad enough, there are more robust options. I can imagine a botnet that spread much like WannaCry, and which offered deniable messaging via covert channels. Data transmissions would be hard to detect, and running the network components would be deniable.

Re:Cross-signing and end-to-end encryption by default by fulafel on Friday May 08, 2020 @12:28AM (#23111389)
When should applications should fail-open when forced to pick between availability and security?
Re:Cross-signing and end-to-end encryption by default by ekianjo on Friday May 08, 2020 @10:35AM (#23115249)
The obvious answer is decentralization, and Signal is not equipped at all to do this.