So it looks like NYC is deploying some half-cooked “blockchain” solution for vaccine passports. theintercept.com/2021/03/24/and…
Thank you to @samfbiddle for only using the G-rated quotes.
At one point @samfbiddle told me that IBM claimed to have a technical document explaining how their system worked, and it (in all apparent seriousness) proposed this diagram as a “system architecture” or something. I nearly blew milk out of my nose.
I’m pretty sure this is a scene from an old Legend of Zelda game.
Ok in all seriousness it’s probably worth explaining why blockchains aren’t a great idea for COVID vaccination passports (if we must have them) and also why IBM’s systems are very dubiously even “Blockchains”.
The problems that blockchains are great at solving are those where lots of people need to agree on some shared history, and the parties *really* don’t trust each other. Ownership of money is one.
Vaccination data is absolutely not an example of such a problem. All of the data comes from a “trusted” source. If a health department tells you someone got the shot, you have to trust them. They might be lying, but blockchains won’t solve that.
The only thing blockchains might do is make it slightly more difficult to hack into a database and change past records. But that protection is going to come with a cost, because blockchains are expensive. And anyway: who is going to do that with a vaccine database?
IBM, however, has unique and proprietary “private blockchain” technology that’s way faster than public chains like Ethereum, so maybe this balances the cost equation. Except that private blockchains don’t provide the same tamper-resistance, so it’s still kind of useless.
Now who knows. Maybe IBM is doing something deep here that isn’t available from normal databases. I’m open to hearing about it.
But instead we get Zelda.
I would laugh about this being an isolated incident, but the EU is *also* exploring vaccine passports — and they’re using *five* blockchains. Multilateralism at its best.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Me: surely everyone else has been a little slower on publishing during the pandemic.
Me: *stupidly checks the websites of my theory friends*
Also me: *vanishes into a tailspin of insecurity*
Advice to new faculty: it is very important to make a friend in your field who will reassure you about why everyone else’s work is easy and yours is both harder and uniquely important. This does not need to actually be true for it to help.
For most of my life I’ve waited for someone to post a credible claim that they’ve broken a major cryptosystem like RSA, and I’m pretty sure tomorrow I’ll still be waiting.
But that doesn’t make it any less fun to think about what a real (implemented) RSA break would look like. Imagine you were a genius who found an efficient factoring algorithm. You have so much opportunity for drama.
Obviously you could just post your algorithm but that’s boring and anyway practical people won’t be able to tell if it works, especially if it’s complicated and you’re not one of a very small number of researchers.
Ok so let’s try these checklists out and see what it’s like to lock a phone down. I assume I’m concerned about someone else accessing my iCloud account as well as apps being evil.
Here’s step 1.
Ok this works pretty well, but it gives me the following confusing exception.
I was trying to be really low-key on this one, so let me make it really blunt. There is every reason to believe the NSA tried to subvert commercial cryptography in the 2000s, and now one of the architects of that work runs applied crypto at Amazon.
I couldn’t tweet a better description than the headline for this piece: After SolarWinds breach, lawmakers ask NSA for help in cracking Juniper cold case. cyberscoop.com/nsa-juniper-ba…
For those who haven’t heard this story, the context here is back in 2015 hackers broke into the source code repository of Juniper’s NetScreen firewalls and introduced serious vulnerabilities. 1/
Everyone has heard of the SolarWinds supply chain attack, but almost nobody outside our little community remembers Juniper. We don’t even know who the ultimate victim was. And there’s a reason for that. 2/