Schneier on Security

Douglas Coulter • September 28, 2017 4:11 PM

I’d known about this for some time, or at least something like it.
If you have a website as I do, hosted elsewhere, like most websites, the info they give you in reports tells you where people came from.
This is just the flip side of the same thing…not that it’s a good thing, but it should have been obvious that it existed/exists for quite a long time.

For ages, if I cared (say I was doing something financial) I would, without exception, use a fresh blank tab or window for that, and only that, closing it and not reusing it when done. Basic computer sanitation IMO. Just like “don’t click on random stuff or open things you don’t know the trust chain of” basic.

Yeah, like 10,000 (at least) other snoopy things – from super cookies to (OMG if I start a list it’ll be too long for the readers…) hidden invisible GIFs or whatever – this is bad. But also pretty predictable and expected.

Cui Bono and “you’re the product” should have alerted anyone who cares about opsec – and motivated more people to learn about it.

As it is, people think crypto or a VPN actually hide anything. Hint – your ISP has all the metadata that’ll ever be needed to convict you – right or wrong – of anything, regardless. And recently, they won a law that lets them sell what they know about you. Pretty hard to use a different coffee shop every time you need the web, especially where I live (the nearest one is a 45 min drive).

If you’ve got a secret, talk as much as usual – or more, but about something else, preferably boring. Lyndon Johnson used this to keep the press at bay, the technique works.

Douglas Coulter • September 30, 2017 5:48 PM

@Jim C – I agree in principle, but it’s also obvious that if it can be done, and there’s money in it, it’s gonna be done. If a site can run script in your browser it can record and send back any user action that’s in the API for that script language.

My eyes really got opened when I had a house guest who’d worked in the big data biz. She demonstrated what they can do if you simply visit a site she’d prepared as a template for sale to those slurper types of customers. They don’t miss much.
If they’ve got money/resources, as has been discussed here plenty, all manner of de-anonymization or outright buying of data on you can also be added in. If it isn’t already hacked and out there free, that is (Experian, Deloite, and others come to mind).
You’d have to be lucky to keep the color of your undies a secret these days.
She was able to find out my bio better than my own memory in not very long, from just visiting a site. Where has that MAC been and when?

Wonder how long it’ll take to get that cross referenced with security clearances from OPM and various porn and other leaks etc to find out who is best to blackmail? Already?

@ throwaway
The ISP sees every single bit you send – yes, some might be encrypted. But then then your packets have to have a destination address, don’t they.
So they know how much, when, and where the next landing was. Someone with resources and access to the next hop can continue the trace. The long arm of the alphabet agencies is, um, long. If they want you, they got’cha. As has been demonstrated a ton of times, crypto isn’t a magic secret sauce, there are flaws in implementations, opsec, and some has probably been cracked and not reported by the crackers who stand to gain more as things stand.

What amuses me as an early author of what we thought of as some really good audio editing code you could use to create fake vocal audio so good god couldn’t tell it was fake – is that now the same thing exists for video too. So they actually don’t need those pics of your pedophile activities anymore (for example, just pick something everyone hates) – they can just make them up and put them on “your” machine or other storage device.
This should of course render all audio and video evidence inadmissible, as anyone with resources can create anything whatever. Bu the law was always about just-us and those with resources generally win, right or wrong (and I’m speaking as one who has been on the winning side of that one). For stills, there was some development of a “photoshop detector” as well – so all the “bad guy” needs is a copy so he can adjust his technique till his fakes pass…just a matter of willingness to expend the effort.

Traffic analysis, metadata, is all that’s really needed, and by golly it’s already like sipping from a fire hose. So your ISP, even with a VPN, reveals plenty.

Example from “Hunt for Red October” is telling, old, and there’s more to it than that, but my fingers would get tired with more:

Listening to the Russian fleet, there’s the usual jabber, some encrypted, as always – guys talking about operations so ships don’t collide, who needs fuel, who is gonna get laid at port, and so on.

An encrypted message comes along, probably from a shore source.

The entire fleet goes quiet, and every power plant starts burning full power, as seen by satellite.

You think any analyst worth the name would not know immediately that something unusual was up in that case, and start looking hard instead of going back to the coffee and doughnuts?

Your comm probably isn’t as dramatic as that, and yes, it’s by far easier to look backwards in time after some event has occurred and see what traffic might have led up to it. This of course also ensures that your innocent traffic, which stands out like a red flag to a bull, will be closely examined anytime something exciting happens (terrorism) also.
This reduces vastly the effort required as now only a few suspect messages need to be ‘cracked’ perhaps, and that takes fewer resources. This is perhaps why in an interview with Snowden by Bruce that as soon as Snowden started to mention “at scale” the subject got changed very fast.