Schneier on Security

Clive Robinson • June 25, 2021 8:15 PM

@ SpaceLifeForm,

Can you do me a favour and check if,

https://dailypopulous.com/2021-06-25-evening/exclusive-hacker-reveals-smart-meters-are-spilling-secrets-about-the-texas-snowstorm.html

Is the same content as you link to?

It’s just the morons in the UK tgink that connecting to what is ostensibly a security related web resource is “to dangerous for UK eyes” thus they block it under instruction from the UK Government…

It’s the same nonsense the Roman Catholic Church pulled for centuries, causing significant stagnation of mankind. The realy dumb thing is the Catholic Church were to stupid to realise that they were hurting themselves as well… All in the name of “moronic status”.

I guess “moronic stupidity” runs in certain types, especially those with strong religious connections in the previous executive and administration.

For those who have not thought about it there was a darn good reason why the framers of what is the US said there had to be strong seperation between Church and State. A look at European History might give people a clue…

Clive Robinson • June 25, 2021 8:45 PM

@ JPA,

The Post Office Ltd new darn well what they were upto, the woman in charge was an out and out psycho. But has gone on to do other well paid “government” work and failed miserably yet again,

https://www.standard.co.uk/news/uk/post-office-ceo-kevan-jones-high-court-simon-clarke-b931437.html

But like many psycho’s she believes she is doing God’s work unquestioningly,

https://archbishopcranmer.com/revd-paula-vennells-should-be-removed-from-the-cofe-ethical-investment-advisory-group/

5 million GBP in bonuses on top of wages and other perks, for doing not “God’s work” but the work of “cupid politicians” who have eyes turned away. The wages of sin and all that…

But you might also look into the History of “failed mega projects” in the UK and how a certain company that was behind the POL keeps cropping up in all of them very very profitably…

Their contract has an interesting set of clauses in it I won’t go into the nitty gritty specifics but

1, You pay all their costs.
2, You pay all the overrun costs.
3, They always own the software.
4, If they fail you have to pay them plus an exit fee amounting to atleast half the costs on top.

And quite a few more eue openers. Unsurprisingly they almost always fail on such contracts.

Then go on and sell the software to multiple others…

To say it is a scam run by crooks is an understatment.

Clive Robinson • June 27, 2021 3:06 AM

@ SpaceLifeForm,

Someone on twitter, please request threadreader unroll on

“Simples” as the UK insurance add says,

1, A bunch of people downloaded Micro$haft Windoze 11.

2, They tried installing on hardware that Intel had wanted rid off as they want you to bleed through the nose for their new CPU’s and chips with all those nasty nasty features they will not fix.

3, True to form the Micro$haft 11 download blew up in peoples faces (renember the forced Win10 death of laptops?)

4, Now people are moaning…

Normally you would expect some Darwinism to work with supposadly intelligent individuals…

But as Apple have proved over and over “Fan-bois” are not the most usefull of light bulbs in a corridor…

I’ve not upgraded to Win10 and have no intention of doing so XP still works fine for me with Win2000 actually needed for some eyewateringly expebsive software I’ve purchased in the past.

If at some point I have a need to use such crap as Win10 or Win11 –remember it’s mainly “tinsel on top” to push other products,– I’ll either get someone else to pay for it, or I’ll buy the cheapest bit of consumer kit that will work, then bill somebody for it. That way it files the,

“Douglas Adams S.E.P. criteria”

And I can get good cardiovascular excercise passing the buck onto them in a very very direct and firm way, moving on to defenistration if required.

[1] People speak of the “pachyderm in the room” because well when grey they are kind of obvious and try though you might, you can not ignore them they are just a little to… However paint it neon pink and add accessories then you can pretend “Grandma Lil has not left yet” thus safely ignore it. Thus making it invisable to concious thought not very difficult,

https://hitchhikers.fandom.com/wiki/Somebody_Else%27s_Problem_Field

[2] Cardiovascular excercise being vigorous and requiring large amounts of air to be moved in and out of the lungs can be obtained in many ways, wild gesticulation and annunciation for a minimum of your 20mins a day can do wonders for lowering your stress and bad hormone levels… As for the person who might consider themselves the object of invective, well clearly they are to “it’s all about me” so are very much into dirty office politics and the like, so should be painted neon pink and accessorized untill every one can safely ignore them, except of course when the need for a cardiovascular workout is required 😉

Clive Robinson • June 27, 2021 3:27 AM

@ D-wop,

I was just reading an article the other day about embedding microchips into people such as criminals, whistleblowers, journalists accused of “secret” crimes.

That sounds like made up conspiracy nonsense.

However animals do get regularly “ID-Tagged” for “pet-pasports”, “Stock Control” and indirectly via bright orange ear tags in the food chain.

The most common use in humans currently is in the chest or arm for medical reasons. Such as heart monitoring and blood glucose monitoring.

Whilst not an issue for heart monitoring other sensors stop working fairly quickly due to the build up of a “fibroid” around the device.

In a way it’s the human bodies equivalent od making pearls in oysters.

Some years ago there was a “transhumanism fad” where people were injecting all sorts of crap in their bodies including highly dangerous lithium batteries, one guy actually built in a microphone and recorder… As those that just put tiny quater matchstick size bar magnets in found, they,start of fine. But fairly quickly become useless due to the fibroid. The problem is whilst the fibroid does eventually get reabsorbed by the body often the functioning of nerves does not…

Thus there are or will be all sorts of issues about compelling people to have chips installed.

After all we do not generally look kindly on chopping off the hands of thieves or the cutting out of toungs for not telling the truth, castration or the removal etc of body parts or the stopping of body parts functioning (on the eye for an eye principle).

Clive Robinson • June 27, 2021 3:51 AM

@ Fake,

Not sure what you are asking for.

Most undergraduate stuff on Information and the statistical mechanics that come up in it are available as freely downloadable PDFs from Uni Course web sites.

Whilst calculus can be seen as the search for the infinitesimal the truth is it’s actually not much use in the real world out side of mathmatics as anyone who’s tried to apply it to a real world engineering problem has found.

Information theory can be thought of as finding meaning in noise and the limits of communication in “bound systems” which all real world systems effectively are.

The use if the word “entropy” in infornation theory has as much impact on the real world as it’s thermodynamic equivalent.

The problem is it’s “beguiling simple” as an idea, that is it is a measure of “what is possible” not “what is” and that can cause people problems the way the ideas about infinity did back in Cantor’s time when he showed with a proof that there was and always would be an infinity of infities within finite bounds.

Mind you, you do not have to go back that far in time to find that zero caused significant problems for those studying mathmatics… Most of us these days accept the fact of zero as nothing but actually still do not realy understand the implications of it. Some one once observed nature does not do nothing it simply changes something to something else. So like bubbles under wallpaper as you hang it, pushing down on one only makes others pop up some place else.

Clive Robinson • June 28, 2021 3:32 AM

@ SpaceLifeForm,

You might want to see the “probable” projection of #2,

https://www.nhc.noaa.gov/gtwo.php?basin=atlc&fdays=5

However my gut says it’s going to be not quite that “straight track” thus there is a chance it will go north a bit and continue to build as it turns to go up the eastern seaboard… Which means it could then head off for Scotland in a week or three and make another mess up there as some have in the past.

I’m not putting any money on it… But then I’m not going to go anywhere on the UK west coast then either.

We’ve had rain with extra added rain with a few downpours sprinkled on top over night in London which is a bit much even for the notoriously fickle and sometimes tempestuous “longest day” weather period in England.

People tend to forget that “global warming” for most humans is not realy about long term averages, but short term extremes that can cause crops to be destroyed just before harvest etc.

But if you want one indicator… Back about a quater of a century ago a small group of parakeets escaped/released in “Strawberry Hill” west London. Since then they have become endemic in and around most of South London and increasingly SE England. They are an invasive spiecies (from Brazil) and have almost entirely displaced / killed off the native Starling population. Last night I had twenty seven of them sitting on the fence and god alone knows how many in the trees. They were not just loud but apparently unafraid of humans…

So “Do we have “climate change?” well it appears to be increasingly hard to argue against one way or another.

Clive Robinson • June 29, 2021 1:59 AM

@ SpaceLifeForm,

Regards WX

Time will tell. If it stays on westerly course, and can slide into the Gulf of Mexico between Yucatan and Cuba, it could be a major.

Danny proved stronger than the prevaling SW to NE off shore and has thus gone inland.

But as I thought it might, the prediction for the 2nd proto-trouble is starting to turn north and I suspect people in Florida’s East coast are starting to think it’s time to start getting in a few supplies, if they did not for when Danny went twirling by like Cinderella’s Skirts at Disney.

Clive Robinson • June 29, 2021 11:07 AM

@ SpaceLifeForm,

With regards the Weather outlook at,

https://www.nhc.noaa.gov/gtwo.php?basin=atlc&fdays=5

Just looked and, whilst Storm Danny is now off of the prediction maps…

Another wave appears to be building behind what was the second. And what was the second has now moved up from “low” and looks like it’s going to be further north still and might miss the Lesser Antilles and hed into the gulf or up to Florida… thus of concern to some.

Or to quote their forcast,

”
1. Disorganized showers and thunderstorms continue in association with
a tropical wave located over the tropical Atlantic, about 850 miles
east of the Lesser Antilles. Some slow development of this
disturbance is possible later this week and this weekend while the
system moves westward to west-northwestward at 15 to 20 mph, likely
reaching the Lesser Antilles by Wednesday night.
* Formation chance through 48 hours…low…30 percent.
* Formation chance through 5 days…medium…40 percent.

2. Shower activity associated with a tropical wave located about 800
miles southwest of the Cabo Verde islands has become a little
better organized since yesterday. Additional slow development of
this system is possible during the next several days as it moves
generally west-northwestward at about 20 mph.
* Formation chance through 48 hours…low…10 percent.
* Formation chance through 5 days…low…20 percent.
“

What’s that old saying about “It never rains just pours…”

Clive Robinson • June 29, 2021 7:41 PM

@ SpaceLifeForm,

EMFI hacking.

Nice to see a new generation getting a bit of fun out of such tricks.

Mind you I’ll give LR their due, they published, which is more than I did after the first run in I had with one major hardware manufacturer who basically tried to set their corporate sharks on me…

The trick with the “local eddy current” has other uses at lower power, if you can locate the part of the chip with the AES hardware on it you can use “cross modulation” to get the key to leak out…

You can also “mung-up” any hardware TRNG etc to give a more or less known output…

And a few less interesting things.

The obvious defence is to put a “shield plate” inside the chip, but that just means stepping up the game a bit…

Clive Robinson • June 30, 2021 10:41 PM

@ SpaceLifeForm,

It looks like NHC has given up on the wave that I have been watching for a week now.

Two reasons might be,

1, They turned South.
2, They have run out of steam.

There may be a cold/dry weather front coming down from the North West across the US causing one or both effects.

But the forcasters have obviously decided the two weather waves are disipating and won’t become cyclonic.

But that third wave, is not so much a wave as a depression with defining edges, thus has a high probability of not just cyclonic behaviour but increasing cyclonic behaviour upto or above storm levels. At a thousand miles out, it’s got about 40hours of “build time” in it which will with a little advantageous help of sun and wind get “the kettle to boil”. If it does it will tighten up increasing the thermal energy density, thus causing more thermal energy to get drawn in and rise and so on. There is insufficient data to say if it will get to a critical point or not where “inertia wins”[1], but it looks like the forecasters think it will.

[1] Think of it the same way you would a jet engine, you need a degree of inertia for it to get going and be self sustaining.

Clive Robinson • July 1, 2021 11:45 AM

@ The usual suspects,

Signal’s murkier parts are getting another little re-boil again,

https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-great-encryption-needs-great-authentication/

But whilst the “ghost idea” of GCHQ etc can be made to work and would be more in line with a Signal’s Intelligence Agencies “arms length” attack method.

The simple fact remains is Signal’s security end points are in the wrong place, as are all “connected” consumer device security end points currently.

Clive Robinson • July 1, 2021 2:49 PM

@ Winter,

You simply ask for the impossible.

Far from it, provided you put your security end point beyond the reach of your opponent, the the opponent has only three choices,

1, Accept you have secure comms they have to attack the security of directly which may be impossible.

2, Find another “technical” way around your security end points.

3, Find another “non-technical” way around your security end points.

There is absolutely no secure communication channel.

Again not true as it requires the impossability of an omniocular, omnipresent, thus omniscient opponent. That currently only exists as some kind of “night terrors monster inside your head” that “Sees all you see, knows all you know, and goes where ever you go”. That is a nonsense instilled in the very young to gain power over them, and is frequently oracticed by religions to ensure obedience.

The reality is all real opponents are resource bound and the resources they have are far from perfect, though technology is improving their abilities. But importantly there are infact techniques that exist where “knowing everything you know” and “seeing everything you see” is insufficient.

So lets look at point 1 above, is it possible to have a secure comms channel that an opponent can not attack? The answer is “Yes within what we currently know”.

That is it is currently assumed that we do not live in a purely determanistic universe, therefor non-determanistic processes can be used to create streams of unpredictable bits. These in turn can be used to communicate a message between two parties, that a third party can only guess at the meaning of. That is,

“To a third party evesdropper, seeing a commnications C of length N bits any bit pattern they can formulate of N bits or less[1] is equiprobable.”

Thus within certain rules the secure communications of a message is not just possible it’s inherent in our current understanding of the laws of nature.

The real issue though is you have “moved the problem” that is both the first and second parties have to have copies of the unpredictable stream of bits for the communication of information between them to be completed. As importantly though, no other party should have a copy of this stream of unpredictable bits.

Whilst a second channel for communications of the copy of the unpredictable bit stream is required it has the advantage of enabling amoungst other things “time shifting” that works for the first and second parties against any other parties.

Without going into details there are actually ways to ensure that a third party can not gain sufficient information if they are neither omniscient or omnipresent for the technical attacks covered by point 2 above. You do this by using certain unproven but thought likely to be true theorems such as the use of “One way functions”. Other technical attacks in point 2 can usually be dealt with by appropriate OpSec precautions that have long been established.

You can even come up with a system that with care stops the most likely non technical attacks in point 3 above. That is you can make a message not just deniable “covert”, but deniable by the first party if the second party “betrays” them to a third party. It’s a consequence of unpredictability. Whilst the bandwidth of such a channel is usually small it can not be eliminated by an opponent. Thus it is possible to have a third party see all the messages as though they were sent as a “broadcast in the clear” such systems have been in use quite successfully since WWII and are reasonably well documented.

In short where information is to be communicated, it can contain other information within it as a consequence of structure and thus redundancy. Even if as a third party opponent you think you have eliminated all structure within your system, you actually can not stop the first and second parties overlaying structure on your system except by stopping all communications between them.

It is by the way the actual reasoning behind what some call “Special Administrative Measures” which we know has already failed in various ways. People tend to forget the absence of something is actually a message in it’s own right, that people have usefully used (warrant canaries being just one example).

[1] Actually it’s a bit more complicated due to “redundancy” it is possible to compress messages with “structure” prior to being communicated so the actual message could be longer than N bits[2].

[2] However structure in messages does not convey information it duplicates it in some manner thus is “redundant” so the actual information content of the message would still be N bits or less. Structure is mostly used in communications to ensure the correct transmission of information in an imperfect communications channel[3].

[3] For various reasons it is best to remove all structure from a message prior to encoding it for communications, then add any structure to ensure the communications is received correctly outside of the information encoding. The primary reason for this is “structure” by it’s presence acts as a discriminator making one or more possible guesses at the message content more probable than others. Structure thus significantly helps a cryptanalist when the first party makes the mistake of sending two messages encoded under the same nondetermanistic stream of bits (look up Chi Squared statistical method).