Schneier on Security

Clive Robinson • August 1, 2010 12:27 AM

@ Jonathan,

“Is it a paradox that we have to employ countermeasures against security measures that are ostensibly in our interest”

Short answer is “No”.

The slightly longe answer is “It is the result of the falliblety of the human mind expressed as something aproximating the lowest common denominator of average human ability”.

That is we know by experiance all humans “forget”, that is knowledge fades. However what they can remember and for how long appears dependent on many things.

For instance the length of time you can remember knowledge appears to be based on amongst others,

• How young you where when you first became aware of the information.
• How frequently you have cause to revisit that information captured by your mind as knowledge.
• What you do with the knowledge on recall.

Also there appears to be significant differences between short term and long term memory. And the conversion from short term to longterm is effected by the rate at which you become aware of new information (information overload).

Further the abbility to recal longterm memories to short term memory for concious use is effected by the rate you are being exposed to new information at the time (it’s why shutting your eyes and humming or sticking your fingers in your ears appears to help you remember)

Likewise for similar reasons converting the short term knowledge into a physical action appears to vastly strengthan a long term memory (that is writting it down actualy makes the memory stronger). This may also be in part, due to the fact the conversion to a mechanical process holds the information in your short term memory significantly longer than you would otherwise do and thus the conversion to longterm memory is reinforced. This is one of the areas under investigation with “Cognitive Behavioral Therapy” which has many otherwise very odd and effectivly inexplicable results.

There is also the issue of “associativity” as well, that is an infrequently recalled piece of knowledge gets strengthaned by being associated with another piece of information that is frequently recalled. An appt example of this is “mothers maiden name”.

Again associativity appears to be vastly strengthend by conversion through a physical sense such as touch or smell.

I could give you a bunch of (dubious) analogies such as “VDU screen burn in” or “deepening groves by repetitve over writting” for the short to long term memory process and “path lengths on access trees” for associativity etc, but as we don’t realy have much of a clue as to how human memory realy works…

What we do know from experiance is that the normal concious human mind does forget and recal of knowledge gets progresivly more difficult with time between recals (importantly there are exceptions to this normal “memory fade” such as “savants” found on the Autistic Spectrum. [1]).

So you have the odd situation that a frequently used password usually becomes embedded in a persons mind, whilst the security questions and answers attached to it are very infrequently used.

Thus all other things being equal you would expect the security question and answer to be normally forgoton more quickly than the password… Opps…

Thankfully all things are not equal, due to long and repeated use some knowledge becomes deeply embeded and other knowledge inherits the embeddedness by being intimatly associated with with deeply embedded knowledge.

Thus easily remembered security questions fall into either deeply embedded (first pets name) or associated with deeply embedded (mothers maiden name).

Unfortunatly “deeply embedded” knowledge is due to the very reason it is deeply embedded usually very well known to others and thus a matter of record in one way or another.

And where there is a record it can be found by those unknown to us either by direct access to the record or through another person wh has access to the record (theMs Pailin Problem).

The very difficult part in this modern “interconnected information” age is not in remebering knowledge or in accessing others records, but in stopping the record being made in the first place.

It is because of this “fallible memory” / “infallible record” problem we have a large number of security issues when the record is also “available”.

Unfortunatly the most desirable solution of “no records” is not going to happen for a plethora of reasons.

Nor for the same reasons the next best option of “no access to records”, but it gives a big clue as to a way forward.

Which is create unique and nonidentifiable records that only you have access to. Thus something like a password safe where frequent use of the locking password embeds it deeply in your mind alone and the use of random passwords, security questions and answers.

However there is still one problem,

“Where did I leave the bl**dy thing!!!”

Without other precautions such as backups the system is fragile. But this in tern creates security issues…

If the backup is not securely encrypted it can be copied and “brut forced” in a period of time proportional to the strength of the password.

And as you have to remember this password for a very very long time with infrequent access we get back to the original problem of the fallability of the human mind.

Thus in turn you get back to the issue of unique records with access locked to the record creator.

Solve this problem within the context of the fallible human mind and you’ve cracked the “password” problem

[1] Autistic Spectrum Disorders (ASD) appear to have some connection to “left handedness” and “males” and is considerably more prevalent in engineers and scientists and those who deal with information as opposed to physical objects. Architects and designer engineers for instance work with the often abstract information about physical objects not the objects themselves, and in the process transform the abstract information that appears “ugly” to most people into a physical realisation that has “beauty” even though it might remain abstract.