Schneier on Security

Clive Robinson • March 5, 2024 7:54 AM

@ ALL,

There is a saying,

“Sometimes when you pay for what you get, you really pay for what you get over and over.”

Meaning that “buyer beware” is rather more than a surface effect.

Worse that there is no real correlation between paying more and getting better quality (remember security is part of quality). Also there is not a correlation between paying less and getting less quality (thus security) even though the price difference has to originate from somewhere, the question is “where?”

As a rule of thumb these days you should ask “Why is this connected to the Internet?”

That is what justifies the expense of,

1, added components
2, added software
3, other added such as board area.

And importantly,

4, What does the consumer gain
5, What does the producer gain
6, What do third parties gain.

If your “third party model” includes data brokers, law enforcement, and Governments –and it should– then deciding the price is too high no matter what you pay may or should tell you to make a different purchasing or acceptance model.

Money may not be everything, but peace of mind almost certainly is in the long term.

Clive Robinson • March 6, 2024 4:57 AM

@ R.Cake,

Re : Security systems that are secure.

“Just wondering: does anyone on this forum [know] if there are known-good camera doorbell systems? The technology is clearly available to – for example”

Yes there are, quite a few, but they are not “consumer grade” but “professional grade” and carry not just a significant price tag, they are usually not for sale via outlets but only through “professional service installers” and the like at eye-wateringly expensive prices.

There was once a growing “semi-professional” market but that has been swept away due to hidden third party profits (see my point 6 in the first comment of this thread).

By any reasonable definition of security, any security system that as part of it’s primary function,

“Has to route via third party servers on an insecure public network by deliberate design”

is not secure.

And almost certainly had some kind of “con game” in play as well.

Which is why you find out that Ring and Amazon are running what is actually an extension of the “you are the product not the customer” Internet “Let’s get rich on the theft of PII” idea.

Combined of course through the,

1, Bleed them by rent.
2, Bleed them with forced obsolescence.

Both put in place by the likes of John Deere, Amazon etc to increase profit.

If you look back Ring devices were being given to US Law Enforcement “for free”, who were then using then as “give aways” to people who “over looked” lets call them “places of interest” and the LEO’s acquired access to the Ring servers where all the footage was stored…

There is a private report floating around in the “Private Security” world that does the cost comparisons of getting such surveillance installed and the professional installed and all to obvious “street lamp” systems.

In short it’s way better than 450 to one on average.

The police get the “door bells” given to them, they can be installed by a “community beat officer” in five minutes or so, and about a half hour of installing and demonstrating the app on a householders phone etc it’s done say two hours tops of police officer time maybe a day total with the paperwork etc. They LEO’s then get a copy of the feed via a let’s call it a rental agreement with the commercial organisation that supplies the cameras for free.

Compare that to taking upto six months of negotiation with the city authorities and in some cases upwards of $100,000 to install and run for a year a professional system They LEO’s also have to supply their own monitoring staff and recording equipment. Which is why the LEO’s used to sell access at road junctions and the like to traffic control and auditing firms who packaged it up and sold it back to the city planners as well as commercial radio/TV etc for “live traffic news”.

Cost wise these free Ring and similar devices are a “no brainer” for the LEO’s. The only difficult part is getting some householder to allow the install. This is where the “We are the good guys” comes in. Usually if LEO’s want to put surveillance on a property it’s because of “complaints received” by locals who are having problems with the property. Thus a friendly “Community beat officer” does a little friendly building of bridges and does the old “you need a burglar arm” style sales trick and most house holders “getting it for free” will agree faster than a hat can reach the ground under gravity…

Now what’s in it for the third party company?

Well they also sells those feeds to private “security organisations”. Knowing that the local LEO’s have “put them in” then the sales go at “premium price”.

It’s a variation of the model Palantir uses that has built them up to being some claim the worlds largest security organisation that rivals both the CIA and FBI on coverage and depth of information.

So whilst what you want is quite easy to do, it’s not going to happen the “closed source” commercial way as there is way way to much hidden third party money floating about.

So if you want to start your own FOSS system then good luck, the problem is getting the hardware.

Do you remember what happened with the FCC and WiFi routers?

Expect the same to happen if a FOSS project gains traction.

Oh a friend and I did an informal test recently of just how much “street facing” “home surveillance” there is in London streets[1]. We found in certain areas as many as one in five properties had them… Most of them technically illegal as they were not registered as they are legally required to be via the UK “Information Commissioners Office”(ICO) as a data base.

[1] As I’ve mentioned before you can spot CCTV cameras by a variation on the “red-eye” or “lamping” effect of 180degree internal reflection of focused optics (think those “cats-eyes in the roads). Spotting “CCTV video over WiFi” is also not much of a technical challenge due to “basic traffic analysis” as the shape of the transmissions have certain distinctive features well below the abilities of encryption to hide. So using one to find the other is not difficult either.

Clive Robinson • March 6, 2024 11:26 AM

@ Peter A., ALL,

Re : Looking out allows looking back

“Just install an analog optical peephole with a fisheye lens, you lazy chimp. Or a (partially) glass front door.”

Both of which work against you with criminals.

Criminals that attack homes unless they are really stupid want information about if people are in the house or not.

Even frosted glass allows the movements of people inside a house to be seen from an outside observer. Also there are “reverse peephole lenses” that can look back through a peephole.

From experience of being attacked in my home and being stabbed in the head with a screwdriver, nearly loosing an ear because a neighbour dumped a broken trellis at the edge of the property a burglar grabed and swung at full might at my head, and having had to fight with a saucepan a burglar who had got inside and grabbed an eight inch blade kitchen knife from the block in the kitchen… I’ve spent some time thinking about how to cover not just the front but sides and back of the property and the roof as well[1].

The problem for the defender in the main is “wildlife” causing false positives. A pigeon flying to land on a branch can be the same hight and moves about the same speed as a burglar…

For the attacker knowing when and where you are in the house is vital for them unless they are just mad “nutbars” and some actually use “game trail / nature” cameras to scope a place out and see what routines the occupants might have.

There are various tricks you can do with mechanical clock driven switches to give apparent random light changes. But that only works if they can not observe actual movement.

[1] A Jewish friend had art thieves climb up a neighbour’s property bridge across to their roof and lift the roof tiles cut the felt etc, to go after the artwork in my friends home whilst they were asleep in bed (The thieves had tried to bypass the alarms on all the doors and windows).

Clive Robinson • March 8, 2024 1:24 AM

@ ResearcherZero,

Re : Lord of the flies solution.

“I tore the little sucker off, removed wiring and bits and bobs. I did find that an abusive message telling everyone to go away works. Not for family members unfortunately.”

I had a problem with unwanted callers of the “faux-religious” kind who would “bang on the door to save my soul” at unreasonable times…

So I put up a metal door “fly screen” and hung a genuine electrical “risk of death by electrocution” sign on it. And as it crackled and zipped with blue-white arcs connected it via a time switch to a very high voltage generator (much like the hair raising one you get in school 😉

They came to bang on my door at an unreasonable time and got a bit of a shock… So they called the police… Who when they arrived started off on the wrong foot. I pointed to the danger notice on the self closing and latching/locking gate that clearly said “Authorized Access Only” “Qualified Personnel Only” along with the dire warning of death by electrocution symbols, emergency phone number etc. I pointed out that the requirements of the law had been not just complied with but verified and that they were in fact breaking the law as were the very unwelcome faux-religious nut jobs.

As for “family members” yes they can be a problematic issue especially when having been abusive they become “born again” religious nutbars. Last century I made it clear to members of my family that I regarded any contact from them as “harassment” with a “Cease and Desist” notice that formed a legal contract.

In return for them not contacting me in any way again, I would not take legal action against them. They broke it several times on what they saw as “gods work” or similar before the earthly message sunk in via “14 day notice of intention to proceed” letters.

In a “reasonable world” having to use the “sledgehammer on nut” principle would not be required… But as I suspect you’ve found out for some their definition of reasonable behaviour is “very self entitled” and not even remotely close to your definition of “reasonable”.