Schneier on Security

Clive Robinson • July 11, 2023 10:02 AM

@ Bruce, Peter A.,

“…about popular printing services, and whether or not they read your documents and mine the data when you use them for printing“

It rather depends on what you mean by “mine”.

A probably valid assumption would be that as the documents are being paid for, the documents were already massaged and proof read by one or more humans. Thus of a reasonably high standard.

So they would have value, not just as the documents, but for other purposes…

Look at it this way, if they stored all they printed out, that could be sold as more original content to be shoved through an AI LLM learning process. Thus avoiding many issues of Internet scraping…

@ Peter A.,

It’s not just print manufacturers, consider the value of the Microsoft Office “online” for “original human contrnt.

The person incharge of Microsoft currently appears to lack all morals when it comes to other peoples IP and it reflects down through the organisation.

I’m not at all surprised, and predicted that “Cloud Services” would be bad news in many ways years ago and let’s say they’ve lived well below expectation so far. Also if what the Industry is asking the EU to do against Microsoft for it’s behaviours they are currently at the bottom of the barrel…

Clive Robinson • July 12, 2023 12:51 PM

@ lurker, Grim Sqeaker,

“passing it in digital form to a mechanical device that may be owned or operated by unknown forces, then it’s Game Over Man.”

Just one addition,

“If they can get communications to it”.

I have a policy of not buying anything that “requires, needs, or uses without my consent data connectivity”.

This results in me not having the dubious upsides of “Spy on you tech” but it also has the downside for them of not just not being able to take my money under false pretenses, it also stops the “commoditizing” of me for their profit as well.

Has the loss of the dubious upsides effected my life?

Not that I’m aware of, but then I was born a little under a decade before the time when having a landline phone and a colour TV made you very much “upper middle class”. Likewise both parents having cars and at that time well paid professional jobs.

I however along with all my friends did not use phones and well TV only had three channels by then and they were mostly not that good. So our activities were more physical than informational, most of us had pocket knives, matches, string, and similar bits and bobs in our pockets and “building camps” an almost endless activity in the summer months. Most of us could shoot, fish, set traps, and chop down trees. Oh and cooking, I guess we all knew how to do that to some extent before we were ten…

Do any of that these days and you’ld br called “ferral” or worse and “locked up for your own safety”…

Technology of the sort we are getting, is not good for “the public” but the Corporations, that’s a different story, the more helpless they can make you, the more money they can make from you, and they will unless you decide otherwise and learn those skills and have fun with them…

Clive Robinson • July 12, 2023 9:55 PM

@ lurker, ALL,

“If his ‘puter that drives the printer has some other connection to the world, then all bets are off.”

An issue, that I’ve talked about here and other places for what feels like a life time…

There is that old saying,

“If only the walls could talk…”

Well they can… as @RobertT and I pointed out with diagnosing how BadBIOS could work on this blog a decade ago, based on very similar work we had independently done back in the 1980’s.

But as with discussions with @Nick P, about other TEMPEST / EmSec issues we were “well ahead” and most a decade and a half later nave not yet realised they need to think about it.

As an example I pointed out why Code Signing could and would fail, and those “Walled Gardens” of Apple and Google prove it every day.

I’ve also pointed out “air-gapping” is a security failure this century, it’s quite deficient. If you are not “energy-gapping” then you are not even playing security “Janet and John” style… Yet next to nobody does it…

You might remember I got a bad rap for saying “secure messaging apps” were very definately,

“Not secure by design”.

Even though it was simple to demonstrate as fact. I think most security professionals now accept that it’s “the reality of the world” but hey “the tech is cool…”.

I can give people advice as to what to do and the mechanics and methods involved in how to do it.

But will the ordinary user do it?

No because of “convenience”.

I can prove quite simply that it is not possible for Govenments to stop E2EE if people want to use it. But it requires the individuals to take a little responsibility for their own actions. And as you can guess overwhelmingly people will not dissipline themselves to do it…

So the old,

“You can lead a horse to water, but…”

Applies and the old,

“Give me liberty, or give me death!”

Cry of Patrick Henry two and a half centuries ago, has become,

“Give me convenience, and bring me death!”

As those CIA assets in China and Iran discovered to late was not the way to go…

So what to say… I guess you could say I’ve failed, because I’ve not convinced people…

Clive Robinson • July 13, 2023 10:38 AM

@ Peter A., ALL,

Re : All messages can kill.

Please do not take this the wrong way, but…

“I have absolutely no issue with transmitting “Honey, I’ll be back at XX hrs, please put on the potatoes” over a cellphone that could be wiretapped by any 3-letter agency over here”

Are you sure of that?

Because I’m almost certain the opposit applies.

Prosecutors and all those behind them have absolutly no interest in justice.

They will take anything and twist it any way they can to make you look guilty.

This is not my oppinion, but the oppinion of more honest lawyers and Law Enforcment officers who advise you,

“Never talk to the Police”

Because even a totally innocent person telling the absolute truth can have it used against them as has been proved so many times.

Neither the prosecutor or police who –are often “elected” in the US, but even if not– get promotion and pay increases on “Meeting and Exceeding Conviction Numbers” are interested in truth or justice. They just want a quick and easy body count to climb up the ladder.

But this is not new, there is the famous quote attributed to Cardinal Richelieu that puts it fairly starkly,

“If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.”

But in the case of your,

“Honey, I’ll be back at XX hrs, please put on the potatoes”

Is so openly a “secret code phrase” to signal when to commit a very serious terrorist attack you should by now be on your way to an Orange Jumpsuit in a cage at one end of Cuba…

Why? Remember that pair of inept wanabe’s that thought using a “cake recipe” was a safe cover… Well “cooking potatoes” is just another variation…

That would be an “Easy Sell” in the US where prosecutors and law enforcment can pre-bias a trial by running it in the national media… And do so on an almost daily basis, as we see even in International News Media…

Now tell me do you prefere the chair or the needle as apparently hanging is not cruel enough…

Oh and before anyone argues I’m a socialist or liberal, have a look at the leanings of those in the US in jail who have “talked themselves in” by bigging it up etc. If nothing else the FBI are having a field day with a whole bunch of them right now, even those that were lawyers in high positions…