The only way anything can continue working in practice is if it’s decentralized, and served by different websites secured bu https rather than one app in one app store. Hard to take them all down.
The thing with https of course is that the governments can insist that browsers include their backdoored certificates. But the browsers are large enough that it’s difficult to get them to do it. China’s Great Firewall probably can. But in order for that to happen they have to prevent packets encrypted with the non-backdoored certificate chain from being routed. That requires serious control over all the networks.
This is partly why I started Qbix. So people can host whatever they want on computers of their choice. Without this decentralization, the governments are two steps away from mandating ALL your voice conversations are scanned, transcribed and analyzed by AI at the edge. Microsoft Recall + message and voice scanning = 1 step away from total panopticon of everyone everywhere. And with superintelligent AIs doing precrime based on everyone’s conversations!
If CAs start to get backdoored, people can operate a la web of trust or other asymmetric protocol where the public key is posted on a public board and the server can verify its ownership of the private key without a third party other than the public notice. More work but should be doable.
They won’t be able to operate that over public networks in China, because the routers will drop their packets.
You’d need to roll your own mesh network — definitely doable in local areas but the question is how to connect them over wider distances without going through the Great Firewall. Satellites?
Go make a protocol that fools all the AIs from every angle, that are scanning 24/7. They can get you on the metadata pattern alone, nevermind even the content.
JWTs are best practice for OAuth as it can transport claims. It’s up to your application if you continue to use it after the initial flow.
You are fine to convert it, but most apps don’t as it’s easier.
I use Strongbox and store my Passkeys in a Keepass File. Vendor agnostic, private syncable and locked by my passphrase.
I like them and wish more services would implement them properly.
