Schneier on Security

Clive Robinson • November 7, 2026 7:18 PM

@ Andy,

First off, thanks for the “shout out” I suspect @Bruce is likewise pleased with the “hat-tip”.

With regards,

“It is not until investigative hackers fully reverse engineer and expose the code of these systems that the truth gets out.”

I’m of the view that,

1, Just observing malfeasance in EMail etc is enough to go into full on avoidance mode (it’s why I don’t personally “do email” or similar).

The reason, “Because waiting on the ‘never never’ of “reverse engineering” for proof can do you a great deal of harm in the meantime.

2, All communications channels have redundancy to transfer information. Anywhere there is redundancy you can open up a channel within a channel[1].

3, Where there is redundancy you can make what appears random look like innocent plain text. Thus you can use the “observer problem” to your advantage.

Hence “Deniable encryption” that has Shannon “Perfect Secrecy” via “all messages are equiprobable” can give you a covert channel inside “What is to an observer a plaintext message” that also has other useful properties / features.

But…

4, You should always take the “security end point” and UI off of the device with the “communications end point”

Because with a little thought it kills “Client Side Scanning” and with care gets around “soft-censorship”.

Interestingly “deniable encryption” is something you can get an LLM System to do…

Which is proof enough that guardrails at an LLMs input and output will always be subject to being bypassed thus fail… And by extension any LLM Agent in a “sandbox” that still has external communications will be insecure at best thus fail.

At some point within the next decade I suspect most people will have caught up with this information.

And as we saw with the end of the “war on E2EE” which triggered the push for “Client Side Scanning”. CSS will likewise be over for those who prefer to excercise both caution and care over convenience.

Thus it’s time to start thinking about the next battle within the war of “peoples right to privacy” v “authoritarians you have no rights”.

Sometimes you have to apprentice as a Poacher to become a good Gamekeeper[2]…

[1] See the papers of Claude Shannon and Gustav Simmons for the proofs.

[2] This Poacher to Gamekeeper transition is something the less than bright managers towards the top of large companies have yet to wake upto with regards AI. As many in the software game know unless you are a lot smarter than AI then the result of using AI to produce code will be,

“Well over priced AI slop”

Thus the question will arise fairly soon of,

“Where do we get smart people?”

The answer that most senior managers do not want to hear is,

“By training them up for 20,000 hours.”

For which people will expect decent renumeration befitting skills that few others will ever acquire.

And No “Current AI LLM and ML System” will even get close to those required skill levels no matter how the Altman and Amodei types, their genuflecting employes and servile shills spout otherwise.