Patrick Radden Keefe Is One of the Good Guys – New York Magazine

Photo: Caroline Tompkins/The New York Times

On a recent evening, journalist Patrick Radden Keefe was in his home office in Westchester County, toying with a story idea that involved the Russian mafia. Before calling it a day, he printed a trove of related documents and left them in a stack on his printer tray. When he returned the next morning, he found that someone had taken one of the pages a picture of a dead body inscribed with a threatening message in Cyrillic letters and placed it on his desk. The culprit had added a single word to the page: No.

As a staff writer at The New Yorker, Keefe has written about all kinds of disreputable figures an international arms broker, hackers, a dubious diamond dealer, a mass shooter, and the Mexican drug lord Joaqun El Chapo Guzman, to name just a few and this wasnt the first time someone had tried to get him to beg off a story. While working on Empire of Pain, his 2021 book about the Sackler familys role in the opioid epidemic, Keefe came to believe the family had hired an investigator to intimidate him by loitering outside his home. This time, however, the intimidation campaign was coming from inside the house.

Every time he tells me a new story idea, I feel like I have a miniheart attack. Oh jeez, another litigious asshole or murderous criminal? Cant you do a celebrity profile or something? says Keefes wife, Justyna Gudzowska, an attorney who specializes in international financial-crime policy. Patrick is intrigued by all of the bad guys.

Keefe insists that his predisposition toward bad guys is not a point of tension in his marriage, but his new book, Rogues: True Stories of Grifters, Killers, Rebels and Crooks (Doubleday), is proof of his nearly undivided focus on scoundrels. After the enormous success of Empire of Pain and 2018s Say Nothing, a murder procedural set against the backdrop of the Troubles in Ireland, Keefes latest is a collection of 12 stories drawn from his work at The New Yorker and a reminder of his command of the magazine thriller.

I need a story about people. I always start from the ground up. There may be some kind of particular 30,000-foot phenomenon thats interesting, but I have to find an anecdotal way into it, Keefe says, sitting on a bench in Tompkins Square Park on a recent sunny afternoon. Im often thinking about these kinds of questions of the specific and the universal and to what degree can we empathize with people even if theyve done awful things.

The appetite for stories about people who do awful things has never been higher. Magazines have embraced the era of true crime with cash-starved glossies selling the rights to 8,000-word, already fact-checked features to streaming services. There is peril in that bargain: Narratives sometimes read as if theyve been engineered for Netflix; vulnerable sources, who are often victims, can feel exploited; and lurid storytelling can romanticize, or absolve, criminals. But Keefes work is mindful of the havoc his subjects unleash on their victims, their families, and the institutions around them.

In his hands, an abyss becomes a mirror. You end up learning what is the vulnerability or the vanity of the culture that got taken in by this person or that allowed this criminal to triumph or prosper. Thats why I feel like his work, admittedly emerging during a time when there is a grifting-journalism economy, stands out as singular, says Daniel Zalewski, Keefes longtime editor at The New Yorker.

Keefe has a natural tendency to key in on his subjects family lives as a means of interrogating their motives. In Rogues, nowhere does that tendency serve a story better than in the case of Amy Bishop, a disgruntled former science professor at the University of Alabama in Huntsville, who killed three colleagues and injured three others in a 2010 mass shooting. Years before her rampage, when Bishop was 21, shed shot and killed her 18-year-old brother. Keefe tirelessly reported on that time period, making trips to Bishops hometown of Braintree, Massachusetts. His reporting pointed to a theory that Bishops parents had called their sons murder an accident instead of facing the horror of fratricide. Keefe landed a series of interviews with Bishops parents, Judy and Sam, and laid out his theory for them.

I was able to home in on some of the inconsistencies in Judys story. But, of course, I didnt feel any sense of triumph. Cruel is the wrong word. I felt great empathy, because I felt these were two people who, in order to survive, had constructed a universe of denial. And there I was poking holes in that edifice, Keefe says. They called me the night before the piece came out. It had been through fact-checking already. Sam said, We want you to know that whatever happens with the piece, were really glad that we told our story to you. Which meant the world to me. The next day, the piece came out, and they havent spoken to me since.

While Rogues represents 15 years of magazine writing, its Keefes relatively recent work that launched him to a level of success few journalists ever reach. Say Nothing was a New York Times best-seller and optioned as a limited series on FX. In the spring of 2020, as the U.S. went into lockdown, Keefe released Wind of Change, an eight-episode podcast in which he investigated the mysterious origins of the Cold Warera anthem of the same name by glam-metal band the Scorpions. It was picked up by Hulu. A year later, Keefe published Empire of Pain, which also quickly became a New York Times best-seller.

At 46, Keefe is tall and lean with a sharp nose and a trimmed thicket of salt-and-pepper hair. Hes painstakingly affable a manner that surely serves him well as a reporter. Were eating chicken sandwiches from a trendy Indian restaurant Keefe was eager to try. A self-described dedicated eater, he doesnt have much time to explore the citys culinary delights these days thanks to two young sons, work, and the promotional obligations that come with literary fame. He has just come from a podcast interview about Empire of Pain and, in 48 hours, hell be on a plane to the Maldives for the Jaipur Literature Festival, which is being held at a five-star resort there. His books have earned Keefe awards, a spot on late-night TV couches, shout-outs from A-list celebrities, and the chance to testify before Congress. Ive heard that he no longer fields blurb requests from fellow authors, because there are simply too many.

Its ridiculous, he says of the Maldives trip. Next month, Im going to Ireland and doing a bunch of speaking. I could never have imagined, until a few years ago, saying no to that kind of opportunity. But Ive had to start saying no to stuff, because the last thing I want to do is keep running a victory lap for work that came out over a year ago.

Keefe grew up in Dorchester, Massachusetts, the son of an urban planner and a professor of philosophy. After undergrad at Columbia, Keefe went to Cambridge and the London School of Economics. Even as he was collecting masters degrees unrelated to journalism, Keefe always knew where he wanted to end up.

Working at The New Yorker was always his dream job, says Gudzowska, who also studied at Cambridge and LSE. I found this incredibly pretentious when I met him, but we were living in the U.K. together and hed find the newsstands that got The New Yorker earlier than the other newsstands and insist on going there as soon as the issue came out.

After England, Keefe and Gudzowska enrolled at Yale Law School, where Keefe took a year off to write his first book, Chatter, about the U.S.-eavesdropping-surveillance network. In 2006, the same year Chatter was published, Keefe sold his first story to The New Yorker, about Sister Ping, a prolific human smuggler in Chinatown, which Keefe would expand into his second book, The Snakehead.

He sent in a pitch, and it was so strong that I immediately agreed to work with him, said Zalewski. What was clear was that he could see that it was a crime operation, but that he was most interested in the complex motivations that had led her to embark on this endeavor to both help and exploit her community. It was that awareness of the double edge that caught my eye.

If there is a cinematic quality to Keefes work, thats because he plainly admits to drawing inspiration from the structure, pacing, and reveals in movies. When Keefe flew to Paris to interview an HSBC computer technician hed pitched to his editors as the Edward Snowden of Swiss banking, he quickly realized he was sitting across from a compulsive liar. At first, Keefe thought he needed to scuttle the story, because he couldnt build a feature around such an unreliable subject. Then he remembered The Informant!, a 2009 Matt Damon film about a disastrous FBI source, and it inspired him to lean into the unreliability of his subject. While trying to make it as a magazine writer, Keefe briefly worked as a Hollywood screenwriter, adapting a Jo Nesb novel for Channing Tatum and writing a script about Somali pirates for Jerry Bruckheimer. (It is a mercy to the world that that didnt get made and Captain Phillips did, he says.)

Back at Tompkins Square Park, Keefe is finishing the last few bites of his sandwich before getting back to work on a story about a CIA hacker on trial for allegedly leaking a massive cache of files to WikiLeaks. Before leaving, I ask whether he regrets any part of his interviews with Bishops parents. I wouldnt change a thing, he says. Its a thing that I wrestle with not so much ethically but emotionally. Its the Janet Malcolm thing, right? When you sit down to write, if you are pulling punches on behalf of the people youre writing about, youre not doing your job. There may be a necessary and inescapable cruelty in that. Which emotionally is hard for me but, professionally, I feel fine with.

Daily news about the politics, business, and technology shaping our world.

By submitting your email, you agree to our Terms and Privacy Notice and to receive email correspondence from us.

See the rest here:
Patrick Radden Keefe Is One of the Good Guys - New York Magazine

NFT Party Report: I Met a Spy Dressed as the Riddler – Gawker

Times Square has been worse than usual this week. Since Tuesday, the standard hordes of theater attendees and people in Tin Man costumes have been joined by thousands of NFT lovers in lanyards, descending upon New Yorks most-lit neighborhood for three days of panels about NFTs for the leading annual NFT event, NFT.NYC.

By now youve likely heard the spiel on what NFTs are (Its a receipt of digital ownership for a jpeg that looks like shit, someone has maybe told you in a bar). But the broader project of NFT culture is, reductively, to turn every aspect of human interaction into a commodity. There are NFTs for drinking coffee, playing football, skating and buying streetwear, doing feminism, joining private clubs, going to conferences, and, I assure you, much more. Fortunately, this isnt going well. NFTs, as you may know, are down bad. Per the Wall Street Journal, they are flatlining; in May, daily sales had fallen 92 percent from their peak last September. That makes it a very funny time to host what Insider called the Coachella of NFTs (in perhaps a tidy illustration of his poor marketing instincts, the conferences founder prefers the clunkier epithet, the South by Southwest of NYC).

Perhaps because the money-making side of NFTs isnt making that much money, the word on everyones lips at NFT.NYC was community. The conferences Twitter bio reads: NFT.NYC brings the NFT community together in NYC. There were countless talks on topics like The Power of NFT Investment Through Community, NFT Branding and Community Building, How to Build an NFT Market and Community, Security Measures for Community Building, 7 Ways To Optimize NFTs for Community, and the ominous, NFT Community Service Hour. As one Miami real estate developer told me: I dont see NFTs as an investment. I believe in the technology, and the community. Right on.

Wednesday night, I tried to get a sense for what that community is like. Specifically, my boss wanted me to do an NFT party report, so I took a look at the conferences list of satellite and community events (which, for an expo boasting over 1,000 speakers, was relatively short), and found the Eventbrite of something called the Flyfish Club Cocktail Party. Flyfish Club, as I learned from a fast Google, is the worlds first NFT restaurant. Technically, its not a restaurant yet. They dont have a storefront. But early next year, they plan to open an international seafood-focused dining venue somewhere in New York, where only the owners of their proprietary NFT, or others who lease those NFTs for a night, can eat. For now, the party would be at Scampi, an Italian spot in Flatiron.

Much like the hypothetical blockchain-enabled restaurant, the party was invite only. But thanks to a very kind doorman, a possibly-related high ratio of men to women in attendance, and the only name that came to mind when asked if I knew someone inside (Andrew Sullivan), the community let an NFTless loafer into their temporary home. I have to say I thought the community was nice, mostly the part involving an open bar, a spread of high-end crudit, and servers milling around offering some kind of tartar on a razor clam shell. The conversations were also better than I was expecting. I had precisely three of them, excluding the sweet doorman who checked in periodically to see if Andrew Sullivan had made it.

The first guy, who I met while trying to eat giant slices of hard salami in a minimally disgusting way, had also come alone. He was not a member of the club either, but a nice restaurateur who popped in to scope out the business model. He works for a restaurant company that owns a sushi place in New York and San Francisco, the latter of which has still not reopened after the pandemic. They were mulling the pivot to NFTs. I asked him how much money he had lost in crypto, and he said Its not great right now. We exchanged LinkedIns.

Back at the salami station, I met a Miami real estate developer who goes by Chichi, though it is not his real name. He came wearing a Moonbirds hat, so this was not his first blockchain-based private club rodeo. He had joined Flyfish Club at the behest of Resy co-founder Gary Vaynerchuk, or Gary Vee. I follow everything Gary Vee says, Chichi said. He had also lost a lot on crypto and NFTs. But as noted earlier, he does not think of them as an investment, so much as a community. He didnt plan to participate much in this particular community, being based in Miami. Instead he mostly planned to generate passive income by leasing his Flyfish Club membership to interested, but less committed community members. We also exchanged LinkedIns.

The grand finale was a 20-minute chat with a man wearing a Riddler jacket, a Hawaiian shirt, and a necklace of large titanium rings. He also had a glowing, neon-green, LED backpack, but he wasnt wearing it. The Riddler had come to promote his bio-authentication hospitality tech business. The gist, if Im remembering right, is that this tech would simplify the dining experience, by scanning your face at check-in to automatically find your reservation. The ordering and eating experience would proceed normally, but instead of paying at the end you could just leave. The face-scan would charge your card. He said they had a patent pending, and that Oracle was involved in some way.

Crucially, the Riddler wasnt always into face-scanning. He claimed he used to be a spy in Hawaii. I have no idea if this is true, but for approximately 10 minutes he detailed how, after joining the army, he had worked as a satellite imagery analyst for American intelligence. Specifically, he claimed to have worked on PRISM, the NSA data collection program from which Edward Snowden leaked classified documents in 2013. The Riddler had mixed feelings about his high-profile, alleged former colleague. Im concerned about the intelligence assets in Bulgaria, who had families, he said, but I do think the American public had a right to know what was going on.

The spy life sounded great he worked only six months of the year in Hawaii but eventually he had to go his own way. After working for a novelty political party, that I wont identify to protect his identity, he started an acne-preventing pillowcase company. He claims they pioneered the pillowcase technology, but that the business cratered when his partner embezzled all their money. I could not find more information about this online. But these days, hes in face-scan services. I think its going to change the world, he said. At the end, we exchanged LinkedIns.

All told, I did find a fairly pleasant community, if one that primarily took place on LinkedIn. At about 9:30, I slipped out the door sans Andrew Sullivan, and went downtown. Unfortunately, some of my real life friends were having their own NFT party. I guess the community was coming from inside the house.

Give Us Your Email

Would you like to receive a newsletter?

Link:
NFT Party Report: I Met a Spy Dressed as the Riddler - Gawker

Dozens of cryptography libraries vulnerable to private key theft – The Daily Swig

Ben Dickson28 June 2022 at 15:38 UTC Updated: 28 June 2022 at 17:20 UTC

Signing mechanism security shortcomings exposed

A poor implementation of Ed25519, a popular digital signature algorithm, has left dozens of cryptography libraries vulnerable to attacks.

According to Konstantinos Chalkias, a cryptographer at MystenLabs who discovered and reported the vulnerability, attackers could exploit the bug to steal private keys from cryptocurrency wallets.

Some but not yet all of the vulnerable technologies have been patched.

Ed25519 is often used as a modern replacement for the Elliptic Curve Digital Signature Algorithm (ECDSA). Ed25519 is more open, secure, and faster than ECDSA, which is why it has become very popular in many sectors, especially in blockchain and cryptocurrency platforms.

The main benefits against ECDSA is that EdDSA sig[nature]s are deterministic and users dont need [access to] a secure Random Number Generator [RNG] to sign a transaction, Chalkias told The Daily Swig. Why is this useful? because a users laptop or IoT device might not have a good source of entropy or support a weak RNG function.

Numerous security incidents have shown that poor random generation can result in private keys being leaked or stolen. One notable example was the private key leaks of PlayStation 3, whose technology relies on the ECDSA algorithm.

The standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the message. Some libraries provide a variant of the message signing function that also takes the pre-computed public key as an input parameter. There are some benefits to this implementation.

Recomputing the public key each time would result in a slower algorithm (it adds an extra scalar to elliptic curve point multiplication to derive the public key, which reduces the speed by almost 2x, potentially making it even slower than ECDSA), Chalkias said.

Read more of the latest hacking news from around the world

And generally, in cryptography, its good hygiene to avoid accessing the private key many times. If we allowed the public key derivation on each signing invocation, then this implies we need to access it twice, once to sign, and once to derive the public key.

However, the modification also creates a security loophole in the library.

Chalkias found that some libraries were allowing arbitrary public keys as inputs without checking if the input public key corresponds to the input private key. This shortcoming means that an attacker could use the signing function as an Oracle, perform crypto-analysis and ultimately get at secrets. For example, an attacker who cant access the private key but can access the signing mechanism through an API call could use several public keys and messages to gradually build up insights into private key parameters.

Chalkias initially found 26 libraries that were vulnerable to the attack. The list was later extended to 40 libraries. The security researcher also found several online services that were vulnerable to the same kind of attack, including a fintech API.

In some applications when keyGen fails or a clean-up process deletes the privKey for this user, then the app usually retries keyGen. But in the meantime and for a few sec[ond]s, the DB [database] still stored the old , and this allowed a narrow window for race condition attacks before the DB gets updated with the new pubKey (a scenario that, surprisingly, we managed to exploit with significant probability), Chalkias noted.

Since his report, several libraries have implemented fixes and workarounds, including ed25519-elisabeth, PASETO, and Trezor wallet.

A few libraries [have] already provided either fixes (if they were vulnerable) or proactively added extra checks that the stored pub key corresponds to the private keys, Chalkias concluded.

YOU MAY ALSO LIKE Researchers crack MEGAs privacy-by-design encryption, storage

Read the rest here:
Dozens of cryptography libraries vulnerable to private key theft - The Daily Swig

FACT SHEET: The United States Continues to Strengthen Cooperation with G7 on 21st Century Challenges, including those Posed by the People’s Republic…

Today President Biden met with G7 leaders tostrengthenour cooperation on economic issues, cyberspace and quantum, andother 21stcenturychallenges, including thoseposed by Chinato our workers, companies, and national security.The G7, representing over 50% of the world economy, is demonstrating that it is among the most potent institutions in the world today, with like-minded democracies solving problems.

Committing to a unified approach to confront Chinas unfair economic practices:The G7 will release collective, unprecedented language acknowledging the harms caused by the Peoples Republic of Chinas (PRC) non-transparent, market-distorting industrial directives. They will commit to working together to develop a coordinated approach to remedy the PRCs non-market policies and practices to ensure a level playing field for businesses and workers.

Elevating supply chain resilience:The G7 will share insights and best practices to identify, monitor, and minimize vulnerabilities and logistic bottlenecks in advance of supply chain shocks, as well as coordinate on long-term risk that undermine global security and stability. The G7 will make a commitment tointensifydevelopment ofresponsible, sustainable, and transparentcritical minerals supply chains and establish a forward strategy that takes into account processing, refining and recycling.

Cooperating on Cyber and QuantumTechnology:The G7 will make a commitment to intensify and elevate our cyber cooperation; working with our close partners to achieveaccountability and increasing stability and security in cyberspace. The G7 will also commit to new cooperation to deploy quantum resistant cryptography with the goal of ensuring secure interoperability between ICT systems and fostering growth in the digital economy.

AdvancingTrade and Technology Council standards for democratic, market-oriented approaches to trade:The G7 will include a commitment tostandards in technology, trade and innovationthat represent our values as G7 partners compete with China.Through fora, such as theU.S.-EUTrade and Technology Council, we will demonstrate to the world how democratic and market-oriented approaches to trade, technology, and innovation can improve the lives of our citizens and be a force for greater prosperity.

Improving the multilateral framework for debt restructuring:The G7 will underscore its commitment to successfully implementing the G20 Common Framework for Debt Treatments beyond the Debt Service Suspension Initiative. The G7 will urge all relevant creditors, including non-Paris Club countries such as China and private creditors, to contribute constructively to the necessary debt treatments as requested. The G7 will also reaffirm its commitment to promoting transparency across all debtors and creditors for improved debt sustainability.

Committing to tackle forcedlaborandupholdinghuman rights:The G7willcondemna range of human rights abuses occurring globally, including abuses linked toRussias further invasion of Ukraine,thePRCs repression in Xinjiang and Tibet,the military coup in Burma,andongoing suppression of freedom in Iran.The G7willalsocommitdtoaccelerate progress totackle forced labor,with the goal of removing all forms of forced labor from global supply chains, including state-sponsored forced labor, such as in Xinjiang. G7 countriescommittedto takefurthermeasures to strengthen cooperation, including through increased transparency and business risk advisories, and other measures to address forced labor globally.As one important example of action to combat forced labor in the PRC, the United States is implementing the Uyghur Forced Labor Prevention Act, which President Biden signed into law in December 2021.

Reaffirmingthe Importance of Democratic Resilience:TheG7 Leaders along with the leaders of Argentina, India, Indonesia, Senegal, and South Africa releasedastatementon Democratic Resilience,affirmingthe importance of strengthening resilience to authoritarian threats within our own democracies and around the world.ThisStatement will amplify the shared democratic values across G7 countries; condemn Russias invasion of Ukraine as an attack on democracy; affirm the importance of civil society and independent media; and outline how G7 members will strengthen actions in response to rising foreign threats related to illicit finance and corruption, foreign malign influence, and transnational repression.

###

Originally posted here:
FACT SHEET: The United States Continues to Strengthen Cooperation with G7 on 21st Century Challenges, including those Posed by the People's Republic...

Can Crypto Still Save The World? – Forbes

Its been a nightmare couple months for cryptocurrency investors. Theyve watched their Bitcoin BTC holdings hemorrhage 70 percent of their value since the record high of $69,000 back in November. Overall, theyve suffered crypto losses totaling more than half (55%) of capitalization, or an estimated market loss of $2 trillion.

The days when crypto enthusiasts could talk about crypto as if Bitcoin were the new reserve currency, or the digital equivalent of the gold standard, or even a transformation of what it means to invest, are over. Crypto looks more like a classic boom and bust investment, like Dutch tulips, rather than the next best hope for humanity.

PARIS, FRANCE - FEBRUARY 06: In this photo illustration, a visual representation of the digital ... [+] Cryptocurrency, (Photo by Chesnot/Getty Images)

As I warned in an earlier Forbes column, the crypto boom was driven by systematic policy failures by major central banks. As long as they made bad decisions about monetary supply or failed to take on inflation, cryptocurrencies were going to look like solid investments. As soon as central banks shook off their inertia, crypto values started heading south. Meanwhile, the threat of regulation of the crypto marketregulations that might strangle the Bitcoin goosehas raised additional uncertainties about where the market is headed, and whether it pays to buy low nowor run for the hills.

Nonetheless, as Bloomberg reports, venture capitalists still want in the crypto game. Theyre being smart. They sense that despite the burst bubble since January, cryptocurrencies will be here to stay. They may not save humanity from itself, as some thought, but they remain a valuable speculative instrument but also a store of value when other investments look uncertain or too volatile to handle.

At the same time, Bitcoin and crypto do offer a deeper secret that is important to the rest of humanity. That secret isnt what they do, but how they do it. i.e. with Distributed Ledger Technology or blockchain.

An abstract digital structure showing the concept of blockchain technology with hexadecimal hash ... [+] data inside each block.

We can think of blockchain as an enormous spreadsheet thats reproduced thousands of times across a network of computers, that regularly updates the spreadsheet and its common database. The growing list of records in the ledger, called blocks, are linked or chained together to all previous blocks of transactions, using a cryptographic fingerprint known as a hash. Each transaction is independently verified and confirmed by peer-to-peer computer networks, time-stamped, and then added to the distributed ledger. Once recorded, the data cannot be alteredand its only shared with those who are part of the encrypted ledger.

Former SEC Chairman Jay Clayton has predicted that blockchain is the future of our financial markets, including digital currencies. High-tech guru George Gilder sums up the future of blockchain this way: Even though bitcoin may not, after all, represent the potential for a new gold standard, its underlying technology will unbundle the roles of money. Blockchain may even represent the future of the Internet.

There is, however, a cloud hovering over the DLT future, a quantum cloud.

This column pointed out back in 2018 that DLT was vulnerable to future quantum computer attack. Our latest report from the Quantum Alliance Initiative at the Hudson Institute, gives some idea of the cost of such a future quantum computer assault. Our econometric calculations indicate that such an attack would amount to $1.8 trillion in direct losses, with an additional loss of $1.4 trillion in indirect impacts. Taken together, a successful quantum computer decryption of cryptocurrencys most valuable assetits blockchain encryptionwould result in a $3.34 trillion hit on the U.S. economy, with negative ripple effects across the global economy for a long time to come.

Stablecoins doesnt fare any better in this scenario. Since these crypto instruments are pegged to 1:1 ratios with fiat currencies, the resulting liquidity crunch as margin calls come due and banks scramble to cover losses, means they too become quantum road kill.

Whats the answer? As weve mentioned in other columns, crypto companies need to adopt quantum-safe encryption to protect their future. That means either installing post-quantum cryptographic algorithms like the ones being standardized by the National Institute of Standards and Technology or turning to quantum-based cryptography, which uses quantum random number generators and quantum key distribution to create hack-proof communication links across the ledger.

There are even quantum security companies that offer both.

Likewise, it would make sense for a government regulatory crypto regime to require installing quantum-safe solutions for the entire industry. Making cryptocurrencies quantum secure could even set the next cryptographic standard for the rest of the financial sector, from banks to equity and credit markets.

Either way, the future of blockchain, like the future of crypto, hangs in the balance. So will the future of the U.S. economy, unless we start getting smart about the quantum threat to come.

See more here:
Can Crypto Still Save The World? - Forbes

Features That Distinguish Bitcoin from the Other Assets – Telemedia Online

Bitcoin has gained worldwide popularity, distinguishing itself as a unique asset class. Institutional bankers and private and public corporations are also adding this digital money into their portfolios. On the other hand, this digital money is significantly different from conventional currency. Here are a few features that differentiate Bitcoin System from traditional assets.

Stocks restate, and fiat currency is controlled to varying degrees by the government. However, this digital money is the first truly decentralized asset. Bitcoins network aims to keep power decentralized. Instead, the networks algorithm determines supply and distribution.

As a result, this electronic money doesnt have a single entity controlling it. Instead, anyone accessing the internet can technically join the Bitcoin network and add the asset to their portfolio. The peer-to-peer structure is Bitcoins core feature and distinguishes it from every other asset class.

Every transaction on this digital money network remains on a block linked to a previous block of transactions. This blockchain technology is immutable, meaning no entity can erase or alter any information on the network. Transactions on this virtual money are verified by network nodes through cryptography and recorded in the blockchain. More so, a blockchain is a public ledger.

The distinguishing feature of immutability makes the network reliable and trustworthy. It makes it stand out from all other asset classes where a lack of transparency, forgery, or corruption could pose a risk to the investor.

With this electronic money, you cannot tell how much of this virtual money a person can own, but at the same time, it is visible to everyone on the ledger board how much transaction has been made by which user and who are the recipients of the Bitcoin. As a result, Bitcoin transactions are crystal clear to everyone in the ecosystem of Bitcoin. Also, from this mentioned history on the ledger board, on a proper analysis, anyone in the network can know the asset owned by another person if they want. However, network participants can do a lot of things to prevent this.

When comparing this digital money transaction to other banks or other methods of commerce, Bitcoin transactions are exceptionally fast. People can send funds using Bitcoin viahttps://bitcoinprime.software/within a few minutes. On the other hand, when you send such an amount using banks, the transactions will take weeks to go through successfully.

Generally, banks take long documentation and procedures for opening and managing an account, including dealer records and credit checks. Also, they consider legal aspects and implications of their operations when dealing with electronic money. On the other hand, you can make an address in Bitcoin in a few seconds without any need for legal documents. You only need to set a strong password and not forget it because once the password is gone there is no getting it back.

Since the creation of this electronic money, Bitcoin has gradually become a mainstream asset. More so, estimates suggest that there are over 100 million active Bitcoin users worldwide. The popularity of this electronic money makes it more valuable. Also, Bitcoin is considered a legitimate store of value, and many people use it. And this gives it more liquidity and acceptability than most other traditional assets.

All the above features, including censorship resistance, hard-capped, and immutability, are among the many features that make this electronic money stand out from the other assets.

Continue reading here:
Features That Distinguish Bitcoin from the Other Assets - Telemedia Online

Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

Apple has unveiled its version of passkeys, an industry-standard replacement for passwords that offers more security and protection against hijacking while simultaneously being far simpler in nearly every respect.

You never type or manage the contents of a passkey, which is generated when you upgrade a particular website account from a password-only or password and two-factor authentication login. Passkeys overcome numerous notable weaknesses with passwords:

After a test run with developers over the last year, Apple has built passkey support into iOS 16, iPadOS 16, macOS 13 Ventura, and watchOS 9, slated for release in September or October of this year. These operating systems will store passkeys just as they do passwords and other entries in the user keychain, protected by a device password or passcode, Touch ID, or Face ID. Passkeys will also sync securely among your devices using iCloud Keychain, which employs end-to-end encryptionApple never has access to passkeys or other iCloud Keychain data.

Best of all, perhaps, is that Apple built passkeys on top of a broadly supported industry standard, the W3C Web Authentication API or WebAuthn, created by the World Wide Web Consortium and the FIDO Alliance, a group that has spent years developing approaches to reduce the effectiveness of phishing, eliminate hijacking, and increase authentication simplicity for users. Apple, Amazon, Google, Meta (Facebook), and Microsoft are all FIDO board members, as are major financial institutions, credit card networks, and chip and hardware firms.

Many websites and operating systems already support WebAuthn via a hardware key like the popular ones made by Yubico. You visit a website, choose to log in using a security key, insert or tap a button on the hardware key, and the browser, operating system, and hardware key all talk together to complete the login. A passkey migrates the function of that hardware key directly into the operating systemno extra hardware required. Websites that already support hardware-based WebAuthn should be able to support passkeys with little to no effort, according to Apple.

Before we get started, note that Apple writes passkey in lowercase, an attempt to get us to use it alongside password, passcode, and passphrase as a common concept. Google, Microsoft, and other companies will offer compatible technology and may also opt for the generic passkey name. While new terminology can cause confusion, passkey is better than the more technically descriptive multi-device FIDO credentials, which doesnt exactly roll off the tongue.

Lets dig in to how passkeys work.

Passkeys rely on public-key cryptography, something weve been writing about at TidBITS for nearly 30 years. With public-key cryptography, an encryption algorithm generates a secret thats broken into two pieces: a private key, which you must never disclose, and a public key, which you can share in any fashion without risk of exposing the private key. Public-key cryptography underpins secure Web, email, and terminal connections; iMessage; and many other standards and services.

Anyone with a persons public key can use it to encrypt a message that only the party who possesses the private key can decrypt. The party who has the private key can also perform a complementary operation: they can sign a message with the private key that effectively states, I validate that I sent this message. Crucially, anyone with the public key can confirm that only the private keys possessor could have created that signature.

A passkey is a public/private key pair associated with some metadata, such as the website domain for which it was created. With a passkey, the private key never leaves the device on which it was generated to validate a login, while a website holds only the corresponding public key, stored as part of the users account.

To use a passkey, the first step is to enroll at a website or in an app. Youre likely familiar with this process from any time you signed up for two-factor authentication at a site: you log in with existing credentials, enable 2FA, receive a text message or scan a QR code into an authentication app or your keychain (in iOS 15, iPadOS 15, and Safari 15 for macOS), and then verify your receipt.

With a passkey, the process is different. When you log in to a website offering passkey authentication, you will have an option to upgrade it to a passkey in your accounts security or password section. The website first generates a registration message that Apples operating systems will interpretit happens at a layer you never see. In response, your device creates the public/private key pair, stores it securely and locally, and transmits the public key to the website. The site can then optionally issue a challenge for it and your device can present it to confirm the enrollment.

On subsequent visits, when youre presented with a login, your iPhone or iPad will show the passkey entry in the QuickType bar and Safari in macOS will show it as a pop-up menu. In both cases, thats just like passwords and verification codes today. As with those login aids, youll validate the use of your passkey with Touch ID, Face ID, or your device passcode, depending on your settings.

Behind the scenes, your request to login via a passkey causes the site server to generate a challenge request using the stored public key. Your device then has to build a response using your stored private key. Because you initiate a passkey login by validating your identity, your device has access to your passkeys private key when the challenge request comes in and can respond to the challenge without another authentication step. The server validates your devices response against your stored public key, ensuring that you are authorized for access. If it all checks out, the website logs you in.

A passkey replaces two-factor authentication, and its worth breaking down why, as it seems counter-intuitive: how can a single code held on a device provide distinct aspects of confirmation? The rubric for multiple security factors is usually stated as at least two of something you know, something you have, or something you are. A passkey incorporates at least two of those:

Think for a moment about the advantages here. A passkey:

Apple stores each passkey as just another entry in your keychain. If you have iCloud Keychain enabled, the passkeys sync across all your devices. (iCloud Keychain requires two-factor authentication enabled on your Apple ID; Apple hasnt said if passkeys will replace its internal use of 2FA for its user accounts.)

You can share a passkey with someone else using AirDrop. This means you have to be in proximity to the other person, another element in security. The details are shared through end-to-end encryption, allowing the private key and other data to be passed without risk of interception. Apple hasnt provided much more detail than that AirDrop sharing is an option, so there may be other provisos or security layers.

Because passkeys replace passwords and a second factor, you may be reasonably worried at this point about losing access to your passkeys if youre locked out of your Apple ID account or lose all your registered devices. Apple has several processes in place for recovering Apple ID account access and broad swaths of iCloud-synced data. For an Apple ID account, you can use Apples account recovery process or an account Recovery Key. For iCloud data, if youve enabled the friends-and-family recovery system, iCloud Data Recovery Service, you can use that to re-enable access. After you recover account access, Apple has an additional set of steps that enable you to retrieve iCloud Keychain entries: it involves sending a code via SMS to a registered phone number and entering a device passcode for one of the devices in your iCloud-synced set.

This is all a fabulous reduction in the potential for successful attacks against your Internet-accessible accounts. But theres more: Apple isnt building yet another walled garden. Instead, passkeys are part of a broad industry effort with which Apple says its implementation will be compatible.

Apple built its passkey support on top of the previously mentioned WebAuthn standard, which describes the server side of how to implement a Web-based login with public-key cryptography. FIDO created standards for the client side of that equation and calls the combination of its protocol and WebAuthn FIDO2. Apple developed its own client-side approach thats compatible with standard WebAuthn servers and should be interchangeable with other companies rollouts of passkeys. Google, Microsoft, and Apple made a joint announcement in May 2022committing to this approach, too.

In Apples passkey introduction video for developers, engineer Garrett Davidson emphasized Apples commitment to compatibility, saying:

Weve been working with other platform vendors within the FIDO Alliance to make sure that passkey implementations are compatible cross-platform and can work on as many devices as possible.

He then demonstrated using a passkey on an Apple device to log in to a website on a PC, showing how a QR code could be used to enable a passkey login to one of your accounts on a device or browser thats not connected to your existing devices or ecosystem.

Heres how you might log in to a passkey-enabled account on someone elses PC using your iPhone with your passkey as the authenticator. During the login, you can opt to add a device instead of entering a passkey or other authentication in the browser. The websites server generates a QR code that includes a pair of single-use passwordstheyre generated just for that login and used in the next step for additional validation. (Note that the device with the browser could be any passkey-supporting operating system and device. The authenticating devices might be limited by Apple or other companies to a smaller set, much like you can only use an iPhone to confirm Apple Pay in Safari on a Mac, not a Mac with Touch ID to confirm Apple Pay from an iPhone.)

The PC in our example also starts broadcasting a Bluetooth message that contains the information needed to connect and authenticate directly with the server. Scan that QR code on your iPhone, and the iPhone uses an end-to-end encrypted protocol to create a tunnel with the PCs Web browser using the keys shown in the QR code. (This encrypted connection isnt part of the Bluetooth protocol, by the way, but data tunneled over Bluetooth; Bluetooth doesnt incorporate the necessary encryption strength.)

This Bluetooth connection provides additional security and verification by offering out-of-band elements, or details that the PC isnt presenting to the device thats providing authenticationhere, your iPhone. Because Web pages can be spoofed for phishing attacks, the Bluetooth connection provides a device-to-device backchannel for key details:

This broad device and platform compatibility lets you maintain the same degree of passkey security and simplicity without downgrading to a weaker method for login when accessing your account using other peoples devices. Whenever theres a way to force a weaker login method, malicious parties will exploit that via phishing, social engineering, or other interception techniques. (Providing a second factor via an SMS text message versus a verification code is a prime example of a weaker backup approach that has been exploited.) In fact, until passkeys can be used exclusively, password-based logins will have to remain available, and theyll remain vulnerable.

There might be some usability hiccups as passkeys roll out, but they shouldnt be widespread. Its possible, for instance, that some WebAuthn server components will need to be updated or that Apple will have to add more edge cases to its framework to encompass how things work in the wild.

But imagine a world in which you can securely log in to websites using any current browser on any device running any modern operating system, without having to create, remember, type, and protect passwords. Its relaxing just to think about.

The main question that remains unanswered is how portable passkeys will be among ecosystems: can I use iOS and Android and Windows and share a passkey generated on one among all three? Given that Apple has built an AirDrop-sharing method for passkeys, I hope FIDOs broad compatibility includes sharing passkeys among operating systems, too.

Passwords have provided an uneasy security compromise since their introduction decades ago when multi-user computing systems began to require protection. Passwords are patently imperfect, a relic of an age when physical proximity provided the first level of protection, something rendered moot by the Internet.

In an effort to answer some of the weaknesses in a password system, two-factor authentication was grafted on to require that you had something besides a password, something that required holding or being near an object to validate your right to log into a computer, service, or website. But because 2FA starts with an account password and uses a second method that can be subject to compromise or phishing, it remains a patch applied to a damaged wall.

The passkey is a modern replacement for passwords that rebuilds the security wall protecting standard account logins. Proximityin the form of the device that stores your passkeysis a powerful tool in reducing account hijacking and interception. Passkeys may seem scary and revolutionary, but theyre actually safer and, in some ways, a bit old-fashioned: theyre a bit of a throwback to a time when having access to a terminal provided proof you were authorized to use it.

Read more:
Why Passkeys Will Be Simpler and More Secure Than Passwords - TidBITS

Bureau of Industry and Security

Mass Market (Section 740.17)

Hardware and software items that would otherwise be classified as 5A002 or 5D002 can be classified under 5A992.c and 5D992.c if they meet the criteria listed in Note 3 to Category 5, Part 2 ("the mass market criteria"). In other words, some 5x002 items can become 5x992.c based on the way they are sold. Mass market items are described in 740.17(b)(1) and (b)(3) but not (b)(3)(iii) e.g., digital forensics) of License Exception ENC and have classification and reporting requirements.

Although a 5A992.c and 5D992.c item does not require a license exception to go to most places (because it is only Anti-Terrorism controlled) they are described in License Exception ENC 740.17, which includes the submission requirements that need to be made to BIS. Whether an item is 5x002 or 5x992.c - mass market (per Note 3 to Cat. 5 Part 2), the submission requirements are the same and therefore described in a single place under 740.17(b)(1) (self-classifiable) and (b)(3) (requires classification request to BIS).

The mass market criteria under Note 3 to Cat. 5, Part 2 has two paragraphs:

Paragraph A describes products that are generally available to the public at retail. Mass market products are typically consumer products sold at retail stores or internet locations, but products sold only to businesses can also qualify for mass market. BIS takes into account a range of factors when determining whether something qualifies for mass market including quantity of the item sold, price, technical skill required to use the product, existing sales channels, typical customer, and any exclusionary practices of the supplier.

Paragraph B applies to components of mass market products. In order to qualify for this paragraph:1. It must be a hardware or software component of an existing mass market product, meaning it is:- The same component that is factory installed in the mass market product; or- A functionally equivalent aftermarket replacement that has the same form fit and function.

2. Information Security must not be the primary function of the component;

3. It must not change the cryptographic functionality of an existing mass market item, or add new encryption functionality to the item; and

4. The feature set of the component must be fixed and not designed or modified to customer specifications.

ITEMS NOT Eligible for Mass Market 5x992.c: Items that meet the criteria in 740.17(b)(2) (e.g., network infrastructure) and 740.17(b)(3)(iii) (e.g., digital forensics) are NOT eligible for mass market treatment.

When a mass market 5x992.c item requires a Classification Request to BIS:Mass market items described under 740.17 (b)(3)(e.g., chips, components, SDK) (except for (b)(3)(iii)(e.g., digital forensics), which are not eligible for mass market) require a classification by BIS via SNAP-R before they can be classified as 5x992.c.

When a mass market 5x992.c item can be Self-Classified:Mass market items that are described under in 740.17(b)(1) can be self-classified with an annual self-classification report. If you choose to submit a classification request for a 740.17(b)(1) item, then a self-classification report for that item is not required.

When nothing is required to export a mass market item 5x992.c:The export of Mass market items that are described in the scenarios under in 740.17(a) do not require any submission to BIS.

Continued here:
Bureau of Industry and Security

Should You Use This Encrypted Period Tracking App? – Gizmodo

Screenshot: Lucas Ropek/Stardust

A period-tracking company proclaimed last week that it was dedicated to protecting womens data rather than sharing it with cops in a post-Roe v Wade world. Stardust, a woman-owned period-tracking app, announced that it would be the first company of its kind to roll out end-to-end encryption. E2E limits datas visibility to only the user, keeping personal information safeand is widely considered on of the best privacy protections on the web. Stardust founder and CEO, Rachel Moranis, announced the plans in a video on the apps TikTok account on Friday, claiming the change had already been in the works prior to Roes overturning. What this means is that if we get subpoenaed by the government, we will not be able to hand over any of your period tracking data, she said.

Stardust didnt stop there, though. In a series of tweets, the company went on to state that it hopes to implement a host of new privacy protections, including a way for users to completely opt out of providing any personal identifiable information (no account generation) and use the app fully anonymously, as well as full local data storage. Following the announcements, Stardust saw a huge surge in interestbecoming the second most downloaded app in the U.S., as of Saturday.

Then the company had to do some cleanup. It wiped any mention of end-to-end encryption from its website. It admitted toand pledged to stopsharing data with at least one third-party marketing firm. And it changed its privacy policy to remove language about providing info to cops without any warrant.

The Supreme Courts recent decision to overturn Roe v. Wade and end nearly half a century of constitutional abortion rights in America has already begun to bear ugly results. In a bevy of states, draconian trigger laws have materialized, effectively criminalizing most if not all instances of the medical procedureand more laws are expected in the coming weeks. In this brave new world, civil liberties advocates have expressed concern for the ways in which womens data could be used by law enforcement to monitor for digital evidence of pregnancies. Critics have worried about the data on period tracking apps in particular, which they say could be used to prosecute women who have sought abortions via data on pregnancies that end.

As with anything that sounds potentially too good to be true, critics were quick to point out some problematic elements of Stardusts plans. Questions have swirled about whether the companys new privacy measures will be as effective as they sound. Other critics have wondered whether, in this day and age, it even makes sense to use a period tracking app at all. Its a good questionand worth considering given whats at stake right now.

G/O Media may get a commission

If they want to survive, all of these period tracker apps out there need to really get their house in order and be building up user trust, said Riana Pfefferkorn, a scholar at the Stanford Internet Observatory.

Probably the most problematic thing about Stardusts claims is that they seem to have changed over time. TechCrunch reported Monday that what the company was offering didnt really sound like ironclad end-to-end encryption. The outlet wrote:

Stardust founder [Rachel] Moranis told TechCrunch that all traffic to our servers is through standard SSL (hosted on AWS) and subsequent data storage on AWS RDS utilizing their built-in AES-256 encryption implementation. Although this describes the use of encryption to protect data while in transit and while its stored on Amazons servers, its not clear if this implementation would be considered true end-to-end encryption.

Following the interview with TechCrunch, Stardust apparently scrubbed its website of any mentioning of end-to-end encryption, essentially watering down what it had originally offered to users.

Even more problematically, further analysis of the companys platform appeared to reveal that the firm was occasionally sharing individual users phone numbers with a third-party analytics firm called MixPanel. This kind of information sharing could quite easily lead to the identification of individual userswhich is something the company has promised not to allow. After being confronted with this issue, Moranis told TechCrunch that the current (old) version of Stardust leverages several data collection mechanisms of Mixpanel that we have disabled/removed in the new version. In addition to not sending [personally identifiable information] to Mixpanel, we have also disabled IP tracking for our users to protect from that metadata being used to identify our users.

Meanwhile, Vice News was quick to point out that Stardusts privacy policy left something to be desired. In a story published Monday, the news outlet pointed out that the apps policy acknowledged that it would share information with police whether or not legally required. The policy clarifies that Stardust may...

...share aggregated, anonymized or de-identified, encrypted information, which cannot reasonably be used to identify you, including with our partners or research institutions.

When reached for comment by Gizmodo, a company spokesperson said that Vices story was based on an outdated privacy policy. A visit to Stardusts website on Monday revealed that the language in its privacy policy had been changed. The spokesperson also provided us with a statement from Moranis, Stardusts Founder and CEO, who again reiterated that the new feature was designed to avoid a digital subpoena.

With the update set to go live...Wednesday, June 29th on all iOS devices and Android, users login information will not be associated with their cycle tracking data, and therefore their data will not be a subpoena risk, she said.

We also asked for better information about the apps plans for encryption, but have not heard back yet. We will update this story if we get a response.

Its no surprise that companies like Stardust are now seeking to implement new privacy protections. In fact, such protections might be something of an industry imperative for period trackers, given the full-blown panic about digital health data that now exists afterRoe.

Stanfords Pfefferkorn said that, when properly applied, encryption could be used to protect against the harsh laws currently being passed across the country.

The Dobbs decision [which overturned Roe] underscores the importance of adding strong encryption, by default, wherever it doesnt currently exist already, Pfefferkorn told Gizmodo. She added that companies like Stardust are suddenly under a lot of scrutiny and that their business model is under threat from the public panic spurred by the recent Supreme Court decision. She said, That means being more transparent about the kinds of data that the apps collect and instituting better protections to prevent the data from falling into the wrong hands.

Pfefferkorn also recommended that women invest in existing privacy applications. One of the simplest ways to protect your online communications is to use an encrypted chat platform. For that, one of the best options is to download Signal, a chat app that offers true end-to-end encryption. Its free, easy to use, and should ensure that your conversations stay private. That might be the best place to start.

Follow this link:
Should You Use This Encrypted Period Tracking App? - Gizmodo

Another Issue With Internet Antitrust Bills: Sloppy Drafting Could Lead To Problems For Encryption – Techdirt

from the not-good,-not-good-at-all dept

As the big push is on to approve two internet-focused antitrust bills, the American Innovation and Choice Online Act (AICOA) and the Open App Markets Act, weve been calling out that while the overall intentions of both may be good, there are real concerns with the language of both and how it could impact content moderation debates. Indeed, it seems pretty clear that the only reason these bills have strong support from Republicans is because they know the bills can be abused to attack editorial discretion.

There have been some other claims made about problems with these bills, though some of them seem overblown to me (for example, the claims that the Open App Markets bill would magically undermine security on mobile phones). However, Bruce Schneier now points out another potential issue with both bills that seems like a legitimate concern. They both could be backdoors to pressuring companies into blocking encryption apps. He starts by highlighting how it might work with AICOA:

Lets start with S. 2992. Sec. 3(c)(7)(A)(iii) would allow a company to deny access to apps installed by users, where those app makers have been identified [by the Federal Government] as national security, intelligence, or law enforcement risks. That language is far too broad. It would allow Apple to deny access to an encryption service provider that provides encrypted cloud backups to the cloud (which Apple does not currently offer). All Apple would need to do is point to any number of FBI materials decrying the security risks with warrant proof encryption.

Sec. 3(c)(7)(A)(vi) states that there shall be no liability for a platform solely because it offers end-to-end encryption. This language is too narrow. The word solely suggests that offering end-to-end encryption could be a factor in determining liability, provided that it is not the only reason. This is very similar to one of the problems with the encryption carve-out in the EARN IT Act. The section also doesnt mention any other important privacy-protective features and policies, which also shouldnt be the basis for creating liability for a covered platform under Sec. 3(a).

It gets worse:

In Sec. 2(a)(2), the definition of business user excludes any person who is a clear national security risk. This term is undefined, and as such far too broad. It can easily be interpreted to cover any company that offers an end-to-end encrypted alternative, or a service offered in a country whose privacy laws forbid disclosing data in response to US court-ordered surveillance. Again, the FBIs repeated statements about end-to-end encryption could serve as support.

Finally, under Sec. 3(b)(2)(B), platforms have an affirmative defense for conduct that would otherwise violate the Act if they do so in order to protect safety, user privacy, the security of nonpublic data, or the security of the covered platform. This language is too vague, and could be used to deny users the ability to use competing services that offer better security/privacy than the incumbent platformparticularly where the platform offers subpar security in the name of public safety. For example, today Apple only offers unencrypted iCloud backups, which it can then turn over governments who claim this is necessary for public safety. Apple can raise this defense to justify its blocking third-party services from offering competing, end-to-end encrypted backups of iMessage and other sensitive data stored on an iPhone.

And the Open App Markets bill has similar issues:

S. 2710 has similar problems. Sec 7. (6)(B) contains language specifying that the bill does not require a covered company to interoperate or share data with persons or business users thathave been identified by the Federal Government as national security, intelligence, or law enforcement risks. This would mean that Apple could ignore the prohibition against private APIs, and deny access to otherwise private APIs, for developers of encryption products that have been publicly identified by the FBI. That is, end-to-end encryption products.

Some might push back on this by pointing out that Apple has strongly supported encryption over the years, but these bills open up some potential problems, and, at the very least, might allow companies like Apple to block third party encryption apps even as the stated purpose of the bill is the opposite.

As Schneier notes, he likes both bills in general, but this sloppy drafting is a problem.

The same is true of the language that could impact content moderation. In both cases, it seems that this is messy drafting (though in the content moderation case, it seems that Republicans have jumped on it and have now made it the main reason they support these bills, beyond general anger towards big tech for populist reasons).

Once again, the underlying thinking behind both bills seems mostly sound, but these problems again suggest that these bills are, at best, half-baked, and could do with some careful revisions. Unfortunately, the only revisions weve seen so far are those that carved out a few powerful industries.

Filed Under: aicoa, amy klobuchar, antitrust, bruce schneier, encryption, open app markets

Continued here:
Another Issue With Internet Antitrust Bills: Sloppy Drafting Could Lead To Problems For Encryption - Techdirt