Schneier on Security

Clive Robinson • January 10, 2025 5:34 PM

@ Bruce, ALL,

For a jaded old soul such as mine, you have to be somewhat cynical about various aspects of life.

Like Banks and other Financial institutions are always going to be a long way behind on the security of there users (which is why Sim-Swap attacks still work).

What this “advertising ecosystem” tells us is that there is a distinct lack of ability for people to make money on the Internet in ways most would consider “honestly”.

As the old saying has it,

“This is why we can’t have nice things!”

Like Privacy and the Anonymity and Security that underpins it.

Worse, as people find out, those that push to have Privacy “In Real Life”(IRL) and Online / Virtual life those that make the legislation and regulation are “bought off” by Big-XXX lobbyists.

Obviously there is an issue there because you can not be in a “democracy” where “lobbying” and those with “unlawfull interests” can,

“Buy what they want, when they want.”

Effectively with impunity (as the legislation to turn unlawful into illegal / criminal does not happen, or atleast not often).

Thus shocking as this “out of sight” behaviour of those in the “advertising ecosystem” is, in all honesty I can not say I’m even remotely surprised.

Two things people need to understand at a very in-depth level these days,

1, Your Mobile phone number or Email address are now near “universal identifiers” once known.
2, That E2EE and Storage Encryption, now nolonger realy work due to the various forms of “On Device in UI” or “Device Side Scanning” and “fingerprinting”.

Worse the oft faux-legal excuse of “Know Your Customer”(KYC) is used to force you to divulge those “universal identifiers”. Or another wheeze is 2FA using those identifiers for the “side channel”, thus requiring they be divulged.

With just about every advert that happens in your internet or email client is acting either directly or indirectly to do “Device Side Scanning” or “Fingerprinting”.

The “universal identifier” and “fingerprint” are very very quickly irrevocably linked.

Worse the data that then gets recorded is easily available to those involved in “SIM Swap” and similar “social engineering” attacks.

Are there ways to stop this?

Yes use “throw away identifiers” and “change your system fingerprints frequently”.

But the sheer level of “Operation Security”(OpSec) to do this is way beyond most peoples capabilities, due to the way humans generally work.

In the past I’ve indicated,

1, Turn off JavaScript and more recently those HTML5 extensions etc.
2, Don’t have a Personal Email account, and never use the Work one for Personal.
3, Have at least two computers, one that is “Private” and one that is “Public”.
4, Where possible remove all mutable memory from the Public computer and never ever use it for Private activities.
5, Don’t have an Internet or other Communications or Connections that connect to your private systems.

For which in the past it’s been suggested I’m “Paranoid”. Yet here we are at the start of 2025 with an example of why the above points are not in any way paranoia, and were just the minimum of sensible precautions.

But they are now actually insufficient, because there are those that really “are out to get you” in their DataBase or as Nixon used to say “On my list”[1]. With Google, Microsoft, Meta and Apple being just the more obvious actively pursuing ways to make Fingerprinting and Device Side Scanning “built in” and “unavoidable”.

[1] Yes Nixon really did have an “Enemies List” and for a while it became public knowledge and shocked people. Now it’s mostly not known by those less than a half century old, who mostly have only heard at best a “Cliff Notes” version on “Watergate”. It teaches a lesson of “Abuse of Power” that everyone living in a Democracy or Republic should be quite cognizant of,

https://en.m.wikipedia.org/wiki/Nixon%27s_Enemies_List

Clive Robinson • January 14, 2025 2:16 AM

@ Lurker, ALL,

A question that is not being asked about “location” is,

“Why Apps?”

After all we’ve known how to track animals and humans for over a hundred thousand years, probably longer as “hunters”. Likewise carnivorous creatures have done it since before the dinosaurs and probably before life existed on dry land. Because even very basic single organisms can “track” via chemical or energy sensing.

The answer is actually one of “pollution” or “electro-smok”.

As individuals we now push out all manner of EM Radiation that travels out from us for miles. And as some are now only just realising with MSM reports on Starlink and others wanting to provide “mobile phone service” from satellites, it’s actually hundreds of miles into space…

That is we do not need “Apps” to get location at all to find an EM radiating individuals location, nor do we need the individual to have GPS or some other way to know their location to report it by the app.

Anyone who has worked with “Emergency Position Indicating Radio Beacon”(EPIRB) and similar systems over the past half century or morr knows this implicitly, all you need is an accurate “time difference”. Back in WWII we had the birth of the Gee system,

https://en.m.wikipedia.org/wiki/Gee_(navigation)

From which most other radio navigation / positioning / location systems have evolved[1]. Modern GPNS systems when used correctly can get position down to fractions of a meter (by near differential and long averaging) sufficient to measure continental drift.

So we come back to “Why Apps?” Well the answer is that “hunting” by traditional methods is both resource intensive and single target focused.

That is the ROI on traditional single target surveillance methods is very low, but the use of Apps is an “industrial process” not “bespoke” thus has a cost amortized across millions of people. Better yet it is in effect “automated” and in effect free-rides off of other technology as well as having a “mass market” for the data.

However it is all predicated on you being an “EM Radiator”. If you don’t radiate EM irrespective of you having a backdoored App on your mobile phone you are “invisible” to these current tracking systems[2].

Hence the reason other technologies are being investigated for industrial mass surveillance[2] that will become more ubiquitous fairly quickly and make the use of “Apps” mostly redundant.

However consider that as “mobile phone use” is now considered a necessity of modern life and all mobile phones are tracked, not just by the service provider mobile network, but the phone OS supplier, and all to many Apps, not having one puts a huge question mark over you.

Thus it’s easy to see that in the near future location data from facial recognition and Mobile signals will be “compared and contrasted” to not just build up data but as importantly to see quickly “who is trying to hide”. So where CCTV is used not having a mobile phone on and on you will paint a large target on your back.

In effect it will find suspects of “pre-crime” or “thought-crime” or other things such as “poverty” and be used by Guard Labour for all sorts of atrocities.

After all if sitting eating a sandwich in a public space can get you shot by police, that then suffer no real consequences for killing an innocent person… How far do you think things will degrade in the not to distant future?

Especially when current hallucinating LLM and ML systems are responsible for “target selection”?

As far as I can see the only thing preventing current and future AI system use for such activities, is the cost of implementing the AI systems. And you might have noticed it’s dropping very very rapidly.

What a year ago cost $100million or more is now apparently down to less than $500,

https://novasky-ai.github.io/posts/sky-t1/

(And yes some have noted “How unnecessarily creepy” the name is comparing it to “SkyNet and Terminator 1” from some old Arnie films…)

[1] Whilst arguably what became RADAR and the German “crooked leg” beam systems came first, they were not general location and crude and inaccurate. They were at best “flight path” systems that got less and less accurate with distance from the transmitter which limited their future use.

[2] This issue of “The Invisible Man”(TIM) has not been lost on certain people in Governments and Guard Labour and the marketing industry. Which is why “facial recognition” systems are getting considerable effort this century. Especially as the traditional CCTV “sensors” are now as little as $10 and falling and new technology using optical phased array MEMS sensors that are too small to be seen and don’t show up in most traditional “bug-sweep” detectors are coming into service. Whilst not strictly accurate the term “Micro-Optoele-Ectro-Mechanical Systems”(MOEMS) has been used since the mid 1990’s and seen in E-Ink and some Projector systems.

Clive Robinson • January 20, 2025 9:56 AM

@ Buggy,

I’ve advised turning off javascript since almost before it became popular back last century.

Nobody has made a “secure sandbox” for consumer and commercial personal computers, computing devices or other smart devices such as Smart Phones. Nor it would appear for US Government users either.

By definition Javascript is “not trusted” and mostly “not secure”, and if thought about sensibly nobody would run “untrusted insecure code” on their computers.

Not using Javascript or around 2/3rds of HTML-5 makes your On-Line activities even safer these days than it did last century.

The people who get most upset are those who make a pittance pushing scamy adds and often included malware at users who do not have the skills necessary to defend themselves. In the past the users computer would be taken over and used as a “bot” or “cut out” to run attacks against other computers and users and even crypto-coin mining and click-scams.

If a site is being “run for profit” but can not “earn it’s keep” evolution would suggest it’s not going to survive anyway. So the sooner those who run it learn the lesson the sooner they can move on to something that will perhaps earn them some kind of income.

But also consider quite a few people are on mobile data plans where “unsolicited advertising” and the veritable tsunami of scat that entails steals large amounts of their data plan that in the US in particular they’ve paid a very high fee for to incumbent telco’s who all apparently happily defraud the Government, their customers and just about anyone else they can. Who spend tens if not hundreds of millions a year via lobbyists to ensure they can continue their very scamy ways.

These are the sorts of unlawfully behaving entities that make so much “tax money” from your pocket for doing nothing.

Clive Robinson • January 21, 2025 4:54 AM

@ Buggy,

With regards,

“Yes, it’s insecure, but what are my options if I want to leave my farraday cage’d bunker and experience the Real World?”

Firstly it’s not “the Real World” it’s not even really a quater century old, and it’s three causes are

1, Convenience
2, Corporatism
3, Crime

The first “Convenience” has given rise to “social pressure” to be an “It Person” and more recently “one of the rat race” who are “always on call” and their location and by inference their habits noted. Hence become pray to Corporatism and other forms of Crime.

So in some parts of the world there is an expectation you will conform to corporate interests in “rabid consumerism” and all that goes with it including crime, debt, and bankruptcy, and increasingly ill health and early death.

These are known as “Personal Risks” with the emphasis being on “Personal”. That is it is your choice and your choice alone as to if you participate in the “Risk Taking” or not.

The problem is that a “herd mentality” has arisen, which allows the likes of others such as Governments and Corporates to put pressure on you to conform to what is actually of no benefit to you but quite a large amount of benefit to them and their corporate interests.

Whilst an employer may have some call over you for the hours they pay you, unless you are daft enough or desperate enough to sign up to what then becomes quasi-legal mental abuse you should still have 2/3rds of the working day under your control.

As far as I’m aware the only two legally required channels of direct communication are,

1, The National Postal Service.
2, Access for “Personal Service”.

Outside of that it’s by “your agreement” only which you can rescind at any time by written notification or other reasonable direct action.

Because even in the late 1990’s most people did not have either “Home Internet” or “Mobile Phones” and many especially in the US did not even have the landline “Plain Old Telephone Service”(POTS).

In some places, changing your mobile phone number is as simple as walking into a Super-Market and taking a SIM card package off of the rack and going and paying for it at the checkout with “cash”. Likewise buying extremely cheap non “Smart Phones”.

In other places where the telco’s have too much power such as AT&T in New York, they believe they are above the law,

https://arstechnica.com/tech-policy/2025/01/att-complies-with-law-requiring-cheap-internet-by-ending-a-service-in-ny/

It’s actually shocking just how much AT&T charge for what is “basic service” in the UK. If I shop around in the UK I can get a way better service for less than ~$10/month…

Which demonstrates that US Corporates in a Monopoly or Cartel position are not just exploiting their customers but behaving unlawfully yet the legislators and justice system “sit on their thumbs” for various reasons.

But it’s your choice what “Personal Risk” you take within your “Social Context”. The only people who can resolve the unlawful abuse by Corporates and Employers is legislators acting in the interests of their voters.

If they won’t act then it’s upto you as an individual to “take technical measures” as well as as a voter take political actions to ensure your “Privacy”. And if enough voters do, then “society moves” and the legislators have little choice but to follow or take other measures.

At the end of the day I can point out what technical measures easy or otherwise are available to you and the information you need to do them. But you have to understand two very important things. Firstly,

“It’s your choice to evaluate the ‘Personal Risk’ of taking ‘Convenience over Privacy’.”

And secondly as importantly,

“There after live with the consequences of your choice.”

As that terrible US saying has it,

“Brace up and buckle up your big boy pants.”

Though not many these days take a “Belt and Braces” attitude to trousers or anything else which is probably in part why we are in the mess we are.