Verizon fell for fake "search warrant," gave victim's phone data to stalker

The most relevant example I can think of would be a CCP hacker forging a search warrant for a US-based political activist. The government would probably care, but good luck identifying some random Chinese Army hacker, much less extraditing them.

I doubt it wouldn't have cost them anything more than what they're already paying to staff their legal department.

"Normal" phishing is a bad example, because many phishing emails notoriously use misspellings and bad grammar on purpose because scammers don't want to waste their time on people with half a brain, they only want people dumb enough to respond in spite of the ludicrous misspellings. But in this Verizon case, that logic doesn't apply, because there was only a single targeted recipient.

With respect to "If your defense against phishing relies on your adversary not knowing what a legitimate request looks like - it's not a very good defense", I wholeheartedly agree. My point was only that the fact that Verizon responded to this fake subpoena despite the reddest of red flags makes me think that they must have horrible procedures generally for verifying these types of requests.

Getting the tech adopted might be difficult (like you say some judges may not see the point of it) but the PKI doesn’t have to be super complicated…

Having different authorities provide signatures for different types of documents may or may not be needed, in theory it is more secure, but just checking the domain name suffix should be a good start. And every tech literate person has a general idea how to tell “valid” domain names from phishing sites, so the scheme translates well

This is an unnecessary dig. Not all "rednecks" are dumb. They got us to the moon. Not all people who resist tech "innovation" in their space are "rednecks" or "dumb". They probably know a whole hell of a lot more about their domain than you do.

Be cautious of the toxic sense of superiority tech people have that they somehow know better than the unwashed masses, even before immersing themselves in the domain to understand and then solve problems.

Take delivery apps that have somehow made the previously thriving small business of delivering food a giant industry that loses money for everyone involved.

Adding a tech doesn't automatically make things better. When people resist your shiny new (and likely ill conceived) tech that doesn't mean they are dumb. They might just recall the sting from last time.

This is a feature. We don't want courts to "move fast" because the consequence of breaking is far more severe than losing a few files on Google Drive.

I worked in a data center once, and we would have FBI contacts that would come in regularly to access criminal data (CP, terrorist communique, heavy piracy, etc). We would verify the warrant before secure entry+accompany them to the specific requested entity. I know procedures are similar + even more stringent for the medical field. Things get even more complex for small local authorities, but the idea that "just having a slip of paper" is enough is ridiculous; unless the person accepting the request is dumb/lazy/uninformed/undertrained/etc, as in any social engineering feat (in your case, the responsible person decides to not bother with the QR because their phone connection is bad, it takes too long, etc; for example).

Imagine a city with police force of 6,000 combined with country, federal, state, and university LE. You might have a total of 20 neighboring or overlapping agencies ranging from 6 to 6,000 employees.

Personal cellphone numbers are used in LE sometimes, whatever one might think of that practice or implications for discovery and preservation.

The State/Fed have public official websites with this information.

This is why I would rather have profit hungry corporations manage things than governments. Because with government there's always a legion of people rushing to excuse and explain away even the most serious examples of ineptitude and mismanagement.

Would you accept it if Facebook or Google let people login to user accounts via signed letter? So why is a signature enough for a search warrant?

A signature is not an acceptable method of authentication in 2023 for important documents. I don't see how that's not obvious.

Those that do not fit the above, having no impulse control, or perhaps mental issues, then laws result in stuffing them away.

It's not perfect. Yet every human society does this, and has done this for millenia. Consider that.

E.g. there is a law saying you cant serve alcohol to minors. That in and of itself doesnt prevent beyond threat of punishment if caught.

There is also a law saying you have to check ids. Procedures like that do have a preventitive effect.

This isn't always correct and is rather myopic.

Quite often laws will issue punishments for some behaviors, but also issue things like funding for programs that work on the roots of why particular crimes occur.

Now, laws that punish post ad hoc are always easier to measure and see, because it's much harder to prove that you prevented something that only had a probability of happening in the first place.

I’m not saying that Verizon’s handling of this was anything other than grossly negligent, but let’s not pretend that the sole solution to, well, any problem involve…what? Asymmetric cryptography?

Something being illegal, even in another jurisdiction, is certainly a deterrent for a lot of people.