Schneier on Security

Clive Robinson • November 6, 2026 7:23 PM

@ Bruce, ALL,

More Apple backdoor censorship?

Apple was in effect the first mobile phone OS developer to put into their OS the foundations of “Client Side Scanning”(CSS) under increasing pressure from US legislators and law enforcement agencies.

Apple received a lot of bad press over it and slid some of it backwards.

Importantly though it emphasised the point that the US Gov had finally accepted the impossibility of NOBUS backdoors in “End to End Encryption”(E2EE) even though it had been repeatedly pointed out by those involved with ICTsec.

Thus the USG move to attack privacy on the other side of the “security end point” via CSS as an “end run attack”.

Something pointed out on this blog back in the very early days of “Secure Messaging Apps” and the weak links in the security chains on consumer and commercial systems.

Hence the argument for taking the “security end point” off the device that is the “communications end point” (and why I gave the basics of the design of how to build a “Deniable Encryption” system on this blog).

Well Apple have a new less obvious nod in the direction of “Client Side Censorship”(CSC).

Investigators have discovered quite deliberate censorship in the user side “autocomplete” text entry system,

Apple’s autocomplete restrictions include ‘Dictator Trump’ and ‘Sleepy Joe,’ researcher finds

Apple has an undisclosed multilingual gray list of tens of thousands of words and phrases that its iOS keyboard will ​not autocomplete or swipe-type, a researcher said on Friday.

“The list is not a ban. iPhone users can still type what they like when drafting emails and texts. But the words on the ‌list will not be suggested to users via autocomplete or swipe-typing in most cases. The researcher, Derik Kauffman, said the find opens a window into how Apple manages the tradeoff between anticipating what hundreds of millions of iPhone users are trying to say and preventing the devices from offering offensive or politically charged suggestions to users – something he said could quietly shape how they communicate.

“It’s a very light-touch form of censorship,” said Kauffman. “But at the scale that Apple is operating, it only takes a light touch to have a big impact.”“

https://www.reuters.com/business/retail-consumer/apples-predictive-text-restrictions-include-dictator-trump-sleepy-joe-researcher-2026-11-06/

Not only is it a first step “light-touch censorship” system, it also opens up fingerprinting users via their typing cadence and word / symantec usage.

Clive Robinson • November 7, 2026 7:18 PM

@ Andy,

First off, thanks for the “shout out” I suspect @Bruce is likewise pleased with the “hat-tip”.

With regards,

“It is not until investigative hackers fully reverse engineer and expose the code of these systems that the truth gets out.”

I’m of the view that,

1, Just observing malfeasance in EMail etc is enough to go into full on avoidance mode (it’s why I don’t personally “do email” or similar).

The reason, “Because waiting on the ‘never never’ of “reverse engineering” for proof can do you a great deal of harm in the meantime.

2, All communications channels have redundancy to transfer information. Anywhere there is redundancy you can open up a channel within a channel[1].

3, Where there is redundancy you can make what appears random look like innocent plain text. Thus you can use the “observer problem” to your advantage.

Hence “Deniable encryption” that has Shannon “Perfect Secrecy” via “all messages are equiprobable” can give you a covert channel inside “What is to an observer a plaintext message” that also has other useful properties / features.

But…

4, You should always take the “security end point” and UI off of the device with the “communications end point”

Because with a little thought it kills “Client Side Scanning” and with care gets around “soft-censorship”.

Interestingly “deniable encryption” is something you can get an LLM System to do…

Which is proof enough that guardrails at an LLMs input and output will always be subject to being bypassed thus fail… And by extension any LLM Agent in a “sandbox” that still has external communications will be insecure at best thus fail.

At some point within the next decade I suspect most people will have caught up with this information.

And as we saw with the end of the “war on E2EE” which triggered the push for “Client Side Scanning”. CSS will likewise be over for those who prefer to excercise both caution and care over convenience.

Thus it’s time to start thinking about the next battle within the war of “peoples right to privacy” v “authoritarians you have no rights”.

Sometimes you have to apprentice as a Poacher to become a good Gamekeeper[2]…

[1] See the papers of Claude Shannon and Gustav Simmons for the proofs.

[2] This Poacher to Gamekeeper transition is something the less than bright managers towards the top of large companies have yet to wake upto with regards AI. As many in the software game know unless you are a lot smarter than AI then the result of using AI to produce code will be,

“Well over priced AI slop”

Thus the question will arise fairly soon of,

“Where do we get smart people?”

The answer that most senior managers do not want to hear is,

“By training them up for 20,000 hours.”

For which people will expect decent renumeration befitting skills that few others will ever acquire.

And No “Current AI LLM and ML System” will even get close to those required skill levels no matter how the Altman and Amodei types, their genuflecting employes and servile shills spout otherwise.

Clive Robinson • November 8, 2026 12:09 PM

@ Apokrif,

With regards the ARS story you might want to know about,

https://www.iclr.co.uk/document/2026009098/2026ewcacrim1228_TNA/html

The soldier was found guilty at level 1A which starts at a 12month imprisonment and goes upwards from there and this is what the sentence handed out by the Court Martial despite mitigating circumstances.

The appeal basically gave a “two finger salute” before “rubber stamping” the court martial sentencing.

Now look the other way…

You will see the 1A Level is not actually about the “offence” but the “potential harms” that might arise.

Think on that for a moment, befor considering,

1, The behaviour of the court martial and appeals judges has been the expected “might is right” and “justice must be seen to be done” nonsense.

2, The behaviour of these courts has now made very public the Who, What, When of the events along with identifying other forces personnel and their roles to the world.

3, Thus those who hacked the phone now have information available from the courts that they probably did not have before.

4, Now think about that in terms of “harms committed”, they meet or exceed the Level 1A threshold and that of the original offense.

So now considering the imbalance in the harms the courts have committed, what punishment do you think should be handed down to them?

There is an old saying that many know but bares repeating,

“Military Intelligence is an oxymoron.”

https://quoteinvestigator.com/2013/10/02/oxymoron-intelligence/

With the original source appearing “authorative” on the matter…

Clive Robinson • November 8, 2026 10:34 PM

@ lurker, ALL,

With regards the FCC and testing radio equipment it’s actually quit involved.

Officially the party line is about “reciprocal testing” but the reality is the Executive has designated much communications equipment such that it can not be “Exported to China” (kind of like the GPU issue).

So there are no US companies wanting to export to China because they are not allowed to do so. Which means no US company wants to have equipment tested to China’s standards. So there is no requirement for reciprocal testing…

Thus the executive can claim a bunch of nonsense.

But it gets more interesting the FCC want all Chinese comms equipment to be “specific to part” not “general to many parts”

So GMRS equipment has to be specific to the part regulations for GMRS and tested as such. Even though identical electronics will do GMRS, PMR, and Ham bands without circuit modification (just change a file contents used by the software). Similar applies to FRS etc.

But the FCC is talking about having any change require “full certification testing” even if it’s not electrical / electronic just a change of knob design or case colour etc.

They are even talking about changing requirements so that you can not have common fitting removable batteries, so all cases have to be different… As well as requiring antenna connectors that are Copyright to US Corps and that can not be made outside of the US or for that matter sold into China.

The thing is that the result will not bring manufacturing of radio communications equipment “back to the US” as the market is not there. Because few people would pay well over the odds for what will be substandard limited capability equipment, compared to what is made in what the US calls “Asia” and most others call the Far East.

The problem the FCC has at the moment is that of the commission seats, there is only one Democrat and they are in effect end of term. Brendan Carr is pushing to make all seats Republican. The legality of which has been called into question,

‘https://broadbandbreakfast.com/wyden-an-all-gop-fcc-would-be-unlawful/

How it will pan out on the “lame duck exit” in the two houses prior to January will prove interesting,

‘https://broadbandbreakfast.com/democratic-congress-could-put-new-pressure-on-fcc-chairman-brendan-carr/

Speaking of illegal / unlawful Brendan Carr was bring his position into disrepute yet again,

‘https://broadbandbreakfast.com/rachel-goodman-baseless-election-interference-threats-from-the-fcc/

Clive Robinson • November 9, 2026 1:14 PM

@ ResearcherZero, ALL,

With regards adolescents and your observation that they are in effect “cast adrift” thus easy prey for,

“There are some who are willing to offer a sense of certainty and belonging.”

It’s actually worse than most realise…

Back at the begining of this century there was terrorists arising from the Middle East. The reasons why there was and still is such terrorism can be laid fair and square at the doors of the US State Dept and those setting policy even against the directions of the US Executive and of other US politicians having a majority in one of the houses…

But the big issue on the ground was and still is in the area the “Strongly patriarchal society” in nearly everything not basic domestic.

The problem with this is that adolescents are “told what to do” in nearly all aspects of their lives, thus they do not develop “a moral compass”.

Which means when they move out of the homeland for education or as refugees etc they are in no way prepared for living equitably in the society they find themselves in.

The results can be disastrous as the UK has found the hard way. But if I say almost anything, I would be the one ending up in prison or dead.

The problem I in part identified back in the 1990’s is that adolescent males in education away from their patriarchal influence were easily recruited for many anti-social activities…

Not just cult like religion but all sorts of criminal activities including preying on girls and young women that were socially disadvantaged.

Both main political parties in the UK have been either in denial or just look the other way and ignore it mentality. The result is fringe political groups have gained much mileage from “stirring it up” and in some cases been strongly financed by the likes of those behind the US GOP…

So the issue is UK politicians have allowed a situation to arise that they could and should have prevented twenty to thirty years ago. But they chose for various “political milage” reasons not to. Now the situation is out of control unless certain types of very draconian measures are not just considered but put into place…