Schneier on Security

Clive Robinson • June 15, 2019 4:41 AM

@ Z.Lozinski,

OK, so it is a specialist skill, but we have learned that the wicked people specialise too.

Yes I can remember @Bruce being surprised when I first mentioned photographing keys.

When I was young I did not need a camera I just memorized the pattern of leaver lock keys in my head and could cut them by hand with needle files. By 1976 I’d got a near compleat colection of Fire Brigade “FBx” keys. I then without knowing about “impressioning” reasoned it out for myself and got the rest of the FBx keys.

It was not for a decade or so untill chatting with an Ex-Convict turned security consultant that I found out that prisoners had learnt that trick years before which is why prison officers were taught to “shield their keys”.

Being or thinking “Hinky” as @Bruce describes it is a state of mind, you just look at a problem in a certain way and you see the holes. The thing is the more you do it the better it gets. I can not explain how the human mind does it, it just does. As I’ve mentioned before correctly designed hardware be it mechanical, electrical or electronic when drawn as blue prints, plans or circuit diagrams have a certain “beauty” to them when they are right. When you see something that looks even a little bit messy to down right ugly, you just know you are going to find to much complexity sloppy thinking or worse obvious errors. But more importantly from the security perspective that lack of “beauty” even just a little messy means there are probably vulnerabilities there.

I don’t know if the ability to see things that way is inate or not but most people either don’t have it or have not developed it whilst young.

Oh it also works in software. Most diagraming techniques if you take the time to learn how to use them effectively help show “bad code”. The fact this gets discoraged by various modern software development techniques –some of which are just bullying / humiliation / power rituals– might have something to do with the defect rates we see in modern code.

It also works for one off projects and similar, where you use the idea of “story boarding” or as was once called “Rich Pictures” thay don’t need to be works of art but they do help spot where things need to be done and importantly by when.

The visual cortext is –without meaning to make a pun– the biggest window into the brain, also perhaps more importantly it deals easily with multidimensional input. Maybe in some it is more developed and thus pictures enable us to see two or more dimensionaly problems that most only think of serialy.

As for being “wicked” in a lot of cases it’s more a state of mind than an actuality. Society makes up rules for good or bad usually at somebodies whim. These days often so that they can gain an advantage over others in the rent seeking game where winners get the scarcer and scarcer assets and loosers get to pay over more and more of their labour just to stay afloat.

Thus you have the ridiculous interpretation of some rules by the guard labour to some, and likewise non application of clear rules to others. More often these days however rules are designed to be of the sort where a crime is where somebody says it is. We call the broad in scope, but their actual intent is for arbitary punishment.

There is supposedly that distinction between having a “Public duty” (criminal) and “Private duty” (tort). Where rule bending happens, a lot these days, thus for similar actions some have their actions seen as criminal others as torts. The deciding factor appears to be “status” of the person.

In theory criminal activities get treated in a “Public way” that is by incarceration or community service. Whilst torts are treated in a “Private way” by the transfer of money. But we see the downgrading of crimes to fines with the rich and “entitled” buying their way out easily for a trivial percentage, whilst the poor and “unentitled” find their fines are set quite deliberatly beyond their means thus become crimes on non payment, and any assets they might have aquired get taken away from them to be sold frequently to the advantage of rent seekers.

So where do you see the real wicked minds?

It’s a question I find I ask myself more and more frequently these days…

Clive Robinson • June 16, 2019 9:20 AM

@ Will,

Behind all of this is the push not just by corporations but national governments towards de-anonymising people in every thing they say and do.

Back in the early days of what is now often called “Single Sign On” user convenience and ease of administration was pushed and pushed hard…

However it did not realy take off at the time for various reasons. Two of which were basically battles over who got the big slice of the online pie, and government systems were associated with the “Papers Please” of National ID cards through the back door and making “Police States” easier (think about the Chines “social credit rating” as an example).

Unfortunately too many people focused on the Government / Police State asspect than the Corporate / data minining / Police State aspect (via third party business records and NSL based “bulk collection” and later legislation).

So various major silicon valley Corps fought it out for the “single Sign On” title belt.

Thus anyone who considers using any kind of “Single Sign On” is playing into the hands of the data aggregators.

Perhaps it’s time our host @Bruce did an op-ed on the societal dangers of SSO systems and added a caution about their near equivalent of “Online Password Managers”.