Schneier on Security

b • March 23, 2009 10:50 AM

Many of the comments here are thinking on internet-scale instead of the real world, much like that post a long while back about gunshot detectors. These don’t need to be perfect. Things in the real world rarely are. It just needs to be good enough, and it could be especially useful at checkpoints. You’re not going to put these everywhere, but an extremely sensitive explosive detector would be nice for mass transit points, for instance, where no, you we aren’t going to be letting you on the train/plain/cruise ship carrying those cans of gasoline.

b • March 23, 2009 2:10 PM

@Eric: “Are you implying the internet is larger or smaller then the real world?”

I’m implying that they are very different. The speed, distance, and prevalence of attacks on the internet are much greater than in the real world. Additionally, virtually all security measures on the internet must be automated. My servers are on the receiving end of ssh dictionary attacks almost continuously. However, to get into the data center where my servers are, you need a card, my thumbprint, and get past the security guard. Each of those, by themselves, is almost trivial. Combined, they’re really annoying. Why? If you fail more than a couple of times to get your spoofed fingerprint past the reader (most of the methods of spoofing don’t get it to work on the first try, heck, it doesn’t always get my real finger on the first try), the guard will notice, even though the guard probably doesn’t know my face. The layers of security are stronger than the sum of their parts in the real world.

On the internet, the layers are effectively atomic. You get past my ssh key, then you’re at a login, but you’ll need to break the sudo password next. The ssh breakin doesn’t slow down the sudo password searching, since it has already bypassed it. Each layer is relatively atomic.

Internet attacks are widespread and thoroughly automated and can be done from half a world away. Real world attacks require that the perpetrators be on premise, massively increasing their risk. The attacker, for instance, can’t stand there at a door using a dictionary attack on the keypad the way the internet attack keep knocking on my ssh door from china. The guard will see him on a security camera. Even attempting to break the door code can land the attacker in prison. The internet attackers from across the globe are quite safe; the attempt itself carries little to no risk, so they can keep trying.

Denial-of-service attacks are also quite different between the two. If I was paged every time someone tried to break through ssh on my servers, I’d never get any sleep. Again, because the attempts are remote and anonymous and there is nothing I can do to punish the attackers. A denial-of-service attack against the real world protections is more difficult, elaborate, and require much greater risk. Planting explosive chemicals into the ice-salt, as mentioned above, would get the attacker jail time, even without an actual attack on the facility.

The human element, as much as we go on about the stupidity of the bulk of homeland security personnell, would make most of the attacks that you see on the internet unworkable in the real world. Even stupid humans are more adaptable than automated computer systems.

Many people here are viewing this device akin to a system that will page me every time someone fails an ssh password. That’s completely the wrong way to look at it. Look at it, instead, as giving every security guard the nose of a trained bomb dog.