Schneier on Security

Clive Robinson • September 10, 2021 7:54 AM

@ ALL,

After being compelled by a Swiss court to monitor IP logs for a particular user,

Take note of the implicit time line,

1, No logs.
2, Secret court order
3, — unspecified time duration —
4, Logging becomes “public knowledge”

That unspecified time of “secret logging” would for many be a danger zone. In that they would assume no logging and carry on their activities that might cause them problems down the line.

So,

Assume you are ALWAYS, without exception logged, by everyone and act accordingly.

I know it is a sad state of affairs to realise that you are by default treated as a “suspect” or “enemy of the State” but that is the reality of this century so far and we are only 20% of the way through it.

As the old saying has it,

It will get worse before it gets better, if it ever does.

Clive Robinson • September 10, 2021 6:29 PM

@ Frankly, ALL,

They can always make and enforce laws, even unreasonable ones, to defeat any technology. So we are only as secure as our politics, not our technology.

Not fully true, that door swings both ways.

The ultimate laws that can not be cheated are the “natural laws” of the Universe. Even though our understanding of them is limited we know there are things we can not do.

So any laws passed by humans are constrained by the natural laws. It’s why we find the notion of making Pi a rational number by law so idiotic that in this day and age it’s funny.

More recently we had a laugh at the Australian Government for passing other just as idiotic laws. And prior to that a belly laugh at Australian PM “Malcom Turnbull” who made a right arsehat of himself by saying,

“The laws of Australia prevail in Australia, I can assure you of that. The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia.”

He was wrong and provably so. The only way “The Laws of Australia” can prevail against “The laws of mathematics” is by corruption in the legislators, judiciary, and similar undemocratic behaviour. In fact the very behaviours we deplore in the domains of fascists, tyrants, despots, and Police States. Where “disposing of people” by “hit squads” and show trials by kangaroo courts is the way of ensuring continuance of power. However as the old saying has it,

“Live by the sword, die by the sword”

Is usually such “leaders” fate often by a subordinate who desires power, and, often stupidly the “status of office” as well… hence the old saws about “The power behind the throne” and “Sitting ducks”.

In such places it is clear that the laws of the nation no matter what they say are still bound by the laws of nature. After all legislation will not stop the inertia of an assassins bullet or knife.

However there is a counter balance to all tyrants, dictators and even democratic leaders, they all need resources to maintain their positions. Because there is a chain of “No resources, no followers, no power, no status”. If you can bring about “no resources” then things will collapse eventually. It is by the way the ultimate fate of mankind and no legislation will ever change that.

Because of the need for resources to maintain authority by guard labour etc there has to be some degree of freedom not just for the resource makers but the authoritarian following guard labour. In short there is a counter balance that provides an opportunity to evade the authority. It always favours the majority not the minority even when technology is used by the minority against the majority. In short ultimately it’s a numbers game.

Yes this appears to be contrary to the principles of “asymetric warfare” but actually it’s not. At the final analysis asymetric warfare only works where the majority defeat themselves through fear etc.

During WWI and WWII it was assumed that inflicting hardship, casualties and death on sufficient of the oppositions population would bring the politicians to heal. Well it did not, because for various reasons the population did not defeat themselves.

The thing about “numbers games” is you can use them advantageously to hide in. One face in a crowd is unremarkable. So is one message in a million as long as it remains unremarkable.

It is the idea behind covert communications within overt communications. The minority authority is resource bound by definition no matter how much technology they have to hand it to is always going to be constrained. Providing the communications is unremarkable the minority authority does not have direct cause to progress beyond a certain level of investigation, because it does not have the resources.

So the trick is to keep communications unremarkable, for which there are various techniques. One set of which are provably secure because of the issue of equiprobability. As an observer you can not say with certainty what an individual message means if it has redundancy within it.

You can hide a supprising amount in the redundancy of a spoken language or when it is written. The trick is to maintain equiprobability for an observer but not for the intended recipient.

Such systems were used during WWII and will work just as well today, providing people follow the rules correctly. You can even get “full message deniability” against “Second party betrayal” if you do things correctly.

The problem is most humans do not follow rules precisely, they look for short cuts or even ignore them. Just one mistake like that can make an unremarkable message remarkable, thus attract attention, the usage of more resources and the dangers of being targeted.

By and large the job of SigInt agencies is looking for “individual mistakes” and then working them looking for other more subtle mistakes or correlation with events (a form of traffic analysis).

That is they look for cracks to place the tip if a wedge and drive it. Sometimes they get lucky and it all falls appart, most often they do not as “random happens”.

At the end of the day all numbers games are a question of probability, if you can work within it, then your actions can not be distinquished by an observer from random events that crop up all over the place.

Clive Robinson • September 10, 2021 8:48 PM

@ name.withheld…,

Just wondering…

You are not the only one…

I had assumed @Nate had misread something.

However, having been myself recently repeatedly attacked by baseless accusations and having my defensive replies @Moderated but the baseless accusations left up… It appears that “Open Season” time is approaching yet again and many blog posters will just leave without saying why, leaving the site much poorer for their going.

In my case I have decided to alow the accuser to hang themselves a bit, which they are doing with their usual arm waving and their “I’m-rightery” nonsense. It is shocking how much they conform Parkinson’s Law Of Triviality (PLOT)…

I guess we will have to wait and see if @Nate can make his case or not, or will even try.

Clive Robinson • September 11, 2021 5:01 AM

@ Sanguine, ALL,

Schneier is simply reporting recent security news here – nothing more, and it’s your job to decide whether it’s valid or worth worrying about, not his.

Yup.

@ ALL,

Also similar with posts in threads as well.

There are certain persons that are “Kennel Dwellers” who insist on denegrating and abusing people baselessly. Some even try to stir things up by hiding known “Political dog whistles” in longer posts. Presumably to try and trigger the likes of Internet Robots / search engines etc to bring Trolls and the like around. In short their intent is to commit damage for vanity or other reasons, thus is the equivalent of Trolling or cyber-bullying.

My advice if you have doubts about a posters arm waving or aggrandizement claims is do the OsInt Intelligence analysys bit and verify any grandiouse preening or other unsupported claims accusations etc.

If they can not be verified then see if they are just a harmless anecdotes in response to another commenters anecdote, designed to provide a little “lite amusment”, or to indicat / illuminate a security or technical point, rather than arm waving to get attention thus what the arm waver thinks is “status they are due”.

Also if some one provides logical argument / reasoning to support a point they make, work your way through it. If a part of the logic or reasoning is unclear then “ask questions”, because if you don’t understand something, then others probably do not either. Also it alows the person presenting a logical / reasoning argument to adjust their presentation to be more inclusive, which is important for both the presenter and the audiance.