Schneier on Security

Clive Robinson • November 2, 2025 7:54 PM

@ not important, ALL,

With regards the Time Crystal link you give, it is to Yahoo that day by day are further proving the are “A bunch of Yahoos”.

The link fails but to be honest they probably ripped it off from another site without acknowledging them.

Can you check if this open link

https://www.sciencedaily.com/releases/2025/09/250907024555.htm

Covers what the Yahoo’s does?

Clive Robinson • November 2, 2025 9:31 PM

We don’t live in the Matrix because it can not exist.

I mention from time to time Kurt Gödel’s little “bump in the road” that derailed many trains of thought not just at the time but subsequently.

Well one thing it shows is that as the universe comes from information some of which can not be generated algorithmically it can not come from a deterministic process…

Well some one has written it up as a formal proof,

https://arxiv.org/abs/2507.22950

It does when you think on/about it, open up the notion, that there is something beyond Quantum Computing as well.

Which in turn begs the question will Post QC Crypto need to be replaced for Key Agreement etc.

Clive Robinson • November 3, 2025 1:31 PM

@ lurker, ALL,

With regards,

“If you’re having persistent problems with Yahoo, maybe that is local to you.”

It depends on what you mean by “local”.

Increasingly I am seeing issues that are the “fall out” of the UK Gov demanding via the “Online Safty Act” that people give all sorts of personal information including images of Gov Issued Identity documents.

Basically things are just getting “slapped on” by third party organisations badly and without thought. The sites for such companies I either don’t go anywhere near or block.

As you might have heard various charity equivalent organisations such as the the internet archives and encyclopedias getting told they have incurred mammoth fines. Bycan organisation “OfCom” that I personally know to be corrupt at best and certainly some were “on the take” (look up “Clive Corrie” to see one such corrupt individual).

Clive Robinson • November 5, 2025 6:23 AM

@ not important, ALL,

You ask,

“Will AI mean the end of call centres?”

The simple answer is “Yes and No”

There is a public need for “call centers” hence the “Yes”, but we’ve already see many become Email and chat groups with few humans involved hence the “No”.

More complicated is the “can we train the custards[1]” to pay for what should be free to all customers who have purchased a product or in other ways boost profit mentality of the bonus hunting C-Suits.

The basic approach is to “cut costs” by where they can getting rid of working humans[2].

This is the aim of “automation” and it’s been going on for way longer than AI has[3].

Thus the basic rull of if your job is vulnerable is,

1, Can you be replaced by automation?

And the answer to that is unless you are pushing the bounds of the unknown in knowledge and creativity, at some point you will be.

But the speed it’s likely to happen is,

1, Are humans in your job cheaper?
2, Are humans in your job more profitable?

Put simply between 1/3 and 2/3rds of jobs in the West are “Makework” and although they can draw upper middle class wages, they are mostly “tedium” as they are basically due to being strongly “rules based” so effectively “mechanical” in nature.

Anything “mechanical” becomes subject to the law of “Force Multipliers” that basically means a machine optimized to a given function will be more “efficient” thus more “productive” than something not optimised like say a human. It is after all why you “drive a car” rather than be “carried in a sedan chair”.

There once used to be a job called “Calculator” their job to do basic maths over and over to find results. The job nolonger really exists, same with “Typewriters”. But go back a while and you find the job of Navie long gone, and quite a few farm jobs. Then semis skilled and even skilled jobs of weavers and masons all replaced by machines.

If you want to see this in action just look at the number of “self checkout machines” that are spring up around you in shops. Being a “till jockey” was never a job that required much… But it provided “productive work at minimum wage” and thus met a need in society. As a teenager it gave me money to get me into collage, a second job as a “plate washer” in a restaurant turned me into becoming a chef, again paying my way. Other jobs I picked up turned into trades and professions. As an orphan I had some hard lessons that I would not otherwise have had, had my upper middle class parents lived.

So if we loose those entry level jobs where people “learn the workplace” what are we going to do with them? It’s a question employers are asking even about “graduates” who are “skilled in knowledge” but totally inept in just about everything else.

So the more rules based your job is fundamentally the more vulnerable it is. It’s why not just call center staff but upper middle class professions are the ones that are going to get hit.

That is anything that involves “encyclopedic knowledge” and “pattern matching” is when you think about it little more than a “Database with Search engine” which is all mechanical in nature so can be replaced.

Current LLMs by the way they are designed are just “Databases with Search Engines”…

Thus the professions of Lawyers, Accountants and much of the medical profession are replaceable by LLMs. As are their support staff.

Why we will need to keep them around all be it in much reduced numbers is the “creative side”. In all rules and mechanical systems there are non functions, edge and corner cases, and vulnerabilities. A creative and oft artistic mind will be able to easily outdo an LLM. Because LLMs and the ML that populates them are not designed for “creativity or artistry” only “mimicry of what exists”.

Thus the more “creativity or artistry” your job requires the longer it will last.

So Scientists, Engineers, and some researchers are fairly safe, as are architects. Less so doctors and only some of lawyers and accountants.

The problem nobody is giving voice to is “How do we select and train them”. Politicians talk of “life long learning” but that can not be done if there are no entry level jobs…

And it’s entry level jobs that LLMs and current MLs are replacing…

The US is a classic example of “Offshoring and Outsourcing” and the price paid is the US does not have a “skilled workforce” left.

It’s why I smile ruefully when I hear the “Trumpster blurt out his idiocies” about MAGA, it’s not going to happen for Americans in the next three to 10 generations. Jobs have gone they got optimised and automated out of existence whilst being done abroad. Those left behind in the US don’t have the required skills and they are very unlikely to obtain them because they are “over thirty”.

I could go on about the nest feathering politics but I would get banned 😉

But suffice it to say whilst you can wind back a clock, you can not wind back time.

So “when jobs are gone” after a very short while they are never coming back again…

[1] The term “Custards” comes from amalgamating “Customers an 13astard” which originated with the early sales and call centers. Moved into management and has become a viewpoint of the C Suits in places like Amazon, that the customers should know their place and that is to be exploited for profit not take it away for their legal rights.

[2] As I pointed out many years ago here it’s a short sighted view point. To survive a company or organisation needs money. Where does that money come from that their customers hand over?

Yup ultimately out of the pockets of “people who work”…

So if you lay staff off you are in effect shaving to much off and thus “cutting your own throat”.

[3] Look up the “cotton gin” if you want one example. But in more general terms how the word “Sabotage” came into existence. Sabot is the French word for “Wooden Shoe” and if you throw them into a machine it’s unlikely to fare well. So it literally means “Putting the boot in”. So who were the people throwing their clogs into the system? Those who had lost their jobs to the machines. Those in charge named them luddites to turn the public against them thus make them easier to sanction to hanging or life in jail.

Clive Robinson • November 5, 2025 7:03 PM

@ pour one out for me,

With regards the bleeping computer article it says,

“Britain’s largest mobile carriers have committed to upgrading their networks to eliminate scammers’ ability to spoof phone numbers within a year.”

I’m saying,

“It ain’t going to happen.”

Two reasons,

1, The Telecoms companies realy do not move that fast.
2, All the spammers have to do is buy a Sim Box or O800 number.

The first has been demonstrated “Historically” but one of the more recent was “Pulling Chinese manufactured 5G equipment out.

But there is another point with regards to this, the “Mobile Carriers” don’t own or run the networks they have. They lease them and get the maintenance and updates done by the leasing firms for “Tax Reasons” but more importantly so they can “massage the margins” so they look good to those who buy shares.

So realistically “within a year” does not have a high probability.

But if they do it or not is not really relevant.

Because of the second point. All they need is a UK phone number they can “dial out from” and an Internet or other electronic connection with sufficient anonymity lets say Tor as an example. But it does not really matter as there are hundreds of ways of carrying digitised audio.

All the scammers then need to do is “convert back to audio” and add an old fashioned dialing device that takes a serial line that talks to an “auto dialler”.

This can be conveniantly done with a low cost “Digital PBX” on a computer using part of Asterix or similar.

The point being that the “carriers” can not tell the difference between an international call and a national call…

So the idea is a bit of a bust, if not just a “publicity stunt” any one with sufficient “Historical Technical knowledge” will know this and confirm in detail how to do it.

I used to do something similar with a “Pole-Job” as part of surveillance equipment I designed for UK Government agencies. Trust me it’s not difficult the biggest per unit cost would after the “Safety box” would be line isolation transformers and if you needed it BABT approvals to cross the “Demark”.

Using a variation of a SimBox removes the need for Approvals or line transformers but you are stuck with using the equivalent of mobiles.

However it is common practice currently for the “company 0800 number” to be used even from individual SIMs if they were all registered to the company. Such things are done for “Sales People” who are “on the road”

Another trick is to use one of these “Push-to-Talk over Cellular radio hand-held devices”(POC).

Currently the way they are billed the Operator is not UK based (even though the SIMs often come from near Scotland).

Because of what they are primarily used for –replacing analogue and digital “mobile radios”– which is for “work men” and other mobile staff. Getting bespoke ID’s is not a problem. And the business behind POC networks being abroad means “a sale is a sale” and they won’t check if it’s the legitimate UK company, because the reality is they can not…

Also registering a company in the UK whilst superficially difficult is actually not difficult, or you xan just buy one from any one of the hundreds of “company formations companies. You then simply change the name with a form you can print off or fill in on-line from “Companies House”. Thus as long as it is unique can be almost anything.

So lets say you want to register “IBM Telecoms” then you can do it if anyone asks you simply say it’s a new subdivision. Even if they want to check with IBM, IBM HQ generally does not have a clue about all the sub companies that get created for Tax / Business / Shareholder reasons. All you then need is a company bank account.

The reason this is so often done is that it “goes in on the other side of the balance sheet” so is seen as an investment from then on and does not negatively effect a large corporates margins thus Share Value…

What is “standard practice” is almost always a vulnerability waiting “Exploitation”.

So at the end of the day this is a near meaningless agreement for “Good Publicity” the fact it will be so easily bypassed will be “Somebody elses problem maybe at some future time” at which point it nolonger matters.

Clive Robinson • November 6, 2025 12:04 PM

@ ResearcherZero, ALL,

You make the point of,

“AI is being used to implement polymorphism into malicious code to produce mutating versions of malware that will change over time, fetched new scripts for evading antivirus detection and regular rewriting of malware source code to assist in avoiding signature detection.”

These AI uses are “narrow in scope” don’t require any reasoning or other “wo wo nonsense” and have a great number of “examples in their training set that can be seemingly “mixed and matched” untill beyond what many if not most humans think of as “impossibly large”.

Thus yes they have the basic requirements to be a success for developing malware without writing it.

In general all software uses loops, branching, and static linear code. Even at the assembler level there are multiple different instructions or arrangements to make each without changing higher level functioning in the slightest.

Likewise blocks of instructions can have the same function yet be built from different multiple instruction sub-blocks.

And so on upto Scripting languages and apps.

Thus polymorphism does not require reason or intelligence it’s just a form of almost random shuffling.

In fact it is known you can make a stream cipher implement enormous combinations of end assembler code that are in effect uniquely different but perform exactly the same function.

The cipher generates a byte, and this gets used Modulo the number of code or code groups to select which to use.

I’ve used similar techniques myself to “protect code” by putting in the equivalent of a DRM signature using “Low Probability of Intercept”(LPI) techniques back last century.

So using an LLM to do basic polymorphism is actually “over kill”. So as a force multiplier it’s efficacy would be questionable, even though quite functional.

Where the balance would change is where you start to get well above basic code blocks, and importantly want to mimic another programmer’s “style”. Here AI would be considerably more useful. But the reasons for doing so would be akin to malicious impersonation / fraud for the intent of “fitting up a fall guy”.

Something as an observer I would say is not just bad, but very bad with an intent to harm another deliberately.

I could go through the other things you mention with a very very similar analysis.

That said it’s not something current investigators are going to be likely to consider.

So an interesting future lies in the future for all of us on this.

Clive Robinson • November 6, 2025 12:52 PM

@ ResearcherZero,

You might want to watch and consider this,

https://m.youtube.com/watch?v=NOKz67LkBIk

Clive Robinson • November 6, 2025 2:44 PM

@ ALL,

Is OpenAI “to big to fail” or “to late to stop”

Is an interesting question in theory, but practically either way OpenAI are talking about tax payers bailing them out,

https://garymarcus.substack.com/p/if-you-thought-the-2008-bank-bailout

For those caught up in the hype,

“No”… Current AI LLM and ML System and associated companies claiming “National Security” status are full of hype and bovine tail exhaust.

They can not deliver on their promises and almost certainly never can. In a normal world they would have “slammed into the wall” of bankruptcy long ago.

The only reason they are seen as potentially “to big to fail” is the US Economy has “flat lined” and the only thing making it look alive is all the artificial churn surrounding AI in the Silicon Valley Mega-Corps.

But it’s not “real economic activity” it’s actually an empty “artificial money spiral” where debt is transformed by “accounting tricks” to “investment” thus makes artificial margins for dumb share holders to ‘buy into’ and so becomes pseudo-profit thus faux-value.

There is only so many times that spiral can turn to make churn before it becomes obvious to those primed to “grab and run” leaving nothing but debt and loss behind on their “Sunset Run”.

So is Open AI “to big to fail?”

As an organisation no it’s passing would hardly be noticed technology wise. As a debtor probably not, empty barrels float high out of the water but they are far from stable. But… with a precariously faked up US Economy depending on the AI Hype bubble the answer is Yes, as long as the US Economy is crap OpenAI will be a national security concern.

Because if OpenAI goes then so do all the others it has circular investment agreements with (the exception to this most likely is Microsoft but you’ld have to dig deep into the legal paper work to determine this. But the way the men at the top are behaving, that is “running or preparing to run” says that maybe the paper work is not that good).

With a major recession pending old wisdom said it was time to go on a “War Footing” and go start one.

But that policy like the one OpenAI is hinting at means it’s the ordinary tax payer that will pay and pay and pay, for considerably less than nothing in return.

The only trick will be how the Fed will get on board to massage it in this time around as “Quantitative Easing” is so 2008.

Clive Robinson • November 6, 2025 7:27 PM

@ Bruce,

You might remember the papers “Why Johnny can’t Encrypt” from back last century?

Well at the same time were numerous similar comments and articles about “passwords”.

Well another report on the fact the majority of user selected passwords are bad has been peoduced, and The Register has an article,

https://www.theregister.com/2025/11/06/most_common_passwords/

My thinking for a couple of decades at least is it’s a human brain problem. It appears to be that for,

“The neuro typical non technical human.”

Their brains are still incapable of doing things securely… Such things being in effect alien to their everyday normality.

Thus it could be said that,

“It’s the human condition at work.”

That gives us such sayings as

“To err is human, but it takes a computer to really fudge things up!”

What ever the cause “Passwords” had outstayed their welcome over sixty years ago before even “Flower Power”.

And we really should be rid of them.

Clive Robinson • November 7, 2025 4:42 AM

@ Bruce, ALL,

For some reason we’ve now had another “trip down memory lane” incident just recently.

Or for the superstitious the third of,

“Accidents come in threes”

Or for the more paranoid of those that are still alive of, 007’s “saw” in Ian Fleming’s ‘Goldfinger’ story of

“Once is happenstance.
Twice is coincidence.
Three times is enemy action.”

This “third one” being about the three decades or more long arguments[1] about On Chip RNDs that centers around the Intel designed on chip RND and the resulting “RDRAND” and “RDSEED” x86 instructions.

https://www.theregister.com/2025/11/05/amd_promises_to_fix_chips/

Which kind of makes “enemy action” feel like being about right…

But hey that’s just my “paranoia”, “spidey-sense”, “third eye view” kicking in yet again 😉

[1] Any one else remember the Linus vigorous “head nodding Yes whilst mouth saying No” incident as a reply when asked if he thought On-Chip Real-RNDs in CPU chips were “backdoored” by the NSA?

It is part of the story that goes back into the early 1990’s when Intel + Suspected NSA bodies tried pushing Linux developer Theodore Ts’o to “just use the Intel on chip hardware RND”,

https://web.archive.org/web/20180611180213/https://plus.google.com/117091380454742934025/posts/SDcoemc9V3J

An incident of which Theo later said,

“I am so glad I resisted pressure from Intel engineers to let /dev/random rely only on the RDRAND instruction… Relying solely on the hardware random number generator which is using an implementation sealed inside a chip which is impossible to audit is a BAD idea.[2]”

[2] As I pointed out at a similar time when talking about the Intel Real RND design using two “ring oscillators”… There is a very simple reason to see why it’s “a BAD idea”,

The use of two oscillators mixed in a D-Type latch is a very bad idea, because even with graph paper you can clearly see the result at the output of the latch is a “1bit oversampled sinewave of the difference frequency”. Close in “it looks random” on an oscilloscope, but dial the time base out and you start to see the “bunching” of the waveform be a sinewave[3].

That is put the output through a simple integrator / low pass filter and you get a very good quality sinewave at the difference frequency.

It’s a technique I used way way back when designing a “digital audio signal generator” for a “Radio Test Set”.

[3] I’ve also pointed out that Intel always follow their RND source with a Crypto Algorithm and don’t let you see the real source output which again is a “BAD idea”.

It’s raised the “What are they hiding?” Question a number of times. To which “it’s crap and has no entropy” or “they’re hiding a back door” and some in between answers have been suggested.

As I’ve said before it’s a “BAD idea” because if you think about it for a moment you will see a simple thought experiment of,

“Let’s assume it’s a “1bit quantatised sinewave” output, putting it behind a crypto algorithm is “encrypting it” which by definition “Makes the statistics flattened and random looking”.

If you don’t have “the key” then you can not see and sync to the sinewave, but if you do you can…”

So think how much easier it would be if the NSA “had or controlled the key”. Then it could become a NOBUS back door.

Clive Robinson • November 7, 2025 11:29 AM

@ Winter,

With regards,

“This has been done with a few European banks at the time.”

You forgot the important one, the Icelandic, Ireland, Spain, and others decision to prosecute and jail even the “seniors” as well as fines sequestrate of any and all assets (in some cases I’m told they concluded “in wifes name” was money laundering and got the assets, not sure if any of the wives did time or not (but they should have)

It sent quite a message at the time,

And for one of them in Italy they are still under imprisonment.

The FT “pink-un” did a piece on it some years back,

‘https://ig.ft.com/jailed-bankers/

Prior to this such “self entitled” people assumed no matter what they did they could “buy their way out”…

But not having any money corporately or personally took most options off the table so in Iceland I’ve been told they “turned on each other” in hopes of “consideration”.

It would be interesting to see the state of their economies today v those of countries just tut tuted and let them walk away.