The point is that if the comparison point is PGP-encrypted email, which has no protection for any metadata and passes it on the wire in the clear, raising concerns about Signal’s metadata protections makes no sense.
To pick a boring example: you run IT at a big company. You want all your employees using passkey auth, and you want it to be smooth for them, so you buy a bulk order of a couple thousand yubikeys and some glass fishbowls and plop a fishbowl full of yubikeys in the middle of each office.
Attestation means you can trust that nobody is accidentally or intentionally enrolling some random passkey-presenting device with rogue components.
We just had a front page story here this week about folks buying what they thought were secure hardware cryptocurrency wallets that had been modified maliciously.
That's the scenario where you need it the least, because then you're providing the devices and can register the key of each of the yubikeys before you drop it in the fishbowl. Then if someone throws a handful of rogue sticks into the fishbowl, their keys aren't on the list.
Which would further impede the scenario where they have the capability to extract the key from a real yubikey and then throw some of those in the fishbowl, because then even though they're "real" they're not on the list. To pull that off when you're enumerating the keys instead of using remote attestation they would have to go to the office and grab a handful of keys, hope nobody notices that that many of them have disappeared, extract the keys from them and hope they don't destroy any of them in the process since they can't replace them, and then go back to the office to put them back in and have a second chance of getting caught. Whereas with remote attestation they go buy a bunch of yubikeys, break as many as they need to in order to extract the private keys from some of them, then show up once to exchange those for the same number out of the fishbowl since you're only verifying "is a yubikey" rather than "is one of ours".
You also don't need remote attestation to verify that the keys you bought are the expected model, because a key that can establish that can do it locally when you're registering it without involvement from the network authentication protocol.
Look at Show HN. Literally an infant could prompt and post every single thread. It’s so simple, so stupidly repetitive, and these are so-called “products.” I wonder what the man who built SQLite for the US Navy would think when he sees someone calling themselves a software engineer while prompting a machine to build a note taker app for dogs. I would be ashamed to be seen as their equal.
The FTC can fine for deceptive practices. There are a slew of vicarious criminal recklessness and liability approaches that charge an operator. Damage to infrastructure falls under public welfare and strict liability. There are state-level AI statutes (like Wyoming law that doesn't really allow "autonomous" defense) For civil damages, the CLAIM Act can be used to sue devs for negligince.
You listed some broad areas of criminal law. If you’re saying that some statute inside those areas would apply here, can you say what it is so that we can actually look at the elements?
Your linked icann doc is huge, but from skimming it the top portions seem to describe google’s intent to use it themselves for hosting their own projects and services.
reply