Schneier on Security

Clive Robinson • June 22, 2018 2:22 PM

@ Bruce,

It’s interesting that the analysis doesn’t really center around the security properties of Telegram, but more around its ubiquity as a messaging platform in the country.

The actual security of Telegram –which is weak anyway– is mainly irrelevant to the users, it’s the perception of securiry real or otherwise that more or less defines the usage.

For years Microsoft and others used ROT13 to hide information from view along with “:” colon extensions to create hidden files. Prior to that “Ctrl Z” to give false file endings in MS .txt files used by edit. None were in anyway secure but the perception and actual result were the opposit.

The fact is that few take on the fact that the –supppsadly– secure messaging apps mark a user as a “Person of Interest” irrespective of the actual use to which they put it. On this score not even WhatsApp has sufficient users to make it “ubiquitous in use” thus usless as an identifier.

Even in the US prosecuters are using the fact that a secure communications application of any kind can be construed as at the least suspicious if not a signe of criminal intent or actual criminal activity without offering any evidence of content let alone use. Thus you have to ask what we view as “represive regimes” might regard as sufficient to sanction some form of action?

My advise is not to use such “privacy” applications at all, but use external “One Time” codes/phrases in what appears plaintext for “secret communications” of importance, along with other OpSec techniques from times past that have been carefully modernized.

Yes I know good OpSec is a hassle but if you want to preserve your freedoms, liberty and life, you have to ask “Would you use anything less?”.

Clive Robinson • June 22, 2018 6:32 PM

@ bob,

The first scenario raises the standard, the second does not. I believe, in the long run, the second strategy is determined to fail at preserving your freedoms, liberty and life.

But as I have noted on this thread and several previously there are other scenarios so it is possible to preserve your freedoms, liberty and life, without using an application or physical technology of any privacy / security level at all, let alone one that raises some standard. And importantly do it without raising the suspicion of an observer hostile or otherwise. Which in turn means the question of legality does not arise nor does the near imposability of growing a security based mass market product sufficiently to give cover. You simply use what those who have already grown a mass market give you by way of communications in a standard OS distribution.

As I’ve noted before, it’s impossible for adversaries to back door such systems, which is why “golden XXX” initiatives are a bust before they even pass the legislation.

Clive Robinson • June 23, 2018 3:19 AM

@ Bob,

I think i dont understand at all what you said…
…To me, it is an example of what i refer to with “the second”.

It was your use of the word “tool”, to most people tool is an object you use rather than something you do which would be a method.

Thus a pen is a tool and the method that uses it would be writting or drawing.

I assumed by tool you ment an object such as a physical device such as a token or an information device such as a piece of software.

To me the difference is important. A physical token or piece of software would be verifiably in your possession, thus can be used as direct or indirect evidence against you. Where as sonething you could do entirely in your head can not be used indirectly as evidence and only directly if your are caught/observed in the act in a provable manner which can not happen with a well designed One Time code/phrase.

If you want to know why the distinction is important you need to look at the history of evidence and Dr. Edmond Locard’s “Exchange Principle”, it’s in effect the “Forensic foundation/touch stone” as it in effect defines “trace evidence” which is factual and may or may not be circumstantial evidence or even irrelevant, but still “Prima facie Evidence” that will stand unless rebutted,

https://en.m.wikipedia.org/wiki/Locard%27s_exchange_principle

The point is once you are aware of it you can reduce prima facie evidences quality to something that is an irrelevance or easily rebutted.

For instance, lets assume you can not do something entirely in your head and need to do “rough working out” with pencil and paper. The exchange principle holds that the paper will leave contact evidence on the pencil, but this proves little other than the pencil was used. However the pencil leaves a clear impression on the paper which could be quite significant to a prosecution. The easy solution is to burn the paper to ash and then break up the ashes, thus the significance is reduced to at best supposition that can be rebutted if the ash is ever found and connected. However what few people realise is that the majority of surfaces are sufficiently soft to hold an impression and those that are sufficiently hard can hold a static image by electrical charge patterns (see ESDA tests). The solution to this is to put individual sheets of paper on a glass surface, and when finished wipe the glass down with a soft cloth, then destroy the sheets of paper. In effect the use of the cloth turns the static image into randomized thus usless noise.

It is this reason why desks in the likes of Commcens / crypto cells / SCIFs etc frequently have glass tops.