Mathematician warns US spies may be weakening next-gen encryption

True. But it's important to note that it is likely that, given the requirements of creating large, functioning systems of administration, it might be true that all governing systems are trying to solve the same types of problems.

And it's worth remembering that, even in the US there exist examples of people who pushed for real change to these systems, and ended up detained, dead or simply disappeared.

It might also be worthwhile to consider the following well known allegations: revolving door appointments between bureaucracy and companies that it interfaces with and regulates; compromise of politicians by various interest groups using bribery or blackmail; the effects of corporate lobbying and donations to distort the legislative and electoral processes; the powers of unelected career bureaucrats whose tenures often outlast elected officials.

It's important to recall that the US is not alone is allegedly suffering from these maladies, but that it might suffer from them ought be a cause for concern.

Such considerations seem to raise the question of whether the president (and associated democratic and elected apparatuses) are in some way figureheads designed to provide a focus and an outlet, but may also function to protect the overall system against substantial reforms.

Such a description may help explain why processes in democracies often stagnate.

The is not to say that the Chinese system is "better" in any sense (our first consideration indicates that perhaps all large governing systems must essentially be the same), but it might be more honest about what it is.

This gives rise to the sense that democracy, at least in part, may be a deception that usefully provides people the illusion of a voice for change, while at the same time protecting the governing system by ensuring people do not seek more disruptive methods to alter it.

Of course, the flipside is, without such less disruptive avenues, people are then without peaceful recourse. This means that in the Chinese system, the government knows it faces the threat of revolution, which, while it could be thought to function as a kind of guidance of, or check-and-balance on, its power, is also responded to by the system itself becoming more draconian and authoritarian, in order to protect itself, if that makes sense?

So in the US, the system protects itself with what may be described as a generally more peaceful and free society, with what be a somewhat deceptive democracy (of course more authoritarian exceptions are occasionally made to neutralize true rabble rousers), whereas in China, the system protects itself more overtly, with a generally more authoritarian and restrictive society, which is more open about what it is.

The point of this comparison is to foster more mutual understanding and less false-differences that fuel unnecessary divisions and distort discussions with fallacies, in an attempt to try to guide discussions along more productive directions, based on realities.

You don't need to weak cryptography to work towards that end with passkeys.

For key pairs that can be transferred, it's no different than the threat of password managers stealing your keys to the castle. You just have to trust the cloud and your entire hardware and software stack your password and passkey manager run on, and/or that nothing in that stack gets swapped out without you noticing.

Similarly, I've yet to see a hardware security key that you can verify doesn't have backdoors compiled or soldered in. All the cryptography in the world doesn't matter if a government/whoever can just pop your Yubikey in a machine that does whatever magic incantation is needed to dump your keys. That magic incantation can even be secured with strong cryptography to ensure only the US government/whoever can use it.

No passkeys are based on whatever the best crypto is -- for example in a world where quantum computers are practical then they'll be using a quantum safe algorithm.

Spy agencies, law enforcement, and criminals would all much prefer people use easily guessable and/or unsafely stored passwords. Those are both easier to discover, easier to brute force, and easier to intercept (specifically all you need to do is intercept a password once as it's definitionally not based on a single time exchange).

>Because your options are Beijing or DC.

We have plenty of standards in Europe too :-)

However, with cryptography historically the best crypto has been invented in the US and it made much more sense for allies to just use ready made solutions than to roll their own. Do countries on the US crypto exports ban lists have their own incompatible crypto? I dont know, they might, but they for sure don't share it as freely available standards.

I've been in rooms watching cryptographers trying to figure out what exactly it is Bernstein was saying with that blog post for the past week, and I do not believe that Matthew Sparkes at The New Scientist understands it any better than they do. Since Sparkes doesn't have any direct reporting from Bernstein, and nobody here cares about the NIST quotes, the right thing to do here is to treat this story as a dupe.