Schneier on Security

Clive Robinson • April 22, 2026 10:46 AM

@ Bruce, ALL,

You just know it’s a honking great pile of “horse apples” when you read,

“ICE’s Homeland Security Investigations (HSI) is using various tools as part of its mission to disrupt and dismantle foreign terrorist organizations, “particularly those involved in the trafficking of fentanyl.””

This linking “terrorist organizations” with “trafficking fentanyl” is just the new,

“Think of the children”

Nonsense to “knee jerk people into cognitive bias”.

When you realise this you start to think about what the real purpose is …

So leaving your smart phone / tablet at home, and taking the dumbest “oldies brick” instead makes a lot of sense.

Also get “encryption/decryption” of of your smart devices the move to “client side scanning” should tell you this is a very very bad idea.

As I keep mentioning you need to go “off comms device” via a properly gapped method…

Thus ensure that,

1, The attackers can not see the user interface in any way.
2, The “security end point” is well clear of the communications end point.
3, Traffic flow is fully segregated and mandated.

Further I advise the use of “deniable encryption” that is also proof to betrayal by the second party to any third party.

Sadly such systems need more KeyMat than total message lengths envisioned so you can get “Shannon Perfect Secrecy” as a base step.

Clive Robinson • April 22, 2026 8:27 PM

@ K.S.

With regards,

“you are preaching to the choir instead of helping people.”

Actually not true.

I have repeatedly posted to this blog how to go about doing it with just a pencil paper and a match.

But how many times do you think I should keep on saying it and getting complaints for doing so?

Come on come up with a number so every one can have an argument about it with you, it is what you are obviously after.

To disrupt this blog and basically attack our host.

What makes you so petty? So small minded? And well need I go on about your clear failings?

Clive Robinson • April 23, 2026 5:45 AM

@ lurker,

With regards,

“Ah. it’s eugenics now is it?”

That was tried in both Europe and the US a century ago. And whilst next to nobody talks about it, history shows it was a compleat failure for fairly obvious reasons.

What has been found to work is simple but certain people in the US really don’t want is,

“Good open education from around age 2”

Under repeated testing it has been shown to reduce crime of all types as well as improving “health score” and other “life issues”. Thus over all effecting positively all the “life score measures” that were made, and thus increasing “Average longevity” (remember the US is just about the only place in the western world where average life span is decreasing markedly).

In the US in many places it is clear that certain political types want “Cast/Class based Education” because it makes exploiting the population oh so much easier when they’ve been badly educated.

Need I say as a policy this is not going to “Make America Great Again” for anyone because this century Sovereign GDP very much depends on the base education level of the population… Oh and Current AI based on LLM and ML Systems is not going to fix the GDP issue no matter how much Sam Altman and Co might claim otherwise.

Clive Robinson • April 23, 2026 6:39 AM

@ ALL,

ICE think the Glass-Hole look is cool…

I mentioned on the previous thread,

https://www.kenklippenstein.com/p/exclusive-ice-glasses

Exclusive: ICE Glasses

Homeland Security is making “smart glasses” to collect intelligence on Americans

“The Department of Homeland Security is developing specialized smart glasses that will allow federal agents on American streets to automatically identify “illegal aliens” from a distance, budget documents reveal.

These new ICE Glasses, building on available glasses that allow video recording and heads-up data display, will be able to pulse vast federal holdings of biometric data — from facial recognition to walking gait — to identify people in real-time.“

For those with short memories or of a tender age the very derogatory term “Glass-Hole” came about due to one of the Silicon Valley Mega Corps designing and selling “Smart Glasses” that could “spy as you go” and could give the wearer the equivalent of a private “heads up display” it was touted as “never forget a face” technology for “constipated manglement types”.

Other more useful uses were for engineers and similar working on complex machine maintenance / repair.

But the wearing of such glasses in public very quickly became a Social “No No” and would get you shunned even by geeky types.

The potential for abuse with such glasses is so immense it’s crossed over into “unimaginable horror” territory.

And realistically the level of abuse they can be used for today, are going to be as nothing within a very short period of them being put into general use. As the author of the article notes,

“Though Congress has been notified of the project, no members have said anything publicly, including Homeland Security Committee leaders Bennie Thompson, Rand Paul, Andrew Garbarino, and Gary Peters.

When that federal agent near an ICE protest in Maine said, “We have a nice little database,” he wasn’t kidding. The only joke here is Congress.”

Clive Robinson • April 23, 2026 12:23 PM

@ Winter,

With regards,

“I have internalized the message to not write my own cryptographic code.”

This is one of the pieces of advice I really hate… Because,

1, As a general observation nearly all code has exploitable instances, in fact it has lots as it gets more complex (once given as the 1 line in every 5 has a vulnerability metric).

It’s not a product of the programming language or the programmer (which is why “flame wars” are such a waste of time). It’s a product of a “non engineering approach” as forced by “management and marketing” due to their wanton inability to apply “engineering techniques”… So as we’ve seen “aircraft fall out if the sky, and people die”…

2, Like all skills it takes about 20,000 hours as an adult to learn to write secure code over and above the hours spent learning a generic programming language for “production” coding.

But… considerably less than half that when you start as a pre-teen in a structured way the hours fold almost invisibly into learning a generic programming language to write cleanly and competently…

Many don’t realise that the alleged famous quote of Edsger Dijkstra against BASIC of,

“It is practically impossible to teach good programming to students that have had a prior exposure to BASIC: as potential programmers they are mentally mutilated beyond hope of regeneration.”

Was just one of many he made against popular programming languages for production code at the time. For instance,

“The use of COBOL cripples the mind; its teaching should, therefore, be regarded as a criminal offense.”

And so on with many more…

The reality is that Edsger Dijkstra just hated programming languages because he hated production code programming that did anything that people would pay money for…

“Progress is possible only if we train ourselves to think about programs without thinking of them as pieces of executable code.”

Thus he was railing not so much against the resource limited programming languages of the time, but the “Methods of Mangle-ment and Mark-hitting” to get “code out the door that brings in income quickly”.

Hence,

“Don’t blame me for the fact that competent programming, as I view it as an intellectual possibility, will be too difficult for ‘the average programmer’.

Along with,

“Computer science is no more about computers than astronomy is about telescopes.”

And worse about OOP indicates that he was actually mostly uninterested in the use of computers for anything tangibly practical, as emphasized by his statement of,

You must not fall into the trap of rejecting a surgical technique because it is beyond the capabilities of the barber in his shop around the corner.”

Ivory towers are there for people to be shouty about others from…

The problem is the person shouting can be missing the mark by a long way.

Look at it another way,

How do you become expert enough to write secure code, if you don’t put in the time “on the job” to get the experience?