Schneier on Security

Clive Robinson • March 18, 2025 9:03 AM

@ Bruce, ALL,

The article gives,

“We conducted a literature review to understand the extent to which participant samples in UPS papers were from WEIRD countries and the characteristics of the methodologies and research topics in each user study recruiting Western or non-Western participants.”

Would make a prime example for a rewrite of,

“How to lie with statistics.”[1]

For instance take a look at the D of WEIRD, and ask an obvious question,

“How many WEIR nations are not D?”

Then ask the second obvious question,

“Until fairly recently how many non D nations actually did academic research or filed patents?”

So treat this much like a piece of “road kill”, it might be safe to consume but are you going to go to the effort of testing to see if it is…

But a valid point is,

“The moral may be that human factors and usability needs to be localized.”

That would be true irrespective of WEIRD criteria.

The question really is,

“How localized?”

[1] You can read Darrell Huff’s some what humours 1954 book on line,

https://archive.org/details/HowToLieWithStatistics_201608

Clive Robinson • March 19, 2025 12:04 AM

@ Bruce, ALL,

A very significant question to ask about “WEIRD” is,

“What is left after the D is gone?”

It’s something that is increasingly speeding up in North America, The UK and a number of parts of North and East Europe.

And surprisingly to many it’s not the politicians bringing this about but actually what most would consider “Big Tech” that is behind “Globalization” and similar.

You can kind of look on it in a similar way to “Brutalist Art” that quickly predominates and adheres it’s self to authoritarianism.

Technology has become “Brutalist” and yet few realise and even less understand the “What, Why, and When” of this change.

Oddly or not depending on how you look on potential synchronicity, in the UK “The Guardian” newspaper –that employed our hosts skills for quite a while– has just published an article that addresses part of the problem,

https://www.theguardian.com/commentisfree/2025/mar/18/stem-graduates-technology-careers

Put simply it’s about “employment opportunities” for many “Science Technology Engineering and Mathematics”(STEM) graduates the only real opportunity for not just employment but career progression is with “The Bastions of Capitalism” that brook no honest dissent.

Part of this is “Data Collection and Processing”. Data especially personal data is seen as “The new black gold” that “Oil once was”. Not only does it have “basic value” like Oil it can be refined and turned into other more lucrative and money earning products.

Some see it as “Bulk Surveillance” others “Theft of Personal and Private Information” and others view it as akin to activities the likes of Stalin would have given anything and everything for. And as many know “Non D” states with certain types of authoritarian leaders are rapidly acquiring and deploying such technology every which way they can.

But increasingly so are supposedly D nations, Australia, France, Sweden, the UK and now other nations are insisting on access to communications without hindrance or any oversight on a “Might is Right” authoritarian basis.

First access to “plain text message” stores, when people stoped that and started E2EE the authoritarians demand impossible “Crypto Backdoors” and as that is actually not possible now it’s “user interface” via “Client Side Scanning” or “On Device scanning” and similar.

Quite a few people have waved read flags over user interface scanning not least Prof Ross Anderson a few years back,

https://www.lightbluetouchpaper.org/2021/10/15/bugs-in-our-pockets/

The simple fact is that like BLE Beaconing put in for C19 but never fully removed, scanning of the user interface is going to happen and has already started.

Since “Secure Messaging Apps” became a thing, I’ve warned that they are not actually secure in use. I’ve detailed why, and what people need to do.

Unfortunately a “secure system” is not as “convenient” as an “insecure system with the illusion of security”.

Further there is the issue of the security of the “root of trust” or if you prefer the “Master Key” from which all security is derived.

Unless people “meet in person” and “exchange by hand” there is no reliable way to ensure that a 3rd party will not gain access to it. If you doubt this consider how a “Man In The Middle” attack on any and all communications channels serves as a base for this security failure.

Is it an “impossible task to solve?” Probably not China has at least one satellite orbiting that in theory does it though the practicality is low and there is no real assurance that it is doing as claimed. See Quantum Cryptography / “Quantum Key Distribution”(QKD) on Wikipedia. A recent investor type puff piece is,

https://thequantuminsider.com/2025/03/05/space-based-quantum-key-distribution-a-deep-dive-into-qkds-market-map-and-competitive-landscape/

But just a few days ago China announced it had a working link to South Africa,

https://asiatimes.com/2025/03/chinas-quantum-satellite-link-a-hack-proof-leap-forward/

The article goes on to describe some potential attacks and counter measures. But this is “normal” with what is thought of as “Military EM Radiation” based systems (see ECM ECCM wars).

Can QKD be made fully secure and “generally” practical, whilst I’m not sure on the former, I suspect that the latter will without “Authoritarian Interference” happen within a half decade or so as much of the technology is already there.

Clive Robinson • March 20, 2025 10:43 AM

@ John Clark, ResearcherZero, ALL,

The one rule to rule them all.

As you note,

“Chain-of-Thought Reasoning In The Wild Is Not Always Faithful”

The “one rule” is “ambiguity”…

Let me explain with this simple example,

I input,

9,9 9,11
Indicate which is larger?

You will probably get told “9,11”.

Why well there are several reasons the first of which is there is no meta-data indicating the input type.

So does the LLM or any other program for that matter treat them as strings or numbers?

As the inputs are actually “strings” then 9,11 being one character longer is by one view “the larger”.

However humans especially in Europe and the US won’t see them as strings but something else.

In Europe the use of a comma instead of a full stop is seen as a “Decimal Point” so they will see them as numbers in which case 9,9 will be seen as the larger.

In the US however 9,11 has “special meaning” as a date marking a tragic event.

Thus 9,11 is a “later date” that can be seen as larger (as in time elapsed).

But also 9,11 in many different presentations will be extraordinarily more present in any textual input corpus scraped from the Internet. So again it is larger by representation.

These are “the simple cases” that can be easily seen…

But LLM’s don’t work the way humans do…

They take any input and they “tokenize it” then build vectors for each token. However the tokens are built by “chains of probability” and that makes them a product of “a drunkards walk” like brownian motion trends of things can be seen “in general” but not “in specific”. Thus in practice you have absolutely no idea how input to the LLM builds it’s tokens, nor can you see them as such.

So you have no idea how the statistics of the LLM will work in the “specific” only in “general”.

Thus “ambiguity rules all rules” is very much an inbuilt and effectively impossible to avoid issue of current AI systems, and importantly “the humans that use them”.

Which brings us onto ResearcherZero’s more general than LLM point,

“Unfamiliarity with language, processes and what is hidden for the user can be exploited to bypass security processes… …Chained with other vulnerabilities it is a powerful attack – which when skillfully executed – can easily escape the user’s detection.”

Is not quite right, because I can show mathematically from information theory that,

1, If there is enough redundancy in the primary channel
2, There was/is a covert side channel

Then a covert channel can be created within the primary channel that any other party can not see or prove exists.

Thus,

“It can be very difficult to mitigate some of these exploits and develop a long-term fix.”

Can not be done with any semblance of “free input” and removing “free input” stops “information being communicated”…

Oh and both “free input” and redundancy are another way to say “ambiguity”…