Schneier on Security

Clive Robinson • August 1, 2021 7:55 AM

@ CMYK,

Why printers add secret tracking dots

They are a bit of a “red herring” as there are multiple layers of tracking techniques used that go back into the 1960’s if not earlier.

If you think about it the dots are at most three decades old as printers before that were dot matrix or fixed type head like a Selectrix / IBM golfball etc.

One such was to use different “white space” widths. That is some printers had narrow medium and wide “white space” that could be used to do left and right “justification” that looked better than the ordinary software of the likes of WordStar etc.

There was also tricks that changed the way hyphenation was done and underlining.

But there are other thricks you might have heard of the ancient english “thorn” chatcter that looks like a capital Y well it actually replaces “Th” so remember when you see “Ye Old Sausage Shop” the “Ye” should be read and prononced as “The”. But printers have all sorts of two into one such as “ae” and similar. We tend not to see them these days but prior to WWII they used to popup in not just books but newspapers. Obviously they can all be used to “hide codes” etc.

At a higher level there is more than one way to spell some words the medical profession abound with old English, new English and American English spelling of words that are all treated as equally valid. Other proffessions similarly.

But there are also some rules for how you hang paragraphs so they look right that can also be used to hide code.

But these days a good thesaurus can be used to replace one word with another for instance look up stupidity and cupidity, whilst they are not interchangable by quite some measure they will often not make any meaningful difference if you do use them interchangeably. That is,

1, The software fault was due to senior managments cupidity.

2, The software fault was due to senior managments stupidity.

Tuck that difference away in the middle of a block of text and most will not notice it when they read first one version then the other.

But you can have fun with words like “install” and “instill” the average person is unlikely to have learned the difference.

Thus you can use such pairs of words to send a single bit of information. Something Francis Bacon was aware of in the early 1600’s and suggested as one of several ways to hide code within plaintext.

Obviously you can do similar with grammar or these days even markup.

Thus there can be several systems in use with various codes at various levels.

Clive Robinson • August 2, 2021 5:19 AM

@ SpaceLifeForm,

The degree of deficit was worse the more severe the initial covid infection had been.

Whilst people have suspected a link between viral infection and long term disability for about a century now, the evidence is piling up and thus the view becoming more and more main stream…

For instance Type I diabetes was around three decades ago still considered to be a genetic defect.

Whilst there is a component of being more genetically susceptible, the notion of a “viral trigger” or similar is gaining ground, and you’ld be hard pushed to find a diabetes specialist who could not rationaly discuss it with you these days.

There is also mounting evidence that there are links between some bacteria and cancers. Whilst I probably heard about it earlier, what sticks in my mind is the Australian Dr who found the link between stomach ulcers and a bacteria that lived in the stomach despite it being such a hostile environment. Less well reported were the cases of early stomach cancer that got the new “out of patent anti-biotic” treatment for ulcers because tests to confirm cancers were backing up thus delayed. The biopsies showed that yes there had been cancer but it effectively got stopped in it’s tracks by the anti-biotics…

It begs the question, which would you rather do, take handfulls of out of patent anti-biotics for upto six weeks or wait two or three months of cancer growth for a biopsy and eventual chemotherapy? Especially when in most –but not all– cases the downside of antibiotics in an individual can be fairly easily reversed, whilst chemotherapy…

From my point of view “when the clock is ticking” you try not to hang around letting things get worse doing nothing. You try and at the very least to slow or stop the clock so you have more time thus more opportunities…

I have a nagging suspicion that the fact that we have more super-bugs than we used to and more cancer than we used to, might not be unconnected, or just be an artifact of incrrased life expectancy or diagnostic capability, and that some scientist think that might also be the case.

Back in the 1980’s there was much said about “yuppie flu” and much derision was heaped on a few people who were shown to be ill but nobody could point a finger at a specific cause. Since then the world has moved on.

If you look back on this blog to the early days of COVID you will see I had concernces over viral infection and it’s analogs causing long term effects such as auto-immune disease in the medium and long term (year to a couple of decades). Since we’ve now got “long COVID” but we only know about it in the “short to medium” term of upto a little over a year.

The world can not aford neo-con health care systems and even quite short term Long COVID…

That is ask yourself what is going to happen to people that need a year or more of near hands on therepy of four or five trained medical staff every day? How about two years?

Then ask what about a life time of auto-immune disease like kidney failure or diabetes or worse?

This is not FUD or “Scarry Monster” raising, this is fundemental “Policy Questions” that could end up effecting 1% or more of the population and costing more than many Nations Defence Budgeting, which puts it on par if not of higher priority than many National Security questions…

Not something that can be left to the supposed “Free Market” their “lobbyists” or “Finance Markets”, or politicians and legislators they buy. Without doubt it will effect every child, woman and man for more than four or five generations at least who have not been exempted. Worse for every six months to a year we alow politicians and their backers to prevaricate over it, that’s another generation that will be condemned to very poor life chances, not just by “lost opportunity costs” but by those behind the politicians ensuring that they, and only they will be exempt and not have to carry the long term cost to society.

Clive Robinson • August 3, 2021 1:21 AM

@ SpaceLifeForm, Winter,

This is not actually a “do not roll your own argument”.

Read carefully,

“as Filippo Valsorda notes, at some point, some devs have to ignore the ‘do not roll your own crypto’ mantra. And they do not need a PHD in crypto. They must be learned, and should seek out review, but they should never give up because they do not have a PHD.“

This is an argument against a “closed shop” much like it is with a “legal profession” such as,

1, Medicine.
2, Surgery.
3, Law.
4, Accountancy.
5, Architecture.

And in some places,

6, Engineering.
7, Construction.
8, Repair.
9, Maintainance.

Used to in effect extort a higher price for services than the market would traditionaly bare.

As with “The Guilds” of old the restriction on trade creates a system which is “old, slow, political and exploitative” in the extream and holds society back for decades and centuries.

Clive Robinson • August 3, 2021 3:27 AM

@ SpaceLifeForm, WinterALL,

Competence vs Confidence

At some point in our lives most of us become “over confident” in our abilities. Mainly for one of two reasons,

1, We are not aware of what others are aware of.
2, We chose to ignore what others warn us of.

The first is a very general failing and is unavoidable, even the most informed of us are not omniscient especially when others chose to keep things “secret” for what they see as “advantage reasons”.

In some cases we actually acknowledge this and call such witheld knowledge “zero-days” and similar. It’s practiced at all levels “of the art” and it underlies the notion behind NOBUS.

However as was once noted,

“What one man can make another can unmake”

Thus NOBUS is doomed to fail and there are a couple of examples of this happening.

But importantly history tells us through centuries of religion trying to hold back the tide of knowledge this is the case, it does not however stop certain “mental types” from repeating the nistake over and over. The less smart ones figure they can somehow keep it secret in perpetuity.

The slightly smarter ones delude themselves as well, in that they think if they can hold one thing back, that gives them time to find another new way to hold it back and so on. This is the same doomed logic that has people run from under one tree in a rainstorm to another tree under the mistaken belief that some how the tree they head for has not been saturated by the rain that is falling on all trees.

Those that actual can think about the issue know that the reality is they have a very short time window they can exploit the advantage thus they should use the advantage wisely.

But there are always those who for what ever reason chose not to listen when others warn them… We give it various names one of the kindest of which is “Not Invented Here”(NIH syndrome. Others less kindly call it “cognative bias” or “cognative deficit” or just “Being bl@@dy stupid”.

So when I design systems an implicit part of the design is,

“It will fail, how do I mitigate or buy time”.

Even at the best of times it’s realy all you can do.

As I point out to people,

“The One Time Pad is ‘theoreticaly secure’ but do you actually understand what the real ‘security guarantee’ of an OTP actually is?”

Mostly they do not, hence the systems they produce are effectively “built to fail by design”…

But… The main reason security systems fail is a very common human failing and it’s also why oh so many systems not just security fail. Strangely it’s something evolution tellsus is a very bad idea as well…

Normally I simply say,

“Security -v- Efficiency”

But the point is the more “efficient” you make something the less slack there is in the system that alows for “resiliance”. Without resiliance systems become “fragil” thus fail “more easily” and usually “more quickly” and worst of all “much harder”.

I’ve been saying this for more than a quater of a century but those whose mantra is “Don’t leave money on the table” or similar do not want in any way to acknowledge the disaster their mantras will bring down on peoples heads…

The funny thing about COVID-19 is it showed the failings of these mantras for all to see in supply chains and the like. Yet have these people learned? Of course not all they’ve done is follow that unfortunate failing of most gamblers, they’ve “doubled down” on it…

So “Masters of the Universe” they are not, no matter what they think. However the lesson for everyone else is, if the self entitled will not learn, why should we trust or follow them?

The most important thing is not “do not fail” you can not stop that happening you are bot omniscient, nore is anyone else. But “learn from yours and others failings” in two ways,

1, Firstly to use more than one system that use entirely different principles such that they are unlikely to fail coincidently.

2, Secondly to design for the inevitable failing to be dealt with both in timely and graceful ways.

In high reliability systems they talk of “Availability” which is based on,

A, Mean Time To Fail (MTTF).
B, Mean Time To Repair (MTTR).

It should be obvious that whilst increasing the former is good as is reducing the latter, they both get increasingly expensive rather disproportionately. Thus you look at changing which gets you the better benifit at an given cost.

There are very similar rules for security. It’s learning how to use them to best effect that is the real lesson to learn.

Clive Robinson • August 5, 2021 9:13 AM

@ MarkH,

With regards,

the CIA director asked his staffers, “Who puts a privacy wall around a patio?”

That’s easy to answer “Anyone who knows they have nosey neighbours, or has heard drones from the patio more than once, or sees odd phenomn near it.”

I also know for certain, that atleast one young lady who does yoga in the fresh air, who lives on the top floor of flats near the Hackney Rd in East London put a privacy screen on her patio/balcony. Why? because for some strange reason the nearby “Traffic / anti-Crime CCTV” camera with zoom lense for some unacountable reason was often pointing up at her flat… After she’d spoken to me about it I installed a covert camera and CCTV for her to record the “odd phenomn” happening and yes it’s very “real” and stopped shortly after the screen went up, make of that what you will.

As for,

“the house had few windows”

You don’t say if you source said if it was “built that way” or had “windows bricked up and rendered over”.

Mind you neither are particularly proof of anything, I’ve got blinds of the slatted sort inside my windows which slant down. They let ambiant and ground reflected light in but you’ld have to be very very close and therefore trespasing to “look in”. But also behind these are “net curtains” that break any image that’s not “back-lit” up and there are lights between the nets and the blinds that point down at a carefull angle and activated by movment sensors. Behind the nets are heavy “thermally lined curtains” that realy keep the warmth in in winter and the heat out in summer.

I happen to like “mood lighting” so inside the rooms lighting is provided by quite a few low energy LED lights and the like and the pattern of which are on and which are off changes frequently. Thus the LED lights use one heck of a lot less electricity than the heating/cooling that would be required if the heavy thermally lined curtains were not closed as much as they are and give me ambiance as well. So I’m being “environmentally friendly” as well as happy 😉

Speaking of “environmentally friendly” this would be under other circumstances funny,

“its occupants burned all of their trash, rather than putting it out for pickup as was the custom for other homes in the neighborhood”

The amount of “trash” I put out a week fills less than a 400gm tin you get chopped tomatoes in, and is mainly tea bags. Food waste goes on the compost heap, recycling I collect up like for like and take in bulk loads to the recycling point, as for burnable rubish like paper cardboard etc, I save it and make it into “fire logs” for burning in the winter in the “stove” (closed carbon cycle).

As for,

“the house — despite being large and expensive — had no telephone or internet service”

As I’ve frequently mentioned neither does my house have phone line, cable TV or Internet, they realy are in the UK atleast a compleate waste of money if you can get adiquate mobile provision for 1/5th or less the price (which generally you can).

Now I know on the surface of MSM reporting US forces can appear particularly stupid with things like “We kill on meta-data” etc. But I suspect there was a lot more to this than the items reported as being the “meta-data” in this case.

Thus I suspect somebody to put it politley is being “economical with the truth” possibly for the old “methods and sources” reasons. But it still leaves the question.as to why the author did not dig a little deeper or was more suspicious of what is essentially “a truck load of horses apples”.