366 karma · joined February 17, 2023
> Causing anxiety
The news is literally designed to do that to you. Stop consuming so much of it for your own mental well-being, and that of everyone else you interact with.
Open it in a regular and "incognito" browser tab. This is a long term identifier of your browser which persists across cookie clearing, IP address changes and other ritualistic totems privacy-seeking individuals still inexplicably cling to.
That's not what happens (new identity for each message) and compromise of a Signal identity key has no impact on message security, unlike GPG. Also it's not how all TLS works; it's how TLS works with perfect secrecy ciphers only.
> There is no empirical evidence for how frequently to rotate your identity keys.
Certainly not if you refuse to look for it.
> A few years ago NIST started recommending never changing passwords unless they are compromised
Passwords derive session keys (cookies) which rotate very frequently. You have a lot to learn about computer security, I'm happy to make some reading recommendations if you're sincerely interested.
It worked well for Afghanistan, also Vietnam.
That's not up you, it's up to your adversary.
> How much does rotating credentials reduce risk? Should I rotate once a year? Once a month?
As frequently as possible. Signal for example uses ephemeral keys for each message.
> Rotating every day would be even more secure, right? But how much more? I think not very much.
Stop guessing and use empirical evidence to support your reasoning.
> The risk is that I don’t know if I’m compromised. But I think that risk is less than the errors involved in rotating keys according to some arbitrary schedule.
It's arbitrary because you are making a strawman argument to support a foregone conclusion.
The irony of this statement is government is historically responsible for the most deaths as they are best armed. When technology like firearms are decentralized and more people have access to them, fewer overall deaths occur and more individual freedom ensues.
Same concept for cameras, when they are pointed at police and agents of the state by citizens.
That does not logically follow; another technology would just as soon take the place of surveillance cameras (phone tracking, social stigma, stricter laws and punishment). It is the intent of the oppressor and the courage of a culture to resist it that matters most.