Schneier on Security

Clive Robinson • March 2, 2023 11:02 PM

@ Jordan, ALL,

Re : Back before the Police State.

“Can you believe in the past they had to remember their security keys in their heads?”

Anything you do not store ONLY in your memory is not a secret any more in the US and quite a few other places…

We are told early on in ICTsec training the three basic authentication factor mantra of,

1, Something you know (memory)
2, Something you have (token)
3, Something you are (biometric)

Like all mantras it does not hold true for very long, as society especially moves.

I noted today[1] to @Matt Palmer that bio-metrics are a compleat security fail as in reality they are part of a faux-market and will be beaten by someone who can think in short order. Or worse they already have been beaten before the biometric reader hit the faux-market. So the something you are bio-metrics should nolonger be considered a valid security factor.

Worse in the US judges have said that forcibly using a suspects body part as forcably as LE “think” necessary –efectively unlimited harm– is neither assault or torture, thus not a breach of the victims human rights (a spurious “ticking time bomb” argument is behind this to make it “Exigent circumstances”[2]).

The same applies to the something you have tokens, that are not further protected by at the very least,

1, Something you know
2, In your memory alone
3, Valid in only a limited time frame.

Augmented by as a minimum technical measures for

4, Anti-guess protection
5, Active anti-tamper protection
6, Emergancy erase button

If not all are present and working then the token should also be seen as a “security fail” and should not be considered a valid security factor.

Which leaves only the “something you know” of your memory left…

Which thankfully in the case of most humans is very short term and easily forgotton by the stress of compulsion/torture, thus has “reasonable deniability”.

Howrver what the average person can remember is realy very low entropy at best[3]. And as now frequently demonstrated by password cracking competitions, often entirely predictable enough for a simple “password guessing” attack augmented by a few prediction rules (such as “Word with two digits pre or post appended”).

It’s why over a decade and a half ago I looked at designing and making a token that used more than just a pass word/phrase “string” by adding geo-temporal components such that the string would only work in a given place at or upto a given future time. Such that the person being compelled/tourtured by law has only to “hold-out” for a limited time of say 24hours.

This was an extension to the “shared secrets held in multiple non cooperating jurisdictions” extension I gave @Nick P as an extention to his “computers in multiple non cooperating jurisdiction” idea in our discussions on this blog.

The reality people have to face these days is,

Physical object protections are at best of very limited use to secure information based objects.

And,

In by far the majority of cases the human mind is incapable of accurately memorising more than a six digit number

Which is why most humans have to use “reinforcement” methods that boil down to a form of “muscle memory” by physical action or “visual memory” association. Which is the former case is how we remember tunes, songs, and the latter poems / sayings / mantras, all of which suffer from high predictability and often being “public knowledge”…

Which is why we need to use different traits of human memory that work significantly better.

[1] Bio-metrics are a bad idea, simply because they have always been relatively easy to spoof, and thus they have become a time based “arms race” that an an attacker that lacks ethics or morals will always win. Thus bio-metrics should never be used for either authentication or identification.

https://www.schneier.com/blog/archives/2023/03/fooling-a-voice-authentication-system-with-an-ai-generated-voice.html/#comment-418759

Remember that one of the failings of bio-metrics is that with them “identification” is always the first step of “authentication” after that spoofing it is done in the “measurment gap” or “test failure” or a mixture of both.

[2] Exigent circumstances : is in the US the “Might is Right” doctrine of thugs and Ne’er-do-wells, dressed up on false reasoning of the “Emergency aid” doctrine. Of what a supposadly “reasonable person” might think makes a Law Enforcment action a necessity due to mostly imagined –post circumstances– “time limitations”,

https://en.m.wikipedia.org/wiki/Exigent_circumstance

Remember a fist in the face, is no less harmfull for being dressed with a “pink ribbon” tied around it.

[3] Evolution has favoured “loose pattern matching at high speed” over the ability to “precisely remember”. Because mistaking an unknown creature for a known preditor has much less disadvantages than not. After all heading for and up a tree at high speed will take energy, but also get you into a safer place where you can then take more time to observe and learn, which having your belly ripped out, or your wind pipe crushed generaly does not.

Clive Robinson • March 3, 2023 9:48 AM

@ John, ALL,

Re : Replacing Passwords.

“When is this supposed “passwordless” future going to get here?”

Not for some time yet.

To see why you have to examine the many aspects involved.

First off is “Computer Storage”…

Remember to some services a million user capacity is neither unexpected or a high water mark. Throw in four fake accounts for every real one as appears to be the case with Twitter, that the creators cycle to avoid detection issue and the service provider need to keep dead accounts alive for seven years for legal reasons and you are looking at 2^25 user space alowance. So how much space per user? Well UserID. GroupID, Account name, User Name/Data, salt and password used to be a minimum, so say 12bytes per field and double and a bit for Name and Data and a three or four four byte date fields giving 12 x 5 + 24 x2 + 4 x 4 = 124bytes… Call it ~8,000 users per megabyte that gives a “password file” of 4Gbyte.

Now with a big of 256bits and 512bit hash storage that adds aproximately another hundred bytes per user so 2^(25+7) +4Gbyte ~8Gbyte.

Then you need a minimum of three preferably five active copies… 40Gbyte is gone.

Now depending on what you replace the password with that could appear tiny tiny in comparison…

For instance the “nine image grid” system where user has to enter a digit at four successive image grids needs the user to have 16 or more “personal friend” photographs, of say 100×150 bits is in colour ~60kbytes per image or just under a megabyte per user so 2^(25+20) x 5 ~= 160Tbyte…

Then as annoying as passwords are, just about every system of the same aproximate strength tried has proved even more annoying to users. In a major part because of the “something you know” asspect.

The simple fact is the human mind is a bit of a failure for remembering with accuracy. To get sufficient entropy kind of condems us to keyboard entry or the “something you have” tokens, which are very very expensive…

Using a “standard token” takes us down a whole different set of rabbit holes as many countries that hwve tried National E-ID have painfully discovered (and that’s not yet counting that none in use are PQC capable yet).

So the answer as to “When?” is probably “not untill our kids have retired if ever”…

Clive Robinson • March 3, 2023 6:20 PM

@ Sumadelet, lurker, ALL,

Re: Human memory.

“Human memory is generally very good at remembering some things”

Yes if they are image, location or time based (which is why I’ve looked at using them as extentions to “something you know”).

Baaically because they are things evolution selected from long long ago, and even though we generally don’t consider it something most of us are good at. Which is why people get very upset with people who can’t recognice faces, get to the right place, or do things at the right time.

Lesser used skills are learning tunes, songs, poems and the gist of stories. Usually done by repitition thus are like “muscle memory” you need for playing instruments. But importantly you don’t have to be 100% accurate the odd lar lar lar rarely does harm (unless it’s in “Hickory dickory dock” 😉

However there is an average… Which means for every outstandingly good person, there are one or more who are shall we say embarrassing bad balancing it up.

It’s why bank cards only have a four digit pin, and they alow you to use your birthday or 1225 –or 2512 for our US friends– for Santa’s visit etc. Worryingly is the statistic that says married men often use their wife’s birthday or their wedding aniversary… Not sure if it’s because they have remembered those dates or they are hoping repeated reminders will stop them forgetting…

The fact is that around 10% of people write their pin down in their diary/address book…

But… Any system for general use that is going to replace passwords/phrases realy has to work with people in the bottom 5-20% or it just won’t be acceptable as a replacment…

So yes,

“Many more humans can be trained to have good memory, eg. civil servants in China for the past two millenia have been expected to be able to quote…”

People can do it, but they have to be either lucky or motivated. But also do they learn a skill or a text? That is if you gave them a new page of text to read, how well would they remember it after just one read through[1]

And a well valued civil servant position is still highly sort after. Have a look at modern day India and their selection system and motivation.

I happen to know hundreds of jokes and I guess the words to hundreds of songs and can whistle maybe five times as many. But… I also write poetry and come up with silly/funny words for well known songs at the drop of a hat. The only motivation is I guess you could call them “party tricks” to make others smile, laugh, or even cry with mirth. Why? Because I believe in my gnarly little soul that happy people are less likely to act in anger or haste.

I could be wrong, but so far I’ve not been attacked by a happy person (yes hugged to the point of near asphyxiation but that’s different, the worst offender on that score was a female rugby player but that’s a story for another day[2] 😉

[1] Many years ago I purchased on a Sunday the latest Douglas Adams story the day before it was officially released and I read it all in a few hours. On the Monday evening I was with friends for a meal, the book was talked about on the news and they quoted a paragraph and I said page 132 third paragraph straight from memory. Needless to say I was doubted, so as I had the book in my bag I handed it over and told them to look as I recited it word for word from memory. Back then prior to having my head karata kicked into a lamp post I had a memory that could do that, now I’m lucky if I can remember what day of the month it is without working it out.

[2] And has more than a few saucy bits so probably comes in the NSFW category.

Clive Robinson • March 4, 2023 9:27 AM

@ Sumadelet,

Re : People with Special Needs.

“It’s almost as though developers and legislators don’t believe they will ever get old, or suffer impairments.”

Or have children etc etc.

I can not say about US legislators, but the EU does have quite broad legislation for those who are off to the disadvantaged side of the mean. Including all ICT.

The problem is that developers don’t do the work… The reason mor often than not is it is effectively “left out of the specification”. Which means in turn it gets left out of everything else.

I had an uncomfortable time as a “new-hire” to manage a test dept, one of the first things I asked for at a team meeting as I could not see it, was the testing proceadures as relating to the disability legislation… It got an uncomfortable silence in the meeting.

They all new we should be doing it, and they all knew senior managment had nixed it as being an unnecessary expense… Worse they also knew senior managment were not going to change just because of legislation or regulation[1].

Thankfully a new job I’d already been interviewed for else where became available…

[1] There is the old question of,

“Q : What’s the difference between a businessman and a bureaucrat?”

“A : They both have a set of rules the bureaucrat is safe if they stay inside, the businessman only survives by being just outside the rules.”

Most businesses will stray outside the legislation and regulations if the agences responsible do not police the regulations and legislation heavily enough that the Risk v. Reward balance is tipped well away from reward. You see this in US MSM headlines, that a business gets a few million dollars fine, on a business model that brought in billions in profit or earnings in that year alone. What the MSM often fail to say is not only are the fines tiny they are one way or another going to get paid for or subsidized by tax allowances and the like.

Clive Robinson • March 7, 2023 4:37 AM

@ JonKnowsNothing, ALL,

Re: collecting typing cadence methods.

The one that most concerned me on Smart Devices was the “spell checker” which is attached to the touch screen input device effectively permanently in Android.

It was at one time fairly easy to “channge” or “update” and getting it to work with an “Internet / on-line” dictionary not that hard. So as with all those search engines which also pull your typing cadence charecter by charecter across the network…

The lesson that crackers learnt long ago is,

“To get users to open up usefull side channels to leak information do something the user finds helpfull thus your tap becomes their essential feature”.