This one is funny. A bit more 'unpredictable' than having "NK's Kim launches missiles towards Sea of Japan" I suppose.
So my q, specially given AI, is are these 'current news' bits really unpredictable? And if the message is signed anyway (and we hope the key is not compromised) what other purpose does this serve beyond key rotation issues (and they don't rotate these pub keys, right?)
p.s. If these bits are supposed to be as unpredictable as possible, then we should note that any matter related to trends in industrial, technical, political, and major religious organizations (the Vatican) arenas are the bread and butter of security services of state actors. The current bits should be things that can neither be creations of state actors (i.e. sock puppets in 4chan starting a trend) nor matters that they by definition are laser focused (such as industrial output of near peers).
They're sufficiently unpredictable, especially the exact phrasing (and the sport scores), that they offer pretty good proof that the message was signed recently. I suspect it's mostly to show that they have not been lazy and prepared all the messages well in advance (which if they did could conceivable weaken the scheme somewhat). But I agree it's probably a minimal improvement in the usefulness of the canary.
The problem with sports scores is that it would be trivial to procedurally generate signed messages ahead of time for thousands of different team names and scores, and then select one that matches the eventual reality.
Let's say a state actor needs a window of 1 week to do some mischief. Just a couple of days to comprise network x. Assume the exploit is worth knocking off a known person, or creating a news worthy event. I think these bits give a false sense of security.
This doesn't really protect from a targeted attack of nation state dead set on keeping it a secret. That would be almost impossible. This is supposed to protect against the much more likely scenario that some government authority or government official decides to commit and overreach and order the disclosure of data and a gag order, but without the full support of the nations information agency.
It's not supposed to guarantee Putin that the US hasn't seen his porn collection. It's supposed to tell me (a regular guy) that the government hasn't seen my vacation photos in secret.
> If these bits are supposed to be as unpredictable as possible
That isn't the purpose of the embedded headlines. They are to show that the canary file was not created and signed two years ago and only just now posted to the website.
They serve the same purpose as what used to be used in movies and TV years ago for "kidnapping" story lines where a photo of the kidnapped person, holding up a current copy of some major newspaper, was sent to the person who was being asked to pay the ransom (or perform some other action) in order to secure release of the kidnapped individual. They show that the item in question is current and not prepared well in advance.
That is understood. The life cycle of canary is n days, in this case apparently 7 days. Industrial output, economic stats, health of world figures, and Vatican whispers are precisely what a state intelligence agency is supposed to know before the general public. The idea is that the message embeds bits of information that were disclosed at a specific point in time and my point is that these types of bits are not that that unpredictable for the sort of adversary that necessitates canaries.
Norway: https://imageio.forbes.com/specials-images/imageserve/60ce8f... (2021 - the Norway curve looks like it was headed to 80% but forecasters adjusted it to be in tandem with the other nations.)
Tens of thousands view body of former Pope Benedict:
https://www.theguardian.com/world/2020/aug/03/former-pope-be... (2020)
North Korea's Kim sacks No. 2 military official
This one is funny. A bit more 'unpredictable' than having "NK's Kim launches missiles towards Sea of Japan" I suppose.
So my q, specially given AI, is are these 'current news' bits really unpredictable? And if the message is signed anyway (and we hope the key is not compromised) what other purpose does this serve beyond key rotation issues (and they don't rotate these pub keys, right?)
p.s. If these bits are supposed to be as unpredictable as possible, then we should note that any matter related to trends in industrial, technical, political, and major religious organizations (the Vatican) arenas are the bread and butter of security services of state actors. The current bits should be things that can neither be creations of state actors (i.e. sock puppets in 4chan starting a trend) nor matters that they by definition are laser focused (such as industrial output of near peers).