Schneier on Security

Skeptical • October 21, 2015 5:56 PM

Interesting thread…

On Linux, while I must express my usual disclaimer of complete technical ignorance, there are a number of options that work well as desktop systems and anyone thinking about beginning to use a Linux system may as well give several a try. I’d purpose a non-essential laptop, about which you have little care as to its eventual fate, to use as an experimental workbench, or you can use virtualization software on a system you care more about.

If you grew up on a commercial GUI oriented OS, then perhaps walking through the process of installing LFS or Arch and the initial packages necessary to have a working system with a functioning X11, graphical login, and windows manager or desktop environment would be educational and useful. You’ll find that there are many – perhaps too many – options. At a minimum though, you’ll find yourself with a sense of the landscape after a week or two. If you’re very comfortable building from source (and somehow escaped any familiarity with Linux at all while acquiring such comfort), then Gentoo may be a profitable option here as well.

Otherwise the major differences between distros suited to desktop systems lie largely in the ease, extent, and means by which, non open source software is made available and how promptly (and automatically) updates are provided, how actively the distro is developed, between emphases on one desktop environment or another, and of course in the nature of the packaging software that lies at the trunks of the major distros (e.g. rpm vs deb).

Depending on the use case and with significant exceptions, in my wholly ignorant opinion, a Linux distro will not necessarily hold much security advantage over a maintained Windows system with a reasonably intelligent operator behind the keyboard.

For many, the bottom line is that certain Windows software is simply essential to communicating effectively and to getting work done. And, despite my misgivings about where Microsoft may be headed from a user-privacy vantage (though I believe this is more up in the air than some here have opined), there actually is a lot to like about Windows and Windows development. I’m even considering giving up my punch cards and adopting it.

As to other options, such as Qubes… my ignorance here is even more profound than wrt other topics, and so I have little to say other than that the developers appear well motivated, committed, and sophisticated – all judgments I am in no way qualified to make and for which I lack anything approaching sufficient evidence. But the use-case for Qubes is in part as a replacement for physically separated systems, and for one to buy into it as such a replacement, one must have a very high degree of confidence in its use of virtualization to achieve isolation of processes from one another. Since I am unable to assess the arguments of the developers for the soundness of their concepts, other than noting that they seem sound if one accepts certain assumptions – and my inability is meaningless – I await testing/reviews from external organizations.

From a convenience vantage, on any well powered system Qubes is quite slick and easy to operate. And if you know more about virtualization and the ability to achieve isolation between machine instances running on top of Xen than I do – a claim which any of my three German Shepherds could probably signal with fair credibility – then you may find it equally impressive from a security vantage.

Of course, there are always Robert Morris’s three rules of security that obviate all of the above.

I should also mention that none of the above will be of much help if you are engaged in any criminal enterprise which has attracted the attention of law enforcement. Take some of the brightest minds and most experienced researchers in the applicable fields, add the strong motivation of helping shut down an operation that is harming others, and mix the ingredients of Western government support, and the half-life of the security of any system accelerates appreciably.

And as to Wikileaks posting the personal information of Brennan – the organization seems to be little changed from the one which, if I recall correctly, at one point harvested user content from an exit node it operated (I may of course be mistaken). That is to say, it is an organization which continues to fall significantly short of reasonable standards of ethics and honor. Its actual conduct makes a mockery of anything laudable in its claimed aspirations.

Skeptical • October 21, 2015 8:14 PM

@Miguel: I find, here, Skeptical’s insistence that anyone is engaged in Bad Things from these angles as very amusing.

I did not insist on anything of the sort. Instead I noted the irrelevance of the discussion to any who might be engaged in such enterprises. We seem to agree on this point, given your later remarks about obscurity, which might make your amusement the source of bemusement to some.

The only real news issue with wikileaks and the “cia hack” is, yet again, a demonstration of the horrible job performed by US intel leaders. Wikileaks is absolutely inconsequential to the story. Blamining Wikileaks is the work of those who already do not understand how computers work at a fundamental level. If it were released via pastebin, no one would be making the ‘medium the message’.

Ah yes, the fallacy of “the story”, as though there is only one aspect of a series of events that we should focus upon. Whether the widespread adoption of this fallacy derives from the infection of our minds with concepts of public relations or from simple carelessness is an interesting question.

There are at least several aspects to “the story.” There is Brennan’s use of the account to save old drafts of documents dating several years ago (presumably forgotten); there is the manner in which the account was able to be (repeatedly, allegedly) compromised; there is the decision of Wikileaks, having come into possession of emails taken from the compromised account, to publish them.

As with Snowden, as with OPM, as with the failure of the intelligence regarding WMD in Iraq – as with so very much – yet, again, we see just how un-intelligent America’s intelligence infrastructure truly is.

You’ve managed to take 4 remarkably different episodes spanning over at least 13 years and coalesce them into a judgment of the capabilities of what must be one the largest and most well-funded collection of intelligence agencies on the planet.

But if you say so…

Skeptical • October 23, 2015 8:10 PM

@Galt: these are the kinds of numbers you get when you ask, “how device state trajectories would have to be checked to find all of the possible triggers for undocumented features?”

Indeed, I think the practical impossibility of checking every possible state of a particular electronic device forms part of NASA’s criteria for what constitutes a complex electronic device.

But perhaps a kind of modularity and testing at the build level would enable one to handle giant branches closer to their root?

@Gerard: Wikileaks has made itself into one aspect of the story by publishing highly personal details that most reputable outlets would avoid. But of course that’s in part how Wikileaks raises money. If it doesn’t garner public attention, it withers; and to garner public attention, it must either have some truly scandalous material (nothing I’ve read about in Brennan’s AOL account remotely qualifies), or it must act at least somewhat outrageously.

But, the better media outlets have certainly focused on the question of what Brennan had on his account, whether it proper, the gravity of the mistake, what it says about the conduct of public officials generally, etc etc etc.

@Dirk: In which case you are the only non-technical person I know who has actually heared about stuff like Qubes and Xen whilst also knowing the difference between .rpm and .deb packaging systems 😎 Either you’ve been paying some serious attention to some of the discussions here, or you’ve taken some kind of management class on this topic.

A little learning is a dangerous thing – I have the good fortune here to know enough that I know quite little. I’ll make an analogy to international relations, which pops up here often enough. It’s a subject easy to talk about, but one deceptively difficult to understand without absorbing some of the basic literature, understanding contemporary methodological debates and arguments about the best overall framework in which to understand a given set of phenomena, etc.

Folks show up here all the time with completely absurd narratives about how governments work or what’s “really” going on somewhere – they have just enough facts (or what they suppose to be, anyway), and just too little background knowledge to assess whether the theory weaving those facts together is plausible.

So while I may enjoy certain technical subjects, I try to avoid fooling myself into thinking that I know more than I do and I’ll certainly avoid giving anyone else the impression that I do. I am quite ignorant of many things the names of which I glimpse here and there, on dimly lit signs in the night as I pass through.

Re: the perennial Linux vs Windows security comparison:

Depends on the distribution you go with.

I’d even hazard to say that it depends period. What functionality do you need? Are you going to configure, or adopt a suitable, SElinux policy? How “safe” are you – and can you be – while operating the system? How well do you know Windows, its weaknesses, and how to protect them (e.g. EMET)? How well do you know Linux? Is physical security of the device achievable against threats against which you wish to prepare?

Although a stock Fedora or OpenSuSE installation has quite an attack surface, from a security angle I will still prefer them over a vanilla Windows installation. And with the exception of Ubuntu, I’ll prefer any Debian-based distro over Red Hat/SuSE. Which in their turn I will discard for a well-installed and configured BSD system. And we can go on.

The advantage of the enterprise versions of Red Hat and SuSE is the support – a naive user can get expert level help with configuration. So if money were no object, I don’t think I’d be indifferent. I can get an extremely well configured system should I use them. As to the BSDs… the things that I understand about them, at a very superficial level, have been largely adopted by other OSes, no? Or is it a trust in the process and approach of a project like OpenBSD that inclines you, rather than particular design attributes or features? I certainly admire and like what I hear about those projects, and hope they continue. But outside of special use cases related to licensing, I wonder how much of a decision to use a BSD comes down to taste.

In my experience, the average Windows/OS X user has no clue whatsoever how to improve security on his/her machine, and which in essence even goes for the average desktop technician and company IT guy too. And even though both MSFT and Apple have significantly improved default security over the years, a privacy-conscious person has no reason whatsoever to go anywhere near known data miners and PRISM associates.

Which raises an interesting question that others here are far, far better able to answer than I am: how much does that user need to know in order to improve security? Stacks, heaps, overflows, security tokens and security contexts, privilege rings? Or perhaps all the average user needs to know is a small set of practices and concepts highly abstracted from the seemingly endless dimensional extensions of technical turtles, entangled in a quantum sense with God knows what other stacks of species which frequent metaphors and urban myths. Really – who has the time for all those turtles, unless you truly enjoy soup or the view or study these things professionally in some aspect?

Actually, no. This is a myth about as persistent as Macs not being vulnerable to viruses and malware. Admittedly, there is a serious learning curve when transitioning from Windows/OS X to Linux, but after a while you will find that you don’t need either for personal, regular day-to-day communications and average computer usage but for convenience purposes. For work, it’s a different thing.

Yes, but most of us would include work as part of regular day-to-day communications and computer use.

Which is why I maintain a strict separation between “work” and private machines/VM’s.

Sure – always a good idea in general, even at less sophisticated levels than virtualization.

And as to Wikileaks posting the personal information of Brennan …

It’s what they do. We may question their motives and MO, but the matter of the fact remains that Mr. Brennan is in clear violation of security policies an ordinary employee or contracter gets sacked for and loses his security clearances over.

Maybe – it depends in part on what was in those drafts and when he wrote them. More importantly, it’s entirely possible to report that aspect of the story without dumping his emails and partially completed SF86 on to your servers for everyone to peruse.

I think transparency of policy – and just as vitally, and far more difficult to achieve, understanding of policy – is vital to a functional democracy. And I believe that a free press is essential to that enterprise; and I think that whistleblowers are an important protection against corruption and abuse.

But Wikileaks just goes so far beyond any of those things as to make me seriously question whether their values are anything more than a moldy mix of half-baked anarchism, outdated pop-neocolonialist theories of the world, anti-Americanism that receives funding from one of the most authoritarian governments on the planet, and sheer ego.

I’m sure for Wikileaks Brennan represents some kind of awful, evil figure. In reality he’s an individual in the public service of a legitimate democracy with robust protections for individual rights, who is not corrupt, and who has not broken any laws. There are reasonable arguments against the counterterrorist strategy Brennan backs; but there are also very reasonable arguments for it. And let’s be clear: in the real world, i.e. the world of practical possibilities, the alternatives to targeted aerial strikes are bloodier and far more complicated.

Once upon a time I might have said – this small footprint approach is simply political gamesmanship pretending to be effective policy, and the price is counted in billions of dollars of resources and numerous lives injured, wounded, and destroyed, pointlessly, in the service of small wars that merely manage and never resolve the core problems. [NB – I know better today].

But in a democracy you don’t always get your favored policy. Once you’ve lost the ability to understand the perspective of those with whom you disagree, once you rationalize treating them and their private information far outside the norms of any reasonable ethics, then you’re no longer an authentic democratic participant. You’re someone who puts up with democracy because you must, and you treat all your opponents accordingly. In which case, when you act like what you’ve become, and I see it, then I will find it offensive.

I obviously have no problem discussing Brennan. But I don’t think Wikileaks should get a pass here either.