Schneier on Security

Clive Robinson • March 16, 2017 6:27 PM

@ The usuall suspect’s,

At last a paper to give some very serious thought to.

@ Thoth,

Use separate devices to handle separate levels of security which myself, @Clive Robinson, @Nick P et. al. have long been hammering

This paper apprars to be one that has relevance to the C-v-P design so I shall have to realy dig in more than the paper does.

It will be interesting to see what @Wael will make of it as he had an interest in such things.

Clive Robinson • March 17, 2017 5:37 AM

@ Thoth,

I have warned about this but it has fallen on deaf ears.

You and me both, I first started going on about this need for seperation back in the 1990’s with banking that was moving online. It was horribly clear to me that “authenticating the user” was trivialy defeatable, then “authenticating the channel” was only slightly harder to defeat and that a sepetate –now called side– channel was required. In the foolishness of comparative youth, I decided that the SMS channel of a mobile phone was the way to go. I should note that this was more than half a decade befor getting what would become known as “mobile data” was got working even for “rocket scientists” or a decade and some before the first Smart Phone happened. When I saw which way that was going I changed my tune about mobile phones and went to independent tokens that had shared secret. After a few more trips, I realised just what level of token was required and how it had to be used. You had to put the human into the loop to prevent covert channels and the end point had to be beyond this and every transaction had to be authenticated this way. The problem humans are on average no good at typing random appearing data, and will not do the 128charecters necessary without error, therefor it would not “be usable”. With a few side trips via a tealy bad captcher idea, I realised users could not evaluate even non abstract risk even close to realisticaly.

The message “Ease of use will trump risk even that of bankruptcy and death every time” with 99.999% of users.

You will also find that there is “half house backlash” caused by two other human failings. That is people will recomend “Signal” or other “end-runnable” security trying to be helpfull, and those that will get hurt by it will lashback at all people talking what they will call “security trash”. Thus all will be tared with the brush of “half assed security” that Signal and Tor are.

As you say,

Go ahead and continue to keep calm and use Signal while “they” happily decrypt all your “secure” messages.

It’s not just the “key stealing” on the device or man in the middle server, it’s the endrun attacks with shims in the IO so they see what the user types before it gets to an app like Signal and likewise they will see what comes from an app like Signal effectivly before the user sees it displayed.

With such shims we know from malware attacks on banking apps that they can change what you type and change what you see. So they are a MITM on the “plaintext channel” from the app like signal to the user. That is a game over senario no matter how good the app may be.

No if’s, no but’s and no maybe’s, the only question is When and Why you will get made an example of. The most likely Why is because will be seen as a threat with the When an appropriate oportune moment to do the most damage. But there are other Why’s such that you are “a useful fool to frame” we see the FBI doing this already with their making then entraping faux terrorists, so that they can have a public show to keep the FUD going.

Why more people are not “joining the dots” is what surprises me. It’s something even our host appears to not want to think about.

There is a small matrix of things you can do one of which is “see nothing, say nothing thus do nothing” which might or might not lead as it has to chronic depression. Another is to go into total denial and change what you do in life. Others are to get strident or even take direct action of some form. None of which I would recommend, thus for sake of sanity and to be lawfull, just plainly and unemotionaly state the case and eventually others will by their and others misfortune get forced out of their denial zones. We are starting to see this with Tor we will see it with apps like Signal, and eventually increasing numbers of users will realise they have to change their habbits and shift the security end points beyond the SigInt and other IC Agencies grasp.

How ever as it approaches that point, there will be the usual security con artists getting into the game with their half arsed and insecure patent medicine snake oil solutions. That will be when the real fight starts.

Hopefull more than just you will read these words and take it onboard and learn what they need to know. However I can predict that there will be disagrement from some of those who don’t want people to learn for what boils down to their own personal gain…

For those who still don’t get the problem look up the sword of Damocles. In essence the bargin was he had to sit under a sword suspended by a human hair. Now imagine some enterprising smith comes along and says you need something stronger and presents a hugh unbreakable link to put in between the hair and the sword… It will achive less than nothing, that is what Signal and similar apps are a heavy weight to make the dangerous load not just heavier but more noticable…

Clive Robinson • March 17, 2017 6:18 AM

@ furloin,

I beseech thee, is it legal for me to read this treasure trove and speak of it?

It is a published academic document, thus has been put into the public domain in the interests of the common good.

As far as I am aware it is not derived from classified information, nor am I aware that it has been classified.

Nor do I think the information breaches criminal codes in the west.

As for civil legislation, you would have to have entered into some kind of contract with people for that to apply. And for a contract to be in existance and enforceable something has to be offered for something to have been gained without force in both directions.

So unless you have been bound by contract of employment or NDA by you or your employer then probably “it is legal for [you] to read this treasure trove and speak of it”.