Distributed Security

A reader writes: ""Where Schneier had sought one overarching technical fix, hard experience had taught him the quest was illusory." A long and detailed article at The Atlantic Online on why Bruce Schneier has come down from his strong cryptography tower to preach the gospel of small scale, ductile security against the popular approach of broad scale, often high tech security that often proves to be very brittle."

Comments

Haven't we been here before?

[sstammer]

Haven't we been here before, about a year ago?!

non-password validation

[Raiford]

Let's move into a non-password method of user validation for computer systems and networks. Anyone for a USB retinal scanner or DNA fingerprint validation system for your office network PC.

Interesting article.

[^MB^]

Very long, but worth the time to read. I've been a big fan of Schneier since i read his book a few years ago.

Best Article quote: "Cryptophiles, Schneier among them, had been so enraptured by the possibilities of uncrackable ciphers that they forgot they were living in a world in which people can't program VCRs.

Perfect timing as I'm gearing up for CRYPTO 2002 at UCSB, YAY!

-Nick

Re:yeah

[Anonymous Coward]

I was the anonymous poster of this story, and the title I submitted was "America's Maginot Line". I am disappointed that this title was dropped as it is directly relevant to the attitude being discussed in the article, and in fact the Maginot Line is directly referenced in the piece. A quick search reveals not a single use of the word 'distributed' in the entire article.

p.s. Sorry about the clumsy double use of 'often' in the last sentence - wouldn't have minded some editorial action there.

Re:Secrecy failure in the entertainment industry

[fyonn]

Once that secret gets out, the security is hopelessly compromised. The Germans learned this the hard way in WWII.

well, I'm not sure abot that. once the allies worked out how the enigma machines worked then german comms were not suddenly an open book. yes, we could set the early calculating machines (the bombes) and the first computer (collosus) to attwempting to work out the daily code but they needed help. alot of the breaks were where the germans were careless like sending weather reports first thing in the morning in a known format. if if you knew the weather was clear then you could capture the first msg of the day form place X and know that the cipher text matches the plaintext "the weather is clear". there was, of course, a bit more to it than that but thats a basic idea.

knowing the algorithm wasn't enough as the task, with no clues, was too computationally intensive for the technology of the day to solve, much like cracking public key is certainly do-able when you know the code, it's just not doable in any reasonable timeframe.

the clues that the allies got to what the cyphertext might decode to and the codebooks they captured contributed massively to the code breaking effort.

dave

Re:the most important point of the article

[dillon_rinker]

what if they sharpen the edge of a credit card? isn't that more dangerous than a nail clipper?

Yup. Flint knapping is a not-unheard of hobby. Wonder if I could get a piece of deer antler and some rocks past a security guard. Or a CD - ever break one of those? How about a laptop computer? They're full of sheet metal, and you can make an expedient knife out of sheet metal.

RTFA (Was: non-password validation)

[Observer]

FWIW, the referenced article includes an extensive discussion of the ways that currently commercially-available biometric authentication mechanisms have been found, how to put it politely, rather less reliable and rather more easy to spoof than their glossy booklets and glossy marketroids (not to mention lossy polliticians) have been wont to claim.

Which is not to say that a biometric device combined with intelligent human oversight (so you'll be spotted if you try to use an artificial hand to fool a device based on hand and finger sizes, for example) isn't an appropriate component of an authentication system, and the article gives an example in use on Mr Schneier's home turf.

Seriously, do read the article, even if it is a little on the long side. It contains a lot of good sense: in particular its emphasis on putting human decision-making back into the loop, rather than looking for all-encompassing technical solutions. We're clearly not yet at the point where our technology is sufficiently advanced that it can act as if by magic - as a lot of snake-oil merchants pretend, and a lot of quick-fix politicos who should know better affect to believe.

Re:Lessons for Programmers

[sphealey]

But this often fails - the threat either goes around the armour, or the incoming shell is bigger than you'd bargained for, and penetrates. Far safer in practice, though not in theory, is the Blob. This has layer after layer of safety features, each of which is easily circumvented in isolation, but every one of which limits the damage.

Two problems: (1) in an actual organization, people need to get work done, and don't have an infinite amount of time to deal with security systems. This is easily seen at a nuclear power plant where Joe Operator can spend up to 25% of his (paid, presumably productive) workday dealing with security and access control mechanisms (2) organizations don't have an infinite amount of money to spend on IT, either. Consider $250,000 spent on a 5-axis milling machine vs. the same amount spent on IT systems and their associated security requirements. Yes, the 5-axis machine is expensive, fussy, difficult to set up, and requires a lot of training. But once it is in and running, it works, generating a stream of profit for the organization. And while it requires maintenance from time to time, it doesn't suddenly explode, taking the entire customer list with it (say). Which may explain the sudden drop in IT investement in the last 2 years!

sPh