Schneier on Security

Clive Robinson • February 28, 2017 8:33 AM

@ Ion,

So they are right to enforce Authoritarianism

All legislation can and will be viewed by some people as “Authoritarian”, that is the nature of the human race, even excluding those with sociopathic traits and similar.

However legislation can be viewed as a way of encoding societal norms such as “Though shall not kill” etc.

Citizens in general accept legislation they can see as being for the common good, and some will protest laws they see as unjust or against the common good.

Various EU countries having been in what quite a few would regard as authoritarian control as part of the CCCP have seen where a lack of privacy leads to and thus are against any plans to reduce or remove privacy.

There is little evidence that a masive intrusion into privacy –that the US and UK want– will achieve anything other than increases in authoritarian behavioir from Politicos and their paymasters… And many are keen to avoid such intrusion.

In the EU various pieces of new US legislation are seen as being not just undesirable, but actively designed to turn service / OS / App supliers into the instruments for “collect it all” US IC. Worse is the Cloud fetish, the US IC agency actively attacking the likes of Googles backend site to site communications has woken many upto the idea that any data in the cloud is openly available to the Five Eyes and similar to their potential harm. Hence they do not want the “Instrumentation” of their privacy by anybody at any time.

They view it as equivalent to “Big Brother overlooking the bedroom, toilet and other private places in their homes, especially as they know they will be “rated” by such intrusion.

For some reason unknown to those living outside the US, US citizens in general appear to be lacking in basic understanding of what privacy is and why it is essential to society. Some put it down to the propaganda of the US Government and the outrageous behaviour of the political parties and their plutocracy backers, others that the average US Citizen has been brain washed.

Clive Robinson • February 28, 2017 5:17 PM

@ Ergo Sum,

In my view, it isn’t the [National SigInt] agencies that collect most data, even if they do their share. It’s companies like Apple Google, Microsoft, etc., who do the collection most of the times…

It depends on “who the target is” to some extent. It is possible to use the Internet and avoid using the “snoopware” of the US Big Five Corps. Thus the national SigInt agencies have to still Vampire the major arteries to get at the life blood of those who chose not to play in the Corporate tar pits.

The problem for the SigInt agencies is “crypto workload” even quite poor security products and protocols put quite a few rocks in the way and thus eats resources. In the past the US SigInt agency –and I assume other national SigInt agencies likewise– exploited the corporate “private leased line” backhauls between data centers thus getting past the Internet link encryption security end point.

People need to keep this in mind when they think about their security. If the SigInt agencies can not get beyond the “security end point” at the corporate end, then they are going to use other techniques… Starting with least effort stuff such as MITM attacks with faux certificates and getting beyond the security end point at the client end. If that fails then traditionally they would look to exploit weaknesses in Standards, Protocols and Implementations.

However the new game of corporates making money through “collecting PII for commerce” is a target rich environment for SigInt agencies and they will get access one way or another be it overt or covert. The SigInt agencies would prefer fully covert but will go with what they can get, especially if a big chunk of the “analytics work” has already been done for them[1] by the Corps.

Thus as an individual you need to consider how you keep your PII and thoughts Private. Obviously you need to work well beyond the security end points, further than a SigInt agency can reach. Also avoid, where possible, any comms system that has a hub beyond your control, thus P2P is preferable to client-server etc etc.

As was noted in another thread the other day, Osama Bin Laden used an ordinary computer with communications by trusted couriers carrying USB Thumb/Memory drives. The computer was of sufficient age that it did not have built in WiFi and other comms beyond an ordinary users control. Thus it was beyond the SigInt agencies reach.

[1] There is a problem with using such processed results. As you go from raw data to processed data you loose information and you add assumptions. That is the analytics lenses are filters and colour the results and it is unlikely that the analytic filters of a large corporate are going to align with those of a SigInt agency. Thus even though processed the data is of less direct use to the SigInt agencies than the raw bulk data. Worse for the data subjects is that the SigInt agencies “kill people by metadata” and corporate data is directed at maximizing revenue thus tends to be speculative not definitive. Do you realy want some one to decide you are probably Muslim because you buy a lot of beard grooming products, then have a SigInt agency work on that assumption as though true?

Clive Robinson • March 4, 2017 12:45 AM

@ Gweihir,

… you are spot on, especially in your first and second comment.

Thank you, for saying so.

Clive Robinson • March 7, 2017 4:43 AM

@ a b praeceptis,

I’ve just seen your comment, I must have missed it in the 100 last comments for some reason (probably another deluge of unsoliceted advertising).

With regards,

I respectfully disagree. This blog has gone into a downward spiral not for lack of things going on on the technical side but…

The downward spiral started quite a while before that, Bruce even went “clickbaity” for a while as an experiment prior to the tolerance, then alowance of the political comments. Thus they appear almost as a concequence of the decline, not the cause. Almost as though it’s another experiment, or way to increase the numbers.

I suspect however it might be that Bruce has less time on his hands these days thus other “irons in the fire” get a greater priority.

As for “Krebs”, I was refering to the type of blog it was with regards the way readers could post comments and that one or two regulars hear used to post there, not the type or quality of the posts.

With regards “Email” I stopped doing personal email some time ago as others hear know. There were some personal security reasons why I stopped, but in all honesty it was taking to much time for to little return. As for social networking I saw what a tarpit that was so never bothered with it. Now as standup comedians are now devoting entire acts to taking a rise out of social media, it looks like it has started on a downwards spiral of it’s own.

I’ve been asked in the past why I never set up my own blog, when blogging was the thing. The reason then as now is the workload involved with finding analysing and presenting high quality comments that people would want to build a community around. But there was also the “crowd issue” I’ve never liked the idea of making people register to say something. I do enough “drive by commenting” that I would have to have an unmanagable number of credentials and other information to carry around which in it’s self entails unacceptable risk, due to the majority of people not understanding certain basic problems[1]. The other thing I like about “public commenting” is the third party eye of the audience it tends to not just civilse comments it actually encorages more thoughtful comments in those who want to be a part of a community. However there is a down side, crowds are not communities, and there are always “crowd elements” that are sociopathic in various ways, be it by trying to advertise, or abuse in one way or another. Cleaning up such behaviour is a thankless task at the best of times and due to the time taken gets in the way of other things that might be a more productive use of time.

So Bruce has both my thanks and sympathies for building and maintaining his blog, few say thanks which is a shame.

[1] Put simply there is no way to tie people in a physical way to an information based identity thus digital authentication of a person is nothing of the sort. Thus when people get text messages on phones that says it’s from their mate “Fred” they don’t question if it’s Fred or a Policeman etc who has taken Fred’s phone that is actually typing in the text message they read (which has happened in the UK and caused problems in court). Thus if people know there is no “authentication” on a site, they are going to hopefully judge more by the style and content of the comment than any handle that might be used.