Schneier on Security

Mr. Pragma • May 29, 2014 10:34 AM

Pardon me but with what I perceive as spamming going on here by all the foss/gpl proponents I can't help but to think that maybe they were somehow involved in the current truecrypt "drama".

And I say that knowing perfectly well that this implies a certain communality between foss/gpl and the usa government agencies.

But then it has aroused my suspicion since quite some time now that "democracy" rather than "good engineering" seemed to be the foss/gpl priority and that "democracy" has been (ab)used for many usa agency crimes (like kids being bombed in kindergardens by a "democratic" "government" supported by and put into power by us-american agencies).

Mr. Pragma • May 30, 2014 7:35 AM

Alternative? Replacement? Why? Whatfor?

truecrypt users trusted in tc for years without much more than hardly verifyable promises in their hands. tc 7.1 has been audited (part 1) and found more or less ok. So, actually the situation for tc users has strongly *improved*.

As for 7.2.: Is there some new and vital feature in 7.2? Don't think so.

As far as I'm concerned, the problem of tc users isn't what's currently happening, who is behind it, etc, etc, but the fact that they use windows and truecrypt in the first place.

Another problem that I see in that context is that every other Joe and Jane feel the necessity to have an encrypted volume; quite typically without really understanding what they want and do. And this is not limited to windows, this includes linucks users, too, at least many, many of them. And, sorry, bot No, knowing *how* to configure encrypting disks, containers, whatever, on linucks does not equate to knowing *what* one does and how it works or its potential side effects or potential problems (which can be outside of tech., e.g. legal), risks, etc.

Don't forget: nsa isn't so successful because they have so many eggheads with thick glasses but because so many companies you trust are colluding with nsa and because the vast majority of the victims know -- and care (beyond lip movement) -- about as much about security as cows know about dancing tango.

So we have reason to believe in miracles now (in this small segment of security)? Don't think so.

So just go ahead and make a backup of your tc 7.1 (incl. hashes!) and walk on. Nothing to see here.

Mr. Pragma • May 30, 2014 9:14 AM

Mike the goat (horn equipped)

It's worse.

Security is also to a large degree (as Bruce illustrated so often and well) a theater.
And security, at least for the vast majority, a widely not or misunderstood book with seven seals. Unfortunately shockingly often (to avoid saying "almost always") even the simple steps are not taken, most importantly analysis.

Security is very very different things for, say, a member of a terrorist group, an average company, and a home user.

In most companies, even the basics of security fail to be understood; security to them usually is something to be bought. It's things like access controls (often only in rudimentary form, e.g. locking systems), firewalls, and "security cards or keys".
Their concern typically is two issues: disgruntled or otherwise "evil" employees and competition.

Often such companies shell out considerable amounts of money for (what the feel to be) "security" but at the same time they fail to understand even basics such as having a dedicated "internet box" in their, say r&d department; instead they install some security theater snake oil (AV and a windows "firewall") on the very systems their engineers use to design products with, say autocad inventor; and then the engineers happily surf and email from those very boxes without any worries because, you see, each of the boxes has "security" for 300 us$ on it! How can there be a problem?!
Next they have a "secure" file server. It must be secure because there's a, say, red stripe on it and it cost serious money! Now they happily "back up" their sensitive work to the "secure file server" using cifs/samba. And hell is that file server secure; there's even a security dongle in an usb port. How can there be a problem?!
Last but not least the r&d department has dual doors and an intrusion detection/alarm system. There is even a small rfid box right under the light switch where authorized personel must swipe their "security cards". And the central device to make those "security cards" is only at the secretary of the human resources boss. And only well selected engineers have such a "security card". Oh well, and there are 3 or 4 cards with some outside service providers (e.g. cleaning). Now, if that's not security, then what is?!
Of course, the chief of r&d being a smart and mistrusting fox has a second backup of all important r&d stuff. Just in case. And of course it's encrypted. With "security drives w/encryption" on his windows 8 box. Or maybe he put it in the cloud. So that eventual burglars wouldn't get at it.

And then comes you. Wanting to advise them on security.
Forget it! Symantec has a name. And so has microsoft. And xyz, the company producing and selling the security file server with a red stripe. And who the fuck are you? Can you be trusted? No, better no risk with you. We'd rather buy another *real* security product. Maybe we are lucky and symantec soon offers a cloud security file server with an impressive yellow/black stripe. How much, you say? 12.000? Sounds reasonable. After all security is important to us!

Mr. Pragma • June 2, 2014 3:42 AM

unimportant

Very smartly put!

And that also explains "democracy" which maybe (I don't know, I'm no historian) was meant honestly when it began in Europe and usa. Today, however, it's not really important what or whom people vote for; they virtually always end up with a "central united parties" government, sometimes in one colour, sometimes in another. It's not (at least not anymore) about "we the people set the rules and chose the rulers" but about "we the people are ruled by some faceless organisation that, to keep the theater going on, offers seemingly different versions of itself to chose from".

The north korean leader is, in fact, very useful to the powers to be in that he creates and supports the impression that "evil leaders" are about *full and direct control*. Consequently "our" leaders are not "evil leaders" because we enjoy quite a lot of some kind of freedom.
This, however, could also be arrogance; the arrogance of someone not caring as long he a) has de facto control over the *system* (as opposed to everyone everyday life) and b) can extract whatever his major interest is.

Looking at the last decades strongly suggests that that major interest is money, which is a smart choice insofar as money again helps to create and keep more power. Looking at the evolution in virtually all western countries one factor strikes the eye: The richer get ever more rich while the rest gets poorer.

Someone here who is always blindly defending the usa system (and in fact even his nick would be a typical choice for someone in psyop) said something about IP theft costing the us economy some 300 bln$ per year. This is actually closely related to my point here.

Over vast periods of its history in virtually every system the majority of people worked physically, the economy was largely based on goods, and money was closely linked to some physical goods like gold.
This has changed dramatically in a quite short period of time -- in the western imperium that is.
There increasingly many people work in the services sector, an increasingly large part of the economies are linked to quite few huge corporations, and, probably most importantly, the very term "value" has shifted, first to not physical goods related currencies, and later to basically fictitious units - at the same time the term "value" in its more general meanings has changed, too. A products value is more and more to do with intangible and sometimes even nonsensical factors like coolness, brandname, and the like.
And the workload has shifted. The more tangible and physical some work is the more of it is "outsourced" to poorer countries while the richer countries are more and more into services (often also provided from people from poorer countries) and in the last decades into know-how.

When the usa is complaining about billions in losses in IP then that's the lamenting of an arrogant, lazy, rich king whose income is more and more based on owning rights and largely abstracted knowledge and who lets other people elsewhere get "dirty hands" from actually working.

Now the funny part is that, of course, that king will finally be -- and already is -- acting the same way towards his own people. While those, of course, do not like that (-> occupy) they have been led into a rather helpless situation against an opponent who holds pretty much all aces. An experience many people in many countries can tell about ...

Will that king tolerate encryption? Well, why not. Given that some conditions are met, most importantly the one that he and his courtlings, obedient players, and enforcers have the best encryption systems of all; to be able to listen in to the common people is desirable but not necessary because there after all many other ways to subdue them again if needed at all.

Of course, the kings plans will finally be spoiled and he will finally come to an unpleasant end (as we are beginning to see now).