Schneier on Security

Clive Robinson • September 7, 2023 7:46 AM

@ ALL,

Data you don’t control is open to causing you harm.

It’s a numbers game that is the inverse of a lottery…

The tag line on a lottery is the mug bait,

“You’ve got to be in it to win it”

The inverse for credit cards and the like is,

“If you do it you can rue it”

Oh and as our host @Bruce noted many years ago, centralized databases are an invitation to criminals and worse.

Clive Robinson • September 7, 2023 8:24 AM

@ Anonymous,

You’ve not asked the obvious question,

“Do people have sufficient choice?”

The answer is mostly they do not.

I’ve heard of people in the US refused dentistry and similar because they either can not or will not present a credit card even though they have a stack of cash in hand.

In the UK even though it is against the law, an increasing number of cafés and similar are,saying “Credit Card Only” on their doors.

As others have indicated you can save upwards of 20% by “buying online” and get it delivered ontop of that.

Not that long ago you could get “anonymous debit cards” that were as effective as “credit cards” not any longer… Because like most “anonymity systems” certain people use “think of the children” arguments to get them blocked or stopped for their own distinctly harmfull ends.

This is a very clear example of the very real harm such “we have the right” mentality idiots do. They might say “think of the children” but ask them “What about lives damaged by Identity theft and the harm that causes their children?” or “How many innocent bystanders, and their children?”

Don’t be surprised if their only response will be the equivalent of “The poop emoji”.

Clive Robinson • September 7, 2023 2:44 PM

@ Bob, Ted, Winter,

With regards,

“The fact that nearly everyone in the US…”

The figures availabke say over 8 in 10 American adults have one or more credit cards so like it or not that is factual.

Now to move on,

‘apparently likes “instant gratification convenience over their long term security”’

The credit card first appeard nearly a lifetime ago and has became very very popular due to US Financial institutions pushing them so hard. Ask yourself two questions,

1, Why they became so popular?
2, Why they are behind most US consumer debt?

As for,

‘suggests they have not yet had a piece ripped out of them.’

In the US credit cards are the basis or behind much theft be it directly or by identity theft.

The US Finance industry are very well aware of this and their supposed “fraud checks” still do not work.

Ask yourself why if so much fraud is as a result of this data the US Finance Industry does not take stronger measures to protect either card holders or merchants?

Our host @Bruce has in the past repeatedly pointed out that they “take the profit and dump the risk” by the process of “externalising risk”, “buying legislation”, and “rights striping” by amoungst other tgings making restorative litigation by the harmed so expensive it’s effectively not possible.

To say the US Financial Industry is in chahoots or actually a conspiracy with the criminals would probably pass the dictionary test…

You might not like what I’ve said but it is supported by evidence so no appology.

But you should also read my second and third comments.

@ Ted,

You deliberately left out the word apparently etc in your quote, which changed it’s tone.

@ Winter,

It’s not as you put it a long story, the US is by some definitions bankrupt. It only survives because it runs on so much debt it has littler or no chance of getting out of it in any of our lives or that of our grand children.

The US finance industry know this and mostly their existance is taking 10 or 20% off the top in one way or another and then it gets hidden by the likes of Quantative Easing.

The old economists view that debt drove production by consumption left out the one thing that every relator knows “location location location”. Creating debt in your country to create production in another country is not a smart way to behave. I’ve been saying that “out sourcing” and “off shoring” are very bad ideas for about as long as this blog has been going, and my logic does not appear to have been refuted.

@ ALL,

To this I now add the US polititians views of trying to ban sales to China under a variation of “International Traffic in Arms Regulations”(IATR) and “Export Administration Regulations”(EAR) is not just pointless it’s more harmfull to the US and it’s citizens than China and history shows the reasons are simple,

Firstly China will just move forward in aquiring what it needs to achive it’s stratigic goals thus develop it’s own compeating industry to sell in competition to others including the US. This has happened repeatedly since Japan started in on what we now call “Fast Moving Consumer Electronics”(FMCE) in the 1960’s.

Secondly the way the US politicians are going about it they are crippling the ability of US Companies to make sales not just Internationally but Domestically, thus killing the companies growth and economic benifit to the US both domestically and on the world stage. The harm this will cause to US Citizens is one of the reasons why certain events happened nearly just a couple or so years back.

Clive Robinson • September 8, 2023 12:10 PM

@ Anonymous,

Re : What business

“If one type of business was to be avoided for bad security practices the other business doing the same should be avoided too. My question is if that is the case.”

Not realy because it may not be relevant to what you are trying to achieve.

Normally we talk about “Risks” based on other “games” but people do play “rigged games” and still win against those rigging them. They claim their success is nowing when to get in and importantly out in a way where you have a benifit better than you would in an “honest game”.

So you look for “Benifit v. Risk” on each and every game, not on the industry.

Whilst benifits are peculiar to individuals, risks tend to be general.

Risks, are based on,

1, Variability
2, Velocity
3, Harms
4, Regulatory
5, Residuals

In the case of variability you have changes that have both direction and velocity. Direction can be seen as a trend perturbed by “noise” that takes ot away from a base direction. Those that can predict the various trends can take advantage of them. Which brings into question time. If you can get news faster than an opponent then you can get inside their turning circle of their decision loop. If you can also respond faster than they can then you can outperform them, thus profit at their expense. This is basically what “High Frequency Trading”(HFT) is all about in essence playing the “OODA Loop of trading”[1] tighter than others. It is not realy about skill knowledge or stratagy, just the ability to use an opponents time delays to your benifit by shortening them in variois ways[2].

All games of chance which finance investments are are subject to the OODA loop reasoning. To try and stop the advantage to others the, xchanges prioratize certain trades over others (much as happens with those “stock brokers” who buy and sell shares[3]).

Obviously the higher the velocity these changes happen, the less time ordinary people have to get advantage, and the mote advantage the exchanges have to play you.

But every economic activity is not carried out in issolation, they are all at some point based on “work” that involves “inefficiency” and “energy in”. Crypto Currencies have the worst efficiency of just about every activity you consider. Gigawatts of energy to produce a list of numbers that you could write on a piece of paper.

Such energy does not come from “nowhere” or go “nowhere” they add to all the other “waste energy” causing some form of environmental “harm”. Such “harms” effect us all detrementally eventually so it is a significant risk factor.

Other harms are “market instability”, “economic instability” and thus “National Security”.

Which gets politicians not just hot under the collar but keen to change things by regulation and legislation.

There is nothing stopping a bunch of politicians producing legislation that makes all processes in crypto currency production and trading illegal, thus making your piece of paper with a number written on it worth about as much as that piece of toilet paper you flushed not so long ago.

That is crypto currencies have no inherent worth thus residual value.

A room full of coins might have no spending value but melt them down and refine out the metals and you will almost certainly have residual value. The older they are the likely hood is the residual value is higher.

For instance in the UK when we stopped using 240pennies or 20schillings to the pound the scrap metal value to the Royal Mint was immense. Even the new bronze coins issued actually now have a considerably higher residual value than their minted face value.

I have a couple of tubes of “pocket change” from earlier in my life thanks to a film about Glen Miller. The refined metal value alone vastly exceeds the face value including “official” inflation. But as always in life there are people who give premium value to thinks that are old / rare / scarce / irreplacable.

Between you and me what residual value do you think the integers that make bitcoins will have if they are made entirely illegal?

Yes there are other considerations but just comparing one bad system with another bad sustem does not make either of them better systems.

Comparison across the widest set of risks might give you information like “least face value risk” and “highest residual value” in which case we would be talking about bullion coins in precious metals.

But remember what the US Gov did with gold back in the 1933 using EO 6102, issued under the hand of Franklin D Roosevelt and it was a real “Might is Right” con game. It seized all gold bullion and coins forcing citizens to sell at well below market rates, thus denying them even the fair residual value. Almost immediately after the effective “grab at gun pont” Roosevelt and his cronies then set a new official rate for gold that was much higher as part of the Gold Reserve Act 1934. Oh and in the process effectively devaluing the paper dollar by a very significant amount.

As my father once told me about politics, what might be imposible the first time, becomes ever easier each time there after.

As @JonKnowsNothing, has pointed out in the past nothing is safe from “Might is Right” thinking prevelant in the land of the Corperation, even the home you own can be taken by trivial legal tricks. Worse even the rain that falls from the sky onto your land so you can grow food in many places is not yours.

What ever has sufficient value to rob, has sufficient interest to somebody with a pocket full of legislation to grab… And the only way to survive is by being,

1, Mightier
2, Not there to be robbed
3, Sufficiently inside their OODA that you in effect rob them.
4, To diverse and fluid to be robbed on all fronts simultaniously thus flow around them.

Whilst large Corps might appear “Mightier” they are actually not, they actually use shell companies etc in foreign countries so they are “Not there to be robbed” they also bribe those in power. This bribary works because the tiny slice that goes in the legislators pocket to turn a blind eye is way way greater than the slice they would get from legislatively grabbing all the Corps assets, if they could which would be doubtfull. If you want an education in money laundering examin how Corporates avoid paying tax and then claim it back as losses…

Also Corps due to lobbying are usually well within the legislators OODA, thus with their diversity and fluidity across national boarders usually get away with little loss.

It’s one of the reasons the EU putting in place fines based on entire corporate financial movments caused such shock in Silicon Valley, they thought they would always be able to “skip across the boarder”…

The Corporates will now adjust in various ways. I wrote a report on how to do this for a friends company a decade ago when a certain idiot in the UK went after them like a rabid dog. Whilst this is not to difficult to do for “untraded companies” Corps of the Silicon Valley scale arr almost always traded, thus to maintain their artificial share value they have to declare the figuers the EU went after, to get investors to buy their over inflated shares.

So the two rules,

1, Don’t say anything.
2, Fleetly fly in darkness or by daylight to stay out of sight.

If you think there is any other way to avoid this “Might is Right” game you are very probably mistaken. But one thing is certain crypto currancy, NFTs, Smart Contracts and similar are not the way, other than for crooks to enrich themselves briefly at the expense of others less savvy.

Remember that to function all the crypto currencies, NFTs and Smart Contracts break rule number one,

“Don’t say anything”

Because to avoid the “double spend” or equivalent problems they all leave a certified public paper trail that can be walked backwards.

Oh and to try and recover value, also breaks the second rule,

“Stay out of sight”

Because you have to in effect be public to transfer the coins etc via that public certified paper trail.

[1] The “Observe-Orient-Decide-Act”(OODA) loop is a cycle that you try to turn into an advantage by being able to “get inside the opponents loop” which can become a “spiral game” and certainly has with “High Frequency Trading”(HFT) where beating the speed of light at any cost[2] has made life interesting. The OODA loop was developed by US military strategist, Air Force Colonel John Boyd and has since moved on to many many applications I doubt he could have predicted.

[2] We are told the speed of light is the fastest thing in our universe and it therefore can not be beat. Whilst currently held as being true it does not mean you can not cheat in some way. We know that To get information from A to B requires two times that are additive. The first is the length of time it takes light to get from A to B by the shortest available path, the only way to reduce this is by getting closer in some way (and why HF radio is being seriously looked at). The second is due to sending the information from the first bit to the last bit requires “Channel bandwidth” or more importantly it’s inverse “time”. Thus readducing information and thus time is possible even when you can not expand bandwidth. The question is how, obviously it will involve “data compression” but can we do better? Simple answer is “Yes a lot better”. How? By sending it ahead of time… Sounds impossible but it’s not, you use a simple trick that is more than a thousand years old, you use the old secrecy system of a “code book”. That is you send the bulk of the information in advance to cover all the eventualities you want to cover and you give each a very short identifier. Then you only need send the identifier at the appropriate time. Lets say there are eight eventualities you have decided are of relevance, then all you have to do at the appropriate time is send three bits of data at as higher bandwidth thus lowest time delay you are alowed. Yes there are dangers in that noise may cause a bit to get flipped, but by carefull use of coding theory you can maximise the error distance between the messages –see Hamming distance for a starting point– thus minimise the risk. Another trick is to have standard codes for each eventuality and have a second code for a particular trade. If you interleave the numbers correctly you can minimise the response time at the receiver by effectively running the code book lookups in parallel.

[3] You can be sure that when they tally up if a group of trades for a particular share went well their favourd traders will be at the front of the que thus get the best rate, whilst you will probably get the tail or worst and if it is a bad trade you will be first to get the hit. More fun is offseting, where they have two opposit trades to buy and sell the same share. If you are selling you will get not just commission but the days “low rate” and the buyer will likewise get commission but the days “high rate” so whilst your sahres might only get you $25/share the buyer will give the house $30 for each of your shares…

Clive Robinson • September 9, 2023 9:55 AM

@ Winter, JonKnowsNothing,

Part 4,

I know it’s not popular but people need to know that the number of criminals in imigrants is way way higher than in any equivalent sized domestic population. And where the criminals go trouble of a violent and deadly nature almost immediatly follows as normal and we see it all over the world. Because for criminals human missery and lack of authority is a natural segue as sewers are to rats. And with them comes “Human trafficking” and the most base of crimes against humanity because there is immense amounts of wealth to be made.

Unfortunately the criminals though few in comparitive numbers create vastly disproportional effects and whilst the self entitled use Corporations to hide behind, the criminals hide behind the actual immagrants that are not criminal but just trying to in most cases survive as best they can. In a way the criminals set up their own “Police States” within imigrant populations and the populations quickly get seen in that light.

Which enables others to easily carry on striping humans of their rights and using them as commodities.