Beyond Fear

pres (Preston Tollinger) writes "I picked up Beyond Fear: Thinking Sensibly About Security In an Uncertain World basically because it was by Bruce Schneier. I am sure most Slashdot readers know Schneier's name and his work. The problem is, this book probably isn't for you (but might be perfect for someone you know)." To find out what he means by that, read on for the rest of Tollinger's review, below. Beyond Fear: Thinking Sensibly About Security In an Uncertain World author Bruce Schneier pages 256 publisher Copernicus Books rating 7 reviewer Preston Tollinger ISBN 0387026207 summary A worthwhile introduction to real-world (not just computer) security, aimed at a literate but non-technical audience. The Book Beyond Fear is described very well by its subtitle: this book helps you think sensibly about security. Don't expect the highly technical material you have seen in Schneier's previous books, but rather the more accessible material, much like you might read in his monthly newsletter. That doesn't mean the book is breezy: In Schneier's wordy but well-written manner, he describes a five-step process to analyze any particular security system or practice. The process helps you make sure you understand what you are protecting, what the tradeoffs are, and whether, in the end if it is worthwhile to implement the system.

He then goes on to apply this method to a series of security issues while covering the various types of security and their weaknesses. For the most part this not a technical evaluation of the tools used, but rather an analysis for each example of what the security goals are and how the tools and technology achieve or fail to achieve those goals. Even more importantly, he deals with the tradeoffs inherent in any security system.

Schneier applies this method not only to the global issues that have come up since 9/11, from airline security to protecting government secrets, but also to personal issues, including tradeoffs in personal home security. By doing so, he takes principles which might be hard for some to understand in the abstract and makes it clear how they apply in situations almost everyone has thought about.

By drawing parallels, for instance, between how you might select a home alarm system to how you might evaluate the use of face recognition at the airport, Schneier shows that you don't have to be a security "expert" to think logically about security. He brings to the forefront the tradeoffs that you made in these personal choices; for example, the downside of dealing with deactivating an alarm system every time you come home. Then, in turn, he shows how you must consider the problem of people being falsely identified by the face recognition system at the airport.

Given this strong framework, he then uses his method to analytically and dispassionately tear apart most of the silly and stupid security methods (note my dispassion here) that have been put in place or considered in the past few years, from airline security methods to national ID cards. With a combination of funny yet pointed anecdotes, clear statistics and the occasional Harry Potter reference, Schneier uses his talent for cogent, rational explanation to show how people can think about security in the modern world, instead of simply panicking at every ominous news report.

To Read Or Not To Read So it sounds like a good book and probably would be for some, but there was not enough new content for me to make it worth my limited reading time. Perhaps due to my general interest in security or just because waiting in line at the airport has already given me a lot of time to think, but I have already considered most of the ideas Schneier raises in Beyond Fear. I own a shredder, but not an alarm system, because I have considered the risks and costs. I dislike the idea of a National ID card because I was already afraid of what someone might do who got access to it, and already monitor my credit report. I have written my local representative that while his recent bill to remove SSNs from insurance cards is nice, it's far too late (and how about just getting people to stop using SSN's as passwords?).

If this describes you, skip the book. However you might note above I didn't say this was a waste of my money. This book is soon going to find its way into hands of friends and relations who need to think about security. It is a great introduction to a way of thinking that is critical in a post-9/11 world. It should be required reading for members of Congress before any more security laws are passed based only on the need to do something instead of rational thought.

Summary If you think consciously about security, know who Schneier is, or have ever noticed (and complained) that many airport security measures make no sense, you probably don't need this book. If you have only considered this topic in general, though, and want a book to focus your thoughts, Beyond Fear will do that. Finally, if you have friends who don't yet think this way (admit it, we all do), get this book into their hands.

You can purchase Beyond Fear from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Comments

Fellow slashdotters

[Anonymous Coward]

Prepare to be dazzled! Well, as Timothy already mentioned, the name of the book that I read was Beyond Fear: Thinking Sensibly About Security In an Uncertain World. [Reads from back cover] It's about these ... fears. Fears... with security issues ... and ... mehtods for dealing with them ... and statistics ... Did I mention this book was written by a guy named Bruce Schneier? And published by the good people at Copernicus Books. So, in conclusion, on the Slashdot scale of one to ten, ten being the highest, one being the lowest, and five being average, I give this book ... a seven. Any questions? Nope? Then I'll just sit down

Say what?

[DrFlex]

I am sure most Slashdot readers know Schneier's name and his work.

Are you makin fun of me? Do I look funny to you?

Best example of how to speak about Security

[StaticEngine]

As a computer person, I don't consider myself a great conversationalist. And I agree that I've already thought about a lot of the issues Schneier brings up in "Beyond Fear."

However, most "normal people" relate well to anecdotes, and general examples, and this book is full of them. Instead of trying to describe how 256 bit keys are safer than 64 bit keys to non-technical friends and relatives, I've learned lots of metahphors involving door locks, car theft, and every day risk assesment that will help me to get my point across a lot more clearly.

I think this is the point of this book. It's not technical. It's Security for the Everyman.

Re:Best example of how to speak about Security

[Anonymous Coward]

Why the hell do you have to explain what impact key length has on security to anyone you know??? Admit it, you've never even done that! And if you did, allow me to print here what they almost surely were thinking while you rambled on: "Please leave me alone, why can't you be normal?"

Re:Best example of how to speak about Security

[Skyshadow]

The trouble with that is the tendancy to run into serious "metaphor sheer" when using an example you're making up on the fly...

Here's a book idea: Come up with metaphors for computer-related ideas which will stand up reasonably well even as the user/cluebie/PHB makes assumptions based on them. I'd buy two compies, one for work and one for home, and keep 'em right next to the phone. I can't tell you how often it'd be useful...

Re:Best example of how to speak about Security

[Hatta]

Well, if you're trying to get your friends to use GPG like you should, sometimes the subject comes up.

Re:Best example of how to speak about Security

[jeffy124]

Indeed. When explaining concepts in computer security to non-techy types, the hardest part is how "security" is actually a trade-off. Car safety makes an excellent analogy.

For example, almost everyone can understand that no car is completely immune from accidents, along with unavoidable injury if an accident is bad enough. Hence, lessen injury by wearing seat belts or driving a car with air bags. You may still have injuries in an accident, but the injury is far less damaging than without belts or bags.

Likewise, no computer is hack proof. We all know why, so I wont bother explaing here. But to help explain this to non-techs, I draw this comparison: In order for there to be a car where occupants are injury-free after an accident, the car's gas efficiency would be interpreted not in miles-per-gallon, but rather gallons-per-mile. Why? Because of the sheer weight such a car would have to be.

Re:Best example of how to speak about Security

[Anonymous Coward]

I don't consider you a great conversationalist either buddy.

Re:Best example of how to speak about Security

[Matthew Austern]

The discussions of door locks and car theft and bank vaults aren't metaphors. They're examples. He's showing concrete cases where one makes judgments about security.

Remember: this is not a book about computer security. It's not trying to teach you about password management techniques (although he does use password lists as yet another example, since they're yet another everyday security issue for most of us) or firewall configuration. It's trying to teach you how to think about security in general.

To the extent that this book is trying to teach you about any particular area of security, it's not computers but terrorism. The author is very specific about that in the introduction: he was motivated to write this book because security has recently become a hot topic. There's lots more discussion of security than there was two and a half years ago, a lot more proposals for things that will supposedly make us secure, and lots of that discussion and those proposals are wrong. This book is an attempt to make an important national discussion more intelligent.

Re:Best example of how to speak about Security

[Anonymous Coward]

Hey Hatta, been wondering why your friends don't call you up to go out drinking, like they used to?

Re:Best example of how to speak about Security

[dtfinch]

64 bit keys will protect you against all but governments and large corporations. 128 bits should protect you against all mortal civilizations forever. 256 bits will do the same, but run a bit slower.

In most cases, any of those bit lengths will be effective, so there's no reason trying to explain how one is safer to friends and relatives unless they're protecting really big secrets like the timetable for the next 9/11.

Re:Best example of how to speak about Security

[Tackhead]

> Likewise, no computer is hack proof. We all know why, so I wont bother explaing here. But to help explain this to non-techs, I draw this comparison: In order for there to be a car where occupants are injury-free after an accident, the car's gas efficiency would be interpreted not in miles-per-gallon, but rather gallons-per-mile. Why? Because of the sheer weight such a car would have to be.

Better analogy:

Once you've gotten your co-worker to agree to a statement like that, point out that when everyone is driving an M1 Abrams "for safety", injury rates won't go down. If you're in an M1 and you collide head-on into another M1, both of you are going to have a Really Bad Day. You've got a huge added cost, but no real improvement in safety.

Security works like that. It's possible to do things that sound Really Really Good on paper, and cost Lots and Lots of Money, and still end up no safer than before.

Re:Best example of how to speak about Security

[dillon_rinker]

You provide the perfect example of a flawed extension of an analogy. Main battle tanks are designed to protect the occupants against enemy fire, not ramming. If a vehicle with the same mass as an Abrams were designed to protect against collision with more massive objects, it would be safer even if everyone drove them.

Security works like that. You take something that works in one environment (Abrams on the battlefield getting shot at) and put it in a different environment, one it wasn't designed for (on the highway inevitably getting rammed) and it will fail in unexpected and unpredicatable ways (who knew that periscope, so essential for driving while being shot at, could detach and fatally injure the driver when the tank hits a brick wall doing 70 mph?)

Re:Best example of how to speak about Security

[pherris]

StaticEngine said:

However, most "normal people" relate well to ... general examples, and this book is full of them.

If it's like Applied Cryptography there are tons. For a few weeks after reading AC all I dreamt of Bob, Alice, Trent, Peggy and that kid Alice kidnapped.

WILDCAT IS ON TEH SPOKE

[Anonymous Coward]

I am sure most Slashdot readers know Schneier's name and his work.

Wasn't this the guy with the cat in the lead box?

Re:WILDCAT IS ON TEH SPOKE

[Anonymous Coward]

That's Schroedinger, you insensitive clod!

worth reading, again, with feeling

[Anonymous Coward]

don't be afraud. consult with/trust in yOUR creator.

"It takes a long time to teach the judges, legislators, and public to understand technology. Right now, they're getting a strong dose of "education" on the Internet's threats and harms, and not hearing so much about its potential. Shouts of "piracy" often outweigh consideration of how we might communicate with more open media formats, but judges like Stephen Wilson in the Grokster case are starting to listen through the shouting. We're encouraging more people to think about how the law shapes technological innovation, how the technology itself can foster creativity, and then to do something about it to advance the public interest."--

"The stability of the large world house which is ours will involve a revolution of values to accompany the scientific and freedom revolutions engulfing the earth. We must rapidly begin the shift from a "thing"-oriented society to a "person"-oriented society. When machines and computers, profit motives and property rights are considered more important than people, the giant triplets of racism, materialism and militarism are incapable of being conquered. A civilization can flounder as readily in the face of moral and spiritual bankruptcy as it can through financial bankruptcy."

STILL, the ONLY 'controversy' about the gpl, gnu/linux, etc..., is coming from the phonIE payper liesense softwar gangster stock markup FraUD execrable/walking dead contingent.

Why not for the slashdot folk

[Anonymous Coward]

Because most people here are die-hard capitalist conservatives who'll never get over their fears.

Process vs Organized Security

[Schmucky The Cat]

This piques me. I'd love a process that evaluates proposed security processes. Every place I have ever been, but especially workplaces, have had some sort of "Security" organization. In all cases the goal of that organization has just been to make up insane new practices or arbitrary restrictions that serve to enhance the power of the security organization.

This came true on a national scale with 9/11 of course. The public went whole hog for the idea of airport screeners but those airport screeners have the brains of a mall security guard.

I'd love to see a simple process for evaluating new proposed 'security' practices in my organization to help debunk the idea that these proposals provide any security at all.

Re:Process vs Organized Security

[Slarty]

Airport security just doesn't work very well anyway, even now, after 9/11, when it's supposedly all beefed up.

My freaky experience: I took a trip to Florida, and in my carryon luggage (a backpack) was a buck knife with a 4-inch serrated-edge blade. I wasn't trying to smuggle it through on purpose... the last time I had used the backpack was on a camping trip (where knives are handy) and I simply hadn't unpacked the front zipper pocket, where the knife was.

Anyway, the knife made it cleanly through airport security. Twice. At two different "high-security" airports... and yes, it went through all the detectors and everything. I didn't even find the damned thing until I was on my last connecting flight. So yes, there are some major issues there.

To tie this back in with your post... I hate to generalize based on one incident, but the extra security just ain't giving us a whole lot of extra security. Which leads me to believe that you're right... one of the main "benefits" of all this was just to allow the authorities to take actions "in the name of security" that only serve to give them more power.

What that experience taught me is that I can't rely on those in authority to protect me, either me physically or my data or anything like that. Which means that citizens are going to have to start safeguarding themselves, and sometimes that may be in opposition to the "best interests" of the state. Which sure as heck don't seem to be our best interests much these days.

Paradox

[NoData]

Hmm....so open-minded, rational people don't need to read this book, and irrational, knee-jerk reactionaries by definition won't read it, or won't be convinced. By the reviewer's logic this book is perfect....for noone.

But seriously, I can't imagine convincing an Ashcroftian to sit down and consider the other side, but I might read it just for some common sense ammunition. You know, some security...against those...who..want..more..security... Uh, yeah.

Re:Paradox

[HiThere]

That doesn't define the universe. In fact, the two extreme points that you cite are a very small portion of "all people".

For the people that you are talking about, external agendas are the determining feature, and this book won't do anything for them. Neither will any other form of argument that doesn't address their real agendas. But for many people, this will be welcome. (Many is, again, much less than all people, or even all literate English speakers. But it's probably significantly larger than both of the extreme positions combined.)

Here is a way for security

[mrs clear plastic]

1. Don't own a car/house/boat/gun or anything else
that requres registration/ownership title

2. Be part of shared household (live with
housemates who are similar minded).

3. Use cash to pay your share of rent/utilities

4. Use throw-away cell phones paid with cash

5. Use calling cards vended for cash via
vending machines

6. Use cash on bus/train; don't use monthly or
annual passes with your name associated with
them

7. Work for cash (under the counter or freelance)

9. Travel via thumbing. Don't use train/plane/
intercity bus. In some places you can go far
via local bus to local bus.

10. Get around as much as possible via bike/skate/
walking.

Re:Here is a way for security

[10Ghz]

Also: Don't walk in the open without a hat. If you do, the dreaded mind-control lasers can home in on you!

Re:Here is a way for security

[Anonymous Coward]

ROFL, mod parent up as funny. Dude, I am sitting here grading papers on a kind of gloomy day, you totally just made my afternoon with that post. I kept falling off my chair, I think three times total, during that whole post. Thanks!

Re:Here is a way for security

[Anonymous Coward]

Urm..that's more extreme paranoia than security :)
Some of us enjoy interacting with others outside of some sacred circle of trust and actually owning things :p

Re:Here is a way for security

[Anonymous Coward]

uh, does your raincoat come in the tin foil variety?

Re:Here is a way for security

[Waffle Iron]

You forgot:

11. If you've been hiding in the North Carolina woods, never venture out into an open parking lot to go dumpster diving for food.

Re:Here is a way for security

[stratjakt]

11. Speak a language of your own invention, to foil eavesdroppers.

12. Dip wang in chili sauce.

Re:Here is a way for security

[Anonymous Coward]

11. Profit!!!!

Re:Here is a way for security

[ArmenTanzarian]

11. Buy a tinfoil hat and tell the little alien on your shoulder to get one too.

Re:Here is a way for security

[the_consumer]

Sounds like advice for terrorists ;)

Maybe we'll be able to identify them by their tinfoil hats now?

Re:Here is a way for security

[Gilmoure]

No registration needed to own a gun in Florida. There is a background check if you purchase a firearm from a licensed dealer. If you purchase a gun from a private individual, there's no required information to be given. That said, I wouldn't sell a gun to anyone that I didn't highly trust (currently, about 4 people).

Re:Here is a way for security

[AJWM]

This is so dumb it's probably a troll, but on the offchance it's not:

You're confusing "security" with "privacy". A few points which are clearly anti-security:

3. Use cash to pay your share of rent/utilities
4. Use throw-away cell phones paid with cash
5. Use calling cards vended for cash via
vending machines
7. Work for cash

Carrying all that cash around makes you a target.

7. Work for cash (under the counter

That makes you a target known to less than honest types (if they're willing to pay under the counter) and a target known to not want involvement with the authorites, i.e, a prime target.

9. Travel via thumbing.

Sure, so you can be picked up by who knows who and taken to nobody knows where...

10. Get around as much as possible via bike/skate/walking.

Yes, that makes you a much easier target for muggers, or just plain being hit by a car.

Security? I think not.

(And while the odds of any of the above may be low, they're higher than the odds of something terrible happening to you just because you own a car or use a credit card -- unless you're already a fugitive.)

Re:Here is a way for security

[Anonymous Coward]

12 - Already there!!

What's wrong with national IDs?

[hanssprudel]

I don't understand why Americans are so afraid of national ID cards. Where I live we have standardized national ID cards that are used in most situations, and I can't say how it has made me any less free.

In the modern world, we are counted and registered with our government. What is wrong with having a standardized card to show who we are?

I don't know if these cards would stop anybody from crashing airplanes, but they do help against things like identity theft, which is quite common in America but almost unheard of here. We don't have to have "three kinds of photo id" to go to bank, we don't consider our mother's maiden name or SS#'s security secrets, and we don't need to bring the electic bill to rent a movie.

Granted, my country is much smaller than the US, but I would support having an EU wide Identity card standard. I cannot see sensible argument against it.

Re:What's wrong with national IDs?

[chadm1967]

Very good points. Not all of us in the US think national ID cards are a bad thing...

You brought up some very good points.

Re:What's wrong with national IDs?

[Anonymous Coward]

Ahhh - but you probably live in a free country.

Here in the US, we have lots of nice new laws that allow us to be held indefinitely without counsel or notice to our families. Our friendly government doesn't even have to specify charges or evidence. And if someone objects, we have military tribunals.

If you live with freedom, it is probably hard to imagine needing anonymity so much. Pray your country doesn't lose its freedom like the "Land of the Free" did.

Re:What's wrong with national IDs?

[Otter]

I don't understand why Americans are so afraid of national ID cards. Where I live we have standardized national ID cards that are used in most situations, and I can't say how it has made me any less free.

I think it's a combination of 1) people are used to what they're used to and when you accustomed to not having an Official State Identification Number there's unease about suddenly getting one and 2) many Americans, my own family included, fled here from countries where the government's concern with tracking you was less than entirely helpful.

At the same time, there are obvious advantages to having a standard identity, which is why driver's licenses (state governments are trusted much more than the federal government) and social security numbers have taken on far more importance than they were ever intended to have. Essentially, the combination of the two already serves as an official identity.

By the way, I have no idea of the relative rate of identity theft in the US and Europe, but it's certainly not "common" in any sense in which I'd use the word. If there's a significant difference, it's probably due to the fact that Europeans don't routinely have 15 different credit accounts.

Re:What's wrong with national IDs?

[Jeffrey Baker]

It's really symptomatic of something else: American's don't trust their government. Over the last century the government and laws of the USA have really gotten out of control, but the population has mostly just let it slide. I mean it's illegal to smoke marijuana, but everyone does it anyway. It's illegal in many states to be involved in a blow job, or to arrange your furniture in a certain way, or to change the needle valves in your carburetor. All these laws are pretty stupid, but nobody really cares because they are unenforceable.

In addition the people of the USA have a tradition of just being criminals. Practically anyone has a smuggler or a bootlegger or a bookie in their family tree somewhere. These things were illegal but not really dishonorable. And in the beginning days of the country, it was possible for someone to fuck up their lives in one area and simply start over further west. So we've gotten used to ignoring the laws and taking advantage of anonymity.

The situation changes if the government suddenly becomes organized and informed. If the government has a good way to track who we are and what we are doing, all those things that are illegal will suddenly matter. So the reaction is to resist tracking and information programs. Of course, this is the incorrect reaction: what we should really be doing is reigning in our government and repealling stupid laws until we feel that we can trust it again. But that answer isn't as obvious.

I'll end with a short example: last year I got on an SF MUNI streetcar at a station where the toll machines were broken. I paid my $1, but the machine didn't give me a ticket. No attendant was on duty so I just boarded the train anyway. Well, lo and behold here comes Fare Inspection Shitwit to check my ticket, which I didn't have, through no fault of my own. Inspector Shitwit gives me a ticket ($90 fine) for failure to have a ticket on the streetcar. Naturally I rebuked him profanely and threw the ticket in the trash. I don't have any intention of dealing with such rubbish. But now, six months later, there's a warrant for my arrest which will never be served by the SFPD and I will be unable to renew my driver's license, which is expired, until a year after the incident. If the government were *really* well organized I might even get arrested. I'm really afriad that in some well-organized, well-tracked future government regime, people will get in *real trouble* for not having a piece of paper that says you paid $1 to get on the bus.

Re:What's wrong with national IDs?

[abulafia]

I don't know if these cards would stop anybody from crashing airplanes, but they do help against things like identity theft, which is quite common in America but almost unheard of here. We don't have to have "three kinds of photo id" to go to bank, we don't consider our mother's maiden name or SS#'s security secrets, and we don't need to bring the electic bill to rent a movie.

Most of what you cite is convenience. It may be convenient to have one card for everything, but that doesn't mean making it mandatory is a good idea. Identity theft can be stopped in other ways, and it isn't even clear to me that a national ID card would do much to stop it here at all.

The US started differently than European nations, and has a long history of distrust of the government. I still believe this is a valuble thing.

The only party getting value out of national ID cards is the government. Why should I quietly give that to them? I have no reason to.

Re:What's wrong with national IDs?

[Anonymous Coward]

Read Edwin Black's "IBM And The Holocaust"

Re:What's wrong with national IDs?

[SquadBoy]

Becuase they do not buy any security and they open many holes.
You may trust your government enough to know everything about you and to keep it all in one great big database but you have to keep in mind that here in America we don't so much. In fact we are an entire country founded on the thought that the government should get the fuck out of our lives. National IDs do nothing for security they do nothing to prevent idenitity theft they do nothing but put all of your personal info in one database that can be abused by those who have access to it and broken into and abused by those who do not. In Beyond Fear Bruce goes through this with the 5 step process. You spend a large amount of money and get nothing in return.

Think about it for a moment and I can only speak for the US but I'll walk you through the process.

I have a drivers license and a Social Security card. With those two forms of ID I can get any other form of ID that we have here in the US. Those two pieces of ID are in turn based on a birth cert. You can get a birth cert for a couple of hundred dollars. To implement a national ID they would have to figure out someway to figure out who everybody is and at this point it is impossible to prove who anyone is beyond accepting what their current IDs say. See the problem yet?

So national IDs will just give you another ID that says that you are who you claim to be. But if I don't like being that person anymore it would take a couple of hundred dollars and a bit of time to be someone else. There is *no* way that you can prove that anyone is anyone. Trying to do so is pointless and will merely cause problems for honest folks.

Re:What's wrong with national IDs?

[Anonymous Coward]

Well, lo and behold here comes Fare Inspection Shitwit to check my ticket, which I didn't have, through no fault of my own. Inspector Shitwit gives me a ticket ($90 fine) for failure to have a ticket on the streetcar. Naturally I rebuked him profanely and threw the ticket in the trash. I don't have any intention of dealing with such rubbish. But now, six months later, there's a warrant for my arrest which will never be served by the SFPD and I will be unable to renew my driver's license, which is expired, until a year after the incident.

Some free, IANAL advice -- get your silly ass to a lawyer immediately. You should have just gone to court in the first place, but at least settle this before it really ruins your life down the road. They have these things called "computers" now and this matter won't go away.

Re:What's wrong with national IDs?

[jeffy124]

some people somehow have this notion from some alarmist that says they'll check that ID everywhere you go and track you from point to point.

IMO, simple legislation that provides baseline standards for government-issued ID cards (eg, driver licenses) to have anti-fraud features are all that's needed.

I live in NJ, the state with the license that's easiest to forge. It's easy for someone to walk into a DMV, claim to be so-and-so, and say that they've lost their license. All you need is something like mother's maiden name. Numerous college students use this technique to get fake-IDs to buy alcohol, etc. (I should point out, NJ has changed this, and are phasing in new licenses over thenext few years, along with guidelines that require more than just mother's maiden name)

Re:What's wrong with national IDs?

[HiThere]

Given the current circumstances, not much.

I wouldn't say that, but it's a sham argument to distract us. They already have a national id card. Actually, more than one. If you're a male it's illegal for much of your life not to carry a draft card. Certainly for the ages that they are most concerned about (18-35), I'm not sure about later. Women are generally more trusted, so they rely on the secondary id's: Driver's license and "taxpayer ID #" (it was originally the social service ID, and we were promissed it would never be used for anything else...until they changed their minds). Without a taxpayer ID you can't open a bank acount, hold a job, or rent an apartment. And it's linked to the driver's license, without which it's illegal to drive a car.

So I don't think that we would be giving up anything that isn't already given up. It's a vile idea, but it's already here. Focus instead on what they are currently doing, and don't ruminate on past battles, unless you intend to change the way they came out.

Now someone who, in the name of opposing a national ID, tried to make the government live up to it's promise to not use the social security number to link files for any agency except the social security agency, would have a point. But the battle would be nearly hopeless. No government in the past 4 decades has reduced the power of the government to control the citizens. Not though they had promissed. Not one of them. It doesn't matter which party. Any Democrat *OR* Republican who tells you his party will reduce government control over your life is a damn liar. And an obvious one. That some people will believe them is a constant source of wonder to me.

Re:What's wrong with national IDs?

[44BSD]

If you'd like to learn how it has made you less free, perhaps you'll ask your government to issue John Ashcroft a work visa, so he can run your interior ministry for a few years.

You will soon see....

Re:What's wrong with national IDs?

[seichert]

I don't understand why Americans are so afraid of national ID cards. Where I live we have standardized national ID cards that are used in most situations, and I can't say how it has made me any less free.

In the modern world, we are counted and registered with our government. What is wrong with having a standardized card to show who we are?

It is the counting and registering that bothers many Americans, not the card. Americans have good reason to be distrustful of the federal government's attempts to catalog every aspect of our lives. In the history of our country we have seen continued abuse of our constitutional rights by the government (laws against speaking out against the government, prohibitions on firearm ownership, illegal searches and seizures whenever someone says "drugs", having to prove our innonence (IRS audit), etc.). The threats to our freedom have increased over time and we don't want to make it even easier for the government to control us.

Re:What's wrong with national IDs?

[Matthew Austern]

I don't understand why Americans are so afraid of national ID cards.

Read the book. This is one of the cases that he analyzes. The questions to ask about national ID cards is the same as for any security measure: what assets are you trying to protect, what threats are you trying to protect against, how well does this measure work to reduce the risks from those threats, what new threats does it introduce, and so on.

I can see ways in which a national ID card could be useful. I do not see that it could be useful as a security measure. I can see ways in which it could hurt security. (It could increase the risk of identity theft, for example, by creating a new database with security issues of its own.)

But again: read the book. If I were to present a complete security analysis of national ID cards I'd just be ripping off Bruce Schneier anyway, so you'd be better off getting it from the original than from my summary.

Re:What's wrong with national IDs?

[Jeffrey Baker]

Actually you're wrong. The warrant expires after a year, and I'm almost there! Woohoo!

Re:What's wrong with national IDs?

[AJWM]

IMO, simple legislation that provides baseline standards for government-issued ID cards (eg, driver licenses) to have anti-fraud features are all that's needed.

You obviously don't track this stuff closely. There've been a couple of states that have done something along these lines, complete with "unforgeable" drivers licenses.

The result was DMV offices being broken into and blank cards and the machines to make them being stolen.

Re:What's wrong with national IDs?

[MKalus]

dentity theft can be stopped in other ways, and it isn't even clear to me that a national ID card would do much to stop it here at all.

The problem with ID theft in North America is that the only way they tend to identify you is by using your SSN and drivers license.

Both are easy to get by and in the end nobody is really asking.

The CBC had an interview this week with someone who did ID theft for a couple of years as a living. It's almost chilling to hear how easy it is to loose your identity and get your credit rating trashed just because someone got your home address and Birth Date.

The other problem in North America is that there is no real way of what happens to data.

In Germany for example medical records are not allowed to be kept for more than 5 years (bit me in the ass a while ago when I tried to get some results from some years back), here? Nobody cares.

If I get a ticket in Germany (as long as I don't get points) the ticket diapears out of the system once I have paid it. Same thing for my driving record.

Things are not hauting me forever. Our "all knowning government" has a very short memory span.

On the other hand an ID card etc. in North America IS a lot more scary because the government / private companies never ever seem to get rid of the data they have collected, that is the problem, not the ID card(s).

Re:What's wrong with national IDs?

[MKalus]

So national IDs will just give you another ID that says that you are who you claim to be

Yes and no.

The national ID would be the only ID you would need. No more SSN or Drivers License (which is stupid anyways), no more haggeling over it, AND because the document is a federal government it should be harder to forge (doesn't mean it can't be).

The idea of a National ID card isn't that bad, the problem just is that the way data in the US is handled it won't accomplish a thing. At least not for the people who already have SSN Numbers and drivers licenses.

Re:What's wrong with national IDs?

[Anonymous Coward]

Having personally just gotten through dealing with something very much like what you describe, I can tell you that YOU are wrong. The "warrant" may expire, but the conviction will not. Eventually you will be held accountable, and it will just get more expensive for you down the road.

There is no statute of limitations on avoiding court-ordered penalties. You now have a court-ordered penalty by virtue of your neglect in clearing the matter (therefore the "charge" of freeloading your Muni ride stood).

I also live in SF, so you can't claim that "laws are different where I live".

Re:What's wrong with national IDs?

[Anonymous Coward]

You are aware, aren't you, that not everyone is allowed to drive? Do you want to require a trip to the big database in the sky just to see if someone has passed the driver test/avoided drunk driving/etc?

Re:What's wrong with national IDs?

[Anonymous Coward]

A co-workers Dad escaped from Hungry back in the 50's. One day we saw TV news reports of a huge manhunt for an escaped convict. The cops figured he was in a couple of square block area. Friends Dad commented that back in 1950's Eastern Europe, they would just lock down the area and go house to house, and be done with it. But then, that was WHY HE LEFT.

Read the book. Bruce explains why national id's are a bad thing. (In short, they don't work, they're easy to forge, and have been massively abused in the past.)

Re:What's wrong with national IDs?

[JamieF]

You've just done a great job of supporting the anti-privacy argument - only criminals have anything to hide, so privacy is bad.

Next time, pay the extra $1 (well, $1.25 now) to use another turnstile that actually gives you a transfer. Or, if you like taking the risk, at least go to court when you get a ticket. Failing to pay a ticket or show up for a court date just because you couldn't be bothered to pay $1 is pretty pathetic, and is far from a valid reason for not wanting a national ID card.

Re:What's wrong with national IDs?

[JamieF]

Ever heard of a Social Security Number? Yeah, I too can find all sorts of documents that prove that companies and governmental organizations don't have a right to demand my SSN, but the recourse for that is that they simply deny you service / business. So you can live in a little shack in Montana and not give anybody your SSN, but in the real world, everybody requires it and will just tell you to sod off if you refuse. See, your rights haven't been abridged because no one is forcing you to leave your shack in Montana...

A privacy amendment would pretty much be the only way to counteract this IMO.

Re:What's wrong with national IDs?

[MKalus]

What are you trying to say? You still need a drivers license for DRIVING but not as an ID at a club or at a bank.

Re:What's wrong with national IDs?

[Anonymous Coward]

You've just done a great job of supporting the argument to require high school students to know basic logic before graduation.

Re:What's wrong with national IDs?

[abulafia]

It's almost chilling to hear how easy it is to loose your identity and get your credit rating trashed just because someone got your home address and Birth Date.

Yes, I'm well aware of that - I've had a mild form happen to me (someone got enough info to open two credit cards, and I caught it quickly - it wasn't as bad as it could have been).

In Germany for example medical records are not allowed to be kept for more than 5 years (bit me in the ass a while ago when I tried to get some results from some years back), here? Nobody cares.

This has nothing to do with a national ID.

On the other hand an ID card etc. in North America IS a lot more scary because the government / private companies never ever seem to get rid of the data they have collected, that is the problem, not the ID card(s).

Which is exactly why I object so strongly to having a national ID. All it would do is make life easier for snoops, identity thieves, and meddlesome government. There is no benefit to the citizen, and plenty of downsides.

Re:What's wrong with national IDs?

[Anonymous Coward]

I don't understand why Americans are so afraid of national ID cards.

And [the Antichrist] causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: And that no man might buy or sell, save [except] he that had the mark, or the name of the beast, or the number of his name. Here is wisdom. Let him that hath understanding count the number of the beast: for it is the number of a man; and his number is Six hundred threescore and six.

Re:What's wrong with national IDs?

[JimBobJoe]

I live in NJ, the state with the license that's easiest to forge.

Yes...but the advantage is that NJ doesn't have very much severe fraud committed with the photo driver's licenses (and non-photo licenses.) Everyone knows they can be easily forged so no one trusts them for all that much. As things go, I rather have some under age alcohol consumption than serious credit/financial fraud (which is far more severe in states with much more "secure" licenses, like California or Texas.)

Re:What's wrong with national IDs?

[JimBobJoe]

I don't understand why Americans are so afraid of national ID cards. Where I live we have standardized national ID cards that are used in most situations, and I can't say how it has made me any less free.

It should be said at this point that every country's experience with ID cards is very different. Many European countries use them for mostly bureaucratic functions (functions which are done in other countries, without difficulty, without ID cards. In fact, I like to say, if you don't have ID card fraud, they probably aren't all that useful int he first place. The reason why people in those countries do think they're useful in some way is simply because the "photo ID culture" is already ingrained there, and they can't imagine life without them.)

I once asked my Costa Rican relatives if there were any purpose to having an ID (Cedula de Identidad) in someone else's name...and they couldn't think of anything. But there's lots of ID fraud down there, because their cards indicate citizenship, residency status, and work rights. So illegal immigrants from other nations do need a fake card to work there.

Possibly the most fascinating example of ID cards is that of Israel...it could fill up volumes. The name on the card isn't important...but the cards indicate citizenship *and* religion. This is controversial even among Israeli Jews (the cards no longer indicate that someone is "Jewish" because indicating that a person who was Jewish who wasn't Jewish blood or Orthodox, would severely piss off the Orthodox Jews. The solution to this amuses me insanely, now they simply put a letter "j" on the cards (in Hebrew script...it can stand for Israeli or Jew and doesn't indicate what type of Jew) and not a single person has noticed that that is what the Nazi's put on their ID cards to note if someone was Jewish.)

On the other side of things, when a Palestinian turns 16 they have to get their ID card, and they're treated like rubbish during the process, and hassled for the card regularly. A friend of mine whose been to Israel says that Israeli guards examine the ID cards...and then throw them onto the ground, instead of just handing them back. This is a fascinating form of psychological power...implying that they are just as worhtless as the card they threw on the ground. In the late 1990's...Israeli guards would confiscate ID cards, essentially making the person unable to go home, or anywhere for that matter (ID card confiscation brought a lot of heat unto Israel from numerous organizations, and has since been stopped.)

For the Jews, the card is a form of empowerment and identity. For the Palestinians, it's a form of repression. (Interestingly, other than making sure that people stay in their neighboorhoods and keep to curfews, the cards play no role in security...this, in a country in which security is the most important thing above anything.)

The United States experience with ID cards has been that of fraud. Fraud from people trying to get alcohol (not really severe) and financial fraud. Our financial fraud issues are indeed unique, and why they occur is not easily figured out.

I bring up Europeans again...many European countries do have a national ID card. During World War I, the passport was introduced, and Europeans were horrified by the idea of a photograph based citizenship document. It simply allowed too much control concerning how people could move freely across borders. The passport was *guaranteed* to be a temporary document which would be terminated at the end of World War I (I would like to say that the job of the termination fo the document was in the hands of Wilson's League of Nations...and the failure to put that together is why the passport stuck around.)

I think one thing that bugs Americans is the idea of being forced to do something. No one forces you to pay taxes (you're not forced to work after all, or buy stuff) or vote, or get an SSN...or whatever. But a national ID card would force you to do something you may not want to do. Is it appropriate

Re:What's wrong with national IDs?

[dazed-n-confused]

The US started differently than European nations, and has a long history of distrust of the government.

That's by no means unique to Americans. I'm European, and I distrust the US government, too.

Re:What's wrong with national IDs?

[MKalus]

Which is exactly why I object so strongly to having a national ID. All it would do is make life easier for snoops, identity thieves, and meddlesome government. There is no benefit to the citizen, and plenty of downsides.

If you think that these days nobody can already build a complete profile of you you're pretty wrong.

the SSN and your drivers license alone are enough to track you.

What needs to be done is to re-do the privacy laws in the US (and Canada) instead of hoping that the companies are "honest" enough about their Privacy Policy they should be enfored by law etc.

Yes, not a very populare thing, but it always is scary to me to see that the speeding ticket I got last year will be on my drivers record forever.

Re:What's wrong with national IDs?

[JZip]

You say: "In fact we are an entire country founded on the thought that the government should get the fuck out of our lives." Sorry, but that's just not the case, and I think any one of the Founders would tell you so. In fact, my computer is currently running off power generated by several of them spinning in their graves at this Libertarian variation on the Big Lie.

Re:What's wrong with national IDs?

[escallywag]

It's really symptomatic of something else: American's don't trust their government

Too bad that when it comes to foreign policy that mistrust is swatted by the "America uber alles" knne-jerk reflex... Weapons of Mass Deception Anyone ?

"Not for you"?

[Skyshadow]

Key bit from the review:

...he describes a five-step process to analyze any particular security system or practice. The process helps you make sure you understand what you are protecting, what the tradeoffs are, and whether, in the end if it is worthwhile to implement the system.

This might seem like common sense, but a IMO *lot* of otherwise Clueful people could use having this sort of process tatooed in reverse on their forehead so they'd have to review it every morning when they looked in the mirror.

The trouble with any job that involves detail and careful attention is that the forest tends to duck behind all the damned trees, and this is especially true for IT. Hell, look at all the /.'ers in our recent discussions about programs or products that are "useless" or "should have waited longer to be released" because it doesn't provide absolute security, whereas in reality security is a *step by step* type of deal, not one of absolutes.

Anyhow, in my experience it often benefits even the "experts" to have the blatently obvious spelled out in this way and laid out before them. Security isn't alone here -- this goes for just about all disciplines, IT or not. Given that, I think it's dangerous to dismiss something like this as too basic.

Boldly over-optimistic

[Rosco P. Coltrane]

I am sure most Slashdot readers know Schneier's name and his work.

Oh sure,if he's from soviet russia and he, for one, welcomes 1-2-3-profiting from first posts, I'm sure most Slashdot readers know him.

Re:I am sure...

[zCyl]

No. We aren't all born with the knowledge of obscure technologists here.

Bruce Schneier is well known as an expert in security and cryptography. In particular, he is possibly best known for writing the bible of cryptography: Applied Cryptography.

For other examples of his work, see here.

Is he reading too much into people?

[Anonymous Coward]

Fear is a strong word. I don't think getting an alarm system is evidence that you are cringing in fear, or even feeling fear. It may be a sensible step in a practical plan to simply be prepared. Obviously there are exceptions; some people truly are fearful, but I doubt most are.

One mistake Schnier tends to make is to ascribe certain thoughts to others that may not be there at all. For example, he seems to think that anyone who has a security system of any kind (software, hardware, etc.) assumes that system will be invincible. He then goes on to attack that assumption, without stopping to realize that the assumption he is attacking is not one that is actually held by most people. Now his new attack, on "fear" this time (that he thinks everyone with security systems must have), is of the same form.

However, over the years his all-or-nothing approach has mellowed, fortunately; since he is so influential, it's good that he is starting to see things less as black and white and more in terms of tradeoffs. The old view that poor security equals no security is easily debunked by pointing out that virtually all security systems in place everywhere are penetrable, yet they remain effective in the aggregate.

Bottom line: Beyond Fear is just a good title. Let's hope he doesn't really think that locking your car door is firm evidence that you are quaking in your boots.

Re:Is he reading too much into people?

[Anonymous Coward]

One mistake Schnier tends to make is to ascribe certain thoughts to others that may not be there at all. For example, he seems to think that anyone who has a security system of any kind (software, hardware, etc.) assumes that system will be invincible. He then goes on to attack that assumption, without stopping to realize that the assumption he is attacking is not one that is actually held by most people.

Schnier has spent years in the fields of Crypto and security. He's seen a lot of people who have exactly that expectation of a security system, at least in computers. He himself used to believe it was possible, his previous book was written when he realized it wasn't. He was somewhat depressed by the realization. Now he's moveing on. Yeah, he is probably guilty some of projection, understandably, but a lot of people are standing right where he's aiming.

Most people understand that physical security is not absolute, but this understanding doesn't transfer over to computing.

Re:Is he reading too much into people?

[fermion]

From what I have read of Schnier, which admittedly has only included the work of the past several years, including the first several chapters of AC, and does not include, as of now, Beyond Fear, I find his statement to be based on the behavior of individuals and not on a priori assumptions.

Your security system example provides a good case in point. Many people do buy them out of fear. A security system at best provides a limited time for the intruder to spend on a premises before risking apprehension. For this to be effective the security system has to be monitored, and the security system must be on. This means that the security service must not only monitor for alarms, but must also monitor for system status. For example, an alarm company should know that between the hours of 5PM and 7AM the system should be armed, and if it is not, then someone should be called to find out why not. Not all security services provide this level of monitoring, and those that don't are arguably providing emotional protection from fear, not physical security.

Another example Schnier has cited is guns for airline pilot, which is really a perfect example of fear based policies. The purpose of the pilot is to fly the plane. Simulations in cockpits using real pilots and trained terrorist experts has shown that it is likely that a terrorist will get the gun from the pilot and kill everyone in the cockpit before the either pilot can draw a weapon. OTOH, we realize the value of secure cockpit and are making it happen. The Israeli's have known this for years. If the cockpit is secure, then the pilots can do their job and we will be much less likely to have planes flying into buildings.

And there are other techniques pilots can use to defend the plane. The French in 1994 used such techniques to successfully thwart a plan to crash a hijacked plane into the Eiffel tower which would have killed everyone on board, not to mention many people in the tower and tower area. Instead, the pilots were able to use the physics of the plane to pin the terrorist long enough to land the plane in a French military base where qualified military personnel stormed the plane, killed all 4 hijackers with the loss of (only) three passenger lives. The US knew of that this hijacking could lead to danger for the US, that the anti-terrorist method could be used here, yet even today the best they can come up with is using commercial pilots as police, unworkable passenger screening, and training fighter pilots to shoot down commercial jets. At least it seems that our nations finest are reluctant to commit to such acts.

So I would say Schnier has plenty of reason to assume that people make these decisions based on fear rather than logic.

alarm systems

[Anonymous Coward]

This is slightly OT, but does anyone know of any good homebrew solutions for alarms? I've found a few things from google, but I'd like some personal experiences from fellow slashdotters. Along the lines of what I'm thinking is something that can tie into a spare box so that I can setup scripts to email/text mesg/whatever when the alarm goes off.
Note..it's already fairly easy to do this with motion detection systems, but I'm looking more at entry alarms on windows/doors (I know I could wire my own, but are there kits that people have used successfully?)

-WB

Crypto

[Otter]

The process helps you make sure you understand what you are protecting, what the tradeoffs are, and whether, in the end if it is worthwhile to implement the system.

This is precisely why I don't bother with any encryption that isn't built in. Browser encryption - fine. Using PGP or RMSPG on my email -- as Dogbert asked, "Who would want to read your mail?" There is too much hassle involved, just on my end, never mind getting my sister or mother in law to read encrypted email. Unless you make a fetish of it for your own sake or you're sending something genuinely worth protecting, who cares?

Re:Crypto

[Anonymous Coward]

Unless you make a fetish of it for your own sake or you're sending something genuinely worth protecting, who cares?

All the dickheads here do.

Re:Crypto

[Anonymous Coward]

But if you only encrypt the stuff you want kept secret, you make it easier for them to tell when they should look at your mail.

Encrypting everything forces them to look at, and decrypt everything, only to see your grocery list 99% of the time.

Re:Crypto

[CGP314]

This is precisely why I don't bother with any encryption that isn't built in. Browser encryption - fine. Using PGP or RMSPG on my email -- as Dogbert asked, "Who would want to read your mail?" There is too much hassle involved, just on my end, never mind getting my sister or mother in law to read encrypted email. Unless you make a fetish of it for your own sake or you're sending something genuinely worth protecting, who cares?

Well, the idea is if you only send important email in encrypted form, then the important email is easy to spot and brute force. But if you encrypt everything, then brute force is not such a viable option.

That's the idea anyway, but I'm with you. I tried to use PGP for a while, but none of the people I emailed had any idea what it was, and didn't have the inclination to learn.

Re:Crypto

[HiThere]

There is a periodic effort to get PGP or GPG signing included in Mozilla. I haven't seen any results, though you might consider using KMail. I don't know about any of the others.

N.B.: you said "built into the browser". I translated that into "built into the e-mail program". I hope this was correct. Browser based encryption is present in most browsers. (In Mozilla it's represented by that little padlock icon. If the padlock is closed, then you're in encrypted mode.)

N.B.B.: I'm not sure about the value of encrypted e-mail. As you say, most recipients won't be able to read it. Signed e-mails, however, are quite valuable. They enable you to demonstrate that the email attributed to you has been forged. Anyone who isn't interested can just ignore the gibberish, and will still be perfectly able to read the e-mail.

Re:Crypto

[Otter]

N.B.: you said "built into the browser". I translated that into "built into the e-mail program". I hope this was correct.

No, I meant that I use encryption when it's given to me seamlessly. As you say, using a browser in encrypted mode is routine, so I'm happy to use it. Same for ssh and sftp. If email clients provided that same level of routine integration, great! Obviously, though, it's a lot easier to implement encryption when the hard work can be delegated to a server admin, as with ssh or httpd.

Re:Crypto

[R1ch4rd]

Well, I went through the same way of thinking as you. But lately when all these privacy issues seem to came more and more to out attention it seems we should defend it.
Personally I hope that if I start using signing / encrypting and get my friends to do the same, I've helped the privacy advocates a little. I say this because I loath the idea " If you are honest, what do you have to hide? ".
I lived in a communist country and I know what it meens government control and I don't want other contries to go on that path.
I agree it's a hassle to use PGP.
But I think that only when we get used to security measures on a daily basis we can make the system more secure.
Think about how you'd feel for someone to read ALL your e-mail. It didn't happen to me but I knew people who did it.

Re:Crypto

[CmdrTHAC0]

I don't believe PGP and friends' purpose is encryption; that's merely a side benefit. The problem PGP is designed to solve is authentication: how do you really know fred@foobar.co.uk is J. Fred Foobar of Liverpool?

People don't generally perceive a need for that. My mom, for instance, only emails people she has met IRL and exchanged addresses with anyway. Spam and other scam mails (including the ever-popular "Customers want to use credit cards, so give us your bank account number", supposedly from Merchant Services) are untrustworthy on their own merits. She doesn't need PGP to tell her that.

Re:Crypto

[thinkninja]

Most (all?) PGP support for mail clients is provided in the form of plugins, like enigmail for thunderbird. Even still, I don't use encryption either.

Re:Crypto

[zaphod_es]

Eudora email has a pgp plug in that works just fine. According to a PGP article so do Lookout Express, Pegasus and Groupwise.

Re:Crypto

[IM6100]

Well, the idea is that the criminals, pedophiles, etc. want us all to use encryption all the time because it provides a forest for them to hide in.

Something about:

First they came for the pedophiles, and I didn't say anything.

Then they came for the criminals, and I didn't do anything.

They haven't come for me, and it's a lot nicer out on the streets at night lately. Go figure.

Or do I have the meme wrong?

Re:I am sure...

[chadm1967]

Bruce is not an obscure technologist. He is one of, if not the, leading name in Information Security. Of course, I'm an Information Security Analyst so maybe that's why he is not obscure to me...... :)

Not for you!

[stratjakt]

What are you the fucking review nazi?

No book for you!

Re:Not for you!

[Anonymous Coward]

At least I thought it was funny, even though some asshole mod didn't.

In the review summary

[Anonymous Coward]

A worthwhile introduction to real-world (not just computer) security, aimed at a literate but non-technical audience.

Aren't all books aimed at the literate? (Ok, excluding some popup books)

Re:In the review summary

[Disco Stu]

Nope.

Re:If this is not the first post...

[Anonymous Coward]

Who the hell is Bruce Schneier?

Bias

[captaineo]

It is amusing to watch Schneier walk a political tight-rope in many chapters, carefully pointing out that some issues come down to personal value judgments. He tries his best not to take sides but I feel the work is somewhat politically biased. e.g. I object to his assertion that airline pilots shouldn't be trusted with guns, simply because that is not their primary area of expertise. And I don't agree with his model of US military intervention - basically that intervention leads to anti-Americanism which leads to more terrorism - this leaves out the potential for positive social and economic intervention to weaken extremist positions.

Not to detract from the book as a whole; I found it an eye-opening read, and am very happy it was written and published.

Re:Bias

[Eric Ass Raymond]

I object to his assertion that airline pilots shouldn't be trusted with guns, simply because that is not their primary area of expertise.

I for one do not want airframe-piercing tools anywhere in the plane. If, against all the odds, someone manages to smuggle a gun in and takes over the plane, I'd rather have it stop there. I don't want a fucking gunfight inside the plane.

this leaves out the potential for positive social and economic intervention to weaken extremist positions.

Positive social and economic intervention by boming them? Yeah, right.

See a guy and a girl having a violent argument on the street. Do you intervene? No way in hell. If you do, they'll both forget their differences and kick your ass.

Re:Bias

[Anonymous Coward]

It's bomBing (with a "b") and yes, his point is perfectly valid. Perhaps you should study up on the history of Japan you dolt.

Re:I am sure...

[Anonymous Coward]

No, the bible of cryptography is "Military Crytology" by William Friedman. Unfortunately, its not available thru Amazon. You'll have to go to Ft. Meade MD to get a copy. If you dont know who William Friedman is, find out.

Wrong

[Anonymous Coward]

and five being average

Nine is the average (and the median and mode) for slashdot book reviews.

Re:Wrong

[Anonymous Coward]

nice simpsons rip

Ummm...

[Anonymous Coward]

So it sounds like a good book and probably would be for some, but there was not enough new content for me to make it worth my limited reading time.

so, uh, did you read to book or not?

The administration doesn't want you to read this

[Animats]

This might lead people to realize that the US has overreacted to Al-Queda, Iraq, and street crime, while underreacting to Enron, SARS, and North Korea.

For US government regulatory purposes, the value of a human life ranges from about $1.1 million to about $6 million. (1999 dollars). The current administration would prefer smaller numbers, because environmental and safety regulations are measured against those values. (1 CFR s305-88-7). So the Enron collapse, at $40 billion, equates to about 7,000 lives.

Yet Ken Lay is still at large.

Quote the book when you write your representatives

[lildogie]

I read the book, and I wished over and over that my representatives would read it to.

Next best thing: quote it in letters to my representatives.

Re:What?

[Anonymous Coward]

He's the one that quit. You'd expect a bully like him to stay in and fight it out. I wonder why that ass backed down so quickly.

same price at amazon

[Anonymous Coward]

Ref: Amazon has the same price as bn.
Spend $7.50 more to get free shipping.

Re:same price at amazon

[Anonymous Coward]

Boy, Am I late today! People are going to start mistaking my copycat poster for me....
Ref: Anyways, here's my link to the item page on Amazon...

there is a national ID system

[penguin7of9]

In reality, the US has a national ID system, consisting of your drivers license and your SSN (with your birth certificate thrown in occasionally). It simply is a bad one, poorly administered, insecure, and rife with identity theft and fraud. Why doesn't it get fixed?

Who knows. Probably a combination of stupidity, xenophobia ("the Europeans are doing it--it can't be any good"), crooks like it (and they get to vote and lobby, too), and because it is enormously profitable for some, like companies that make a living out of collecting data about you, aggregating it, and providing that information to others. A good system of national IDs with good privacy legislation would make those companies redundant.

Re:there is a national ID system

[__past__]

...companies that make a living out of collecting data about you, aggregating it, and providing that information to others. A good system of national IDs with good privacy legislation would make those companies redundant.

Why would they? Just because you have an ID card doesn't have anything to do with the collection of personal data. I have a national ID card, and neither is that itself used to create a personality profile of me, nor does it hinder lots of companies to earn money by spying on me. The only one that is likely to make a profit is the state - the things are fucking expensive if you've lost one or it expired.

Re:there is a national ID system

[AJWM]

And California is about to massively devalue that ID by issuing drivers licenses to undocumented (aka illegal) aliens.

Logically, every other state in the union should refuse to recognize a CA drivers license as a valid ID, except maybe as proof of the ability to drive a car (about the same utility as the "international drivers license" you can get). I'm sure Californians will be real happy when TSA stops accepting their DLs as valid ID next time they try to board a plane.

You want a national ID? Get a passport.

Re:there is a national ID system

[JimBobJoe]

And California is about to massively devalue that ID by issuing drivers licenses to undocumented (aka illegal) aliens.

Which would do wonders for fraud in California. You see, the problem is that the California driver's license, for no damn good reason, is trusted way too much. I could do more harm with a California license than any other state ID or license card.

California issues out no less than 25,000 ID cards per day and even at an amazing rate of accuracy and security, you would still be looking at a pretty good number of "bad" cards in the stack. (Sacramento Bee said that the DMV said they issued 100,000 bad cards in 2000. That's what the DMV themselves were claiming.) Every one of those bad cards is trusted way too much. Anything that can take the trust value (my term) down a few notches would help.

Other states do issue illegals licenses...not just California. But the focus is on California, though honestly I wouldn't have trusted one of those cheap pieces of plastic in the first place.

(Speaking of that 100,000 number...I was amused because in 1982 the CA DMV claimed that it was 2000 per year, and that's why they needed to have mandatory license fingerprinting. A lot of good that it did.)

Re:there is a national ID system

[penguin7of9]

And California is about to massively devalue that ID by issuing drivers licenses to undocumented (aka illegal) aliens.

You are absolutely right: what a marvelous benefit. That alone makes me want to support that proposal.

Driver's licenses are for driving an automobile, not for anything else. If California's move causes people not to use them for other purposes, that's a great step forward. Let's hope the other 49 states will "devalue" their driver's licenses in the same way.

Re:there is a national ID system

[penguin7of9]

Why would they?

First of all, a national ID system would almost certainly come with stronger privacy legislation, something that would make a lot of the current data collection and exchange practices in the US illegal.

Also, a large part of the work involved in keeping databases on people has to do with figuring out who they are and whether two pieces of information refer to the same person. A reliable, secure identification system would mean that institutions might not have to outsource that work at all. Many developed nations other than the US get by mostly without the kinds of private data collection and reporting services that are so widely used in the US.

How to get your driver's license back

[Anonymous Coward]

Just renounce your US citizenship but remain in SF. That way you'll now be an illegal alien. Then just head on over to the DMV and they'll print your license out for you straight away.

Re:How to get your driver's license back

[Jeffrey Baker]

That's by far the most insightful thing I've read on /. lately.

Re:I am sure...

[Anonymous Coward]

3 things.

1) William Friedman is dead. Died 1969. Quick bio: http://raphael.math.uic.edu/~jeremy/crypt/contrib/ daoudi2.html

2) Military Crypto is outdated. Written at least more than 34 years ago. Most likely before 1955, when he retired from the government.

3) Military Crypto might be out of print. Hence the reason it's not at Amazon.

Applied Crypto is much more up to date. Written during the 1990's, contains C code of algorithm implementations for reference. Contains algorithms Friedman could only dream about.

Wait until the RIAA hears about this

[jmagic]

Wait until the RIAA hears about this:
This book is soon going to find its way into hands of friends and relations who need to think about security

Re:What?

[Anonymous Coward]

He's [Rush Limbaugh] the one that quit. You'd expect a bully like him to stay in and fight it out. I wonder why that ass backed down so quickly.

It is teh ghey conspiracy...

Oh yeah.....

[LittleGuy]

I am sure most Slashdot readers know Schneier's name and his work.

"Hi, I'm Bruce Schneier! You may have remembered me from my other books, 'A Long Day's Journey Out From Fright', and 'Security is a Well-Patched Mac'."

Re:The administration doesn't want you to read thi

[AJWM]

while underreacting to Enron, SARS, and North Korea.

North Korea I'll go along with, maybe even Enron. But SARS!? Underreacted? Were there ever more than a handful of SARS cases in the US?

A better lifestyle...

[NineNine]

...quit being such a goddamned pussy. Yeah, yeah, I know... "flamebait" or "troll", but I honestly believe this. The US, especially, is increasingly full of people afraid to leave their houses, and when they do, they're armed to the teeth. I don't know what everybody's so goddamned afraid of. Michael Moore's "Bowling for Columbine" suggested this in a roundabout way, but I believe, that that's a big problem with the US. Everybody's becoming scared of their own shadow. Afraid of terrorists. Afraid of crime. Afraid of "cyber attacks" (this is beyond ridiculous). I suggest quit being such a goddamned pussy, that's what I suggest.

Re:A better lifestyle...

[Reducer2001]

Or to paraphrase George Carlin:

Do you want to spend the rest of your life jerking-off and eating at Wendy's? Take a fuckin' chance!

Re:A better lifestyle...

[IM6100]

There has been this pathological fear of 'online identity revealing' as long as I've been online. I come from the old BBS scene of the 80's. We had big social BBSes back then and had social events. We, for a time, played softball every Sunday afternoon and then had a barbeque at one guys house.

Everybody would freeze up with paranoia if anybody said anybody elses' real name at the barbeque.

It was and is pathetic. It seems to hearken back to a fear of computers that people still harbour.

Re:A better lifestyle...

[ScrewMaster]

This goes back to a smug, complacent nation that has not, for over two hundred years, had to deal with the daily brutality experienced by people in the majority of other nations. By simple numbers the normal state of humanity, worldwide and throughout its entire history, is one of abject misery. We've always felt ourselves a protected class, here in the United States, and thanks to the good work of our Founding Fathers and a couple centuries of isolationism we pretty much were. Then we got involved in world affairs and we aren't as "safe" anymore.

But ... so what. There really isn't a whole lot you, me, or the rest of the population can do about terrorists. Worrying about it and losing sleep is utterly counterproductive. Worry about the bald tires on your car or those squeaky brakes: those are much more credible and immediate threats.

To continue the analogy, when I'm a passenger in a car, I try to be alert and watch what's happening around me because there is a real possibility that I could do something to avoid an accident. Conversely, when flying on a jetliner, I typically take a nap. Why is that? Because, while there is still a finite risk of sudden death, if that plane decides to prematurely stop flying and bury itself in a mountainside I'm toast whether I'm wide awake or out cold. So, I simply don't concern myself about negative outcomes and doze off or read a book.

It is important to focus our worries and concerns in areas where they will actually do some good. Unfortunately, I don't see that happening. Since 9/11 I have heard numerous public officials make statements like "We have to make people feel secure so they'll go back to work." Notice they never say they'll actually make us more secure, they just want us to feel more secure so we'll get on with our lives and so the economy won't plummet again. It's a national con job that has taken in a lot of people, but I can't even say that they're wrong in doing it. People were freaking out about the attacks and something needed to be done, I guess.

Compare what our lives, even now after 9/11, to what the Israelis and Palestinians suffer each and every day of their lives. The possibility of sudden death at an enemy's hand, of being blown into very small pieces while eating one's lunch, is very real and very much a part of their daily routine. We are still terrified about something that happened a couple of years ago. Yes, it is pathetic. Get out and live your life, that's what I say.

Re:The administration doesn't want you to read thi

[NineNine]

I agree. Anybody who says that SARS is something to be afraid of watches too much goddamned TV.

Re:I am sure...

[Eric Ass Raymond]

Contains algorithms Friedman could only dream about.

You could have dreamt up the stealth plane that was designed in 1970s?

Do no underestimate the military research...

We NEED to use SSN's as identifiers

[bill_mcgonigle]

I have written my local representative that while his recent bill to remove SSNs from insurance cards is nice, it's far too late (and how about just getting people to stop using SSN's as identifiers?

The cat's out of the bag already. Pretending that SSN's are somehow secret was dubious enough thirty years ago, but is just plain reckless today. It's this coy game of 'if you know your SSN you must be you even though we know that's not true' that has allowed identify theft to proliferate.

Instead we need to just say, "this is my National ID # - use it for whatever you damn well please" - at that point people will have to start looking for real security solutions instead of the crazy half-baked ineffective one they're trifling with now.

Of course, this can't be done electively - there needs to be a national cutover date with probably 2 years notice (then at least 2 years of delays). All that needs to be done is to get Congress, the IRS, the President, and 'Privacy Advocates' on board. No problem.

Bruce Schneier

[Penguinshit]

Didn't he play the cop in all those Jaws movies?

I also liked him as Heywood Floyd in "2010".

Disgruntled pilots?

[JimmytheGeek]

From time to time we hear of drunk pilots being dragged off the plane. All it takes is one wingnut pissed off about paying child support and we have a big problem.

Better to keep the pilots unarmed. Have air marshals on random flights, and secure the cockpit door vs. even them.

Re:Disgruntled pilots?

[llj555]

If the pilot is disgruntled and wants to kill passengers, he doesn't need a gun. He could just crash the plane. If you're worried about drunk pilots on the plane having guns, why aren't you worried about air marshals having guns. Is it impossible for them to get drunk? Or do they not get disgruntled? Hardly anyone is aware of it, but there has been a documented case of an armed airline pilot stopping at attempted hijacking: http://www.findarticles.com/cf_0/m0BTA/2002_March- April/83280949/p1/article.jhtml?term=massad+ayoob+ pilot

Re:Disgruntled pilots?

[JimmytheGeek]

If his copilot can complicate his attempt to crash the plane, a disgruntled pilot would find a gun useful. An ambushed copilot wouldn't have a chance to return fire. Advantage: wingnut

My point about drunk pilots (at least two sets on commercial airlines in the last few years) was that they are not perfectly reliable. As a class, they are more reliable than most any other grouping, but it's too big a group. I think the odds of a dangerous wingnut also being drunk are low. Either variable - drunk, or wingnut, is a problem.

A few air marshalls complicates the hijackers planning. I think having them on every flight increases the number of marshalls to the point where a wingnut slips through the recruitment process. In other words, we're past the saddle point of probability where the risk increases.

Oops - I'm off topic.

Re:The administration doesn't want you to read thi

[MadAhab]

Straight up. I met an epidemiologist around the time of the SARS peak and she said statistically it doesn't make a bit of difference, while TB has been making quite a comeback and kills more people each minute than SARS ever has... Yet no one is closing down airports over TB.

Guys like Bernie Ebbers or the Tyco looters commit the finanicial equivalent of tens of thousands of bank robberies. What are the chances they'll spend as much time in jail as the average bank robber?

Beyond Fear

[herwin]

I teach security to novices, and I have found Bruce's books extremely useful resources. As soon as read Beyond Fear, I incorporated some of his ideas in my lectures (although I expanded the 5-step process to 6 steps for the students). Well recommended.

Talking to non-techies

[isomeme]

I was chief architect several years ago at a pioneering (and now dead) movies-over-the-net company. Beyond the technical issues involved, our biggest problem was movie-industry execs who insisted on "absolute, guaranteed, unbreakable" security. Needless to say, this was a bit of a stumbling block, as there's no such thing.

When I gave security-related presentations to non-techies, I got in the habit of asking for a show of hands asking who had locked their front door when they left home that morning. Needless to say, all hands went up. I'd then point out that a thief could break a window, tunnel through a wall, dig up through the floor, cut a hole in the roof, or batter down a door if they were determined enough to get inside...so why did they bother locking the front door? Thinking about this got people into a more reasonable mindset to discuss cost/benefit ratios and attack scenario analysis.

Re:The administration doesn't want you to read thi

[ZerroDefex]

It has been found however that people of south asian descent often carry a gene that makes them much more suspectible to SARS, which is part of the reason it caused so much havoc over their and hardly anywhere else.

Re:The administration doesn't want you to read thi

[NineNine]

It didn't cause havoc. I don't think that it killed more than 200 people. That's the point. People just eat up this fear coming from the media.