Schneier on Security

Clive Robinson • November 7, 2026 7:18 PM

@ Andy,

First off, thanks for the “shout out” I suspect @Bruce is likewise pleased with the “hat-tip”.

With regards,

“It is not until investigative hackers fully reverse engineer and expose the code of these systems that the truth gets out.”

I’m of the view that,

1, Just observing malfeasance in EMail etc is enough to go into full on avoidance mode (it’s why I don’t personally “do email” or similar).

The reason, “Because waiting on the ‘never never’ of “reverse engineering” for proof can do you a great deal of harm in the meantime.

2, All communications channels have redundancy to transfer information. Anywhere there is redundancy you can open up a channel within a channel[1].

3, Where there is redundancy you can make what appears random look like innocent plain text. Thus you can use the “observer problem” to your advantage.

Hence “Deniable encryption” that has Shannon “Perfect Secrecy” via “all messages are equiprobable” can give you a covert channel inside “What is to an observer a plaintext message” that also has other useful properties / features.

But…

4, You should always take the “security end point” and UI off of the device with the “communications end point”

Because with a little thought it kills “Client Side Scanning” and with care gets around “soft-censorship”.

Interestingly “deniable encryption” is something you can get an LLM System to do…

Which is proof enough that guardrails at an LLMs input and output will always be subject to being bypassed thus fail… And by extension any LLM Agent in a “sandbox” that still has external communications will be insecure at best thus fail.

At some point within the next decade I suspect most people will have caught up with this information.

And as we saw with the end of the “war on E2EE” which triggered the push for “Client Side Scanning”. CSS will likewise be over for those who prefer to excercise both caution and care over convenience.

Thus it’s time to start thinking about the next battle within the war of “peoples right to privacy” v “authoritarians you have no rights”.

Sometimes you have to apprentice as a Poacher to become a good Gamekeeper[2]…

[1] See the papers of Claude Shannon and Gustav Simmons for the proofs.

[2] This Poacher to Gamekeeper transition is something the less than bright managers towards the top of large companies have yet to wake upto with regards AI. As many in the software game know unless you are a lot smarter than AI then the result of using AI to produce code will be,

“Well over priced AI slop”

Thus the question will arise fairly soon of,

“Where do we get smart people?”

The answer that most senior managers do not want to hear is,

“By training them up for 20,000 hours.”

For which people will expect decent renumeration befitting skills that few others will ever acquire.

And No “Current AI LLM and ML System” will even get close to those required skill levels no matter how the Altman and Amodei types, their genuflecting employes and servile shills spout otherwise.

Clive Robinson • November 8, 2026 12:09 PM

@ Apokrif,

With regards the ARS story you might want to know about,

https://www.iclr.co.uk/document/2026009098/2026ewcacrim1228_TNA/html

The soldier was found guilty at level 1A which starts at a 12month imprisonment and goes upwards from there and this is what the sentence handed out by the Court Martial despite mitigating circumstances.

The appeal basically gave a “two finger salute” before “rubber stamping” the court martial sentencing.

Now look the other way…

You will see the 1A Level is not actually about the “offence” but the “potential harms” that might arise.

Think on that for a moment, befor considering,

1, The behaviour of the court martial and appeals judges has been the expected “might is right” and “justice must be seen to be done” nonsense.

2, The behaviour of these courts has now made very public the Who, What, When of the events along with identifying other forces personnel and their roles to the world.

3, Thus those who hacked the phone now have information available from the courts that they probably did not have before.

4, Now think about that in terms of “harms committed”, they meet or exceed the Level 1A threshold and that of the original offense.

So now considering the imbalance in the harms the courts have committed, what punishment do you think should be handed down to them?

There is an old saying that many know but bares repeating,

“Military Intelligence is an oxymoron.”

https://quoteinvestigator.com/2013/10/02/oxymoron-intelligence/

With the original source appearing “authorative” on the matter…