Unsafe Safes

In a long article about insecurities in gun safes, there's this great paragraph:

Unfortunately, manufacturers and consumers are deceived and misled into a false sense of security by electronic credentials, codes, and biometrics. We have seen this often, even with high security locks. Our rule: electrons do not open doors; mechanical components do. If you can compromise the mechanisms then all the credentials, encryption, fingerprint readers, and other gizmos and gimmicks mean nothing.

In other words, security is only as strong as the weakest link.

EDITED TO ADD (8/13): DefCon 19 talk on the security of gun safes.

Posted on August 3, 2012 at 12:57 PM • 47 Comments

Comments

WaelAugust 3, 2012 1:57 PM

@ Robert

Ever hear of electromagnets?

Of course I have! These are Spanish ectromagnets, right?

CAugust 3, 2012 2:12 PM

I came here to say electromagnets too. Plenty of doors have no mechanical-moving-parts locks.

mooAugust 3, 2012 2:13 PM

The best thing about those insecure gun safes is that they can be opened just by shaking them.

A police officer watched his three-year-old open the gun safe that the department had issued to him. Scary stuff.

mooAugust 3, 2012 2:19 PM

Hmm, I hadn't read the article... if anything should generate moral outrage, this article should.

One of the police officer's young children was killed by a gunshot after opening the gun safe which had been issued to him by the department. (they were issued in the first place after a different incident in which another officer's child was killed.)

He complained to his department that the gun safes were not safe. So did the department recall them? Or do anything else to fix the situation? Of course not. Instead they just fired him. CYA for the win.

DaveAugust 3, 2012 2:21 PM

If you examine the packaging closely, most of these "safes" will be labeled as "Residential Security Cabinets" (RSC) rather than as an actual "safe". At best some putative "Gun Safes" come with a Underwriters Laboratory (UL) rating for fire, few carry a UL "Burglary" rating at all.

Even the cheapest RSC-rated products are required to resist being tipped/dropped or beat on with a screwdriver, for a full 5 minutes. The UL should remove their rating from these products.

Brad Hicks (@jbradhicks)August 3, 2012 2:43 PM

The thing to remember about gun safes is that there's a reason they suck: they are sold, mostly, to people who don't actually want to own a gun safe. They don't actually think that they need it. They think that their gun would be perfectly safe sitting out on the nightstand, loaded, with the safety off, "where it belongs." They get nagged into buying a gun safe, so they buy the cheapest one that they can quickly open themselves, just to get people off of their backs.

You know, the same way most companies hire private security. Or buy insurance. It's never really about safety or security. It's about doing the bare minimum to shut up people who care about safety or security.

Doktor JeepAugust 3, 2012 3:03 PM

Well since we can be forced to buy health insurance, how long before we are forced to buy gun safes?
Security for firearms based just on a safe is like having a gun for protection and leaving the front door open. Security for firearms is a system, like like overall home security, that depends on numerous factors. Too often I have seen a gun safe prominently displayed in a trophy room right next to the room where the power tools and hand truck are kept. Only the really expensive safes, actual safes, that bolt to the concrete (and no other works) floor from the inside and can resist fire are any good, and they are very very expensive.

DannyAugust 3, 2012 3:16 PM

Dear Doktor Jeep,

I have no concrete in my second floor bedroom. Am I supposed to run to the basement if someone breaks in?

Tim KeckAugust 3, 2012 3:34 PM

I don't keep my guns in a gun safe. I keep my ammunition in a locked ammunition box. Guns don't kill people, bullets kill people.

mcbAugust 3, 2012 4:19 PM

@ Brad Hicks and Doktor Jeep

These containers are intended for ready storage of a handgun in a household with children or other persons who do not require access to it. They ought to at least be child resistant and proof against YouTubed defeats using screwdrivers, coat hangers, and soda straws.

Steve PordonAugust 3, 2012 4:20 PM

Deviant did indeed speak on this exact same topic last year, and I have found nothing to indicate new research here. I'm surprised Defcon accepted Marc's CFP for a rehash of vulns that was presented just a year ago.

AriAugust 3, 2012 8:38 PM

@danny

Do you actually live somewhere there is a real risk someone is going to break into your house at night and you need a gun to defend your life? Or do you just have inflated perception of the value of your material possessions?

I an sure there are parts of the world where such measures are needed, but I could not imagine living my life in such constant fear.

DaveAugust 3, 2012 9:26 PM

Having a fire extinguisher in your home increases the risk you will be killed or severely injured in a fire.

Do you actually live somewhere there is a real risk something is going to fail in your house at night and you need a fire extinguisher to defend your life? Or do you just have inflated perception of the value of your material possessions?

I an sure there are parts of the world where such measures are needed, but I could not imagine living my life in such constant fear.

a leap at the wheelAugust 3, 2012 10:59 PM

What is it about the topic of firearms that cause half the commenters here act like their IQ is 20 points lower and they don't know anything about security?

Clive RobinsonAugust 4, 2012 6:34 AM

@ Robert, Wael, C,

Ever hear of electromagnets

Yup they are great right up to the point the power fails, then "Open Sesamy". Unlike mechanical locks they draw power all the time and the reality is they are actualy "never locked" only "held".

Thus the problem with them is "how big is your security perimeter?" do you realy want to have a gun safe where the door falls open each time you need the wall socket for the vacuum cleaner. Likewise when Joe Fatpack puts his JCB digger through the cable in the street outside or any one of another million "what ifs" all the way back to the oil well or coal or uranium mine, or if green when the sun goes in or the breaze stops?

@ Steve Pordon,

You know it's odd but I've known how to do this before any of these supposed "wonderful new technology security systems" were designed and have said as much on the blog for many years (some would say endlessly ;-).

Maybe I should apply to DefCon as "an all expenses paid" speaker ;-)

@ Bruce,

In other words, security is only as strong as the weakest link

Whilst it has a nice ring to it as does,

High tech fails to low tech

The truth is a little more interesting in that the real mode of failure is,

Trying to use intangable information to protect tangible physical objects

It will almost always be a "fail" because their fundemental charecteristics are almost entirely unrelated. Physical objects are comprised of mass/energy and are thus constrained by forces,the speed of light and the resulting laws of physics. Information on the other hand has no physical form other than that we give it to store it and communicate it. Thus we usually encode information onto mass/energy by a process such as modulation.

Traditionaly energy is converted from one form to another by a transducer, thus information that is used to modulate energy can via the use of a transducer be converted to mechanical or other forms of energy (eventually the ultimate form of pollution "heat"). Often transducers are designed to have an "amplifying" effect using feed back processes which again tend to act as modulation systems.

So you end up with a massless energy less information signal being used to control substantial mass or energy. "Amplification" is more usually called "gain" and is usually defined as Gain = Output / Input...

So with the input being effectivly "zero" the amplifcation / gain is likewise effectivly infinite, which makes it very very susceptable to interferance or other external influance.

Thus the weakness in nearly all these systems is the transducer and it is the first place you should look to as either an attacker or defender.

For some reason this fairly obvious issue is either ignored or unknown to most if not all designers of commercialy available security products...

BobAugust 4, 2012 11:06 AM

@Clive Robinson

You can invert the process so that you would need to power your e-magnets to open the door. This model is also used for electromagnetic train breaks.
However, as far as I know this always requires some mechanical parts.

Clive RobinsonAugust 4, 2012 12:51 PM

@ Bob,

You can invert the process...

Yes you can with the likes of spring loaded bolts, which are withdrawn by the magnet (have a look at the internal design of safe door lockers etc to see best how to do it).

However the design needs a bit of care to avoid being "bumped" or suffering from a series of other "physics attacks".

The worst of which is down to "wear and tear" resulting in a cable break that then requires the door etc be drilled and parts maniupulated.

This is where train brakes have the advantage in that there is no reason to make the cable hidden and unaccessable, and unlike a safe door failed brakes have "failed safe".

Usually with safes "failled safe" is considered to be where the door stays locked, except where... people could be trapped in side or their lives in otherwise threatened by the door remaining closed.

Now it can (and has) been argued that a gun safe needs to fail in a mode that still alows the owner to easily access the weapon in an emergancy but not for others to do so at other times. This calls for the safe to be able to differentiate between people on physical differences which is difficult to do even with adults and small children (small children are increadably observant and often smarter than their parents). As a simple rule of thumb the more complex the process the more likely it is to fail...

It is a difficult process and arguably one we still cannot accomplish in anything like a reliable way even when we throw lots of technology at it. You only have to look at the way all bio-metrics fail with both false positives and negatives to realise that we have a very very long way to go.

Oh and the least reliable component in most electronic systems currently is the "battery" for all our recent advances we still cannot store electrical energy in reliable ways for more than a relativly short period (there is currently a race on to develop a lock eenergy system for nuclear waste storage that will provide reliable "unlock" energy for just 100years).

Joe LoughryAugust 4, 2012 1:32 PM

Maybe I should apply to DefCon as "an all expenses paid" speaker ;-)

I'd show up at Defcon just to hear Clive speak. I think quite a few people here would.

bobAugust 4, 2012 2:41 PM

@a leap at the wheel

20 points is generous. "Dave" seems to be comparing living with somewhere that's so dangerous one needs to be armed to living in a modern house, full-stop.

Comparing having heating, fire-places, lighting, cooking facilities, etc in your house with living somewhere where the risk to your life is so high that you're willing to kill anybody who walks into your house isn't just, "you should talk to someone about that", it's verging on insanity.

Dirk PraetAugust 4, 2012 3:32 PM

See also Alec Muffett hacking a top box: https://www.youtube.com/watch?v=Vm01fRQyYbc&feature=related .

@ Tim

Guns don't kill people, bullets kill people.

Although your statement is technically correct, I know of very few instances in which someone was killed by having a bullet thrown at him. It can easily be paraphrased as "it's not the falling that kills you, it's the landing".

On topic, what I don't understand is that in a country as litigious as the US it would be impossible to sue the vendors of said equipment for serious deficiency. The term fig leaf security comes to mind.

gregAugust 5, 2012 5:23 AM

I have always wondered why not just stick to plain old mechanical combination locks like the old school safes have. Sure they can be cheap, but they can be done well.

Clive RobinsonAugust 5, 2012 7:22 AM

@ Greg,

I have always wondered why not just stick to plain old mechanical combination locks like the old school safes have

A very good question... I guess it's not "sexy" any longer and thus not firing up the marketing droids with the passion they need to get out of bed to make "easy money" ;-)

Old safes have their problems mainly because advances in cutting and abrading technology has made them vulnerable. However the design of the locking mechanisms has evolved over three to five hundred years and is an interesting lesson in how to make a design reliable under adverse conditions. The advent of "re-lockers" and other anti tamper devices shows in some cases real inventivnes to actually solve a problem rather than give it a thin (and mainly usless) veneer of techno junk.

For instance do I personaly care if the electronics forces the use of 14 or even 100 digit numbers if a strong magnet placed on the outside of the box has the same effect as the electronics putting a current in the coil of the electro magnet used to pullin the pawl in the drive chain but in a tenth the time...

This is not to say I'm anti-technology, I'm not, I am however anti-idiocy/ignorance in the design stage. Or worse than idiocy the deliberate "gulling" of people who don't realise they are being sold a pile of "That, that promoteth growth and none may abide it" (ie a crock of fresh bovine fertilizer ;-)

Anonymous10August 5, 2012 3:06 PM

It would seem that most safes are useless against professional thieves. Unless, it's bolted to the floor, isn't the easiest method just to steal the whole safe?

Tim KeckAugust 5, 2012 7:14 PM

@Dirk,
My point was that if you lock up the ammunition, you have secured the system, and ammunition is a lot easier to lock up than the entire weapon. While no one has been killed by having a bullet thrown at him, I can imagine a child being killed by clamping a cartridge in a vice and hitting the primer with a hammer. Smart? no, but possible? yes.

Anonymous10August 5, 2012 9:12 PM

@Dirk

To win enough money in a lawsuit to break even on your attorney's fees, you have to prove actual damages in the US. Contrary to media myths, children are more likely to die from drowning than accidental gun shots in the US, so the number of people who could sue in the US is rather small. Further, if someone did sue, the safe manufacturer's obvious defense is that the parents could have forgotten to lock up the gun.

AC2August 6, 2012 1:04 AM

Security product manufacturer denies flaws in security.

NRA recommends introduction of gun safety training from pre-school onwards

More details at 10...


Safer to take out the firing pins and hide? Of course that would frustrate the whole "armed robber breaks in and i need quick access to a working gun" use-case.

SalachAugust 6, 2012 2:05 AM

@Clive
Good locks do not use a solenoid that can be bumped. They use a motor + gear that controls the link between the handle and the bolt, making bumping or external magnets useless.

Of course, the devil is in the details and good locks cost more. When you pay peanuts you get monkies, applicable also to locks...

Dirk PraetAugust 6, 2012 6:32 AM

@ Tim Keck

When I received my gun training, we were taught to secure, and if possible, lock up both always. Personally, I was drilled into a very strict routine in which non-compliance was not an option at the risk of getting booted out of the club immediately. It wouldn't be the first time somebody gets shot by accident because the magazine hasn't been removed or - worse - a bullet was left in the chamber.

Clive RobinsonAugust 6, 2012 8:26 AM

@ Salache

Good locks do not use a solenoid that can be bumped. They use a motor + gear that controls the link between the handle and the bolt, making bumping or external magnets useless

Sadly motors and cams are not an effective solution either. I know of atleast two high security locks that used motors that were vulnerable to a magnet. On because the design was such that you could with patience turn the motor end of the gear train with the magnet, the other effectivly used a spring back latch that was lifted by a motor driven spigot. The latch could be lifted with a strong magnet.

It is actually a very very hard problem to get the gain in the transducer to provide the mechanical linkage in a reliable way and still use batteries with a volume of half the size of a traditional lock mechanism. One design we got to work reliably but was to expensive to produce was a "piezo crystal clutch.

My advice to most people (because they are to far down the design chain) is to still use their solenoid but then work out how to add mechanical interlocks that are held open by a large magnetic field. It's far from perfect but it generaly moves "the weakest link" to some other point in the system. For instance from the attacking perspective replacing the magnet with a "bulk tape eraser" will cause the solenoid to work but not all interlocks. Likewise knowing how to "stroke" the lock with a magnet whilst twisting the handle to get the pawl to hold in the mechanism (just like lock picking) but not the interlock can be done. Another attack works against the "snubber neetwork" on the coil/motor drive circuit, In some simply putting either a large voltage or a sufficiently large reverse voltage on the external "batery replacment" pins will open the lock due to the break down of the driver and snubber semiconductors.

TSAugust 6, 2012 9:19 AM

@Robert
"Ever hear of electromagnets?"

If you can't cut the circuits locally, just get the FBI to cut the power to the building.

"You asked for miracles, Theo, I give you the FBI."

karrdeAugust 6, 2012 10:14 AM

I'm trying to figure out how this is different from the Hotel Door Lock vulnerability post a few days back.

The similarity: both are electrical systems designed to control a mechanical locking system.

The differences: the method of attack. Mostly due to ease of attacker access to hotel door-lock electronics.

karrdeAugust 6, 2012 10:15 AM

@moo, police officers and control of service pistols...

I would hope that the police department would institute training for the families of police officers, to help them deal with access to the pistol.

It's not like they have to build such a program from scratch. There's an organization in the United States that has already designed a child-oriented training system for safely acting in the presence of firearms...

And the Police Department should also be able to find training for wives and older children of Officers from similar groups.

John SchillingAugust 6, 2012 10:42 AM

Page 3: "If you have one of these containers, you should return it and replace it with a real safe that is not simply a box with a lock ..."

Good advice. Might have been actually useful advice if it were linked to, say, a list of the actual unsafe containers, or some practical method of distingushing between secure and insecure gun safes. The way Tobias structures his piece, and the linked articles, I'd have to hunt two layers deep and watch over an hour of video to compile such a list.

Some gun safe manufacturers are selling a false sense of security. Tobias, is selling pure unadulterated fear - "Your children are probably about to shoot each other right now, just like these other cute children I have pictures of, on account of your gun safe isn't safe, and I'm not going to tell you how to make it safe!" I'm certain that will get him plenty of clicks on his articles, for which his advertisers will thank him. But if there is a point to be made about security vulnerabilities stemming from inadequate mechanical back ends to sophisticated electronic systems, I would prefer it be made elsewhere rather than linked to this inadequate journalism.

Clive RobinsonAugust 6, 2012 10:49 AM

@ karrde,

I'm trying to figure out how this is different from the Hotel Door Lock vulnerability post a few days back.

The simple answer is not a lot it's the level you look at the problem. The reality is they are both failures in design they only vary in the actuall specifics of the attack.

This one is a "newtonian" attack just like bumping the pins in a tumbler style lock. All locks currently around are vulnerable to Newtonian attacks in one way or another unless they have had specific modifications to stop it. This includes five lever style locks all youhave to do is work out how to strike the levers correctly which usually means making a specialised "slap tool".

Clive RobinsonAugust 6, 2012 11:20 AM

@

Tobias, is selling pure unadulterated fear

Actually he's not.

The first thing you have to remember is HE IS NOT a normal commentator as he is both legaly qualified and further presents himself as such with expertise in this area (this lays a heavy burden on him that most would chose to avoid).

He is required by his status as "an officer of the court" to provide his advice within the context of the law. He is thus not alowed to promote products or services in the normal way, and if saying a product is defective he clearly has to demonstrate why prior to making the claim. That is as a minimum he has to say "after testing product Y in the following way I found it to be deffective in this manner Z".

Further if you have a look at what an "attractive nuisance" is you will be very surprised by what onus this places on those who are aware of it as the legal culpability is high for what many would consider normal behaviour. Interestingly one parent can sue the other on behalf of the child or any other person may sue the parent on behalf of the child. The parent being sued can adjoin others into the action such as their employers, equipment manufactures etc if they can show they followed correctly the guidence issued by these third parties.

http://en.wikipedia.org/wiki/Attractive_nuisance_doctrine

John SchillingAugust 6, 2012 12:10 PM

@Clive,

"That is as a minimum he has to say 'after testing product Y in the following way I found it to be defective in this manner Z'"

That's what I was looking for. That's what I wanted him to say. A clear and concise list of products and their defects. Defects were discussed at great length, yes. And there was a list of products, though somewhat hard to find. The part where the casual reader could figure out which specific products suffered from which specific defects, that I couldn't readily find. If, as an officer of the court, that's the least he is required to say, how do we go about getting his officer-of-the-court status revoked for failure to perform the minimum duties of the office?

Or possibly officers of the court are allowed to bury inconvenient details like that three or more levels down in a linked structure. Don't care. If he's putting the threats on page one, with vignettes of dead children, and obscuring any useful detail on countermeasures, he's fearmongering. Possibly he's fearmongering in his capacity as an officer of the court.

AC2August 6, 2012 1:06 PM

@John Schilling

You're right! The link to the detailed report is cleverly hidden on the 1st page in the text:

"We are providing a detailed report and analysis of eleven different popular gun safes produced by Stack-On, GunVault, and Bulldog to warn the public of the dangers inherent in some of these products because the manufacturers nor their major retailers will do so"

RogerAugust 6, 2012 4:41 PM

@John Schilling, @AC2, @Clive:
If you dig down into these presentation, you will find links to the formal report, and to Mark's You Tube channel. In both, he gives an explicit list of all the models tested (a dozen or so, from 3 manufacturers, across a range of prices and locking UIs) and a detailed exposition of the several methods of attack against each model.

In most cases, it is frighteningly simple. As in, "insert thin object to somewhere near where the latch should be, and poke around until you push the latch back." In a few cases you first have to peel back a decal or rubber strip to get access to the latch, but this is easily done and it sticks back down again afterward. In several cases, you can just poke it right through the crack around the door.

In some slightly better models there is boltwork rather than a simple, non-deadbolted latch; in those it's a little more fiddly, but still pretty quick and easy.

In the most shocking example, a 3 year old toddler in a romper suit opens a "safe" in under 3 seconds by just jigggling the lock!! Apparently what happens it that the boltwork is restrained only by a pin that is normally retracted by a solenoid. The pin is held forward by a very weak spring, and easily moved by vibration. If the pin happens to move rearward just as the boltwork moves a fraction, the door unlocks.

Amazingly, these locks were all certified by the California DoJ. Apparently "the Real WTF" is the quality of security standards that don't do any real testing against hostile attack. (A small sore point with me, as I just had a heated discussion about a proposed design for a fully-standards compliant "security fence" that offered no barrier to any able-bodied person.)

John SchillingAugust 6, 2012 4:41 PM

@AC2:

Yes, I was aware of that detailed report and analysis, thank you very much. I also read it. Did you?

It described, in terms more sensational than analytical, a number of vulnerabilities. Made generically derogatory comments about the gun-safe industry in general, "This junk is made in China..." and the like. It then listed eleven different models of gun safes. And conspicuously failed to identify which safes suffered from which vulnerabilities.

If I want to know whether, say, a QAS-1000 gun safe can be opened by "bumping", I have to watch a five-minute video that Tobias has buried two links deep from the original article. If I want a list of gun safes that can't be opened by such simple manipulations, that's going to take over an hour of work to extract that from Tobias's "detailed report and analysis". Something any competent writer could convey in a few pages of text and a table or two.

And Tobias is certainly a competent writer. The sob stories and defamatory generalizations that are his actual stock in trade, are well written and presented for their target audience. An audience that shouldn't include any self-respecting security professional or even interested amateur.

TerryAugust 7, 2012 2:26 AM

@Tim Keck,

I can imagine a child being killed by clamping a cartridge in a vice and hitting the primer with a hammer. Smart? no, but possible? yes.

True story: As a 3rd-grader (with a very high IQ) I found a box of ammo and came close to hitting cartridges with a hammer. Thank god I somehow refrained.

Re locking up only your ammo, if a child finds your unloaded and unlocked gun, what might a cop do if the child points that gun at them? Could you live with that? I couldn't.

DamienAugust 7, 2012 2:58 AM

@ Terry
Actually, you are unlikely to be seriously harmed by setting off small-caliber cartridges with a hammer, though of course it is possible. The most likely serious injury would be the hammer rebounding into your face, or a small piece of the casing hitting an eye. The bullet itself will not be moving fast enough to do much arm at all. Even a .50 cartridge set off with a hammer is not particularly deadly, though you are much more likely to lose a finger or two.

anonymouseAugust 7, 2012 12:51 PM

@Doktor Jeep

IANAL--but...

The laws already do prohibit such. It was signed into law by POTUS in 2005. I'll let you find the full text, but there's enough below to make google easy.

Basically, you are required by federal law to have a locking device on any imported gun. It is unlawful to purchase any new firearm in the US without a locking mechanism.

Depending on the state, it may be unlawful to store a firearm in a safe *without* using a trigger or cable lock (e.g. NY), as the state law does not define the safe as an attachable accessory to the firearm that prevents firing.

As usual, the law manages to capture devices and technologies, but fails horribly at qualifying the spirit. I own one of these safes and didn't know about the issue until recently. I *hate* trigger locks and cables -- they prevent storing my pistol in condition 1, and force extra manipulation of the firearm.

Trigger locks in particular are a huge issue in that they tend to necessitate unsafe handling of the firearm near the trigger -- and thus encourage dangerous trigger hygiene. Cable locks are a bit better (they run through the magazine and bolt, preventing chambering), but they're trivially defeated without even power tools -- you just need a $5 pair of heavy wire cutters. Further, most cable locks I've ever received have come with crappy $2 padlock-style locks/keys that are integrated with the cable and can be picked with...well...a paperclip. They aren't even industrial padlock grade, much less something I want to protect a firearm with.

Citation:

18 U.S.C. § 922(z). A “secure gun storage or safety device” is defined in 18 U.S.C. § 921(a)(34) as:
(A) a device that, when installed on a firearm, is designed to prevent the firearm from being operated without first deactivating the device; (B) a device incorporated into the design of the firearm that is designed to prevent the operation of the firearm by anyone not having access to the device; or (C) a safe, gun safe, gun case, lock box, or other device that is designed to be or can be used to store a firearm and that is designed to be unlocked only by means of a key, a combination, or other similar means.

jacobAugust 10, 2012 3:06 PM

My first thoughts would be.
1. Like computers,security systems,etc. If someone gets physical access game over with the right tools.
2. Most of the safes are intended to keep out children not adults really.
3. yes, home invasions do happen, I don't someone is too paranoid to have a firearm for personal protection. A 50cal is overkill. I think a bat, and shotgun are sufficient. A pistol tends to go through walls and too easy to miss in those circumstances. And before someone jumps in I am talking shot not slug shotgun loads. The click alone probably would do it. My fear is no knock warrants, it's not safe for anybody (they should not happen) Get them on the street.
4. People should and most gun owners I know have some nice safes if they have a sizeable collection. They research the safe more carefully than they do buying cars. ;) and some are as big as a car.
5. I sincerely hope most gun owners are responsible but fear they don't spend enough time thinking of safe operation, storage, and why do you have it...

Leave a comment

Allowed HTML: <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre>

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..