Schneier on Security

vas pup • September 6, 2023 5:16 PM

Tag – encryption.

Government denies U-turn on encrypted messaging row
https://www.bbc.com/news/technology-6716502

“There has been a stand-off between the UK government and tech firms over a clause in
the Online Safety Bill relating to encrypted messages.

These are messages that can only be seen by the sender and recipient. The Bill states that if there are concerns about child abuse content, tech companies might have to access it.

!!!But platforms like WhatsApp, Signal and iMessage say they cannot access or view
anybody’s messages without destroying existing privacy protections for all users, and have threatened to leave the UK rather than compromise message security.

The debate has raged for several months and for some it has turned into an argument about privacy versus the protection of children. The government insists it is possible to have both.

!!!The government has denied that its position has changed. In a statement in the House of Lords, the minister, Lord Parkinson, clarified that if the technology to access messages without breaking their security did not exist, then Ofcom would have the power to ask companies to develop the ability to identify and remove illegal child sexual
abuse content on their platforms.

Indeed, the Bill already stated that the regulator Ofcom would only ask tech firms to access messages once “feasible technology” had been developed which would specifically only target child abuse content and not break encryption.

=>The government has tasked tech firms with inventing these tools. “As has always been the case, as a last resort, on a case-by-case basis and only when stringent privacy safeguards have been met, [the Bill] will enable Ofcom to direct companies to either use, or make best efforts to develop or source, technology to identify and remove illegal child sexual abuse content – which we know can be developed,” said a government spokesperson.

!!!Some security experts suggest such tech tools may never exist, and the tech firms
themselves say it is not possible.

Head of WhatsApp, Will Cathcart, posted on X Wednesday that “the fact remains that
scanning everyone’s messages would destroy privacy as we know it”.
Meredith Whittaker, president of encrypted messaging app Signal, has previously said =>it was “magical thinking” to believe we can have privacy “but only for the good guys”.
She told the BBC that the firm welcomed the latest clarification which was “a good
start to incorporating the voices of human rights defenders into the final stages.

Prof Ciaran Martin, former head of the National Cyber Security Centre, said in reaction to the minister’s clarification that in practical terms this meant the powers to access private messages would not be deployed: “The government is still technically taking the power but is =>placing so many conditions on its use it cannot to my mind ever be used.”

Another view is that this is an attempt at a last-minute diplomatic resolution in which neither the tech firms nor the government lose face: the government says it knew all along that the tech did not exist and removes immediate pressure from the tech firms to invent it, and the tech firms claim a victory for privacy.

!!!Currently, the two most viable tech solutions are
=>to either break the encryption – which would leave a backdoor open to any bad actors who found it –
=>or introduce software which scans content on a device. It is called client-side scanning and has been dubbed “the spy in your pocket” by critics.”

vas pup • September 10, 2023 7:04 PM

From MIT on subject:
https://www.technologyreview.com/2023/08/23/1077693/crypto-foul-play/

“The world of online misdeeds is an eerie biome, crawling with Bored Apes, Fancy Bears, Shiba Inu coins, self-­replicating viruses, and whales. But the behavior driving fraud, hacks, and scams on the internet has always been familiar and very human. New technologies change little about the fact that illegal operations exist because some people are willing to act illegally and others fall for the stories they tell.

To wit: Crypto speculation looks a lot like online sports betting, which looks like offline sports betting; cyber hacking resembles classic espionage; spear phishers recall flesh-and-blood con artists. The perpetrators of these crimes lure victims with well-worn appeals to faith and promises of financial reward. In Fancy Bear Goes Phishing, Yale law professor Scott Shapiro argues that
!!!technological solutions can’t solve the problem because they can’t force people to
play nice online.
=>The best ways to protect ourselves from online tricks are social—public policies,
legal and business incentives, and cultural shifts.

For Hundreds, NFTs have value as cultural artifacts, and he’s not convinced that their time should be over (although he acknowledges that between 2019 and the writing of his book, more than $100 million worth of NFTs have been stolen, mostly through phishing scams). “Whether or not NFTs are a scam poses a philosophical question that wanders into moral judgments and cultural practices around free enterprise, mercantilism, and
materialism,” he writes.

To articulate how internet crime comes to be, Shapiro offers a new paradigm for the
relationship between humanity and technology. He labels technical computer code “downcode” and calls everything human surrounding and driving it “upcode.” From “the inner operations of the human brain” to “the outer social, political, and institutional forces that define the world,” upcode is the teeming ecosystem of humans and human systems behind the curtain of technology.
!!!Shapiro argues that upcode is responsible for all of technology’s impacts—positive and negative—and downcode is only its product.
=>Technical tools like the block-chain, firewalls, or two-factor authentication may be implemented as efforts to ensure safety online, but they cannot address the root causes upstream. For any technologist or crypto enthusiast who believes computer code to be law and sees human error as an annoying hiccup, this idea may be disconcerting.
!!! But crime begins and ends with humans, Shapiro argues, so upcode is where we must
focus both our blame for the problem and our efforts to improve online safety.

Constructing downcode guardrails to allow in only “good” intentions won’t solve online crime because bad acts are not so easily dismissed as the work of bad actors. The people who perpetrate scams, fraud, and hacks—or even participate in the systems around it, like speculative markets—often subscribe to a moral rubric as they act illegally.

In Fancy Bear, Shapiro cites the seminal research of Sarah Gordon, the first to
investigate the psychology of people who wrote computer viruses when this malware first popped up in the 1990s. Of the 64 respondents to her global survey, all but one had developmentally appropriate moral reasoning based on ethics, according to a framework created by the psychologist Lawrence Kohlberg: that is,
=>these virus writers made decisions based on a sense of right and wrong. More recent
research from Alice Hutchings, the director of the University of Cambridge’s Cybercrime Centre, also found !!! hackers as a group to be “moral agents, possessing a sense of justice, purpose, and identity.”

The definition of crime is also upcode, shaped by social contracts as well as legal ones.

!!!“If we are committing serious crimes like fraud,” he speculates, “it is crucially important that we find ways to justify our behavior to others and crucially, to ourselves.” While this rationalization certainly doesn’t excuse any crimes, it explains how people can perpetrate eye-boggling fraud again and again, even inventing new ways to scam. The human upcode that makes each of us see ourselves as the protagonist of our story is powerful, even and maybe especially when billions of dollars are at stake.

“The human mind is riddled with upcode that causes us to make biased predictions and irrational choices,” Shapiro writes. =>Take the “representativeness heuristic,” which leads us to judge something by how much it resembles an existing mental image—even if that may lead us to overlook crucial information. If an animal looks like a duck and quacks like a duck, the representativeness heuristic tells us it can swim. Phishing scams rely on this rush to pattern matching. For example, Fancy Bear, the titular Russian hacking group of Shapiro’s book, used a visually and tonally convincing message to attempt to hack into Hillary Clinton campaign staffers’ email accounts in 2016. It worked.

!!!!Also coming into play for scams, fraud, and hacks are the “availability heuristic,” which leads us to remember =>sensational events regardless of their frequency, and the “affect heuristic,” which leads us to emphasize our feelings about a decision over the facts, inflating “our expectations about outcomes we like”—such as winning a huge payout on a gamble.

The marketing pitch of communal faith and reward, the enticement to join a winning team, feeds a human social instinct—especially as more offline modes of connection are faltering.

Beyond money, “we’re just as motivated by identity and community (or its upside-down
cousin, tribalism),” writes Hundreds, “and the most fervent contemporary movements and trends masterfully meld them all together. The only thing that feels as good as getting rich is doing so by =>rallying around an impassioned cause with a band of like-minded friends.”

=>Technological innovation does not change our fundamental behavior as humans, but
technology has brought speed and spread to the gambling table. A single perpetrator can reach more victims faster now that the global world is connected.

For Shapiro, effectively addressing online fraud, hacks, and scams requires political, economic, and social shifts such as creating incentives for businesses to protect customers and penalties for data breaches, supporting potential hackers in finding community outside of crime, and developing government and legal policies to prevent illicit payment through mechanisms like crypto-currencies.

Shapiro admits that shifting upcode this way will likely take generations, but the work has already started. The SEC’s recent moves against crypto exchanges are promising steps, as are the FTC’s public warnings against scammy AI claims and generative AI fraud. Growing public awareness about the importance of data privacy and security will help too. But while some humans are working on evolving our social systems, others will continue to hunt online for other people’s money. In our lifetimes, fraud, hacks, and
scams will likely always find a home on the internet. But being aware of the upcode all around us may help us find safer paths through the online jungle. “