Schneier on Security

Clive Robinson • May 5, 2025 2:27 AM

@ Bruce, ALL,

On occasion you have asked/talked about “owning” in the biological sense of one organism turning another into a zombie/puppet.

Well over the centuries humans have tried “training” other organisms, but mostly this has been restricted to mammals or others with what are regarded as higher functioning central nervous systems (another reason to see pigeons as equivalent to rats 😉

Well, over the weekend this article passed under my nose,

https://arstechnica.com/science/2025/05/cyborg-cicadas-play-pachelbels-canon/

Where it triggered the “Oh 5hit” alarm… Whilst I’m broadly interested in bio-mechanoids as they fill a gap between nano-tech and what most would regard as human appreciable robots and tools, I’m not in favour of lobotomizing any living creature.

What made it worse was that last week I’d been looking into robotic quadrapeds and how various people (say hi to Alphapet/Google) are trying to turn them into weapons platforms as variants of ground based drones.

And the rather nausea inducing article I’d seen just before,

https://arstechnica.com/health/2025/05/screwworms-are-coming-and-theyre-just-as-horrifying-as-they-sound/

I’m sure you don’t need me to amplify on the potential link…

Any way if the two regular journalists at ARS who wrote the articles are reading,

“Thank you ladies for adding that certain something to my weekend, that used to be reserved for the visit to the cinema on ‘Scream Night’.”

Clive Robinson • May 6, 2025 10:03 AM

@ ResearcherZero,

With regards,

“Morons have convinced themselves radar are weather weapons.”

Not necessarily “Morons” think about “Cargo Cult” behaviour on Pacific Islands during WWII.

As Arthur C. Clarke put it, in what became known as “Clarke’s Third Law”,

“Any sufficiently advanced technology is indistinguishable from magic.”

But what is forgotten by many is that “advanced” is very much a relative term, and is dependent on “the observers” point of view / experience.

But there is also the concept of “The magic umbrella” caused by a level of self delusion… To see why consider,

Looking back I remember that every time I’ve left the house with my “long brolly” I did not get rained on. However I do remember getting rained on when I did not have it with me.

Thus I start to ascribe mystical if not magical powers to my “long brolly”… Eventually I start thinking of my long brolly as “Magical”…

Now consider those Weatherman Radar Pictures, they only get shown when bad weather is heading our way.

How long before “radar map on TV” correlating with “bad weather warnings” appears to be “cause and effect” in action in peoples minds… Which it obviously is, but… Because the radar maps appear before the bad weather does people get the cause and effect the wrong way around? So assume the appearance of the weather maps is the cause of the bad weather that follows very shortly there after.

Then get to thinking that it’s deliberate, after all the maps are “man made” so simple follow on logic dictates the bad weather must also be “man made”…

Hence the view that the Weather Radar systems cause the bad weather so must be a weapon…

You would be surprised at just how much this happens with technology, especially something that can not be satisfactorily explained to the person wanting an explanation.

I get this issue almost every time when trying to explain “True Random” generation and why “chaotic” just does not cut it, nor does encryption.

It should be “easy” and to me it is “easy” but to others…

You end up finding that the expression,

“Magic pixie dust thinking”

Comes into your lexicon (just search this blog for “pixie dust”).

Clive Robinson • May 7, 2025 3:40 AM

@ ResearcherZero,

With regards,

“A more in-depth look at why TeleMessage was never suitable for secure communication.”

If I said “colour me unsurprised” would you be “surprised?”

The issues with encryption, group chats, and plaintext is not new. I indicated it was a complete mess back in the early part of lockdown with the likes of video meeting apps like Zoom etc.

Put simply encryption burns CPU cycles and “group” communication causes there to be the N^2 issue of the number of links with the number of participants you wish to communicate with. Worse as each participant can not for security usually act as a “center node” in the star configuration communication this normally means a “mid point” that is not one of the participants and the mid point has to know all the KeyMat to function as it needs to work with the plaintext in most implementations.

The fact the company behind the software is reported as ex Israel defence opens up a whole slew of issues and embarrassing questions for the current US executive as it’s broken quite a number of US laws.

Which is going to give “Tulsi Gabbard” at best a head ache.

Speaking of which this will give another,

https://www.reuters.com/world/us/another-us-fighter-jet-falls-into-sea-truman-aircraft-carrier-us-officials-say-2025-05-07/

I believe Oscar Wild had cause to comment on such behaviour with,

“To lose one, may be regarded as a misfortune, to lose both seems like carelessness.”

Clive Robinson • May 7, 2025 5:20 PM

@ ALL,

As some of you may have experienced Spain, Portugal and France all the way upto Belgium experienced a varying degree of power grid drop a week ago,

https://en.wikipedia.org/wiki/2025_Iberian_Peninsula_blackout

The reports of what went wrong and how are not yet available.

However fingers are being pointed at Spain for it’s near total generation by solar and wind.

As I’ve already noted due to “safety reasons” “local power” domestic level generation by Solar or Wind gets rapidly disconnected from the grid and the result load is thrown on regional generation which causes not just voltage drops but line phase and frequency to trigger protection measures. The result is there is little or no “flywheel storage/generation” of “mechanical inertia” to see the grid over momentary but significant changes in load, so it’s possible for a cascade shutdown effect to kick in. It’s unknown publicly if this is the cause and we may never find out.

What is actually needed irrespective of the blackout cause is “flywheel” base load anyway the question is “reliability” of non mechanical systems.

Conventional battery technology is chemical based and only good for maybe a thousand or so charge cycles. There is no way this could provide longterm reliability for “flywheel” capability that would need hundreds of thousand if not millions of charge cycles.

Two other ways to store energy is the traditional “mechanically via inertia” in the flywheel effect in generators or electrostatically in the likes of “artificial transmission lines” or just “electrolytic capacitors of the “super-cap” variety.

In Europe not so long ago, telephone exchanges used vacuum flywheel systems as short term power backup. Such flywheel systems have an almost indefinite life unlike any kind of chemical battery,

https://en.m.wikipedia.org/wiki/Flywheel_energy_storage

Interestingly AI is bringing this lack of flywheel generation storage to the fore, as the way AI electrical load is accessed is often in multiple short bursts,

https://spectrum.ieee.org/supercapacitor-2671883490

Clive Robinson • May 8, 2025 10:07 AM

@ Bruce, ALL,

In

Cryptocurrency Thefts Get Physical[1]

You noted,

“$250 million cryptocurrency theft that, in a complicated chain events, resulted in a pretty brutal kidnapping.”

And I noted,

‘Like it or not this sort of thing will fairly quickly become a “normal crime”’

Well an article in ARS Tech appears to be confirming that,

https://arstechnica.com/security/2025/05/we-have-reached-the-severed-fingers-and-abductions-stage-of-the-crypto-revolution/

But I also noted,

‘The “smart crooks” went into “ransomware” and have made sums in the many many millions. However even ransomware needs planning and technical ability.

But as you go down the “smarts” you end up with people who to use an old quote,

“Do their thinking with their fists and boots”’

So yes having crypto in quantity could get as a minimum not just your fingers broken but severed by “idiots”…

[1] last months thread,

https://www.schneier.com/blog/archives/2025/04/cryptocurrency-thefts-get-physical.html

Clive Robinson • May 9, 2025 12:34 PM

@ ALL,

A base for a security model

A number of security models are loosely based on biological processes it’s why we name just a couple of them as “viruses” and “worms”.

But,

“Do they need to be “biological?”

In a way using biological models is neither accurate nor reliable. Because they imply

1, Self “agency” not controling “direction”.
2, Whilst appearing “inevitable” thus “unavoidable” when in fact they are not.

That second point is convenient to many because it lets us off of the “failure hook” with little more than “a shrug of the shoulders” thus taking on no responsibility for our actions.

The reality is for too long “run fast and break things” has reigned supreme without question. And when allied with “patch later if there is time”. Has created a veritable “Tsunami of technical debt”, with “no incentive to reduce it” thus a monumental number of “errors and vulnerabilities” that keep rapidly rising.

Worse as time progresses there are those that find new and shall we say more interesting ways to turn “instances and classes” of “errors” that have existed for years into freshly exploitable “vulnerabilities”. So acting as a second front on building the tsunami of technical debt. One piece of strategic advice that has been handed down over several thousand years is,

“Don’t fight a war on two fronts”

Especially if one is within your own territory behind your “home front”.

Because as history shows it usually results in defeat no matter how strong your assumed forces are with regards to how you see your enemies forces. That is if you can actually see them at all, rather than by seeing the results of their actions. Which mostly you can not such is the nature of asymmetric warfare.

In short we need to stop letting ourselves off the hook and take a flame thrower to that tangle of technical debt.

One way to start stopping the “let yourself off the hook” mentality is to stop using “biological” analogue models, and start actually using “engineering” models. That is models that have worked since what later became called science turned artisanal crafts people into mechanical and electrical engineers, producing “dependable” and “available” products that enabled the “Industrial Revolution” to actually happen.

I was reminded of this when I read,

“And it’s a nightmare for the DOT, too, trying to make sure this highway is safe to drive on despite it literally collapsing into the earth. From what we know so far, this is not a natural phenomenon, but one that’s human-made. It looks like all these issues were set in motion more than a century ago when the area had numerous underground iron mines.”

In,

When Abandoned Mines Collapse

In “Practical Engineering”,

https://practical.engineering/blog/2025/5/6/when-abandoned-mines-collapse

As you read through it try and draw parallels between the long history of mining methods and the resulting chaos it’s caused, and the short history of software development and the increasing disasters it is causing.

As the article notes,

“But I really think the story of subsidence isn’t just one of “mining is bad” but really “mining used to be bad, and now it’s a lot better, but there are still challenges to overcome.” I guess that’s the story of so many things in engineering – addressing the difficulties we used to just ignore.”

In software development the reality is we are barely off the starting blocks we are still very much not just in the “ignore everything” phase but worse some positively “revel in ignorance” so as to more rapidly crash and burn.