Schneier on Security

Clive Robinson • March 29, 2023 11:59 AM

@ ALL,

Re : EU DMA Perspective,

For those who need to considet the EU DMA in a different way, “The Conversation” gave a perspective view,

https://theconversation.com/can-the-eus-digital-markets-act-rein-in-big-tech-192373

Importantly note the failure of current “take over” legislation brought in back in the “Bricks and Mortar Business Days”.

Likewise how online businesses in particular could simply re-form themselves around the legislation to negate it’s effectiveness.

Oh and it also has some quite useful links on the subject…

Clive Robinson • March 30, 2023 4:13 AM

@ lurker, iAPX, SpaceLifeForm, Winter,

Re : It’s Three party not two.

“The trick is whether the judge can get both A and B to stand up in court and say, yes they fully understood the capability of each other’s phone.”

That is not what the legislation is about… The legislation cares not a jot about the end users A and B or their equipment compatability.

The legislation forces a “gatekeeper” in between the two of them and makes it the legal responsability of the “gatekeeper” not the “Users” not just to know the capabilities of the users equipment and software but also be able to “transcode” the data from one format to the other under all circumstances even when it is not possible[1].

Now consider just how much information each user would have to hand over to the “gatekeeper” about their devices, software, revisions, dates and times of updates etc. More than sufficient to “uniquely fingerprint” thus identify a device and so the user.

And that’s before also having to hand over all encryption keys etc to get the message content in a format that can be transcoded… Which currently means that the plaintext will be revealed.

So in effect this legislation is forcing on users a system for monitoring and censorship, that is actually worse than the “on device” system Apple tried to implement on the pretence it was only to catch CSAM, which we all know was “An abusable nonsense” as in reality it was “A wide opening unlocked back door”.

Remember under US and other jurisdictions legislation authorities obtaining access to all of this as it’s “third party business records” requires no warrent and is not subject to any oversight legal or political.

It does not matter how “shallow” you make the information on file formats etc, each piece of information is a piece of your “Privacy Leaked” with each piece striping you more and more naked infront of malevolent eyes you can not see…

Thus this legislation is worse than alowing anyone to do “up skirt video recording” and then make as much profit or other benifit as they can from it.

[1] There are known ambiguities that can not be resolved with something as simple as “colour”. That is RGBi does not map to CYMK either uniquely or in some cases at all… Which is made worse by applying certain statistics flattrning tricks to acomplish a form of “data compression” much like is done with telephones and aLaw and ulaw encoding that gives a crude aproximation to logrithmic compression. Then there are “internationalisation issues” as an example with dates,

Q: What is 10122022?

The 10th of December or the 12th of October last year, or could it be a Julian style date as a count from an unspecified epoch using an unspecified count step size? All of those and more are valid in CSV format files…

Clive Robinson • March 30, 2023 8:00 PM

@ SpaceLifeForm, modem phonemes, ALL,

Re: railway gauges

“IIRC, courses for horses.”

Actually “Roman courses” to stop chariots and wagons getting stuck. Julius Ceaser passed the 4 ft 8 & 1⁄2 in track width into law.

It’s actually a “usefull trade off” on the graph curve between turning circle and stability, at what ever speed you can reach.

As a very rough rule of thumb the width of the track is about half that of the pulling shaft end and the wheel hub. As speed increases so does the length of the shafts thus the size of the turning circle. Which is why horse drawn coaches in Europe were almost never above “two pair” except for “ceremonial and heavy load drafts, where the shafts were often segmented.

But the wider the width of the track the faster you can safely go, so…

Brunel for his Great West route used a very wide track giving not just speed but comfort. He could only do that as the run to Bristol was nearly flat and straight all the way.

When you have mountains with twisty paths and ledges to run on or holes in the ground with coal or rock being extracted speed and comfort are not criteria that are important thus you had 15inch “narrow gauge” as opposed to Brunel’s 7ft “broad gauge” or one of the many “standard gauges” based close to Gerorge “Stephenson gauge” at 4 ft 8 & 1⁄2 in, which was actually Julius Cesar’s legal guage (It’s said Stephenson just measured the ruts in the Roman Road flag stones, though it’s more likely it was an “artisanal norm” for coach builders of the time that he just followed for convenience and lower cost).

Some “wide guages” were “as big as a house” at nearly 30ft wide, but they were not usually for trains, you can still see them on some older docksides where they were used by the very large steam and later electric cranes used for loading and unloading ships prior to “container vessels” becoming a norm.

Clive Robinson • March 31, 2023 12:31 AM

@ ResearcherZero, SpaceLifeForm, ALL,

Re : Profit and loss privacy.

I know this is ‘tongue in cheek’,

“No one thinks about the profit model of the poor old commercial spyware and surveillance industry.”

But three points to note,

1, Some here do care how the profit is made.
2, We know the business models are technically illegal.
3, We know the companies are protected by nation states.

Oh and as the money comes from the “tax payers pocket” these less than lawfuly behaved companies are in no way “poor”.

Think of the companies and especially their seniors sucking on the teats of billions of dollars of state handouts/subsadies… With we assume as is normally the case some kind of “kick-back” to the political and legaslitive representatives as a mininum… with we can also safely assume “nest feathering” of those who have, or still do, receive salary direct from the public purse (civil servants, guard labour, etc).

But there are three asspects that have to be considered,

1, For a market to exist there has to be customers for it’s services.
2, To be able to provide these services systems have to be exploited.
3, For the services to be exploited they have to be vulnerable in some way.

Kick away any one of those three legs and either the market will topple or be at best dangerously unstable.

As an engineer I know the best leg to kick away to ensure the market topples compleatly is the third one.

That is if the services are not vulnerable, then they can not be exploited.

The problem with this is that the entire ICT industry is set up to encorage vulnerabilities to be permanently embedded at the lowest levels. This is not helped by those behind Elected Governments deliberatly trying to make ICT and associated systems as insecure as possible “for their own benifit”. A look at the history of the US FBI should make that abundently clear, even though so many still want to stick their heads in the sand, thus leaving themselves in an ass-up vulnerable position open to a sense of intrusion few would want to suffer, but one that the likes of the FBI happily take advantage of over and over.

One of the reasons “the technology is broken” is due to history. I and several other readers here were alive and had an interest in what we now call electronics or communications before semiconductors had got as far as “Medium Scale Integration”(MSI) chips[1].

The problem was the resources were increadibly expensive and an almost infitesimal fraction of the cost/capability you can get today (you can get a 20cent chip that can act just like a Micro-Vax CPU and Memory systems).

Thus “bang had to happen for the buck” so for the same reason we had Y2K we have no real security. Worse unlike Y2K that had to be fixed, nobody realy cares about fixing security. So we are running highly insecure systems like SS7 that started their life over half a century ago and were never designed to be secure in any way. And nobody is going to make them secure because they dare not, as even looking to hard at the standards would break them. And with that the worlds largest machine of the telecoms network would break with them probably unfixably… The only way to fix the security is,

“To start again”

They tried this with IPv6 and IPsec in the 1990’s and I think you can see how far that has come near a third of a century later (more correctly ‘has NOT come’).

Most is not all the low level protocols based around IP networking are not just “insecure” but actually “broken” thus known to be vulnerable in some way… Have a look at the software that manages switches and routers every so often another “bug that’s been there for more than 20years” pops up, and it’s a certain bet there are not just more to be found, but some are actively being used in exploits as “zero days” for APT and similar.

So if we can not fix the technology, we need to fix the law, and make the activities of these companies actually a crime, with hard jail sentances for top level executives and those that reward them (Venture Capitalism is currently the biggest security threat enabler as they see it as a more profitable place to play than rigging the finance markets).

But realistically nobody with the ability to change the legislation will do so, because there is way to much “Dark benifits” incentivising the opposite behaviour.

As for killing the market by killing off customers, any legislation that might act as such an enabler will be hobbled in some way. Probably to make legitimate security research that outs Zero Days and similar vulnarabilities illegal in some way.

So untill sufficient people pull their head out of the sand and put legislators in fear of their political lives that any incentives this nefarious industry can offer will be insufficient, it won’t happen…

I hate to say it but people need to look at how the anti-abortion cultists currently work in the US, and repurpose their techniques to get legislative change, that will have the same effect as Dec 1999 did for Y2K. Then maybe we will have a chance of getting Privacy secured so that society as we want it can survive.

[1] That is before calculator chips and the later first 16bit bitslice ALU chips that became the core of computers and eventually CPU chips in the 1970’s. In my case I was a licenced amateur/ham in the 1970’s before the boom in 8bit and later 16bit desktop computers of the 80’s. My interest in the early 70’s had made me a keen “satellite tracker”, in part having started “doing Pirate Radio” all whilst still at school. Then studied electronics and communications professionaly having started being a design engineer in time to ride the leading edge of the computer boom. I’d even written my first non trivial computer program before the mid 70’s and had written for that time proffessional grade satellite tracking software just after the mid 70’s that also produced a world map with an orbital overlay on high end Tektronix graphics terminals and chart plotters, that gave not just the “Subsatellite Path” ground track but the “Aquisition Of Signal”(AOS) tracks and time/inclination “web” lines. A later version output data to drive a “servo system” to control an antenna array (it ended up being used for a while at a University that had it’s own “ground station”).