Schneier on Security

Clive Robinson • March 8, 2012 9:15 AM

There is a flip side to the owners being “men in the middle” and that is “decoupling”.

I’ve mentioned this befor but put simply two (or more) people want to communicate in some form without having a direct or peer to peer connection.

You can view these services as being a “store and forward” message service that supplies anonymity for users from external agencies. When the service has a verry large number of connection points that alow a user to connect via SSH etc then conventional traffic analysis becomes very difficult.

So it’s a technology with more than just the usual negatives.

Clive Robinson • March 8, 2012 11:40 PM

@ kingsnake,

. Or, as I say, “Never put in electronic form that which you do not wish someone else to know.

Sadly it’s worse than that, because with modern file formats especialy those of Micro$haft “it’s not just what you put in that is in there”, there is also a whole load of stuff which can be used to your detriment by a smart lawyer and a forensic file examination.

They have an expression in the army of “never leave amunition for the enemy” giving potential litigants files via EMail etc is doing just that.

So whilst it might be less convenient and take slightly longer my advice to people getting involved in any kind of business or legal action is,

Paper, Paper NEVER Electronic Data

And if a Judge says “send files” my advice is still print them out, then scan them into appropriate compressed graphics files on a brand new compleatly clean non network connected computer.

Atleast that way you can see most of what you are giving to a potential enemy and that you can not should be benign. Oh and another advantage is that as each page is a graphics image the recipient (ie the enemy) cannot cut and paste or search it without doing one heck of a load of post processing themselves which kind of puts “sugar in their petrol of their speed machine”.

And as a matter of self protection from “electronic discovery” don’t just leave documents in the electronic form from the application that produced it because you are shooting yourself in the foot in a number of ways,

1, File formats change with every major and many minor revision of most application software as features are added, bugs removed and the money grabbers force you to upgrade. Thus your files become stale quickly and inaccessable shortly there after (except at very great expense to people who have with foresight kept every revision of application software and media type for solving this issue) and potentialy you are guilty of destroying evidence.

2, You get into the habit of just keeping every thing desired or undesired. Back in the 1980’s people used phones and memos and hand written notes these were ephemeral in seconds or days. Few if any businesses kept audio recordings of phone conversations between colleagues and hand written notes usually went in the bin when finnished with. Not so today and a smart lawyer. getting their hands on a hasty typed EMail etc can turn it into “a venomous snake in a bag” which you then have to “wrestle blind in the bag in court”…

3, In US courts electronic discovery is turning into a game of “begger the opponent” in that judges are quite happy to make formal orders of every silly request the opposition lawyers make and you pick up the bill or forfeit all.

The solution to electronic discovery is as in the days of paper records have a formal policy of how to deal with such things.

Firstly however you need to setup a repository then put all “wanted to be kept” or “good documents” into two standard formats for “image” and “search” postscript and text for example as they are the easist to do and have minimal unknown baggage.

Your policy has rules for what qualifies to enter the repository and rules about reviewing and deleting documents in the repository at regular intervals.

Your policy also has strict rules about the ruthless purging of all “bad files” that don’t get into the repository after say three months after a set point in a project or on a rolling basis with on going business processes.

Importantly get it into peoples heads that “just because we can store it does not mean we should” because like any other business process it has attached costs both immediatly visable (usually small) and long term (that can break the bank). So like any other business process “it has to be efficient in it’s use of resources”, shareholders have the legal right to sue you for not doing this because you are stealing (profit) from them.

This reduces not only your longterm costs of keeping electronic data “fresh” and “available” it also reduces your “liability front” greatly to all including importantly “your shareholders”.

Oh there is a new and MAJOR Major issue you must recognise and deal with, make sure you remember “cloud storage” in this policy and your cloud provider does what you tell them to do when you tell them. Also have a formal policy that employees cannot use “cloud storage” of any form whatsoever with “work” related issues without the prior written consent of the CIO and make it an instant dismissal on breach written into the employment contract of everyone from Chairman/CEO down to janitor, treat it as a theft / blackmail issue as this is what it could become witth a smart lawyer chasing you.

There is a nice little article on this major self evissoration / immolation issue, I realy realy suggest people read it and think deaply about it,

http://m.computerworld.com/s/article/9224800/E_discovery_in_the_cloud_Not_so_easy?taxonomyId=158&pageNumber=1

Electronic discovery is becomming a major “b4ll breaker” for people that are not properly prepared and come up against an increasing band of smart lawyers. It can be more damaging than a fire wiping out all your IT systems and backups. And is also a very very significant reason as to why companies should not use “the cloud” in any shape or form untill they have all the legal asspects of “Third Party” ownership of confidential data nailed down properly.

As I occcasionaly remind people think what happened to Col Ollie North when his confidential EMails were pulled from the backups of a server he never new existed and also Richard Nixon and the Watergate tapes. Now think what would have happened if it was every private conversation, phone call, hand written note, memo or document in draft or otherwise, because that’s what “using the cloud” is all about unless you plan carefully.

Clive Robinson • March 9, 2012 2:02 PM

@ Paeniteo,

…if the texts are not deliberatly distorted…

Yup (I only gave the 20,000ft view, as people complain my posts are too long).

There are a couple of simple ways (both thanks to the UK’s Cambridge Labs).

The first is to use a font with selected spectral characteristics similar to the “soft tempest” idea.

The second is with the whole page image using “anti-watermarking” distortions to manipulate the image such that it looks like it’s gone through an old style mechanical drum FAX machine where the pinch rollers don’t grip properly.

The resulting distortions most humans either don’t or hardly notice, unlike OCR software which in the pastt “would barf on a spec of fly dirt”.

But as you note OCR is getting better (and Chinese capatcher crackers are dirt poor cheap as well)

So there are other aspects to think of with the font. One is making certain consonants oddly distorted think of a capital B that is more like the number 8. And another is conjoining them in certain ways for instance “th” can be made a single character and in some languages “ae” is conjoined. Again the human mind hardly notices some of these whilst OCR can have a bad hair day.

It is a race, and at the moment OCR is still lagging, as it catches up new methods will need to be used.

The trick as always to stay one step ahead not just of the oposition but your competitors as well…

Clive Robinson • March 11, 2012 9:31 AM

@ Nick P,

Just too many BS ways to go down to let lawyers decide your fate

Oh that it were only the lawyers, but to be honest they are just doing a job for money using tools just like the rest of us.

The real problem is the tools and the system of operating them.

The tools are the legislation and the system judicial process.

I think many would agree there are two basic types of law, those that society needs to stay as a society and then those that have been “purchased” on way or another by vested interests with either deep pockets or significant influence over the legislators.

Most of the problems society suffers come from the bought / influanced legislation and nearly all of it is less than a hundred years old. Which is a very significant tell against it.

Part of the problem is communications, more than one hundred and fifty years ago people did not move around much but animals did to get them to market. Thus distance for several thousand years was effectivly measured by how far you could drive / drove animals on foot or how fast goods traveld by oxen pulled carts (about 1 MPH in modern statute miles).

News traveled by word of mouth carried by drovers and traveling traders thus also moved at a similar slow speed. Thus it moved around six to eight miles a day.

However due to the needs of Kings and later Governments to prosecute wars against each other the speed of communications rose, first by runner, then horse back, then signaling by torches, flags untill eventualy by electricity and radio waves, becoming effectivly instant (to humans) to any part of the world between the two world wars.

This introduced a series of issues in that instant communications demanded instant decisions and “thinking time” diminished and the work of managment and government speed up.

Now “the peoples representatives” of the “representational democracies” we live in are all about style and apperances and very little about substance. They had to be seen to do things faster as there was nolonger the excuse of “communications delay”.

Thinking time had gone but worse when you speed things up there is the expectation things will continue at that pace or faster. Soon our legislators could not draft legislation them selves and they had initialy civil servants drafting legislation for them. Then special advisors who had expertise in the areas, then along came industry with the lobbyists, presenting legislators with ready made fact, figures, arguments and draft legislation and analysis.

As we know from the PATRIOT Act legislation is nolonger read in it’s entirety, nore is legislation very much to do with it’s title as little unrelated bits just get shoved in seldom with comment and usually without serious thought or debate.

The result is modern legislation is owned by the vested interests not society who now have little or no say and have got to the point where they feel so detached from the process steadily increasing numbers can not even see the point in registering let alone voting.

I’m not sure what the solution to this should be, in the past I’ve said get rid of “representational democracy” and replace it with “true democracy” where individuals vote on substantive issues not for monkeys in suits. However desirable as this may appear to be it just shifts the problem from lobbying representatives to lobbying society, and the old “Money talks every thing else walks” rules apply, so legislation will still get bought by those vested interests.

So I then considered the fact that our legislators do have to much time on their hands to filibuster and argue their “pet” legislation in. And once on the books like the prooverbial manure on the blanket it becomes difficult if not impossible to shift.

Now in the European Union there is something strange, most if not all directives have a sunset clause of only a few years, where they have to go back to be reconsidered for amendment and voted for again effectivly in the “light of experiance”.

There are several big advantages to this, firstly bad laws can just lapse and be removed from the books, secondly laws can be fine tuned to improve them and more importantly evolve them with the changing norms of society. But thirdly and perhaps more impoortantly it throttles the introduction of new legislation. The representatives can not do two things at once, thus the time they spend on reviewing is not spent on introducing new legislation thus the whole process gets slowed and thinking time could come back into the legislative process.

However we also need to solve the fundemental issue of “expert advisors” in their many forms, we need a way to ensure they are impartial and give the best advice for society not that of vested interests and this is difficult because as we have seen with Global Warming there are a lot of vested view points dressed up as faux facts in a way that is difficult to tell are faux.