Schneier on Security

Clive Robinson • November 11, 2021 8:28 AM

@ ALL,

From the intro to part one, and before any thing of utility gets said it’s running away from the reality of life since the start of the third decade of the 21st Century with,

“If attackers find it too difficult or expensive to get your stuff, there’s a good chance they’ll simply move on to an easier target.”

That only applies to the bottom feeders who are basicaly little more than wanabee crooks. They hardly make it out of the “Level I” catagory attacker outlined in Ross Anderson’s three level model.

If these are the only thing you have to worry about well all I csn say is you lead a very non-life.

It should by now be clear, nearly all States regard their citizens as “the enemy”. It may not and probably is not the elected officials with these as primary views of the electrorate. But you can be sure that many around them who shape policy are very much in this view point, some as in the inteligence agencies see themselves above the elected politicians, and that can only end in one way (bloodshed, to refresh the tree of liberty is histories prefered way of bringing it about).

So the article starts badly by effectively saying “You are not Batman” but we know “You are the enemy”…

But “You are also the product” which is the key to just about every other form of abuse you will suffer “online” regardless of who or what you are.

Clive Robinson • November 11, 2021 2:43 PM

@ ALL,

Back when computer security was mainly fronted by people wearing hats and a strap on of some kind at a handy waist level, the basic security advice boiled down to,

1, Do not connect the computer to any kind of communications channel.

2, Put nothing you need to keep unknown to others on the computer.

Two very sound pieces of advice you just do not hear anymore…

What is the difference today that was not applicable fifty years ago back in the 1970’s?

Well you could blaim technology, but you would be missing the point, we as individuals have been complacent for a half century. And as the old saying has it “The Devil makes use of idle hands” and we eagerly filled them with technology. So much so it’s actually killing people by their own stupidity. That is way to many people can not walk down the street safely because of the technology in their hands absorbing their attention. Some step in the road others trip stumble or fall and some percentage get seriously hurt or die.

But this fixation with technology makes it “Oh so easy to carry out Surveillance on the individual”.

That is “The use” of technology has made us increasingly not just insecure but unsafe as well and certain people see advantage in it.

The point is the data collectors are abusive, in many ways, at the very least they assume they can coerce people. Unfortunatly too few people turn around and say NO[1].

Even as little as twenty years ago we did not have this nonsense, and we’ve foolishly alowed ourselves to be led into a trap. So now the only option is to not just turn around but push back against the flow…

But as I’ve pointed out in the past and again above with those two rules we can protect ourselves way more effectively.

The first step is segregation public from private. That is do not put anything you wish to keep private on a computer unless you absolutly have to. Then never ever connect that computer to any kind of communications channel. Keep this computer locked in a fire proof safe when it is not in use. Oh and never ever connect it to the Internet, and never ever update it… Whilst you do get security patches you also get “spy-ware” from Microsoft, Google and Apple with every update. They might call it something else, but by definition it is “spy-ware”.

If you must “connect” to a communications channel, then use another machine entirely. Preferably build it yourself such that it has no hard drive or other easily mutable storage that run of the mill malware can hide on. If you do it right then simply turning the power off at the wall will clear any of that sort of malware[2] that might have got on it whilst connected.

Oh and don’t do any kind of banking or other financial management on line. You are without a doubt vulnerable, the only reason you’ve not been got at, is it is such a target rich environment. So it takes a while for your turn to be hit to come around, but don’t feel left out it will come to you sooner or later.

As for “social media” what was that 1980’s anti-drug slogan,

“Just say NO”.

[1] I’ve had some rather short and blunt to the point of rudness conversations that usually start with someone saying something along the lines of,

1, You just need to…
2, If you do XXX then…

They act surprised when I say “Why?” and ten seconds after they start pushing out nonsense I say “No”.

They then try coercion of,

3, If we are going to…

To which I simply say “You’ve failed to prove you are trustworthy or demonstrate a real need for the information you are now trying to blackmail out of me”.

Apparently stating the truth is kind of an afront to many such people either from knee jerk training or stupidity, almost their first response is “blaim the victim” or equivalent. Frequently, by at the very least claiming you are rude or hostile. To which my stock reply is “No I’m not, I’m being bluntly honest, can you truthfully say the same?” pause for them to draw breath and then say “Think carefully before you lie”.

Does it make life hard, well yes and no, that kind of depends on your priorities. However I do usually with a bit of effort get what I need and maintain my privacy.

[2] Not all malware can be got rid of at the flick of a switch these days. Unfortunatly there is way to much Flash ROM tucked away in all sorts of places with modern computers. Apple have it in batteries and glued to the inside of their touch screens. Whilst they do it to control the after market repair chain for vast profit, the fact is they leave Flash ROM around which can be used to hide malware.

Clive Robinson • November 12, 2021 12:31 PM

@ JonKnowsNothing, Freezing_in_Brazil,

If you cannot be rude to an AI-Bot, how are you going to be rude to the person who calls from…

Whilst it is easy to be rude to an AI bot if it alows you to reply. The question is, “Is it worth wasting a nice bit of invective on?” because you know, that it’s not going to have any positive practical effect[1].

Do it to a RL person, by being very very blunt, sarcastic, intransigent etc rather than rude, and they are likely to mark their database “Do Not Call” against your name.

But what I realy realy miss as a feature on mobile phones is the ability to eves-drop on your Voice Mail.

Back when we all had land lines and “answerphones” we could hear the caller and “pick up” if we wanted to.

It made for ideal call screening, and if you decided to pick up it was easy to give an “out of breath” excuse like “Hi Sue, I need to get fit, the run from the kitchen is killing me” or some such.

[1] Though it could have a negative effect on you… This idea of “Social Score/Credit” the Chinese are pushing ahead with, has delighted many capitalist loonies in the West. They record everything and store it away just in case they can use it… Remember the case where a man slipped on a wet floor in a supermarket, and it went to court and the company lawyer said the man was an alcoholic / drunk because he purchased booze, and the lawyer had a record of what he had purchased over the months on his credit card and some paperwork from some “opinion for rent” person who analysed it and said various –incorrect– things? Just one of the reasons I pay cash and keep the recipts.