Schneier on Security

Clive Robinson • January 10, 2020 2:42 PM

@ All,

Have other people noted the asymmetry in surveillance reporting?

If we as citizens find out and make available information on the use of surveilance tools by any Government or Law enforcment entity then we are classified as criminals “endangering the lives of” “blah-di-blah make it up as you go along” personnel who are made out to be like the children of the knee jerk “Think of the Children”. Even though as the known events of such people that get recorded in court often show they are at best voyeuristic peeping-toms through to full on law-breaking behaviour which has got them dragged into court or the public eye.

But when we look the other way around if a citizen buys home security systems from Amazon to protect themselves from harm, Amazon does not just let law enforcment and others know who has purchased the systems, they actively give access to the output of such systems to them. Amazon are not the only ones to do this. Thus anyone who buys a home security system would be wise to not just do it anonymously but also ensure the equipment has no Internet or wirless capabilities. And actively avoid anything that connects up to your mobile phone, I very much doubt if such apps are secure, and they might well also “for your safety” extend the “security sensors” to include the phone such that it’s microphones and cameras “phone home to the mothership”.

Part of this problem is down to the Peter Thiel who set up “Palantir Technologies” which some regard as the worlds largest private archive of “secret surveillance” data to be monetized.

Thus started the trend as with PII on the Internet and the likes of Alphabet Google, Amazon, Facebook and others of stealing that which belongs to others and monetizes it.

I think most would agree that whilst the technology works either way, it’s the,”Directing Minds” in the likes of Silicon Valley Corps that are turning it’s use into a panoptican hell on earth for the ordinary citizan.

Unfortunately when you analyze what Palantir and Amazon are doing, the end game is like that of “drug dealers”. The little they provide to security services and law enforcment “guard labour” is predicated not just on what become ruiniously high prices but the “guard labour” typing information into the Silicon Valley Corp systems that the Corps then turn into “new product” to be sold to other “guard labour”…

The result is that the Silicon Valley Corps are building in dependency into Guard Labour and using it to extract significant tax dollars for essentially little or nothing of substance in return. In the process turning the guard labour into weakened addicts that can not break free and become steadily less usefully independent.

Thus the question arises of,

Do you want accountable Police etc looking after the Public’s security, or Private unaccountable Corps that generate unreliable databases of supposition against every middle class person and above, to serve the Corps interest not that of the Public?

Clive Robinson • January 11, 2020 4:07 PM

@ Jonathan Wilson,

I am surprised that building access control systems … aren’t being built with better encryption and protection so they can’t be cloned or copied.

We’ve been through this before with “car locks” and the story realy isn’t any different.

In a way car keys were kind of 1.5factor authentication, you had to have the token (key) and the something you know of which (car) lock it worked in.

When high end cars mabufacturers switched to those electronic keys with buttons on security was most definately not the reason, marketing and ease of use where. Thus the car flashed it’s lights and made a noise when you pressed the button on the key so making realy only single factor authentication of “what you have” or what you can steal… Due to other factors such as battery life, security by obscurity was the way they went and in a relatively short time cloning became way to easy to do, so as with the security on “home banking” rather than fix the problem properly, they just raised the bar to clonning a little bit. So at each step the increment was small enough for the criminals to keep up (the same happened with satellite ‘pay TV’ boxes).

Whilst traditional Hotel keys were worse, with both the hotel name and room number on them not all office keys were quite that bad, many did not have any way to tell them apart from house keys. When hotels went electronic they used very cheap keys made out of paper with a strip of metal foil that got punched then folded inside the paper, later they used mag strip cards. Whilst both had the hotel name on them few had the room number, plus the key expired when a new one was issued so there was a very limited time frame they were valid for. When offices went electronic they started putting the keys inside staff ID cards that more or less told you about which doors the badge would open from the employee telephone book that gave things like the Dept and internal paper mail location etc…

The point about office keys is that these days they are more designed for convenience than security. Few require the card to be inserted into a lock and then have a pin typed in. Way to many are “walk up for open sesame” so even a remote controld toy car could open the doors…

The simple fact is as a past head of the UK’s MI5 Stelle Rimington pointed out about National ID, passports etc it’s currently virtually impossible to tie an individual to a paper trail ID. In essence you are who you claim you are at the time you claim it [1].

Now with most things being digital, just about everything is currently mutable if you have the money or contacts or some covert pretense. We know for instance way too many employers are now looking at peoples “Social Media” history and have been using it like a “credit score”. We also know that way to many Facebook and other social media accounts are complete fakes set up for various reasons. How much effort would be required to push in a fake “back story” via Social Media?

Very easy for some very dificult for others

Which simple economics tells you is a prime recipe for a “business opportunity” there. And no matter if it is legal or not where there is demand, supply will appear if possible, which with technology is almost always the case.

In short security is little more than a “fly screen” these days with the past easily changable for those with the right contacts.

Look at it this way you and I can type what we like into this blog, and at some point it will get moderated. Each post gets a serial number that is tracable in time against the other serial numbers. However a lot of comments which are in effect adverts get moderated away each day, some days there are as many of them as their are valid comments. Thus there is a whole load of serial numbers vacant spread through time…

However there are no consistancy checks that you or I can look at to show the comments were made by us or have remained unchanged over time. In theory we could use Googles Cache and the Internet Archive but then who controls them?

Once in the not to distant past newspapers had to print retractions which became part of the public record and effected a newspapers reputation. Now the electronic newspapers just edit the pages and shazam history is changed, and most times nobody notices or cares.

So now not just our personal histories but event histories we were involved in can be changed by those with the right contacts thus control or leverage…

But we at the bottom of the pyramid will have no control, we can be easily manipulated and there is nothing we can currently do about it… The real question of course is “Will we ever be able to do anything about it?” and I suspect the answer will be no.

Thus whilst the current reason for office insecurity is “lazyness” dressed up as “ease of use” in time it will be because historic security will not be possible, for by far the majority because the price will be too high.

It’s why some years ago some people looked at “life blogging” and it’s varients. In essence you instrument yourself and record everything you do say or even look at to a hard drive. In effect an “electronic witness”[2]… But nobody is a saint there are too many laws for us not to be law breakers, hence reason to seize the hard drive as evidence etc. But as Cardinal Richelieu knew some four centuries ago, guilt or innocence can be a matter of perception. Thus your witness whilst potentially showing your innocence of general petty criminality, can in oh so many other ways be used to make you appear guilty of the highest crimes… We don’t need to imagine if this is true or not, people have been prosecuted because of their “fit bit” data. How long before it’s pacemakers etc.

[1] It’s one of the reasons Governments are turning a blind eye to illegal DNA databases built up by law enforcment agencies and “Know your Ancestors” type companies who’s databases can be got at via a no oversight letter in many cases usually spearheaded by a “think of the children” campaign off of a very very far off outlier (see what’s happening in the US again with regards Apple’s phones). The point is by the time our children have children I suspect every child’s DNA to be on record for some excuse. Initially with some promise that it will only ever be used for something the public would accept, but quickly get down graded to something no one in their right mind would accept such as deciding if you are a suitable employee or health insurance risk… Or worse some kind of minority to be racially abused as happens with many national ID cards.

[2] Back then signed by what is now a way to short key and broken hash function… Which by the way appears to be the eventual fate of all such “chain” signiture systems. That is adding more bits to the length is not the real solution, but using multiple systems in parallel might be.

Clive Robinson • January 16, 2020 1:39 PM

@ ALL,

As MS Win7 is “on topic” at the moment for a couple of reasons and possibly a couple more shortly.

You might find this anonymous comment from an MS Dev who worked there befor the time of Win8 getting going might be of interest,

http://blog.zorinaq.com/i-contribute-to-the-windows-kernel-we-are-slower-than-other-oper/

Oh as for the later remorse comment treat that with a little suspicion. Knee jerk comments tend to be “rather too honest” than you might say to somebody face to face. It’s what tends to make them insightfull, and sharply accurate. Later remorse is a little like those white lies[1] we tell for the sake of peace and quiet if not the illusion of harmany in our public and even private persona projections.

[1] You know the ones about things like “Do you like my cake?” or the dred pitfall of “What do you think of my new jacket?” or other item of apparal (hey nobody looks good in skinny jeans, you just don’t say it 😉