Schneier on Security

Clive Robinson • November 5, 2025 4:39 AM

@ fred blogs, ALL,

With regards,

“… to stop having a person’s birthdate as an authentication item. It is simply too widely visible.”

It’s something that legislators and politicians will fight every which way to keep. Because as pointed out of the ages old problem,

“The Law is an ASS”

It comes 1838 and the pen of Charles Dickens, who wrote it into “Oliver Twist”. But for him to have been allowed to do so, even then it must have been part of the “excepted public view” so started way way before that in middle class and above circles.

The problem is who do you decide who gets the protection of the law and it’s due to supposed maturity.

So you are mostly free from the direct effects of the law under the age of 7 or 11, you are then subject to sanction after sanction including how much you can earn untill you are 18 or 21. Then you were banned from certain positions in life untill you were 35 (still applies in the US). Then there are “benefits” you get for being to old to be worked to death any more such as retirment and pension/ seniors “benifits”.

The fact that fewer and fewer live long enough to get those benefits tells you what is really behind the notion of “being old and a burden on the state”.

But the point the law makes is it must have fences and because every one is assumed to be to dim witted to judge when a fence applies or not, they take time periods of the Earth’s rotation as something we can all say complies with the notion that,

“Justice is blind”

But it’s a foolishness in of it’s self,

Firstly by what point do you apply it?

In the timezone a person was born in or the timezone it’s being applied?

But consider what change as a person do you under go between 5secs to Midnight and 5seconds after midnight?

I could go on and on but consider this,

How much legislation and cost has been added simply to “undo the fences”?

Physical age is only partly based on chronological age, and even worse mental age and capability is based more on experience and the environment we are pushed into other than time.

But “age” has always been a problem, how do you decide how old a person standing before you is?

Simple answer is mostly you can not so you just guess and call it an assumption. Hence the reason for the massive business of “Fake id’s to buy beer”. The problem is moved from a person to a card, only it’s not.

I’ve pointed out several times that there is no way you can make a system that is secure from impersonation. Because there is always a gap between a physical object snd an information object. And because there is a gap it’s open to exploitation. And that’s when “market forces come into play” if enough people want to exploit the gap then others will supply for a price a solution as people demand.

We saw this with “set top boxes” for cable and satellite TV, I found several “exploits” and shared them with friends. Some of whom turned them into products manufactured abroad and imported and sold.

The reason why this was possible was that the operators decided not to put sufficient effort into “security” from day 1 and thus there were many gaps to be all to easily exploited.

The same applies to anything else that is,

“How many gaps that you can close, should you close?”

It’s a basic economic issue, but with a twist I’ve mentioned before which is,

“How much spending on defences is enough so that you don’t get attacked?”

The answer is,

“As long as you are not being attacked it’s probably to much.”

But time and technological advance moves the “cost” usually to the benefit of an attacker and the loss of a defender.

It you think about it there are so many gaps in “OnLine verification” that the cost of eliminating them will be next to impossible to find.

Mean while such attempts by politicians and legislators always introduce security issues.

In the case of the UK Online Safety Act, it’s created a “back door” for Data Brokers to slime their way into to make a lot of money from. And the neo-con mantra about not leaving money on the table/floor means that they will slime through faster than a speeding bullet. And guess what they already have.

This is such lucrative business that the data brokers are already busy lobbying legislators and faking up loud noisy campaigns from the “Useful Idiots” in other countries.

I could go on about the Government Agencies “buying the data back” and making the problem worse, but if you’ve been a reader here for any length of time you will be aware of it.

So NO I don’t think “Age Restrictions” will be removed, for various reasons, but primarily because there is to much profit involved, that it’s going to be more lucrative than “The War on Terror” for all sorts of crooks and criminals, especially politicians.