Schneier on Security

Clive Robinson • January 9, 2018 10:10 PM

@ Bruce,

I don’t think I’m the prophet of doom, and don’t want to come across that way.

Guess what Bruce, we all are to someone when we behave responsibly. Teenage kids want to do new things experiment as it were. Parents might be “Buzz kills” to such children but they would be irresponsible parents if they did not give warnings and apply restrictions.

I’m not as young as I used to be and like Doug above I’ve been designing electronics since before the Z80 was available let alone affordable. I now look back at some of the things I did and well I cringe to be quite honest. How I and some others did not end up being preped for autopsy I realy don’t know…

The US has a reputation for idiot ideas as business plans some despite common sense have become a success[1]. Why I have no idea but then that’s consumers for you… Unfortunatly they have a habit of encorraging other madmen with money. Other insane or idiot ideas thankfully bankrupt their product developers and we hear little more of the idea.

For instance one from history that I tell students. Bath tubs used to be made of cast iron then enameled. Likewise radiators for home heating. Which means bath water gets cold quite quickly. But if you look inside a boiler you see what are in effect small cast iron radiators with gas burners underneath. So yes some bright eyed bushy tailed inventer developed an idea for an under bath gas heater and patented it…

Ever heard of the Boiling the frog experiment? Well this one also had a couple of other disadvantages no flue ment a room full of carbon monoxide and as the burner is close to wooden floor boards houses could and did catch fire…

The patent offices of most countries are full of such madness, and we look back on them and say in our heads “What were they thinking…”

But we forget that 20/20 hindsight can make all of us look smart even complete idiots. Where as 20/20 foresight is a gift given to very few in the world.

Much IoT is as some hear know the 21st century equivalent of that under the bath boiler. It’s just that too few people have the foresight to see they are the equivalent of a frog boiling gas chamber come crematorium.

Because people with not even 20/20 forsight go “Hang on a moment chaps, this might be a problem” they get cast as the “Buzz kill” or the “Doom sayer”…

But I tell you what I’d rather be called that than “murderer”, “child killer”, or worse sit there in private guilt knowing that I should have thought about that aspect of safety.

But as I’ve said before in some languages they have but one word for both safety and security. That alone should make us pause to think about why we treat safety and security differently, and that perhaps when it comes to product design we should not.

For those not convinced we have on this blog passed comment about the idiocy of IoT door locks and how they could be easily be bypassed with a little “Internet fu”. Now think about how many people you have heard about being injured or killed by those gaining illegal entry to peoples homes? No it’s not as common as the press sometimes appear to make it be, I know. But if you had designed such a lock and a home invader had used it to commit a crime and it ended in a horrendous blood bath or worse, how are you going to feel on reading about it? On questioning by the authorities? On questioning by a lawyer representing the interests of the victims in court?

Was it realy too difficult to treat security with the same level of input as product safety, or in fact a lot lot better?

So my view Bruce, though you might not like it, is you are not “Buzz kill” enough, and doomsaying is in effect a civic duty when it can be clearly described and the risks seen.

Oh and watch out for the “salami slicing” or “cheese parring” arguments people with a “can do mentality” come up with.

Some of you might once have flown into the old Hong Kong airport. It was scarry because you flew not over buildings on approach but between skyscrapers. You might have thought “What idiot…” I know I did. The skyscrapers got there by the oldest trick in the book of “nothings happened yet so we can do it again” each year another taller closer building got built because so far no building had been hit… It’s the same daft argument as putting a can of petrol or other accelerant down beside a fire… Each time a little closer untill one bright sunny winters day “Boom”.

Bruce the world has more idiots and madmen than sane who are prepared to stand up to them. Don’t make the number of sane one less because an idiot or madman wants to put squirrels in you head to make you doubt yourself.

[1] Do you realy need what turns out to be a “lighter than air” bouncy castle for your young childs birthday party, where one gust of air could send little jo/joe up to the heavens above or beyond?

Clive Robinson • January 10, 2018 6:29 AM

@ Bruce, ALL,

Having had a bit of a night to mull it over, I think Mr Miessler is playing a rather silly game.

Lets start with,

I know it’s super cool to scream about how IoT is insecure

No it’s not, it’s wise and precautionary to alert people to the fact of what is going on. The fact that some faux technologists are going “wow” and “Super Cool” and “I just want XXX” frequently is a form of direct propaganda avoiding advertising rules.

Next we get the pretend to be giving fatherly advice, etc etc line,

I absolutely respect Bruce Schneier a lot for what he’s contributed to InfoSec, which makes me that much more disappointed with this kind of position from him.

Whilst actually free loading off of your efforts and contributions.

We see the same trick again

InfoSec is full of those people, and it’s beneath people like Bruce to add their voices to theirs.

For whatever reason Mr Miessler has taken a position and like a used car salesman that puts sawdust in the gear box he’s trying to sell readers something that is unwise to buy.

And here it is,

Everyone paying attention already knows it’s going to be a soup sandwich—a carnival of horrors—a tragedy of mistakes and abuses of trust.

You note the “Everyone paying attention”, which is just wrong, we know from all sorts of mrasuers that very few to no consumers who buy IoT or Amazon Tech are paying attention. I could draw up a list but it would be an article in it’s own right.

So there we have the main point of Mr Miessler’s disagreament he does not like the reality of the situation and want’s people to keep pointing it out, he want’s the party to keep swinging despite the fact the punch is made with wood alcohol which realy will make you go blind, not just blind drunk.

He then tries to reinforce it with,

It’s obvious. Not interesting. Not novel. Obvious. But obvious or not, all these things are still going to happen.

But do you notice the wallpapering of his backside with the claim of what is “pre-ordained” he high lighted it to make sure the wallpaper is thick.

So again we see the argument for the party to go on, rather ike it did on the Titanic. Hey don’t listen to those who are trying to save your life just get another drink in they are free as long as you dance on till you drown…

But he then pulls the real whizzer out from behind his back,

When we brought electricity to millions of homes, houses burned down, and people died, but I’d argue it was worth it to have electricity in the home and business.

What a steaming great pile, that argument is so mindlessly stupid, the only way he can get away with it is because very few know the truth of it, even though you can look it up.

The electricity market was a ballon market with winner take all as the prize. There were so many different suppliers all with their own funny ways. Some were DC some were AC some had low voltage some had very high voltage. There might be three or more different suppliers in a large town. The safety features were a joke basically a couple of bare wires came into your home to a board nailed up in your roof space. Then in early systems bare wires ran down the walls to switches and the like made out of metal and fragile glass… The reason people died was incompatability of systems, no safety and naked greed of the industry making “market share” sound familier?

I will bring Mr Miessler’s argument into this century with something directly comparable,

Airline security was so bad that all the people who dide due to 9/11 was a good thing. Because it gave us the DHS and TSA, so we could have fedral employees inspect our shoes. Thus the lucky few bagage checkers who did not get the sack got their wages doubled, the airlines nolonger had to pay for it thus got increased profit, and “all the President’s men” directly or indirectly got very wealthy off of the back of untested and non efficacious security products. Oh and we the citizen’s lost rights, so now it’s OK to be groped up by bullies and perverts and our lives made worse in so many ways, with bo right of redress.

Have a think about what Mr Miessler said and remember it and hold it to your heart every time you read his words from now on. He personaly thinks it’s OK for people to be hurt, killed or burnt to death, just so non liable corporations can get increadably rich off of you one way or another. Untill that is it gets so bad that regulations and standards to limit the harms get pushed through the legislative process…

Further that he thinks it’s wrong of people like Bruce trying to stop his idea from happening…

He goes on just to make sure you get his point,

Fear-mongering about IoT is like looking at the first electricity coming to homes in the early 1900’s and warning everyone it’s a horrible idea because of the fire hazard.

Does he actually realise what he has written? Did he try reversing the order of his argument,

1, The technology has a high probability of causing you significant harm or even death.

2, We saw this in the 1900’s in an unregulated unstandardised free for all market.

3, Mr Miessler considers IoT to be just like the 1900 market.

4, Warning about it is “Fear-mongering” and thus people should not do it.

Does anyone else see the irony in his dismissing what he claims Bruce is doing?

Mr Miessler goes on to lie by ommission with,

You’re honestly objecting to assigning trust, at digital level, to various people in your family, friends, various organizations, etc?

He omits to mention that you are given no choice but to trust the “various organizations”. But neglects to mention that history tells us not only will the quite deliberatly abuse that trust. But Mr Miessler neglects to mention that their security is so week that in effect they give no protection to the device they have sold you, or the data they have collected from you. Thus he’s trying a “sunny side up” argument that tells you ‘Don’t look behind the curtain it’s realy scary and it will take the fun out of non ownership of your IoT toys”…

Then we get a direct lie, an assumption and a refrence back to your harm is good,

Technology is integrating into human life on planet Earth, and there’s not anything anyone can do to stop that. And once we get out of the woods it’s going to be a massive improvement. Just like electrification was.

There is plenty you can currently do to stop the IoT integration, not buying the junk for one, disabling it’s unneeded IoT functions another. If people do not engage with the hype then it will not happen. Then the assumption of “a massive improvment” do you remember people saying that about “remote controls”, they have been attributed to increasing the “couch potato” life style that is reducing peoples life spans does that sound like a good idea on a personal basis? Before you answer remember the average lifespan in the US has dropped yet again and couch potato morbidity diseases are still very much on the rise making not just the couch potatos but big pharma and health insurance fat, very fat, so much so they are a good pension investment[1].

As I said about his electrification idea, remember the benifits of 9/11 it’s a more modern example.

Now we get a real two face argument from Mr Miessler,

We should obviously try to minimize the risks, but we don’t do that by trying to shout down the entire enterprise.

So Bruce very much is trying to minimise the risks (just as parents do with crossing roads). But admitting that would make Mr Miessler’s article pointless, hence he has to accuse him of trying to bring “down the entire enterprise”. Has anyone actually heard bruce say ‘We must never do IoT’, if they have I’ve missed it, all I’ve heard is requests for regulation and standardisation, which considering the potential harm that Mr Miessler recognises exists I think is a quite reasonable thing to do.

So onwards through what is becomming a malodorous cess pit of an article from Mr Mirssler. We get a lie about the obvious and thus two false accusations arising,

To characterize Amazon’s progress in smart homes as, “They want to control our lives.” is both incredibly shortsighted and irresponsible.

Now for anyone who has looked at Amazon their whole ethos is to drag you in and hold you dependent on them in any which way possible. That by definition is controling behaviour we used to call it “customer lock in” when IBM and other big iron software companies did it, and it’s the model much of the close sorce industry wants to move to, one of “endless rent” coming in strong and steady. Thus the only thing you can accuse anybody saying “They want to control our lives” is “Stating the bleeding obvious”. However obvious as it might be to those in the industry it is less so to consumers, thus a person would be fully justified in saying it. It’s a bit like Google’s “Do no Evil” which people regularly call out. However Mr Miessler decides that accusations of “both incredibly shortsighted and irresponsible”. I would say Mr Miessler has mistaken his own behaviour for others more rational, logical and entirely reasonable behaviour.

I’ll let others decide on the other attributes Mr Miessler thinks he has 😉

Now we get to that bit Mr Miessler things Bruce should be doing,

Yes folks—things are going to get nasty. The digitization of our lives through IoT will be a bumpy ride, and people will get hurt. We in InfoSec are on the front lines. We’re the technologists embracing this change first, as the inevitability that it is, and we’re doing our best to make the transition as safe as possible for you.

The first three sentences of that are what Bruce has pointed out for quite some time.

But lets look at the next bit… That fourth and fifth sentences with the “We” at the start, well that’s not realy true, most are not on the front lines, many in fact are on the other side of the lines feeding the enemy with IoT ammunition. As for embracing some are actively fighting it off like you would any parasitic entity which many behind IoT appear to be. Further it’s not an inevetability as I’ve already mentioned. But importantly Mr Miessler is most definatly not trying to make it “as safe as possible for you” with his article, infact the very opposit, he wants you to drink and drown in the faux sparkle and lies of IoT that he would rather see spread untill things get apocalyptic and legislators are forced to act.

But Mr Miessler can not let it go, he’s like a manky scavaging mut with a bone he’s determind to chew to the end. So we next get,

Not dog-piling on every new technology/life integration like it’s the harbinger of death that must be stopped by InfoSec. It’s not our job to stop the inevitable from happening; it’s our job to make it more safe when it does.

Err no this is wrong on just about every point to see why start with “it’s our job to make it more safe when it does”… Thus Mr Miessler is arguing we should do at most nothing untill the disaster is upon us causing harm. I guess he’s not heard about the problems with “backwards compatability” and making a clean break, perhaps he should read up on what Intel have been doing for the past third of a century with the IAx86 internals and what that has led to just recently…

Working back we again find that faux implication of “inevitable”, I guess you have to start wondering what’s so important about it that Mr Miessler has to keep stating it. It’s kind of suspicious any one know?

But then we get back to the lies again. As I said as far as I can remember all Bruce has asked for is sensible behavioir not pointless greed that will cause active harms, and reculation to ensure that IoT minimises harms before it becomes any more harmfull, after all I think most people would agree that the biggest Distributed Denial of Service attack sofar in ICT history kind of counts as a harm in most technologists heads. Perhaps Mr Miessler does not think so and more of the same would be good very good. As I’ve said you have to start woundering about his motivations…

And so back to Mr Miessler’s false use of the electrification argument again,

People complaining about fire hazards wouldn’t have stopped electrification, and people complaining about IoT isn’t going to stop that either.

People did complain from the outset that dangers were involved and measures needed to be put in place (they were aware of this from Victorian Boiler Explosions and subsequent legislation which was the first of it’s kind). But back then they had their own Mr Miessler’s running cover and distraction. Finally regulation and standardisation was achived at immense cost, which nearly killed the industry, it certainly did much harm and killed of sections of it. In other countries it became necessary to Nationalize the electricity business to keep it alive. None of which needed to happen. Likewise the fires and deaths if regulation for safety had been brought in at the begining, they would not have happened.

Contrary to what many claim regulation is not a market inhibitor, it actually makes it broader and fairer and actually increases consummer confidence thus grows a market more along the lines of what is needed not the grasp of a quick profit bubble followed by a downward tail spin “race to the bottom” which decimates the market and often harms beyond recovery.

In general “free market” proponents don’t actually understand markets, whilst those that pay them to spout it are the ones setting up monopolies and cartels and greatly profiting from the disinformation…

But still onwards we go with Mr Miessler’s article, and his plee of “People need us” because,

They’re bewildered and scared. So let’s start preparing them for what’s coming instead of adding to their fear and uncertainty.

I realy do not want to prepare people for significant harm and even death like an inevitability, as Mr Miessler thinks is the way to go to some golden prommised future far away.

The future is almost never golden such is humanities lot, and IoT is not going to bring some universal utopia, if the history of computers is anything to go by a few will get very rich at others expence. For those ordinary people it will cause insecurity, and there will be considerable mental harms such as depressive and adictive disorders, thus lost productivity. Draconian efforts by Dictators and Democracies alike to turn it into a surveillance tool and in effect bring forward a Police State agenda to ensure their tenure by authoritarian behaviour. That’s what the history of computing has so far taught us, what do people think IoT will add to the list, unless regulated to prevent it?

Thus personaly I’d rather warn of the dangers we already know are happening, point out history and push for legislation to stop it getting as bad or worse.

That way if we get the regulation history teaches us we realy realy need to protect us not just from the Corporations but the State and criminals alike, then we don’t have to prepare people from significant harm or death of loved ones etc.

But Mr Miessler if he had actually studdied the history of industrial technology like the electrification of peoples homes he holds up as a shining example, would know that those harms can be avoided or atleast minimised by early and strong regulation.

Which again makes me wonder what’s in it for him to argue otherwise.

As to Mr Miessler’s final point,

We’re better than this.

Yes we are better than what he is suggesting, much much better, the real question is why we are not as successful at it as we should be.

Maybe it’s because of the way Mr Miessler suggests we act. After all it’s how powerfull vested intetests have tried to always play the game untill their excesses brings in strong regulation. Regulation that at great expense provides a better fairer more transparent market, all of which the vested interests hate as it brings down their overly large profits, poor quality and disregard of any humanity.

But I guess Mr Miessler likes that for some reason.

Maybe his readers would care to make comnent on his site.

[1] Yes you can invest in the early death of a couch potato, you just take out life assurance on them. Companies are doing it currently and it’s said by some they see a 10% yield off of it in various ways…

Clive Robinson • January 10, 2018 11:47 AM

@ Bob,

I’m stealing “couch potato morbidity diseases.”

My words but technically Bruce’s derived work copyright, so that’s a drink apeice please…

Seriously though if you ever get to meet our host by him a cup of tea atleast, it’s not an easy job running this sort of blog.

And if you use my words point back to here so Bruce gets another visitor or two who hopefully will join in, as each opinion and point of view counts.

Clive Robinson • January 10, 2018 2:39 PM

@Tim,

There is one more thing that is not often mentioned. How much Radio Frequency Interference is generated by so many IoT transmitters?

Yup not only is it “poluting” the airwaves, it’s also generating an increased heat polution and commensurately larger carbon footprint…

Just the way life works when you have to share a limited resource…

Clive Robinson • January 11, 2018 2:29 AM

@ Rachel,

Mr M, internet of things protaganist, was found in his kitchen castrated with a quarter-lobotomy

Hmm I did not realise that Mr M was sufficiently spinless to get in such a contorted position where a simultaneous injury to brain and gonads could be performed by a can opener no matter how smart it’s IoT tech…

The actual point though is Mr Miessler for reasons unknown decided to be not just overly critical over what most would regard a miniscule difference of opinion, he tried to window dress it up into something major… But in a way that said more about his inabilities than those of who he was criticizing. Trust me if I can spot the failings in his argument, in almost every sentance he wrote, then I would expect many if not most of his readers can as well.

Thus he received a self inflicted injury from his target practice at his feet. Having not knowingly read other of Mr Miessler’s articles, I can not say if this is a momentary aberration on his behalf or his normal MO. But such that it is I find myself in the position of being disinclined to read further of his works to find out.

Look on it like eating an apple in the dark, your first bite is nauseous, are you going to chuck it out or turn it around and take another bite? There are after all many more apples in the barrel to chose from, if not other barrels to pick.

Clive Robinson • January 11, 2018 3:45 PM

@ Nick P,

This man’s article is sophistry and libel that only serves the interests of IoT suppliers and a subset of their customers that accept being harmed without attempts to prevent that.

If you look at Mr Miessler’s book index you will see he’s in effect acting an “IoT Evangelist”.

Thus it would appear that @Bruce is “breaking his rice bowl” hence the “sowing squirrels in your head” rhetoric.

Also the book it’s self the way it’s presented and the reaction all scream “Outsider wanting in” to me. Thus he’s picking a fight to get attention and boost his readership etc and thereby try to get what he considers increased credibility.

Most of us have seen the little guy in a bar get a skinful and get beligerent with a large guy who’s minding his own business. It goes by various names but plain and simple it’s a form of inadequacy complex. Well it’s a similar issue Mr Miessler appears to have…

Maybe we should feel sorry for the inadequacy he feels?