Slashdot Mirror
Schneier: Everyone Wants You To Have Security, But Not From Them
An anonymous reader writes: Bruce Schneier has written another insightful piece about the how modern tech companies treat security. He points out that most organizations will tell you to secure your data while at the same time asking to be exempt from that security. Google and Facebook want your data to be safe — on their servers so they can analyze it. The government wants you to encrypt your communications — as long as they have the keys. Schneier says, "... we give lots of companies access to our data because it makes our lives easier. ... The reason the Internet is a worldwide mass-market phenomenon is that all the technological details are hidden from view. Someone else is taking care of it. We want strong security, but we also want companies to have access to our computers, smart devices, and data. We want someone else to manage our computers and smart phones, organize our e-mail and photos, and help us move data between our various devices. ... We want our data to be secure, but we want someone to be able to recover it all when we forget our password. We'll never solve these security problems as long as we're our own worst enemy.
What he means to say is what most of have known in our darkest heart of hearts since the first help ticket: The vast majority of users are technically illiterate idiots, and you can't fix stupid.
Scruting the inscrutable for over 50 years.
This is how protection rackets have always operated, whether government, religion, or privatized. Make sure that you're safe from our competition, but look the other way if we're ever wrong.
... didn't evolve for this kind of society. AKA we 'want someone else to do it', because we have limited time, resources, intelligence and energy. This is just about the limits of what it is to be human.
Everyone forgets the laws of nature, if you are working most of your life and your constantly being attacked by corporations/government and your mind didn't evolve to deal with it... you get a big mess, who'd have thunk it?
The idea of 100% security just doesn't happen... However they are things that everyone can do that will reduce their risk.
Biometrics is one method, it isn't 100% but it is better than password use on the average. We have Encryption Standards, we just need to find a way to get the Official Certificate issue, so it can be free, and really prove who you are.
There seem from some reason to not push SSH on windows platform, so we are having the many unsecure port issues still...
Sure it isn't 100% but I think we can get to a state of good enough.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Have control over all the encryption algos of this world? Its hard to believe that all these smart people will let them get away with this .. having saild all that .. The prsident , the director of the NSA and all the pezzenovantes dont make this stuff .. This stuf is made by you and me ..
We'll never solve these security problems as long as we're our own worst enemy.
We'll never solve these security problems.
FTFY
Welcome to the real world, where the only way for three people to keep a secret is if two of them are dead. And even that's not a 100% guarantee. Not much has changed over the centuries.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Everyone wants everyone else to follow rules, but not themselves.
I think there are more shades of grey than 50, here.
The phrase "I want my data to be secure" makes no sense. There's no such thing as "secure data". One can't even define "secure data". Data can only be considered secure within context, e.g. my pictures stored on SpiderOak are secure... as long as someone doesn't beat the username and password out of me with a $5 wrench. My Facebook data isn't secure by definition, anyone could save those pictures or that text. And yes, each company wants their piece of the pie (the bigger, the better) and yes, each person wants to be able to do stuff as easily as possible. The more secure data is, the greater the usability sacrifice.
We're not our worst enemy. We are how we are and it's impossible to change it. Try explaining your mom that she needs to enter an overly complicated password and then receive a code through SMS and then type that code manually in a little text box every time she wants to look at each of her granskid's pictures. Won't work. And it's not because your mom is lazy, but because the perceived need for security for such data is very low.
Yes, a thief only needs to browse his local area citizen Facebook profiles to identify who's going away on vacation. Before that, he needed to physically roam the neighborhood to find out. In both cases, the reward (loot) greatly outweighed the effort, the sole difference being less effort now than then.
The advent of Internet and technology brought us great advantages as well as risks. They always go hand-in-hand.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
We want strong security, but we also want companies to have access to our computers, smart devices, and data
No, we don't actually want them to have that access, they don't give us a choice if we want their services. We can solve these by teaching people that you don't need to put your data online and then voting with our wallets by buying software that doesn't force us to do so.
We want someone else to manage our computers and smart phones, organize our e-mail and photos, and help us move data between our various devices
No, we don't. We want it to not be so ridiculously difficult to do so, but companies have determined that they can use this to their advantage and get us to give them our data to make it easier. Android's SD card behavior is so absolutely shit that its easier for non-geeks to just give Google all their data. Apple phones only let you sync certain things over USB and its kind of convoluted for a non-geeky person, so they use iCloud.
We don't WANT it this way, but its the only option we have because you've failed to educate people to the fact that theres another way and what is actually wrong with giving Google/Facebook all our data. You lost peoples interest when you started ranting and raving.
We want our data to be secure, but we want someone to be able to recover it all when we forget our password.
No, we don't. I too write encryption related software Mr Schneier, but I'm not a paranoid nut job. Important data that I want to protect simply isn't available to the outside world so it doesn't NEED encryption. If you get to the data, then you've probably already bashed my head in. This isn't like a door lock where its possible to overcome them and we can't stop them from being overcome, so we take advantage of locksmiths when we screw up. Locks can not be 100% secure, encrypted data can be effectively 100% secure and thats a different environment.
What we WANT is for our systems and software to not force us to put shit on the Internet, and being forced to be Internet connected is why we want it encrypted. Even my 65 year old mother in law understands that encryption is effectively unbreakable and she treats it that way, uses it where it needs to be used (yes, she actually uses encryption) and just acts intelligently about where she puts other data.
People are not as ignorant as you may think, its that you haven't bothered to educate the ones you know beyond being a paranoid nut job about things, which doesn't work well for normal people. Now, I understand why you're paranoid, you have good reason to be, the NSA is fucking ridiculous, but you were pretty fucking stupid for putting shit you don't want people to know on a public network in the first place, and you of ALL PEOPLE should know better, and you have in fact written about this very subject.
If you bothered trying to educate people properly and nicely without being a jerk about it or flipping out about the way things are, things may actually change.
Then theres side two of it all ... MOST PEOPLE DON'T GIVE A SHIT ABOUT THE DATA THAT GOOGLE GETS FROM THEM. The ones that do, DON'T GIVE IT TO GOOGLE OR FACEBOOK IN THE FIRST PLACE.
You're losing your edge, somewhere in your many years of working with security issues you've lost sight of how everyone who isn't in the security or data mining industry behave. This article you've written seriously lowers my opinion of your relevance these days. Not that I'm really relevant either, but I'm certainly not the only one who's losing interest in your opinion.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
More to the point, there is no money to be made in security. Not only does it cost money to implement, having real security *closes off* business opportunities. The entire Internet economy is BUILT on spying on you and selling your information!
My 14 year and still running policy of giving fake names, fake e-mails, fake phone numbers etc and no personally identifiable data other than my IP address to most online companies is working great. They ask me for data I don't want them to have and they get useless bullshit. Problem solved.
Apple doesn't care if they can't get to your encrypted data. If you lose your password to your encrypted iOS device and your primary computer, you're screwed.
Schneier's comments describe perfectly the alleged pseudonymity that Google offers on their Google+ service. You are allowed to use a pseudonym, but only as long as Google knows which real name account lies behind it.
Your right to privacy is respected, but only when Google is exempt.
That's not what he said at all. I mean, I'm not disagreeing with you substantially, but that's completely separate from the actual point of the piece.
It's all about the fact that, in order to do many or most of the things we want to do today, we have no choice but to give someone access to our data—but that almost everyone we could give that access to wants to (ab)use it to make money.
More importantly, that's even true of those who actually want to help keep our data secure from others—even our governments.
The fact that there is really no major entity working to keep our data safe for ourselves and ourselves alone—and that there are so many, even those that theoretically should be trying to do so, working directly against that end—is definitely something we need to be concerned about, far beyond simply bemoaning the stupidity of all the "lusers" who will happily give away their data for free because they just don't know any better.
Dan Aris
Fun. Free. Online. RPG. BattleMaster.
Speaking of security, how about some end to end TLS (with pinning) in the near future?
The fact that there is really no major entity working to keep our data safe for ourselves and ourselves alone
Apple does this. Look at HealthKit for example, all data is stored locally, Apple doesn't mine it. They allow you to control who has what access to specific parts of the data.
It's not exactly true of all data, but Apple tries to give you specific control of data where it can.
The reason why Apple does this and other companies do not is simple - Apple actually makes money selling hardware. Google and Facebook have no revenue except what they can extract from you data, so they have totally different motivations.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I don't want companies and apps having any of my information. They want it, and in exchange for using their services I have to hand it over for them to lose. Yet somehow they aren't responsible for that loss. Then all the someone else stuff is really you want an ecosystem that works on your computer or phone, true I do want it to work togther, but I don't want them knowing anything about my pics or texts or whatever. The last part is ridiculous. The only, only, only reason I need to be able to do a password recovery is because all of these sites don't allow me to use the password I want and nothing less or more. The fact that some demand a capital and don't accept certain punctuation annoy the hell out of me. And without a password saver or some sort of requirements hint on the log in it's all guessing if I frequent the site very little.
Uh, Linux geek since 1999.
Albert King references deserve an automatic +5.
Security is inversely proportional to convenience.
This, like so many articles, and commenters, there is a lot of confusion about the terms security, privacy, and secrecy, equating them as being the same thing. One thing they have in common is that they're each inversely proportional to convenience and violating one compounds the breach of the others.
This tech is your tech
This tech is my tech
From the lowly Bitcoin
To SSL/TLS
From the AES cipher
To S/MIME and GPG
This tech was made by you and me.
The Internet has turned out to be an ugly, hostile den-of-thieves. It isn't going to get better because the thieves own it. Maybe we should abandon http and the World Wide Web and build something with inherent security and anonymity.
Google and Facebook want *your* data to be safe — on their servers so they can analyze it.
No
They want their data to be safe on their servers so they can analyze their data as they see fit. Private property: essential to liberty and freedom.
Can't someone else do it?
https://www.pinterest.com/pin/...
I don't agree with this. it *IS* possible to change. The internet userbase has already done it!
In the early days of computers, they were difficult to use. They used cryptic commands, offered no gui, and had limited help. But we used them. We made them do amazing things. Then as computers became more powerful, and cheaper, they also came with GUIs and help, making them easier to use.
They didn't have to!
We had already learned how to use the complex computers, so we don't NEED the GUIs.
The same is true for file servers. Up until the mid 2000's, every company that wanted a website had their own web server. Many had internal file servers. They were secure, and they were only accessible by the people who needed to access them. Then, when "the cloud" became a popular buzzword, the companies started relinquishing control of the servers to third parties. THEY DIDN'T HAVE TO! If you want security, keep your servers to yourself!
Why haven't we fully embraced security, as consumers? Even as business, we do a lousy job of it. It's because we don't get anything out of it. Immediately. It isn't immediately useful. Yes, it's great if someone hacks your servers, or if you know someone is trying to steal your identity, then you think about it. But other than that, security just makes you WORK rather than give you something. That's why it hasn't been embraced.
Here's how I think that can change. We need to build a service that anyone, and everyone, can use. That provides you with immediate benefits, even as a consumer, as well as a business. What could this be?
Maybe it's just me, but for me, the fundamental issue here is identity, and the attached personally identifiable information (PII). Identity and PII are the link between consumer and business, and they're required by everyone. Your identity (login/pass) to /., facebook, twitter, your bank, your email, your other email that your partner doesn't know about but really they're just pretending, they know it's over, they've been hitting the gym and got a lawyer, and how did you not notice that they've been off facebook for 3 weeks? They're getting a divorce attorney right now. You're screwed. All of these logins require an effort on your part - creating them, and then remembering the passwords. And then remembering to change them on occasion. It's a lot of work, and it's ripe for a service to handle it. But a password wallet? How is that enough, there are tons of them already, you dingus. I know that. That's why I'm not talking about a password service, but an identity service. One built on a cryptographically secure network. A distributed network. An open and public network, that doesn't require significant energy requirements because artificial scarcity is great for currency, but absolutely useless for identities. One that any business that wishes to maintain a connection with their client will use. A network that will allow a business to manage their own internal identities, and associated groups, to avoid having to store passwords.txt in the passwords folder. An identity network that will allow the user to control what PII is associated with an identity, whether that identity is public or private, and to manage requests for authorizations to use PII externally of the system. A method to track and manage identity/PII use and ensure accountability in its use. A network that allows the quick and easy creation of wallets - sorry, I mean identities, really, I'm not talking about the *coin network, artificial scarcity is useless for identities remember, and add them to their own list of identities. A method to post short messages/notifications, encrypted with the public key of the identity and for that message to be passed on, or left for passive retrieval, to the final destination. In short, a simple to use identity service that lets you connect with others, be they anon or a corporate entity, and control/monitor its use of your information. On the plus side, the PII remains encrypted and the business has less to worry about getting hacked.
wo/man, I'm hoping someone out here is smarter than I am and gets what I'm talking about and can help me figure it out.
But this one is one of the "gee, really, you don't say?" kind.
OF COURSE everyone wants to be the only one who has access to something. Monopolies are something really awesome, and only cool if they are, well, monopolies.
Data is worthless if everyone has it, only if you have the exclusive ability to use it it becomes valuable. In our world, the value of something is determined by its scarcity. Data is now something that can, by its very nature, be reproduced with near zero cost in infinite amounts. It only becomes a commodity if you control when, how and most of all if that data may be reproduced.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Hm, I think data doesn't have to be worthless if everyone has it, it has worth to those who take the time to do something with that data. For everyone else, it's worthless. EG if the inner details of a business's day to days was public and accessible to all - you might not care, particularly if the business isn't near by, but a competitor would definitely be interested, or regulators looking for fraud, etc. I get what you're saying, and I'm not trying to be pedantic, but the value doesn't automatically decrease to zero. It decreases to whatever it is those who have access to it value it for (eg the amount of effort they'll put into it).
In the following example:
"Mother" is the Chief of Staff
"Uncle James" is the head of state,
"Maisie's house" is the UN building
"Fishing" is 'discussing nuclear limitations'>br> "Peeling Plums" is 'advising of invasion plans for country xxx
Message starts: "Mother and Uncle James are on their way to Maisie's house to peel some plums. After that they hope to go fishing, then see a movie. Have a lovely weekend. Cousin Sam"
Message is indecipherable without a code book.
"The greatest lesson in life is to know that even fools are right sometimes" - Winston Churchill
The sad fact is that most companies aren't even implementing basic controls that everyone knew were important 10 years ago. If you look at a lot of the high profile breaches, they're due to fundamental stuff, not a lack of super high end ultra-expensive security appliances. Its something consumers reasonably expect companies to be doing, but they aren't doing.
I believe it is possible to have companies manage things and have good security. You could accomplish this by having individual consumers take more responsibility for their information, but its more likely and more effective that "we" would take more responsibility for our information through market pressure, standards, etc.
The most likely form for this to take right now is through standards and compliance. The improvements in the situation are being driven by this now. We're not there yet, but its improving.
The area where I do agree, though, is that it will be difficult to have effective security and privacy without legal support. The government is completely full of shit when it comes to information security, as they are full of shit when it comes to so many things. The NSA's efforts to compromise encryption and product security are a great example of this.
On the other hand there are laws like HIPAA. HIPAA is so vague, and yet it has been effective in driving change in the healthcare industry. Again we're not, "there" yet, but things are changing at a relatively rapid pace. HIPAA is actually a good example of where the government was not overly prescriptive, but does enforce substantive penalties for noncompliance with very general common sense requirements. On the other hand you have industry regs like PCI which are extremely prescriptive and have had a similar effect. Consequences are the only reason why PCI is having an effect as well...
https://archive.org/details/22...
"SO we bide our time, waiting for a purer kick to bloom and the future is still bleak, uncertain and beautiful" -GSYBE
Because as soon as you communicate a little longer you will provide more than enough context to break this "ingenious cipher".
Boy, get yourself an internet and look up "JN-25" or "Kriegsmarine code books Naval intelligence".
These codes were much more advanced and still broken, because they were no real One-Time codes.
Please send me $100 for my educational services via Paypal at noob.educator@yandex.com
It's not that typical users don't understand how anything works and aren't willing to find out (though that annoys many of us). It's that they're busy salivating over the latest hyped product ("can't way for 6!") instead of demanding decent security and demanding that things be done right. When did parents stop teaching their kids to not take candy from a stranger? Everyone's eating apples with razor blades and only complaining when they nearly bleed to death.
So we are all a bunch of idiots. Lazy. Void of responsibility.
Yeah... I knew that. What most don't know is "we" is also who is in charge of securing your data.
They/we don't do any better job of it than I/we could.
We need to remember that most of us would not know how to create a financial derivative wrapping up bad mortgages into a pretty package and then selling them to banks who then get the government to cover the losses at the high end leaving the luzr$ holding underwater assets that they have to just give up. $12T worth of equity vanishing in the process. Yet these are the guys who pay us the best. The "techs" who lurk at the fringe, and who do not really know a packet from a pickle should be treated like physician's assistants or paralegals. Useful to do the routine stuff, but needing tech supervision or nudging aside when the going gets tough. They might be the hardware guys opening the hood and putting in the parts, while we wait at the keyboard to make it work. In a repair shop, it makes sense to form these sorts of teams, but for on-site delivery it is usually a one-man team, and in that case, we need to be careful to send in the paratechs only when called for, sending in the true techs when necessary. In the end, it is about education. Educate the users about why they sometimes only need the power user, sometimes the paratech and sometimes the tech. Educate the support spectrum to have proper (if limited) respect for each other and keeping each level engaged.
Sheesh, you'd think we thought being techie qualified us to do brain surgery, for crying out loud.
"There is no god but allah" - well, they got it half right.