Schneier on Security
A blog covering security and security technology.
« Secret Codes in Bacteria |
| Full Extent of the Attack that Compromised RSA in March »
October 28, 2011
It's a good one. Be sure to read the hover-over text.
Posted on October 28, 2011 at 10:21 AM
• 29 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Always _always_ read the alt text. More often than not, they're as good as the picture.
Re the hover text, presumably that's because the store loses out if your check bounces, but it isn't their problem if you use the gun to commit a crime (nor should it be). I think in most American states these days, you have to file for a permit to buy a gun anyway, so if you're a known felon the permit will be rejected.
I figured that would show up here. :-)
Working in industry... A long time ago, someone told me that if you want to know what's really important to the company, ignore what they say. Instead look at what they measure - Look at what you're measured on for your yearly review, look at what your management chain is measured on.
In other words, follow the money.
Unfortunately that appears to be true at the national/legal level too, not just the corporate level where it makes sense.
@Craig: I don't know if most states require a permit to purchase.
(My home state requires a Permit to Purchase, unless the buyer already has a Concealed Pistol License...)
However, all purchases at a Federally-licensed dealer have to go through the ATF-approved process, and are checked against the Federal National Instance Check System.
The 'security' aspect of it is funny, though I suspect that most 'give us your email twice' forms want the same effect as a 'give us your new password twice' form. That is, to protect the user against errors...
At the supermarket to buy booze I need 2 forms of government ID - a passport or a driving licence isn't enough.
It's enough to a) let me into the county & b) drive 8000lbs of SUV down the highway at 80mph - but not enough to buy a bottle of wine.
@karrde - I think that is rather the point!
Which piece of information is it important not to have made any mistakes on?
1 - the target
2 - your email for follow up marketing
Stopping criminals from getting guns via law abiding gun dealers won't have much impact on anyone (there are to many other sources that won't ask for a *first* form of ID).
Oddly enough, the state of NJ will not accept checks as payment for background checks.
Of course giving them your id for the firearm purchase results in a background check. The two forms for the check does not.
I'm reminded of the lyrics from that old Tom Lehrer song, "once the rockets are up, who cares where they come down/that's not my department, says Werner Von Braun."
Reminds me of something kind-of-unrelated. During online discussions of the recently-tested Emergency Alert System, someone linked to this
Claiming that one time, an operator at NORAD pressed the wrong button, triggering a false nationwide-alert broadcast. (He had intended to send the testing message, instead he sent the actual alert with the proper code-words.)
Now there's a situation in which dual, duplicate entry requirement might have solved a problem.
But that's an alert system, not a missile system.
Don't most ballistic-missile systems require two operators on-site to activate two things simultaneously before the missile will launch?
It is simple economics. You do the minimum you need to for legal reasons. Anything more you do only if there is a financial incentive.
For that matter, why must we type out city names and selects states or provinces from a menu rather than just entering a postal code?
"... but not enough to buy a bottle of wine."
It might be your youthful (good?) looks...
In the UK we have rules about selling to under 21's about requiring photo ID. Now I'm older than Bruce, but a few weaks ago I was buying a cheep bottle of red win to make "chicken in wine" and this little slip of a girl who was probably only just old enough to work part time asked me for ID...
I stared at her and pointed at my face and said "just how young do you think I am?" she had the grace to go bright pink whilst I got my passport out 8)
I'd note that a bartender can get in trouble if he serves drinks to a drunk who then goes driving (and gets into more trouble).
@NobodySpecial - Either/or. One document will get you into the country, the other provides SUV-guiding privileges. (although a US DL might be acceptable at some land borders).
@karrde : In theory, yes. In practice, displays of missile launch control systems deployed in the 50's and 60's were vulnerable to one man with simple hand tools (a screwdriver) and a dozen feet of wire.
@Griskupar: Don't know where you live, but over here in the US, most sites give you the option of entering the street, city, and state, or the ZIP code. Obviously, I prefer typing five digits.
@Clive & NobodySpecial: In Georgia, the rule is supposed to be ID everyone, but most stores leave it to the discretion of their employees. For example, if you think they're younger than their 30's. When I worked in a grocery store at a teenager, one cashier refused to sell it to a customer who looked to be well into her 30's without an ID. She complained to a manager, but the manager left it the cashier's call. Obviously, the manager can't force her to sell without an ID, but it's an example of how every now and then you run into a strict cashier. This cashier was actually older, so she wasn't "green". Over here, the police actually do conduct inspections occasionally, sending an undercover member who is under 21 but looks older. So there are probably a few folks who are extra cautious, since they don't want a free ride in the back of a police car, even to the point of being beyond reason.
Of course, the most effective ID still remains, at least in the US, some green pictures of long dead important men. Change color and gender of the individual in the portrait to match your country. As long as you know where to go, that will get you just about anything without any further ID. Reminds me of the scene in the movie Jumanji where the hunter from the game's fantasy world wants to buy a new gun in a real world gun store. He is bewildered when the gun store owner presents him with the necessary paperwork and requests ID. That all changed when he produced a bag of gold coins. Unfortunately, any respectable currency or highly valuable and fungible commodity will always find a way past the rules that are supposed to protect our society.
YOU ARE A HARD PERSON TO REACH, PROFESSOR FALKEN.
In Tennessee, the rule is to card everyone, every time. It is strictly enforced. That ATF does undercover tests throughout the state probably ensures this. The messed up thing about this law is that it doesn't apply to clubs, bars or liquor stores: they can card discretionary.
@Clive - middle age, the brief window between being asked for Id and offered senior discount!
@Nick P: well, for the time being, in Georgia, you can't buy on a Sunday and take it home, but you can go to a bar and drink all you want and increase the DUI rate. why? Because it affects restaurants, bars, hotels, conventions, etc. this costs not only those businesses but also hurts tax revenues.
*eventually, a domino effect will force most municipalities to roll back the Sunday rule. The legislature recently made this a municipality decision. This puts pressure on each city to drop The rule or see tax revenues go to their neighbors . Hell didn't quite freeze over, but it did start getting cool enough for water to condense.
@ clive ... she wanted to know your name ... _you_ should be blushing (g)
... ... van
@Craig "I think in most American states these days, you have to file for a permit to buy a gun anyway, so if you're a known felon the permit will be rejected."
Leaving the "right to keep and bear arms" versus "rational gun control" strictly to the side, these are two different security problems.
If a permit is required, a database must be kept of those with the special privilege. In California we have an "Entertainment Firearms Permit" process that allows movie studios, prop managers, etc. to have all the cool stuff you see on TV which is a felony for you and me to possess. So the security problem is to grant access to an authorized person. Unlisted persons are never authorized. The goal of presenting ID is to prove that you are a specific person who matches up with your entry in the database.
If anyone can buy a firearm, but a felon is forbidden to buy a firearm, the existing criminal records database must be queried. Other prohibitions (such as mental health and misdemeanor domestic violence) require an additional "prohibited person" database.
So the security problem is to forbid access to unauthorized persons. Unlisted persons (who are US citizens or lawful permanent residents) are always authorized. The goal of presenting ID is to prove that you are in one of the large databases (typically the Dept. of Motor Vehicles or DMV database) but are NOT a felon or prohibited person.
In Tennessee, you can't buy on Sunday until afternoon. Every day, alcohol sales stop around 2am or 3am. In nearby Mississippi, it's 2pm on Sundays and midnight for the stopping point. At least Mississippi doesn't have mandatory carding. ;)
The problem I have with the Sunday issue is that it's a violation of separation of church and state. It's essentially motivated by religion. Oddly enough, it also bothers many members of those religions. And it doesn't work: some stores still sell on Sunday morning & most drinkers just buy extra Saturday night. A pointless restriction of liberty, it is.
@Nick P: the funny thing about people are the freedoms they care about. Some people scream for liberty, but they want the government to ban things they don't like. This goes for all sides of the spectrum except for the purest of anarchists. The problem is, nothing should be regulated or prohibited unless you can clearly demonstrate where not curtailing the rights of one will result in substantial peril to the rights of others. This applies to basic concepts (I don't have the right to kill you because it takes away your right to live, unless you present an unprovoked threat to my right to live) to more complex ones such as financial and business regulations (your leverage if not regulated would allow you to deprive me of my assets or property unfairly without me being able to protect those assets).
The problem is, so many rules and regulations are at best knee jerk reactions to a credible threat and at worst pandering to an interest group or portion of the electorate.
Yes, I to have noticed this contradiction. The worst thing about people is how they gripe rather than act. Sometimes, as in the case of this law, they take about an equal amount of effort. Imagine if even half of the people in Tennessee who are pissed off about this law wrote saying they might vote for a candidate who didn't give them so much trouble. "A candidate who appreciates our vote & focuses on real issues" or something like that. Then, the law would probably go away & we'd have discretionary carding again. Instead.... (sighs)
@ Gabriel, Nick P,
In the UK a report that has just been released indicates that children as young as eight are drinking the equivalent of 18 glasses of wine a week.
Now. there are a couple of things to note, first it does not say how many children nor how the figure of 18 glasses was arrived at (ie by observation or by interview). Then why say glasses which is a very uncertain measure of actual alcohol consumption due to the large variance on alcohol content in wine when we have a standard which is '1 unit of alcohol' at 1cl or 9grams of pure alcohol.
It is a typical "for the children" "chain puller" that is part of some other unstated campaign, that is almost certainly political in nature.
Now I'm aware of some of the dangers of alcohol and also some of the benifits both current and historical, but it appears their is a pitched battle in the UK between the alcohol producers and cheap outlets (mainly 'super markets' such as Tesco's) and other groups with health care professionals in the middle.
It is very little to do with the realities of 'substance abuse' and 'addiction' and the various complicated underlying social issues and more a game of who can put preasure on the Politico's to do something.
The sad thing is there are an awfully large number of people who for various reasons belive thatt they know "what others should be doing for their own good" unfortunatly most of them don't take the time to understand the problem, so actually end up doing more harm. Not just for the individuals but society as a whole.
That being said the US is also an example of what happens (Volstead Act / 18th Amendment) when such people gain sway of the political process (Only the then President Woodrow Wilson appeared to understand the problems and thus stand against it). The result was almost the exact opposite of what was intended with criminals steping in and providing what people wanted via the likes of speak-easies, there was then the protection rackets that made everything bud up to the gangsters that then ended up controling it.
@Clive: "The equivalent of" probably means that the figure has been scaled up by body mass to the amount a full-grown adult would have to drink to get "the same effect". So they aren't actually drinking 18 glasses of wine a week. "As young as 8" is another good one. Want to bet that's the bottom of the age range for the youngest age bracket in the survey?
Let's imagine that the story has been presented to give the maximum impact. So they'd be foolish not to use the smallest standard wine glass size, i.e. 125ml. According to this handy-dandy unit estimating device I happen to have here, a 125ml measure of 12% wine is 1.5 units. So "the equivalent of" 18 125ml glasses a week would be "equivalent" to 27 units, or just under 4 units a day.
Oh look. This same unit estimator says that the government recommended maximum alcohol consumption per day for adult men is 4 units.
See how this reporting business works?
@karrde: Don't most ballistic-missile systems require two operators on-site to activate two things simultaneously before the missile will launch?
Having been down in a silo, I've learned a little bit about this. While each silo has 2 people who must work together, to actually launch it takes multiple, independent silos (i.e. multiple pairs of people), which is just one of many safeguards.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.