Schneier on Security

Clive Robinson • May 26, 2025 3:09 PM

@ MikeOh Shark,

With Regards,

“[A]ny chance we will ever see a compilation of actionable steps we can take to at least minimise our digital dossiers?”

The answers to that have to a certain extent already been given on this blog in the past.

But the important thing to realise is as far as we can tell we’ve been homosapiens for a very long time, and in many respects we have not really changed for ten thousand years or more. Also that we are not likely to change much if at all in the next twenty generations or so unless our technology becomes existential in some way.

But briefly the first actionable step is to,

“Understand your environment”

By that I mean “from the dirt up” and “from three centuries or more ago”. That is before we had anything we would these days call technology.

Yes, lives were comparably short and often brutish but people lived and from their perspective often thrived.

The second actionable step is to

“Know your place in your environment”

Look at what mankind has done, not so much the successes but how the failures happened and the lessons learned. As I’ve mentioned before I have an interest in “industrial history / archeology” not just the taming of the environment and the development of tools and technology but importantly the human aspects. There is after all a couple of reasons why the “english word” sabotage is derived from the “french word” for a wooden shoe.

The third actionable step is,

“Know other peoples place in your environment.”

This was untill recently the “human aspect” of “trust” that many will try to tell you is “paranoia” untill they come running to you because they have over trusted and that trust has been betrayed.

Whilst I won’t say,

“Every one is out to get you”

It rather depends on where you are. A look into the history of the old East Germany under Honecker and his Wife will probably make you reasses quite a few of your trust boundaries,

‘https://historyreclaimed.co.uk/meeting-margot-memories-of-a-marxist-monster/

Unfortunately similar authoritarian behaviours are now spreading in the Western World irrespective of political flavour. What they have in common is power by violence, control, and narcissism as well as the usual criminal activities.

An understanding of the hierarchy power structures and the associated “authoritarian followers” and thus the “guard labour” is way beyond a short comment post. I’ve mentioned in the past Canadian Prof Bob Altemeyer,

https://en.wikipedia.org/wiki/Bob_Altemeyer

‘https://theauthoritarians.org/

As being a good place to learn about such things (and everybody should for their own protection).

The next actionable step I will mention is,

“Understand the three modes information exists in you environment”

These are,

1, Information Communications.
2, Information Storage.
3, Information Processing.

The important thing to remember is that Information is not matter or energy and effectively not subject to physical forces.

Because information is

“Impressed on, or modulates, physical matter or energy”

Thus it is constrained when we can interact with it by the laws of nature that effects matter and energy.

Which brings us to the next actionable step

“Study communications”

It get’s split into two parts, the message and the delivery system, a solid understanding of both is essential in many ways.

There is the story of shaving a slaves head and tattooing a secret message… Or the more practical putting a message under the wax of a soft tablet. These were just basic “concealment”. Later the use of a staff of fixed diameter gave the first “transposition cipher” and Creaser supposedly gave us our first “substitution cipher”. It was quite a time before somebody chose to do both to the same message. Though before that substitution was expanded from letters to words and sentences with codes. The purpose of all of these was to “break the statistics” at various semantic levels. Modern systems still do the same thing even those seen as mathematical ciphers. That is all you are doing is a shuffle and flip the bit states in some way [1]. That only the two parties know even if the methods are well understood and well known to others (Auguste Kerckhoffs Principle of “The enemy knows the system”).

People need to learn the history of the delivery systems used prior to “digital networking”. There are an abundance of lessons to be learned even using “in plain sight” systems like newspaper adverts, postal services, and radio broadcasts.

When looking at “digital communications” remember whilst the recipients address needs to be valid, the senders address does not. In TCP terms consider UDP used in actual “half duplex” mode the receiving node cares not from where the data packet came from all it has to know is the packet is legitimate (it’s why early DDoS attacks worked and to some extent still do).

Further consider that both the DoD/DARPA and ISO-OSI stacks are designed to sit on top of other unknown networks that get lumped into the “Physical Layer”. Thus you could send data via one network and this then drops into the Internet at some other point in the world. In turn the Internet can be the physical layer for another network which is the idea behind Tor and Mix Nets and “Fleet Broadcast” systems.

Ham / Amateur radio operators do this as “standard practice” these days and reading up on the history of the hobby since the 1980’s might give food for thought see how “Hot Spots” and “Reflectors” work. Likewise remember as you go up in frequency EM radiation becomes easier to focus and direct. Back in times past flame or lime light “shrouded lamps” were used through telescopes to give increased privacy for long distance signalling like a highly focused spot-light. Have a look at LoRa / Meshtastic systems and the use of high gain antennas that due to the way they are mounted have little or no side-lobes. The fact you get link encryption using AES can also be of interest. But also consider modern infra-red laser diodes they can do “line of sight” as far as you can see if not further various Ham operators have built digital systems around them. But also as you get down the other end of the radio spectrum into the low HF bands you can beam your TX signal upwards and have it bounce off of the ionosphere back down again look up “Near Vertical Incident Skywave”(NVIS) it gives a regional area of coverage out to a couple of hundred miles. But due to the way reflected low HF works you can really only “direction find” traditionally what is called the “ground wave”. A suitable choice of antenna and location will thus give an NVIS system a modicum of covertness.

There are many other physical layer technologies you can use for delivering messages and importantly as with the older postal systems you can have separation of sending and receiving locations and each of those can be in effect changed message after message. All you need is some way to synchronise. It’s why one of my interests are “Anonymous Rendezvous Systems”.

But as noted in WWII or earlier by Claude Shannon, all communication of information requires “redundancy”. Further as noted By Gus Simmons some years later, where there is redundancy you can form a covert communications channel.

So there are other tricks using Spread Spectrum, working at the edge of the Shannon limit, and “Multiple Input Multiple Output”(MIMO) techniques to produce “Low Probability of Intercept”(LPI) systems.

Thus you do not have to have your location known to protocols or third parties to communicate successfully.

This the brings us to a more problematic actionable,

“Private Storage of Information”

Under usual use the desire is to store all wanted information as long as possible, but unwanted information not at all. Also for Privacy a way to keep stored information from third parties and the ability to reliably erase it.

Most modern technology does not make erasing stored data easy or actually viable in most cases. Which means Privacy has to be obtained in some other way. The two basic ways are segregation and encryption. The problem with segregation is “Might is Right” and “Evil Maids” and similar. You therefore have to assume segregation is at best transitory if not impossible sometimes even in the short term.

Therefore “data at rest” should always be encrypted, and where possible data in active use should also be encrypted in RAM etc.

The problem with encryption and storage is that even though encryption for communications is hard, it’s in effect trivial in comparison to encryption used with storage both short term and longterm.

Consider a stream cipher and a text editor. It’s easy to end up with two files where the plaintexts are broadly the same but are not but encrypted under the same key. The resulting differences opens things up to various attack techniques.

Thus much security of information is despite good storage encryption still done by segregation at as many levels as possible.

It’s in that broad overlap between information storage and information processing.

In the past I’ve talked about having two “energy gap” segregated systems. One on which you do your private work etc and it’s never connected to external communications. the other you use for public communications such as the Internet and is assumed to be compromised at all times.

I’ve also warned about “end run attacks” where by things in your environment can “shoulder surf” you and it’s a subject that would fill several books.

The other issue is modern hardware is designed to use external communications all the time. In past discussions I’ve indicated I have pre-1995 systems I use for development and support. This vintage is the last where external communications was not built in in some way. By the time you get to 2005 hardware external communications is realistically “boiled in” in PC hardware and disabling it difficult at best.

I also use “Embedded / microcontroller development Systems” or systems I have built using microcontrollers. I’ve my own somewhat primitive BIOS/OS and compilers and interpreters that are CLI only and some go back to the 1980’s. It also means I’ve had to write the apps in the past… However these days you can find source code for “minimalist apps” you can strip back to make more “reliable” especially the ditching of anything other than Plain 7bit ASCII and open formats such as CSV etc.

This leaves the problem of “gap crossing” which I have talked about in the past here in reasonable detail. As such it’s a subject very much in it’s own right so really comes under several actionable points including TEMPEST / EmSec both passive and active. So I won’t go into it here.

The last of the three is “Information Processing”.

Whilst it is now possible to somewhat process encrypted information without first decrypting it, such that it works on the plain text without making it available. It’s nowhere near “Primetime”.

So to sum up all of this brings you back to plaintext and strong segregation for processing and encryption just about everywhere else.

[1] Importantly though don’t fall into the “one to one trap” that is there is absolutely no reason why the size of the “plaintext alphabet” set should be the same size of the “ciphertext alphabet” set only that the transformation be uniquely invertible.

Clive Robinson • May 27, 2025 7:12 AM

@ Peter A., ALL,

With regards,

“It requires, however, a very very modest lifestyle.”

Something I’ve always preserved, and a viewpoint I acquired from my parents both of whom fought during WWII but knew the frugality of living from times before and how to store food etc for the lean times. One advantage of which is “a lot less unnatural chemicals in your food”. But likewise it’s taught me “value” which is why I learnt to drive but have never purchased a vehicle and thus been subject to all the “rent seeking” that goes directly with it, nor the risk of a “drunk in charge” or similar associated “rent seeking”.

So as with everything in life it has it’s downs and ups.

BUT Also some of which have,

“Important security lessons”

In a general form within them.

Which is why I note your issue,

“Another example: our kitchen stove broke a little (was still working, but the broken part could lead to further damage). It appears that all spare parts shops I knew of are out of business already… “

As I’ve mentioned before my “gas stove” broke nearly a couple of decades or so back and it was the thermocouple in the oven flame that had burned through and failed after a couple of decades of use.

Like you I found the few shops that still existed even back then did not “carry the part” nor for that matter did any online supplier. The message being clearly sent by manufacturers was,

“Throw the stove away and buy a fancy new microprocessor controlled matching separates –with of course– and new kitchen units to put them in.”

So the equivalent of at least a weeks higher end middle class income even if I did all the installation work my self, versus a part that should cost less than a half of beer…

(Oh and don’t forget that homeless rats like warm, cosy, dark and difficult to get to places, just like such oven laden kitchen units give, to put down roots and make a family…)

So I pulled the stove out and decided to see if I could fix it by buying a component level “sub-part” that would “fit” the broken unit.

A quick examination revealed that it was actually a “Don’t stick your head in the oven” part, a design legacy from “town gas days”[1] that ended back in the 1970’s. The thermocouple when hot enough produced a current that pulled in a solenoid valve that pulled out the gas flow restrictor.

A very short while later I had unhooked the solenoid valve and set the valve in the open position and the oven worked fine again…

A classic case of unwarranted “security” adding complexity that when it fails –and it always does– breaks the whole system apparently needlessly. BUT, ensuring a faster down stream inflation linked income for the manufacture and associated agents.

I’ve looked around since on the odd occasion for a replacement unit or component, but I guess after forty years or so they are nolonger made at all, as the issue they were designed to solve nolonger exists[1]. The oven however still works just fine for what it’s needed to do.

The point is from a systems point of view there is the important lesson that,

Over complicated, ill thought out, or unneeded security systems give rise to the failure of the whole system needlessly. And probably when the system is most / critically needed.

(There are people in Texas who can attest to this and several other places)

Oh and as it also “reduces reliability” of the whole system, it also ruins those all important “availability” figures.

A lesson all Security Systems designers should learn.

Oh and a secondary security lesson,

Security should be integral to the whole system and built in from before the design phase, otherwise it becomes easy to bypass.

A padlock on a chain to keep access secure is “faux-security” because it’s a classic example of two failings,

1, Security as an afterthought.
2, Weakest link in the chain.

It goes back a long way, which is why I usually use the “more modern” example of Victorian artificers and their boilers and steam engines. And how their repeated deadly disasters and news paper front page reports forced Governments to legislate and importantly regulate. With the result science got added to the tool box. Such that engineering emerged phoenix like from the ashs, death, and destruction of the artificer made disasters.

I think most can see parallels with the current Social Media and AI industries with the “Move fast and break things” attitude of a luddite. That unfortunately can be found in other areas of the ICT creation industries. It’s already had it’s head lines which in turn has given rise to opinion pieces like this one from the Harvard Business Review,

‘https://hbr.org/2019/01/the-era-of-move-fast-and-break-things-is-over

[1] Also known as “coal gas” it’s carbon monoxide which is a fairly rapidly deadly poison gas also known as “the silent killer” that will “kill you in your sleep”. Hence all the warnings about having detectors in your home or boat etc. It’s made by “cooking organics” or “partial burning” in a similar process to making charcoal and wood gas. It was well known back in the 1960’s and earlier that “coal gas” was a quick and fairly painless way to kill yourself, hence the “don’t put your head in the oven” device. But it’s replacement “natural gas” does not kill as a poison and they add a foul smelling chemical as a warning. To kill you natural gas would have to stop oxygen getting into you, a process also known as “smothering”. which I can tell you from nearly having drowned in a canoeing accident is not at all a painless process. Your body literally fights for life and you can not ordinarily stop it doing so even if heavily asleep it will wake you. As anyone who suffers from sleep apnoea will have been told is why they sometimes “panic wake” scared half to death.