Schneier on Security

Clive Robinson • December 11, 2023 5:34 PM

@ Winter,

“Without tech, you will neither get security.”

That’s realy not true at all, for several thousand years there has been security without technology, by the application of what we call “field craft”.

As I frequently point out basic technology is agnostic to use, and currently it very much favours the watchers not the watched.

As for,

“Give us evidence, not random soundbites.”

How about Turkey, and of the 1/4million users of a supposadly “secure messaging app” ~10% were rounded up and arrested, some of whom are now in effect “Disapeared”.

But perhaps you should take a closer look at what it is claimed Meta VP of Messenger Loredana Crisan when she wrote,

“The extra layer of security provided by end-to-end encryption means that the content of your messages and calls with friends and family are protected from the moment they leave your device to the moment they reach the receiver’s device.”

As I’ve said repeatedly in the past if your security end point is before the effective communications end point then the system is not secure.

Loredana’s statment make it crystal clear that the Meta/Facebook system is not secure for precisely this reason.

Like so many others you put way to much faith in little bits of technology and do not see the whole systems. Remember a chain is only as strong as it’s weakest component, and in fact a component that is too strong also weakens the chain.

Puting faith in technology is unwise for many reasons as I’ve also indicated in the past, especially when you’ve know ability to assess it the story behind the NSA Dual EC_DRBG is an abject lesson in “hiding in plain sight” the fact that an upto that point “Well Respected” Security company and a less well known Network Company got their customers “back-doored” should tell you something.

But it gets worse EncroChat amoungst several others is proof of this,

https://en.wikipedia.org/wiki/EncroChat

Oh and for those that remember the “Rainbow books” and A1 security[1] and why it had a requirment for delivery by armed guards… Any one remember the Ed Snowden trove that revealed the NSA getting the delivery services to covertly divert packages to them, which they opened, inserted implants into the hardware resealed and gave back to the delivery service to deliver with a hardware backdoor in the equipment…

You have previous argued it only happens to a few so is not realy relevant… What is however, is that it is not just possible but actively going on and rapidly spreading across all communications technology.

Other arguments that get made about “you’ve no need to worry you are not of importance” are equally as specious as Turkey demonstrated, and both China and Russia are in the process of solidifying. Because you have no idea when you or those you have contact with may become a “person of interest” even though you might have done nothing wrong. You might just be “convenient”.

For many years now breaking encryption has not been of major interest to the SigInt agencies or the higher levels of Law Enforcment. What is, is the meta-data and meta-meta-data about communications flows and who contacts who and in what statistical patterns they fall into. It’s a small but very powerfull part of “Traffic Analysis” that builds intel on organisational structures and who can be used either to be leaned on, or as a way to get an entry into the system by “methods and sources” (ie technical and human).

As I’ve said before I don’t use “secure apps” or the services that provide them, I’ve more knowledge and sense.

[1] See US “Department of Defense”(DoD) standard 5200.28-STD known as the “Orange Book” (replaced by DoD 8500.1, which was later updated as DoD 8500.02 after the Ed Snowden Revelations).

Clive Robinson • December 12, 2023 2:59 AM

@ Winter,

“Without technology people die.”

With technology people die, so it’s a non sequitur statment about the value of technology.

“You are saying that you should not put a lock on your door because a lock can be picked. Do you have a lock on your door?”

Sometimes your analogies and reality have a very marked seperation, to the point they lack relevance or meaning.

“If you do not use E2E encryption, you have no privacy at all.”

Another non sequitur, E2EE does not give privacy or secrecy only some measure of work factor to an opponent you can not show is there. On the flip side privacy can be obtained by as little as folding paper and putting it in your pocket, if the opponent does not know it’s there, they have few opptions, but if they act they reveal themselves, thus you change behaviours accordingly.

“You would argue they are better off alone because being in a school or flock makes you suspicious and a target for predators. Evolution has shown otherwise.”

Actually that’s not what evolution shows. Preditors attack flocks, schools, herds for the same reason bank robbers rob banks, they are resource opportunity rich.

What a grouping actually does is make the vulnerable more vulnerable.

There is a saying,

“If you want to go fast, go alone, if you want to go far, go with others, if you do not wish to be left by the wayside, be the fittest in the group.”

The weak are in a herd as a sacrifice to the preditors the herd attracts by it’s very existance as a resource rich entity.

Which is why,

“If everybody uses E2E encryption everybody is more secure and no one sticks out.”

As I’ve said it just increases the preditor work factor so the preditors change their tactics.

We already know that legislation is being touted for “on device” systems where your devices are forced to spy on the plaintext on your device. And because the security end point is not beyond the communications end point you can not stop it reporting back to the mothership.

What you consistantly fail to understand is E2EE is a very small part of a secure system, and importantly it needs to be in the right place in the system as a whole or the whole system will fail.

Which is why,

“We know, because the same happened with https. No one is worse off by using https, everyone is more secure.”

Arguably they are worse off. From the trivial increase in the need for CPU cycles and power, to the more problematic that it’s not stopped the SigInt agencies or Law Enforcment agencies, “collect it all” still happens after all. The agencies have just changed their tactics to where the workload is less and blocking their attack behaviours oh so much harder for the defenders.

We walked through this nonsence back from the early 1990’s for a couple of decades with banking apps. Even now they are still not correctly designed to give sensible levels of security. What the herd effect gives is that sacrificial “low hanging fruit” in what is a very “target rich environment” gets picked off first as their work factor is lower for the preditors.

One such change though is the ramp up of “Ransomware” as the reward effort ratio changed which arguably is now a significant form of financial crime.

Clive Robinson • December 13, 2023 10:37 AM

@ emily’s post, ALL,

The “devil” or the “good god” may or may not be in the details.

I’ve given several multiple times in the past.

I’ve also warned in particular not just about keyboards but spell checkers and the like as security risks.

For instance online spell checkers give away a bio-metric of your typing cadence, irespective of how much encryprion in HTTPS or Tor etc is used.

@ Winter,

A “Logo Turtle” is not a creature but a simple device used to do crude vector graphics for children learning programming,

https://en.m.wikipedia.org/wiki/Turtle_graphics

Clive Robinson • December 13, 2023 12:45 PM

@ lurker,

Re : Technology.

You have to be careful about the etymological origins of words.

Ask people to define “manufacture” and then show them that it actually means “made by hand”.

Another that has had a reversal of meaning in probably less than fifty years was “bachelor gay”…

Oh and if memory serves the OED regarded the 17th Century (1600’s) definition you quote as nolonger acceptable…

Yup the old poem that starts with,

It stands to reason,
If I stood on my head,
With face so red,
You’ld think I’d fed,
On the ground chillie season.

Kind of starts making sense (read it aloud if you don’t at first get it).

Clive Robinson • December 13, 2023 8:27 PM

@ Winter,

“If you look back at the early stages of human tool use it is clear that there is a divide where humans combine objects and shape materials to combine them into a tool.”

It never happened.

Archaeologists have indicated that stone tools go back around 2.5 million years ago and more recently to atleast 3.3million,

http://nature.com/articles/doi:10.1038/nature14464

With simple smoothed hammers and simple flaking. The more precision knapping of certain stone types like flint, chert and the much harder obsidian for cutting tools like scrapers, axes and spear heads are dated around 750,000 years ago. With the use of jade in the Far East still an open discussion (they moved from being tools to use to prized art very quickly).

Humans however well they only go back 315,000 years ago…

So the tool develipment you describe is atleast twice as old as homo sapiens –humans– as a recognisable spiece if not seven times.

Also,

“I would not classify as “simple” a general computer language that is considered a “dialect” of Lisp and the inspiration for Smalltalk.”

The “Logo Turtle” was a “name” for the robot, it was not restricted to the use of just the Logo language. It works just as well with both Pilot and Python and their are implementations of Scratch as well.

The four basic commands are,

1, Pen up
2, Pen down
3, move X millimeters
4, Turn Y degrees

If you used Turn greater than +-90 degrees some implementations automatically fliped things 180 degrees and put the turtle into reverse movment/turn as this gave better tracking accuracy.

There were other commands for closed geometric shapes from circles and ellipses upwards, even conic sections and parabolas, even Bezier curves depending on who’s implementation you picked (some even worked with HPGL commands).

For my sins I wrote assembler level “word” extentions for FIG Fourth for the 6502, Z80 and partially for 68000 to run on the BBC model B and the Torch Z80 and 68000 boards that connected to it. The former running CP/M and the latter running Unix as the respective OSs[1].

The point being to make robot control not just as simple as possible for children/students but as flexible as possible as FIG-Forth ran on nearly every home micro there was at the time and importantly unlike the “Algol like languages” was free and easily available. Unlike for instance the price of a C compiler which was often two to three times the price of the computer. As for Fortran 77 or Pascal, dream on, from memory only the Apple ][ using the UCSD P System had such languages in the late 1970’s and later the RM 380Z and they were 10-20 times and 15-33 times the price respectively of an afordable home-computer of the early 1980’s. Schools got something like 50%+ discounts and did not have to pay VAT (sales tax). So RM machines appeared in UK schools but students were mostly not alowed to use them, and it was not untill the BBC Model B came out from Acorn Research Machines (later ARM) that computers were considered low cost enough for school kids to actually bash their sticky fingers on…

[1] I started updating these to a generalised hardware interface on a 14pin DIP socket or IDC Pin header for a robot umbilicas giving GND, +5V, +12V, -12V, Serial RXdata, TXdata and eight status lines that could be input or output at TTL levels to work with most 8bit home micros. The idea being a loose standard to make interoperability of peoples designs possible. I presented this to the UK Robotics group at a meeting at North London Polytechnic (NPL, later Uni). However the leader of the NLP robot group there was not just “Not Invented Here”(NIH) hostile but vehmently and rudely so, shouting people down in the meeting… Whilst the likes of Frank Spilsbury (FIG-UK) encoraged me to keep going, as did Len Stewart (ACC) the continuous bad mouthing out of NLP was getting beyond the point of loud mouth threatening, so I said “It ain’t worth this 5h1t”. The person at NLP later lost all credability with the whole community because they claimed they could get ZX-Spectrums at a discount rate, took lots of peoples money then failed to deliver, then just prevaricated. It took absolutly ages to have the money returned, so ruining something like a hundred peoples christmas’.

Clive Robinson • December 14, 2023 1:11 AM

@ JonKnowsNothing, Winter,

Re : Knapping patterns.

“Part of the study showed that these techniques appeared about the same time, across geographic areas, across cultural demographics.”

An experienced knapper can pick up another knappers work and reverse it in their heads then run it forward again on a new “core”.

What is known but not widely talked about is that early humans unlike those that came before them traded widely.

Join those two pieces of information and you can see why progress became almost universally stepwise.

As for modern knappers, someone not so long ago did a mathmatical analysis of knapping patterns, and their findings were interesting.

Knapping is non-optimal for the tool purpose. That is cutting edges can be cleaved to a finer angle giving superior cutting and life.

However the knapping is much nearer optimal for maximising the number of tools against wastage. Every time you strike a core to remove a flake you risk ruining the piece irreversibly. Thus time / energy / material resorces would be turned to waste if you tried to optimise for the superior cutting angle.

Somebody has done some mathmatical analysis on cleaving in the glass like volcanic rocks. There are several cleaving angles from broad to very fine. Knapping for a broad angle is energy intensive for little result, cleaving fine angles such that the flakes are the cutting tools uses much less energy but the size and shape of the flakes are almost random so too variable to consistantly turn out tools.

A two stage process can also be seen between a hard impactor made of stone and a soft impactor made of bone or antler. In essence the hard impactor did “rough work” to bring the piece to oversized shape, then the soft impactor would remove small amounts of material to achive the desired finished edged item.

So the optimum is some point in between, which using hard impactors then soft impactors gives you (kind of like a double grind on a hard steel knife).

Mad as it might appear you can apparently knapp certain types of glass, and the edge is scarily sharp. Some say better than the finest ceramics made industrially. However certain glass has an odd property in that it appears to store stress. You may have heard of plate glass shower screens spontaniously shattering, I’m told it can be quite scary when it happens.

The reason is apparently every time you stress the glass it has a physical memory effect and a clock effectively starts ticking down. Based I’ve been told on the build up of nano-fractures, that join up slowely and become faster joining micro-fractures and then the glass just lets rip like a small bomb. It’s apparently akin to what happens with Prince Rupert Drops,

https://www.smithsonianmag.com/smart-news/researchers-crack-400-year-old-mystery-prince-ruperts-drops-180963308/

I guess the last thing you would want is your extrodinarily sharp glass tool just self destructing on you with no apparent warning.

It’s quite a few years since I last talked to the dentist that was not just making scalpels this way but also shining lasers down them as well to stop bleeding. He told me that the cutting was so fine most people did not even feel it cut.

Clive Robinson • December 14, 2023 6:07 AM

@ Winter,

“That is maybe about 300k years”

Actually a little over that. But you are just confirning what I’ve said about hunans –homo sapiens– but as I said it’s not much talked about (as it’s fairly recent).

The three papers from Science back from five years ago are,

http://science.sciencemag.org/cgi/doi/10.1126/science.aao2646

http://science.sciencemag.org/cgi/doi/10.1126/science.aao2216

http://science.sciencemag.org/cgi/doi/10.1126/science.aao2200

You might like to give them a read, especially the first as it in effect moves human –homo sapian– development backwards in time by between 30,000 and 50,000 years.

Interestingly it’s not just the tools but pignents, that suggest that there was a significant culture above that of simple hunter-gatherer and that the range of familial spread by partner swapping was upto 100km which for a people that moved on foot carry their possessions is a significant range, that would realy only have been possible by complex interaction of trade.

Of further interest is the lack of large cutting tools, suggesting the need for cutting down larger vegitation was nolonger required. Along with the evidence of piercing tools may suggest the use of easily transportable shelter such as hides stiched together to form clothing and primative tentage.

As I’ve mentioned a couple of times in the past I have an interest in “industrial archeology” that is things that required more than one or two individuals working in concert at a more or less fixed geo position using trade to bring in raw resources and take out “value added” or “utility added” goods that were “manufactured”. Due to the mode of transport this would favour small items of significant value perceived or actual, which is what is being seen in these papers.

Anyway this has gone way way off topic so we should either conclude or move it back into the more general security domains.

Clive Robinson • December 14, 2023 9:13 AM

@ Winter,

“But Homo sapiens is only half the story of technology.”

As I’ve said all along it rather depends on the “test” you use to decide if it is “technology” or not.

Your argument is everything done is “technology” which it is clearly not as the law and religion currently exclude everything that is not homo sapiens.

It’s why I asked you the question about spiders spinning webs and logo turtles drawing the equivalent under the control of a program, that you’ve so far avoided answering by throwing in lots of diversions.

I’ve even provided a valid test that like Arthur C. Clarks definition of “advanced technology” stays valid as those recognised legally and religiously as part of society develop.

You however just find ever more tightly turned “tail spin” arguments. You wave your arms make rookie mistakes and round you go again.

Each time failing to define what you consider is “technology” without it being totally without measurand thus unquantifiable and testable thus effectively meaningless.

The best you’ve done is latch onto a definition that is without test or measurands and is basically “arm wavery” via pseudo-qualities not usable-measurand, the fact dictionaries and Wikipedia do it does not give it credence, especially as pointed out they have to change it every couple of generations.

So, sorry not to be unkind but,

“No test and measure that holds with societal change/development, then no play”.

Clive Robinson • December 17, 2023 1:18 PM

@ Winter,

“Empirical sciences have only existed for some 4 centuries. Systematic philosophy of nature maybe for 2.5 millennia.”

Prior to the mid 1830’s there were no scientists, as that was when the term was coined. Prior to that they were called “Natural Philosophers” and in some places still are. Importantly they were men practiced in the arts of knowledge (science derives from the Latin word for knowledge).

Also prior to the 1830’s graduates of universities were usually expected to become “men of religion” or “men of law” as that was what universities mostly had their roots in teaching.

It was Medicine from the Renaissance that was the effective start of natural philosophy in universities and the breaking away from the “first estate” of “Church and Law”.

But as for what we now call science, when it started is realy unknown, because men were not involved. Whilst it is true that men were involved in science going back to 4000BC or earlier… Even they had to eat. We know that science started in the kitchen, where the basic measurand we first know of was a hens egg, and the recipies the start of organised processes. Nearly all our subsequent measurands came out of the kitchen in the form of “seed” etc, even your shoe sizes are still measured in “Barleycorns”(1/3 inch).

But how far do “reproducable processes” go? Industrially it would be atleast the Chalcolithic “Copper age” ~3500BC when casting molds for reproducable metal artifacts were first “known” to have been used.

But many industrial archeologists will argue that to do copper smelting needed charcoal and that requires a specialised process, as does brick and tile making.

You will also here about “slip casting” moulding predating copper smelting we can certainly trace it back to ancient Peru and China, and earlier to Rome from Egypt or Persia. Many repeatable processes trace back to or through Egypt with potentially metal smelting / casting guilding with gold to ~3500BC (but not electro-plating).