Schneier on Security

Clive Robinson • July 6, 2018 4:41 AM

@ GregW,

Do protocol designers ever consider that longer-than-youd-think lifespan issue/cost when trading off security?

In general no, because in most cases in the past the networks have rarely been considered “public access”, thus privacy / security has not been even thought of as an issue. Which is why in most cases it has not been on the product specification thus the design spec from day zero.

The real reason for this is gross short sightedness by Government Agencies, where it has almost always been the assumption by the “authorities” like the FCC that they could “legislate thus regulate equipment”. So keeping “air interface equipment” of receivers / transmitters and even coaxial connectors out of the hands of the public by the stroke of a pen… The joke of that has always been test equipment available to not just designers but test engineers, which followed the usuall electronics market trend of “droppibg in price with demand” and technology improvments. Such equipment almost always became “second hand” thus available to “joe public” some of whom had hobbies that required test equipment by the same stroke of the authorities pen…

For various other reasons the government authorities and agencies have almost always been a long way behind the curve of technology. Which is why “in the war” between the FBI and Serious Organised Crime, it was the criminals “bugging the FBI” not the other way around[1].

But the move of production from national to international markets chucked the first of manny spanners into that thinking back in the 1950s. As different nations have different views about which frequencies etc could be used[2] manufacturers designed to cover all bands then put simple band “lock outs” for each band a nation had issues with on the user interface, not the air interface.

This used to be by “hook across” wires or cutting diodes, both of which could easily be reversed as I did with Ham Radio equipment back in the early 1980s. The advent of microprocessors actually made things a little harder but again links on the PCB could generally be found by “poke-n-prod” testing or getting hold of copies of the factory service manuals. So with the advent of “flash memory” some manufacturers would put a “country code” into the same chip as channel storage memories were stored as this gave them a cost saving. Again this solution was easily bypassed by the same process. But the advent of the Internet made these “hacks” available not just to the likes of those that knew how to “hack” in the original meaning but even those who had no more skills than to be able to move a jumper or push buttons in a certain sequence to pull up “hidden menus”.

To show further how dumb the policy of the FCC could get look up the history of WiFi and thr “Reverse SMA” coax connector, supposadly to stop the use by consumers of high gain antennas…

Design engineers in Fast Moving Consumer Electronics (FMCE) look at every workable cost reduction. From individual compenents such as resistors, upwards through the entire production process. Thus their aims are almost always in opposition to the likes of the FCC mandates. The original WiFi WEP was the result of incompatability between the regulators and manufacturors expressed through a standards body that in turn had it’s own agenda both public and private via the interests of the employers of the standards group individual members (the likes of which we have seen with NIST/NSA and the dual eliptic curve digital random bit generator).

But the FCC has a real problem that it’s well out of date methods can not solve and that is “Software Defined Radio”(SDR). For less than 10USD you can buy a USB dongle that covers nearly all the radio spectrum currrntly in use for personal radio communication. SDR cares not a jot about any air or user interface limitations, the dongle is basically a single chip that acts as the air interface front end, with all the demodulation of signals and user interface being software running on a standard PC. There is little the FCC or equivalent government agency can try to do to stop the forward progression and price dropping of SDR. The one attempt that became noticable was with WiFi Access Points and routers, their ham fisted attempts met with considerable “push back” and thus “re-interpretation of words game”…

Thus the only methods of ensuring privacy and security are with strong encryption etc. Which runs counter to other significant “vested interests” in government agencies…

Which is why Crypto Wars Mark two point zero is way way more important than many think.

[1] It is this way behind the technological times that was the original “Going Dark” because those in the know in the Agencies have always known that those above them “Did not see the light”. So every time you hear the “Going Dark” expression realise it’s a compleate nonsense for political cover up of various people being the equivalent of what “Welfare Mothers” are accused of being. That is taking tax dollars and giving little or nothing in return.

[2] There has very rarely been a good reason why different nations have different standards in the consumer side of telecommunications equipment. The main reason usually was “Home Market Protectionism”. Which history has clearly showed is a compleat “busted flush” of an idea that actually has the opposite of the desired effect. Einstein’s definition of “insanity” applys very much to the idea, something modern politicians of limited historical knowledge realy should take the time to get to understand.