Schneier on Security

Clive Robinson • November 7, 2018 12:25 PM

A fundemental assuption of economics is that markets are open thus all can see the market clearly.

As we know from practical experience markets are anything but open. Information that a customer needs to make an informed choice is quite deliberatly and with the help of lobbied for legislation witheld from the consumer. Even when information is in theory available, it’s hidden away behind complex virtually un-navigable language, menus, and other “designed to mislead” systems, not least the old TOCs and EULAs inside the package that you can not read untill you have purchased the product, that you then can not return because you don’t like the legalise.

Thus reports from consumer organisations help a small way to redress this balance.

Whilst that is good it might be better and faster if the law was changed so that software and the hardware it runs on are actually “real purchases” not “faux leases” with the likes of “Right to repair/modify”, etc properly codified in law. Heck even ensuring “The First Sale Doctorine” (17 U.S.C. § 109) for non physical purchases worked would be a start.

But what I would most like to see is all forms of lobbying with transfer of goods, services or tokens of exchange including future employment etc be treated in the same way as the US regards similar “inducments” by companies to make sales. That way there might be a slightly improved chance of getting legislation that favoured the citizen over the corporate. Which then might actually alow for “Open Market Knowledge”…

Clive Robinson • November 8, 2018 7:29 PM

@ K.s., Faustus,

<

blockquote>However, I agree, browsers should be more lenient in cases of self-signed certificates and should be able to pin them by default.

Remember “technology is agnostic to use” amd that “It’s the Directing mind that decides good or bad use”.

I can see the rudiments of how you might go about abusing such a process both technically and by social engineering.

Or to put it another way, nearly all cheap high bandwidth IoT devices come with what in earlier times would have been considered malware. It would be nice if we could say they were all “No name Chinese manufacturered” but we can not, because some more reputable names have also jumped into what is effectively the “collect it all game”.

The question is “why?” and the answer turns out to be run away marketing “featurism”. One manufactuter offers a very insecure but “neat” feature, and the next copies it and around it goes, at each turn the feature gets less securely implemented to “get it out the door”.

It’s long been known that consumers tend to “buy into specmanship” that is the more “green ticks” and less “red ticks” in those “feature comparison charts” you get with “product round up reviews” the more product that will get sold. Thus markiting departments actuall invent new “features” just to get a green tick the other products will have red crosses for…

Whilst most people will say “that’s a stupid way” to make a purchasing decision, most of us fall for it one way or another.

Now not wishing to be nasty but when it comes to security “Stupid is as Stupid does”. It does not take a master mind to work out that there are two effects of featurism on a product,

1, Much increased complexity (code, standards, protocols, interactions).
2, Much reduced testing per feature.

Thus the likelihood that product security will be “adversly effected” by each additional feature is quite high.

Those of us old enough to have been in more experienced positions back in the 1980’s and 1990’s can remember all of these problems with the likes of MicroSoft and other major vendors. It was a “train wreak” market racing to the bottom. It got so bad that even Bill Gates acknowledged that it was bad and syarted making changes to MicroSoft’s production methods.

Whilst we are seeing the same “featurism” in IoT, Smart Devices, etc what we don’t have is a dominant player who can force a change in the market. As others have noted on this blog “security does not sell” for various reasons with “featurism” or “Specmanship” being quite high on the list.

If we make “being insecure” easier in web browsers to cater for “insecure devices” then it’s guaranteed that we will see a decrease in security not just for those doing the “Stupid is as Stupid does” but everyone else as well. That is whilst a rising tide lifts all boats, the reverse is even more true “A falling tide Sinks all ships” in a Titanic way.