Schneier on Security

Ángel • April 30, 2020 8:17 PM

@tfb You are obviously right in that a system may be good enough for A, yet perfectly suitable for B. As long as you do the proper analysis (and you have all the data, knowledge and time needed for that), there’s no problem.

However, you often do not have all those points. Perhaps you do not have the dedication to fully explore all ramifications, maybe simply you were not given the requisites (“we just want a good videoconferencing tool”, is that so that employees may be hanging out. or for signing multimillion NDAs?). As such, in case of doubt, going for the most secure alternative is generally a safe bet. Maybe we could have used md5 safely in that application, but why bother just confirming and documenting that for your specific use case it is still safe when you could have used sha256 instead? Choosing the most secure alternative also avoids you from needing to reevaluate everything when a slightly different use case arises.

Then, you also need the end users of the security advice to understand it. Which is hard. Solution X being acceptable for a Harvard dissertation ≠ being acceptable for communicating with your doctor. Again, in general terms: Perhaps you just tell them “I need the same prescription as usual”, he replies “Sure, please come to pick it up from 9 to 5”, and you both avoid leaking to a presumed snooping party anything you would deem relevant, such as your actual illness (it also requires careful management by the parties to avoid a catastrophic failure).

We can have a look to how Bruce uses Zoom. I don’t think it’d be problematic that he gives his Harvard class using Zoom. I don’t know what’s the Harvard policy for class attendance (could I pass by there and just attend one Schneier class, without being an enrolled student?), but the contents aren’t really “private”. Many people will receive them. Bruce will be paid anyway. The only that may not like that approach could be Harvard accountants, who may think they could have obtained some extra tuition fees from those non-paying attendees. Yet, as they set Zoom as the “University standard”, Harvard presumably analyzed the trade off of using that software vs some alternatives and reached the conclusion it was more beneficial to go for Zoom (e.g. there may be a more secure solution, but it would cost more than those fees missed). Actually, they probably didn’t, but they should have done it. And it’s up to them to change such policy anytime.

Is any use on Harvard fine, then? Probably not. While I wouldn’t generally describe the contents of a class as ‘confidential’, we may have a set of teachers meeting virtually via Zoom -each on their own home- to design the exam questions, or grade certain assignments. You wouldn’t want that to be spied. OTOH, perhaps Harvard uses an on-premise Zoom server, and those teachers were connected to the academic network using a VPN tunnel. With those countermeasures applied it could be considered secure.

You might make a similar argument for business conferences, albeit they are probably in average more sensitive, and involve third parties not connected to a local VPN.

I’d be more wary about personal conferences. It’d depend on how personal you want to go, probably. And how much you value privacy. I would avoid sharing even in private circles some things that certain people happily publish on twitter/facebook. The pervasive point is the “It’s what everyone has” argument. The old, social problem of needing keep everyone using the same closed garden that ties the customer to a ‘bad’ solution.

The point I am more skeptical about though, is that it is really ubiquitous at this point. I can accept it has good platform support, and many people may have installed it for meeting with other people, but as there are competing solutions out there that need absolutely no local client, installing a local Zoom would require more effort.