Schneier on Security

ab praeceptis • December 10, 2016 4:57 PM

A message to the us-americans debating election-related:

Put yourselves into the skin of mighty people, of those who used to (and possibly still) really steer your country.

Then look at the debates here. And that's about the intellectual upper-class of us-americans debating here. There are many much worse.

Now, ask yourself a simple question: "Would I, given I were one of the 0.1%, and given I were somehow out of kind and honestly interested in what the 99.9% think and want, would I and how long would I follow that path - and how soon would I return to the old path of "don't care about the masses. Keep them stupid, use and abuse them to your liking and punish them hard if they are not obedient!'?"

Pardon my french but I've read damn enough self-important idiotic crap here to tell you the real problem: YOU. You are the real problem. The 0.1% don't hold the power and use and abuse it to their liking because they are so intelligent or rich or whatever. Nope. They hold the power because the masses in the western world have become stupid, egocentrical, coreless blabbering idiot-bots.

Most of you/us do not even command of enough self-discipline and reasoning to understand the situation we're in. Most of you/us stay on the lowest most primitive level of perceiving and acting as if elections and the presidency were some kind of gladiator-games between two teams most of us having a clear position on one side.

If I were one of the 0.1% I'd tell you "What are you complaining about? After all we arranged a quite nice and exciting show for you and you seem to be quite taken by it. On a more serious note I could not possibly, no matter the good will I might have, allow the system to be run by you. You are hardly demonstrating what's needed to run a small town. Actually you are so excessively incapable that you do not even understand that you don't understand what's really going on or how it's played."

They offered you a nice fairy tale ("democracy") and you took it, hook, line, and sinker.

Let me close with a simple but important question: Assumed that there existed and would be implemented a perfect election system; non hackable, perfectly just, etc, etc.

Would we then live in a better world? Really?

Let me give you two hints:
a) the light bulb or the diesel engine were not invented by elections in a large convention.
b) The larger a group gets the stupider and easier to manipulate it gets.

Oh and btw: It's not Putin who manipulated your elections. Didn't you hear about the "research" that Putin is dead and that the russkies (possibly using the tens of billions of $ he amassed in his many palaces) created lots and lots of Putin-Clones? Maybe Trump didn't even need to be manipulated because he is a Putin clone anyway (them tricky russkies, threw you off track by giving him a weird hair-do). So what? They did that only because clinton is a reptiloid, probably from Mars. But don't you worry, as soon as the jesuits have won the war against the nazis in Antarctica they will take their flying discs and save us all (unless the creepy aliens in the tunnels come out to eat us all).

ab praeceptis • December 10, 2016 10:11 PM

Maxwell's Daemon

"formal verification ... enlightening"

My pleasure. I mean it. The more of us there are who *really* care about creating safe software, the safer we are all. If I, as it seems, could help you in any way in that endeavour than all the typing (attempt at pun, haha) was good for something.

As for the other matter: What drives me mad is that they (>>90% of the 99.9%) don't even pass the first gate of reasoning. That whole elections debate is meaningless if the premise is wrong - and exactly that seems to be the case. I'm talking about the "democracy" premise.

If our kid were seriously ill, would we walk downtown and poll some 100 people on how to treat the kid? Or maybe even on who of some arbitrary people should perform surgery on our kid?
Hell, we wouldn't even consider that an acceptable approach if it was just our car that was broken.

Short: We look for and demand certain qualities - plus - we want that qualification to be serious and checked by some authority or at the very minimum by excellent reputation.

But with our countries we deem it fine to make a mega poll (elections), well noted with candidates *not* selected by us, on who should run it? Spock might call that "fascinating"; I call it simply braindead.

The magic is simple: Tell some million idiots a fairy tale about their immense significance when chosing between red and blue every 4 years and make an insanely big show out of it - and they will fall for it.
After all, the dumber the derp the more he will be ready to buy the "your vote counts!" story.

I'm bewildered how mercilessly stupid people are. They verify absolutely nothing. "Your vote counts!" - they not only don't verify that but, worse, they are pissed off when I ask them to stop ranting and to think about how to make "your vote counts" at least a little more realistic.

Next, I see a serial mass murder talking as if they were nicer than granny. clinton is exactly that. Provably. Plus a serial liar. Provably. Plus she doesn't care sh*t if us-american soldiers or ambassadors die. Provably.
This is not a question of pro or anti clinton or Trump. In any country with a minimum of lawfulness and civilization clinton would be in jail; simple as that (and so would quite some others from both parties).
Yet, there is an endless stream of us-americans who behave as if the usa could hardly continue to exist without clinton being president.

Idiots. Braindead derp idiots all over the place. Btw, it isn't much better in europe. It seems that mankind needed 3000 years to reach an intellectual and civilization peak but just some decades back towards being apes.

ab praeceptis • December 10, 2016 10:37 PM

Daniela Caruso

First of all, with most issues, and certainly in the field of security, it's always a deal and nothing comes free.

To offer an example: Even if, assumed, tor were secure, you'd pay a price. For one in speed plus, more importantly, in risking to create suspicion.

My usual first advice is "*Against what* do want to defend/be secure?". Another very important point is that the playground isn't static. Example: To defend against too curious neighbours or colleagues, even lousy encryption is good; chances are that even, say, old DES would be more than secure enough. That might quickly change, however, if, say, tomorrow the fbi believed you might be a terrorist.

The ugly part very many don't see is that crossing over a certain level of (simple) security, one quite probably wakes up "sleeping dogs" and has people ofa very different caliber enter the game.
IMO this is one of the ugliest properties of tor. It paints "suspicious" on your forehead (in the eyes of many agencies) and at the same time next to certainly fails to protect you against that kind of adversaries.

As for Snowden and tor my opinion is this: Probably Snowden is a nice human being and almost certainly he had access to lots of security related material - but that doesn't make him an ITsec expert. From what I know he quite probably is not.
If I wanted to know about dirty things the nsa did, I would ask him; if I wanted to know about OpSec in agencies, I'd ask him. If I wanted to know, however, about the security of algorithms or protocols I would not ask him.

Finally YOU are a decisive factor. It's like with a knife. Don't bring one along in a bad neighbourhood unless you master that art. If a bad guy sees you with a knife you find yourself in a severely escalated situation.

If you are a windows user whose expertise allows him/her to click-install tor, stay away. If you are an experienced user with solid security know you won't need (nor like) it.

In other words: Stay within your league and avoid the middle ground.

I'd suggest to look into PGP. That's relatively good security and relatively easy to use (My tax guy learned it in an hour or so (with a little help)). That allows you to encrypt and exchange pretty every kind of confidential material.
As for privacy I'd suggest to go the VPN route. With a little luck that'll provide plenty privacy for little money (maybe 50 to 100$/year) plus an innocent excuse ("I used it to watch TV series in/from other countries"). *Avoid* the big names and look for reputation.

ab praeceptis • December 10, 2016 10:51 PM

Thoth

I agree partly. *Obviously* that guy is evangelizing and selling, for instance, Signal.

At the same time I feel you are too hard on him. Example: a) one *can*, at least with quite some IMs, transfer files. b) IMs short lived and not stored? Maybe. Maybe not.

What worries me more, though, is to see what kid of people work on tls 1.3 - obviously believing in it.
I take his betting on signal, a toy for iphone and android, as a confession of gross incompetence.

ab praeceptis • December 11, 2016 6:15 PM

Nick P

Thanks for your interesting hints. I would, of course, love to discuss that interesting matter that, as a side note, is also closely related to better election machines.

Unfortunately, though, certain people here who only very rarely if at all contribute to matters in the scope of this blog, continue to abuse Bruce Schneiers hospitality and to sully this blogs comments section with the output of what seems to be social and personality disorders.

I'll gladly join the interesting technical (temporarily non-)discussions as soon as that is reasonably feasible again.

ab praeceptis • December 11, 2016 9:36 PM

Thoth

"Why did I chose Java for GroggyBox's GUI client and not some Haskell or Ada ? It has a huge support base and almost every OS and system supports Java. ... has to be easily usable even for one's own granny !!!"

How easy your program is to use is little to do with the language you use.

As for running pretty much everywhere you are right with java - however, the same is true for Scala which is considered more secure. Moreover there exists a (rather rich) Scala subset (LEON) that allows for formal methods.

Although I value your work I find it regrettable that you yourself tainted it by using a language should be considered as quite poor regarding safety.

In the end it comes down to you having lots of good will and having invested lots of work but not having any satisfying level of certainty regarding the reliability and safety of your software.

You should at the very minimum use java ESC (formal annotations). Just a friendly advice.

ab praeceptis • December 12, 2016 12:13 AM

Thoth

First and importantly: I like you. You are a colleage and one that actually moves his ass and works on concrete solution. So, do not mistake what I say as negative criticism. It is not. It's just that I'm the weirdo who happens to think that safety and security are important and worth going an extra mile.

Trust me, I can understand your argument. We all have our preferred languages that we are used to and have lots of experience with, and I myself sometimes grunt at e.g. Nick P under the "paper tower" headline.

No matter how nice a given language is *theoretically*, it's like with a car: The nicest porsche engine is of little worth whithout a good chassis, brakes, wheels, etc.
Similarly, for us developers and engineers we need a complete tool chain that works on/for all architectures and systems we might need to target.

I know what I'm talking about. Seen it, done it, been there. I *actually have* fought with diverse languages like, for instance, Sather as a C generator, Modula-x for diverse stuff, etc. Similarly I did not just read papers about formal methods but I have actually *used* them in practical work. And yes, that's a sad story. In the end there are *very* few practically useable languages with an at least reasonable basic tool chain and for a reasonable set of architectures and systems.

But still, there is a major weakness in your argumentation. It comes down to "why should I eat pain and make major efforts when the whole system is rotten anyway?".

Please, consider 2 points:

a) Unless we start to actually build up a basis, a set of solidly engineered software, we will continue to run in the that wheel of argumentation forever (while nsa, fbi, and accomplices solidly f*ck is with cacti).

b) Unless you can formally prove safety you have none. Simple and brutal as that.

Again, you can't change java or windows or shitty libraries, nor is it your job. What you can do, however, is to make sure that at least your sofware is safe and secure, no matter how much below and above it is crap.
It's not much in a lousy environment, I know, and it's hard work but it's the ony way to create a safer IT basis.

ab praeceptis • December 12, 2016 2:32 AM

Thoth

My javacard knowledge is rather limited but from what I know the javacard tools work on class files; those can be created with scala like with java and the javacard tools should be happy with both.

Moreover, as I mentioned there is ESC/java which afaik can work with SMT solvers in the back. So, one can significantly enhance ones trust in java code. Plus, which is important for javacard, it is transparent as it's annotation based.

You do what you want and I won't evangelize; but I didn't want you to pass up just because you seemed to not know that there are ways.

Whatever. Up to you and good luck

ab praeceptis • December 12, 2016 11:10 PM

Daniela Aligheri Caruso

For the sake of fairness and justice: It's easy for me to look like the nice helpful guy, compared to, say, Nick P.

The reason is simple. Different persons here have different foci and priorities. Mine just happens to be very practical and largely guided by the fact that the vast majority of the people don't have a nsa tao team as adversary but rather curious colleagues or scriptkiddies.

People like Nick P are looking for perfection and for security in even absurd scenarios. It's important to understand that their approach is a very important aspect, too. It just so happens that the vast majority of people will never be in a situation where some opponent infrared laser eavesdrops on the them or runs a highly detailled power consumption profile against their encryption.

For banks or state agencies, however, those seemingly absurd scenarios are tangible and it's good that we have people like Nick P, too, who worry about those.

I'd like to come back on your question and add a point. Pretty everything can be interpreted in diverse ways. "Privacy" is an example. I took it to mean (in your context) that the remote end, e.g. a web site, shouldn't know who you are.

Others took it to mean something more general and that's a valid point. The question is how far one wants to go down that road. You see, one might as well argue that the advantage of tor over a vpn solution is rather limited, if the opponent were a state agency; they could, for instance, do pre-/-post matching, get at your isp and then to you anyway, even if we would assume tor to be secure (which I personally definitely do not).
So, next step: use tor but on top of a public wifi entry point. Oh, gee, no, because your tablet could be identified. So, next step, use a throw away tablet - how many of those can you afford?
But that's still not good enough considering all the cameras in public spaces that would allow to identify you. Well, next step, let's use bombs ... and all of that gets even more ridiculous considering that the vast majority of "I need security!" Joes and Janes forget to look at the cost/benefit ratio. Which leads us back to "against what to you want to defend yourself?" Plus:" Are you sure that you attribute the values correctly?" Plus: "Do you even understand the involved problem field and threat classes well enough?"

And all of that, well noted, in a given realistic context which happens to be that we are not victimized because, oh "aes-128 was to weak, had only we used aes-256!" or because oh "had only we used our computer in a faraday cage mesh!" - Nope. We get victimized because we (way too many of us) are using crap OSs on crap systems running crap software using crap libraries. And as that isn't bad enough we can't bothered to use reasonably secure passwords and reasonably many of them plus way too many have an attitude of "I want 3-D bling bling with stereo sound effects to click on in my browser! plus "security? Hey, there are laws plus I shelled out 30$ for Symerski2000 AV gateway, firewall, anti-evil".

Sorry if I sound rude but the most important advice I have for most people is simply "Avoid idiocy! Use your brain, think before acting and, very important: complexity is your enemy. Of all available reasonable approaches use the simplest one, one that you understand if any possible".

ab praeceptis • December 12, 2016 11:17 PM

Nick P

You evil twin (in mind)*g

Yes. An old pentium with Oberon (in a recent incarnation) on it will carry you a long way if you want a reliable basic communication and reference system.

Another reason for me to second what you say is that, yes, x86 should be looked at with very mistrusting eyes but it's what's easily available (still have my beloved T-22 plus a couple of mainboard and a reserve TFT, hehe) and what's not too high an entry barrier for many less experienced users.