Schneier on Security

Clive Robinson • January 22, 2020 9:04 AM

@ ALL,

I know I’m getting old but,

along with a username and password for the Telnet service,

Jessh I thought the first advisory that Moses was given before he went to mount sinai was “God nolonger uses Telnet, nor should mankind”. If I remember rightly the protocol was developed just so the “Let There Be Light” command could be sent when security was not an issue…

But seriously have people forgoton why Telnet was dropped like a lead kipper?

It’s because it’s plaintext all the way with usernames and passwords open to anyone along the way who can “traffic sniff”… Thus they can get your credentials, and be you…

Clive Robinson • January 22, 2020 9:40 PM

@ PeterA, Bill, Ted Hale,

Yes, it’s more handy than nc or socat for simple cases.

It’s also “less suspicious” as the Telnet Client usually comes with any –non MS– OS as a standard util or comms package.

@ Jesse Thompson,

You trying to steal my claim to being the person with the longest posts 😉

With regards,

…but as plenty of examples have demonstrated recently encryption is second cousins to useless…

Yes a point I make from time to time for various reasons. But encryption does give you communications contents privacy by default on the wire against anything other than deliberate attempts to break it.

Yes it’s a bit of a “fig leaf argument” but the point does make a difference.

But lets look at your points,

A: authorization is impossible

The problem you describe is several centuries if not millennia old. Befor 1973 and the publication of the RSA paper, all encryption required two things,

1, An independent and secure side channel to exchange a secret.
2, A secure way to store the secret from others.

Diplomats used to carry their code books to their posting and then hand them to their Secretary who would lock them up in a draw or a few centuries later a safe.

The RSA paper alowed for a short while people to apparently not need either the secure side channel or the storage of shared secrets. Since the 1980’s various other papers have indicated that Quantum Computing could exist, and later that RSA and other methods of encryption were vulnerable.

However, with regards IoT and other “setup locally” devices, the manufacturer could fairly easily setup the production line such that a unit could have a random pasword generated and printed on a peel off lable on the device. I know this can be done easily because I used to design FMCE equipment that needed units to be able to communicate using shared secrets. Thus had to design it into the production process.

B: the hardware lacks the memory and/or CPU power to performantly encrypt

This is generaly not –or should not be– a problem these days with symmetric encryption. However the problems with asymmetric or PubKey encryption are legion and have been for as long as it’s been in use. The simple fact is there is a very large elephant in the room, which is all asymmetric encryption has a very high work factor to get even a modicum of security. If it were not of use in ways symmetric encryption can not do, it would have died of a “still birth”, and the world we currently live in would have been very very different.

C: you can’t keep the encryption algorithms up to date.

I lay the blaim for this problem directly at the feet of NIST as my comments for the past decade or so on this blog show.

All NIST had to do was two things neither of which would be difficult,

1, Design a framework for the updating of encryption algorithms “in place” (ie Plug and Play).

2, Add that the framework is a required part of the standard for approval.

As long as their is any excuse then the “race to the bottom” mentality of industry managment will hold sway, thus obsolescence will be prefered to upgradability as it’s easier to do and more profitable.

D: You need to proxy/CDN the requests without handing the likes of Cloudflare full control over your website’s digital identity.

This is a political not technical problem. The fact that Cloudflare and others in effect form a cartel and force a lack of security on everyone is not one that can be solved technically. Nor is “the free market” offering alternatives which should give you an idea of why I say cartel.

… is such a small percentage of such a small percentage of the general public that it could be used to illustrate homeopathic practices.

Which is the same problem we have with modern cars. People do not want to know or understand what goes on under the hood, they just want to “get in and go”.

Do you blaim them?

It’s an interesting question. Look at it old school style, “What would society be like if we all practiced Fieldcraft level OpSec?” The answer would be “Like living in a police state”…

So arguably it’s our fault as technologists for not delivering “turn key security”.

Whilst the Telnet client does have some uses, Telnet offers no security or even the illusion of security and the protocol is old very old it’s RFC15 if memory serves correctly. Back then HTTPS would have been impossible not only had the RSA scheme not been thought up, hardware of the time could not have supported it in any way. If memory serves it was about the time Neil Armstrong took his “one step…” and “rope memory” and a bunch of NAND gates was what got him there.