Short updates

It's been a busy week.

Europe is leading the world in making cryptography worse. Again.

Even though the cryptography wars are considered to have ended in 1996, that does not prevent governments from trying to reduce their availability and effectiveness by adding backdoors. The current one, Chat Control 2.0 in Europe, would make client-side content scanning (already performed by Apple with unreliable results) mandatory for chat apps, effectively breaking end-to-end encryption by automatically submitting flagged content to authorities. Matthew Green was invited to speak on the EuroISPA about the subject. His notes are a pretty interesting read to catch up on the discussion.

Tech done right: From medicine air-drops to everything delivery

Zipline has been delivering medical supplies by drones to hospitals in 20 minutes for the past 7 years, saving thousands of lives. Last week, they launched a platform for precision home deliveries. Their silent and efficient drones are miles ahead of the ones we saw in Amazon publicity a while back. We recommend checking out Mark Rober's video showcasing their new platform.

Credit Suisse and intended consequences

Last weekend, UBS agreed to rescue Credit Suisse in a $3.25bn deal brokered by the Swiss regulators. While depositors can be assured their money is safe for now, shareholders and investors have a very different story to tell. The deal represented a 60% cut on CS' market value from Friday’s close and triggered a write-off provision on $17bn Credit Suisse bonds, leaving these bond owners with nada. That provision is part of the "Loss Absorbency" requirements under Basel III, the set of rules created after the 2008 financial crisis to make banks more resilient to catastrophic failure. The banking system is a well-balanced flywheel that keeps steady as long as it keeps moving. Basel III's ultimate goal was to reduce the risk of individual failures disrupting the overall balance (systemic failure).

From a competition perspective, however, Basel III's heightened regulatory standards and the regulators' general effort to protect depositors' interests have led to higher banking concentration worldwide. It should be clear, however, that this is not a casual second-order effect. Higher degrees of concentration have been associated with higher systemic resilience in the financial system. So events such as the UBS-Credit Suiss deal should not sound too weird in a Basel III world. It's the systems' fail-safes working as designed. However, the pernicious impacts of such concentration on other public interests such as financial inclusion and unemployment rates have also been demonstrated. Our biggest concern in this turmoil is the profound impact that a new wave of even stronger regulation could have on financial inclusion and other macroeconomic variables.

Password management: Where LastPass got it wrong and how to approach the issue in organizations

In August 2022, LastPass suffered two cyberattacks that breached customer data and encrypted passwords. LastPass acknowledged the attacks, but their communication was not transparent enough. In November 2022, a follow-up attack compromised customer data further. LastPass communicated that this was a low-risk attack and that customers did not need to take any action. However, in December 2022, LastPass admitted the actual scale of the breach, and that all customer vaults were compromised. It is important to note that every company suffers frequent attacks, but the proper security posture under this type of attack is to assume that everything will eventually get compromised. The incident makes a case for why companies should always deploy additional defenses, such as employing security keys, to stay secure in the long term.

Read the full article

Bad security, good tech, bank rescue, and Where LastPass got it wrong