Schneier on Security

Clive Robinson • July 31, 2015 6:12 AM

@ Truely Skeptical,

A bit like the latest algorithms which will identify you uniquely from 10 minutes of typing and your unique cadence on the keyboard…. where do the ‘experts’ sit on that one since it defeats VPNs, Tor and the like???

It’s a “lesser fleas” problem.

The solution is to go to the bottom of the computing stack and see at what point the attack vector ocupies and mittigate appropriatly.

The “what you are” signiture identification attacks occure because the computer is transparent below certain frequencies ( ie it’s a TEMPEST type issue).

Thus the solution is control the bandwidth of the input, in this case the keyboard. There are two ways to do this,

1, Buffer the input and then send the buffer not the individual key strokes thus key interval timing is lost.
2, Clock the inputs, so they have no cadence.

The second one does not work well with humans, thus the first is the first step to take. However unless you clock the time the buffer is sent, when it’s sent it will leake cadence information on the last key stroke and fine grained information on the response (thinking) time which is another “what you are” signiture.

The transparancy of the system arises due to a problem I’ve banged on about for years which is “Security -v- Efficiency”.

Put simply the more efficient you make a system the more susceptable it is to time based side channels. In this case it’s made way to wide the bandwidth between input and output, thus the typing cadence is well within it.

In the old multiuser Comand Line days, to get efficience and ease of programing the OS bufered up the input via the “line disipline” to the application, unless the programer jumped through hoops to make it otherwise. C was fine wih this but C++ was not so the OS sends the individual charecters to the OS by default and the bandwidth opened up as well.

Does that answer the question?

Clive Robinson • July 31, 2015 8:52 AM

@ Dirk Praet, Winter,

Many people like to pester the parking guards by displaying their entire collection of dozens, if not hundreds of old tickets together with the new one so they lose a lot of time checking whether or not someone has paid up. It’s beautiful. old tickets together with the new one so they lose a lot of time checking whether or not someone has paid up. It’s beautifu

My favorite “denial of service on bureaucracy” happened in Paris over the “Denver Boot” wheel clamp.

Nearly every time one was put on a car a frenchman would come up and inject “super glue” in the lock.

The results were predictable especialy as there was a time penalty on the contractor. It was reported that a victim of the boot or others would phone friends etc who would then gather, and when the luckless contractor turned up he would face a crowd shouting the countdown at him and criticism on his performance.

If that was not enough they were photographed and rewards offered for their true identity.

Needless to say the number of contractors dwindled as they were not getting paid and their neighbors started avoiding them etc.

The scheme died a few weeks later, obviously the message was received loud and clear.

Then there was “The ring of flaming death” for GATSO cameras where a rubber tyre would be put around them and set on fire to “cook the contents”. When the expensive electronics were moved into cabinets they got the same treatment.

Eventually they got to expensive and whilst not totally removed their use was not just to raise revenue. So another message sent.

And back in the Thatcher era the poll tax riots got the message across in a way even Maggie in her madness could not ignore.