Signal rolled out "Automatic Key Verification," which sounds like gibberish to cryptographers. Turns out, it's key transparency. So what's key transparency? It's a phone book that makes sure you can't secretly be tricked into talking to the wrong person. When Bob talks to Jenny, he needs to know her public key. If he gets the wrong one it's like calling the wrong number. Even if everything is secure, he's talking to the wrong person. The problem is, if the app on Bob's phone just asks for Jenny's key, Signal's servers could lie. Far more problematically, they could be forced to lie by an outside attacker, or hacked. The UK, in particular, seem positively chuffed to try and break encrypted chats this way. Instead of calling Jenny, you'll get some blokes in Cheltenham. Of course, the Brits miss that hackers in Russia or Iran might do the same to calls to Downing Street. Key transparency builds a shared phone book mapping users' names/phone numbers to their public keys. The logic being someone, like say Jenny, will notice if her key is wrong, so we just need to make sure everyone has the same consistent phone book. That book is too big for everyone to have a copy, so Signal keeps it on their server, but then builds a clever way for everyone to make sure they are getting answers from the same unaltered phone book (technically it's a log, not a book). This is done with a Merkle tree and auditors (in Signal's case, currently Cloudflare and Trail of Bits).

I wonder if the pope, for a split second, contemplated bringing back indulgences, just for AI. After all, if there's a 1% chance it has a soul, surely someone will pay ....

NEW: A Federal judge just ruled that a warrantless Flock/ALPR search violated a woman's 4th Amendment rights! "Why is it the government's business where everyone goes all the time?" "Freedom from persistent, dragnet-style surveillance while in public is not a foreign concept in our society, and it is a reasonable expectation that society already accepts" Judge Sara Hill (N.D. Oklahoma) notes other courts, including in Oklahoma, ruled the other way on Flock searches. She argues that a decision from 1983 shouldn't govern 2026 networks of what she calls "indiscriminate mass surveillance." "This Court is now faced with technology that appears to be approaching the dragnet type law enforcement practice Mr. Knotts warned of." Setting up for an interesting fight in circuit court if the government appeals. Story by @jason_koebler 404media.co/federal-judge-ru… Ruling: storage.courtlistener.com/re…

The AI sandbox vs. alignment debate for security kinda misses reality. Existing sandboxes are laughably bad, especially for training. But we should also expect good sandboxes to both get broken AND be necessarily porous to be useful. Which means you end up with an arms race of sandboxes, monitoring, and trying to be clever.