Schneier on Security

Clive Robinson • May 27, 2020 5:11 PM

@ Wael,

I don’t trust myself! Now what?

That depends on why you don’t trust yourself? For many people it’s the “fear of making a mistake” for others it’s that and the “fear of not knowing enough”.

Today there is little or nothing you can do about “not knowing enough”, it’s a fact of life. It’s a state that all experts iregardless of if they have “depth or breadth” suffer from, because humans are neither omnipotent or omnipresent. Get used to it because there is darn little you can do about it[1].

The fear of “making a mistake” can and has been solved long ago. In part it’s training, but mainly it’s “Drills and checklists”.

Put simply, for every task, you come up with a list of steps which you follow, just as aircraft pilots do. Provided the check list is right and it’s followed correctly then the result should be trustworthy.

Beyond that I can not realy say, because if you do not trust yourself for other reasons, then it’s not security advice you need.

[1] Yes I know there are things that can be done about it and we’ve had those discussions in the past over the implications of C-v-P. But the simple fact is for what ever reason the industry does not want to go that way… Seciroty os still very very low on the list of priorities and various vested interests do not want that changing.

Clive Robinson • May 29, 2020 6:49 AM

@ Hristo,

Detecting and preventing fraud is hard and doing it automatically even more so.

Actually it’s not it’s actually fairly easy and has been discussed on this blog several times. It was a solved problem in the 1990’s but nobody wanted to do what was required.

Detecting and preventing fraud is only difficult if the systems are so substandard they should not be used.

But the quick and easy solution is “If you don’t use the Internet for any financial transactions, nor dors anyone else then fraud can not happen”. It’s as always the stupidity of Banks, Financial Houses, the Credit Card Industry and online selling that is at fault… But as always they “blaim the victim” be it the customer or the merchant…

It won’t change untill the banks and Financial houses become legaly liable for every cent, with no ability to claim back from the customers or merchants. And you can almost guarenty that things will become secure within days of such legislation getting inked.

Clive Robinson • May 30, 2020 2:28 AM

@ Jesse Thompson,

So just to be clear, are you suggesting that in the 1980s and earlier prior to any human beings using the Internet for financial transactions, that fraud did not exist?

No because all communications systems have been used for fraud even before we had wired communications like the telegraph.

The actual lesson if you will is,

As system implementers we don’t learn from history. Where as attackers do.

Thus until we do the best thing to do is not engage in what is known from history to be a very unsafe practice.

But then the flip side of the coin if you like, the counter argument is,

If we don’t do such stupidly risky things then technology would not develop and improve.

What we have unfortunatly done by alowing the likes of banks etc to “externalise the risk” onto the users of their poorly designed and implemented systems is effrctively stop the “flip side” from happening. Because the banks have no incentive to improve their systems.

I would argue that putting not just the risk but the cost of that risk back on the banks would have a benificial effect fairly quickly.

I’ll let others make their own choices about doing “financial transactions on the Internet”. But my choice is not to do so.