Schneier: Everyone Wants You To Have Security, But Not From Them

An anonymous reader writes: Bruce Schneier has written another insightful piece about the how modern tech companies treat security. He points out that most organizations will tell you to secure your data while at the same time asking to be exempt from that security. Google and Facebook want your data to be safe — on their servers so they can analyze it. The government wants you to encrypt your communications — as long as they have the keys. Schneier says, "... we give lots of companies access to our data because it makes our lives easier. ... The reason the Internet is a worldwide mass-market phenomenon is that all the technological details are hidden from view. Someone else is taking care of it. We want strong security, but we also want companies to have access to our computers, smart devices, and data. We want someone else to manage our computers and smart phones, organize our e-mail and photos, and help us move data between our various devices. ... We want our data to be secure, but we want someone to be able to recover it all when we forget our password. We'll never solve these security problems as long as we're our own worst enemy.

Comments

He's being polite.

[some old guy]

What he means to say is what most of have known in our darkest heart of hearts since the first help ticket: The vast majority of users are technically illiterate idiots, and you can't fix stupid.

Re:He's being polite.

[Anon-Admin]

No they are not Techies they are "Power Users"

They think they are technical because the can navigate a gui, click on a button, and fill in a field. However they have no clue where the data is stored or what is going on under the GUI.

Hmm, that describes most windows admins. Wonder what they will do when windows goes command line and the GUI is no longer installed by default?

Did you read it?

[danaris]

That's not what he said at all. I mean, I'm not disagreeing with you substantially, but that's completely separate from the actual point of the piece.

It's all about the fact that, in order to do many or most of the things we want to do today, we have no choice but to give someone access to our data—but that almost everyone we could give that access to wants to (ab)use it to make money.

More importantly, that's even true of those who actually want to help keep our data secure from others—even our governments.

The fact that there is really no major entity working to keep our data safe for ourselves and ourselves alone—and that there are so many, even those that theoretically should be trying to do so, working directly against that end—is definitely something we need to be concerned about, far beyond simply bemoaning the stupidity of all the "lusers" who will happily give away their data for free because they just don't know any better.

Dan Aris

There is one major entity - Apple

[SuperKendall]

The fact that there is really no major entity working to keep our data safe for ourselves and ourselves alone

Apple does this. Look at HealthKit for example, all data is stored locally, Apple doesn't mine it. They allow you to control who has what access to specific parts of the data.

It's not exactly true of all data, but Apple tries to give you specific control of data where it can.

The reason why Apple does this and other companies do not is simple - Apple actually makes money selling hardware. Google and Facebook have no revenue except what they can extract from you data, so they have totally different motivations.

Re:There is one major entity - Apple

[danaris]

The fact that there is really no major entity working to keep our data safe for ourselves and ourselves alone

Apple does this. Look at HealthKit for example, all data is stored locally, Apple doesn't mine it. They allow you to control who has what access to specific parts of the data.

It's not exactly true of all data, but Apple tries to give you specific control of data where it can.

The reason why Apple does this and other companies do not is simple - Apple actually makes money selling hardware. Google and Facebook have no revenue except what they can extract from you data, so they have totally different motivations.

This is true—I tend not to think of Apple as "an entity working to keep our data safe," since I primarily think of them as a hardware/OS vendor. But yes, any data Apple does happen to hold of yours is as safe as they can make it from those who want to monetize it—and they don't care to do so themselves.

Dan Aris

Re:Schneier's opinion isn't what it once was

[BarbaraHudson]

The professional paranoia peddlers don't like reality very much. It cuts into their schtick.

A generation ago, there was this thing called a phone book - it had everyone's name, address, and phone number - and nobody went nuts about "OMG they have my address!" You could go to the public library and use the Lovell's "upside-down phone book" to look up any address and get the names and phone numbers of the people living there. And it would also tell what economic quintile that area fell into. the Again, no big deal. Electoral lists were sent out before the election giving every voter living in your polling areas' name, address, and profession - and nobody thought "aaAGGHH!"

Now it's like people have gone nuts. As in stupidly paranoid drama queens.

My view is a bit different - put everything out there in the open and there's nothing to be afraid of people finding out. No lever to be used against you. No threats of inopportune disclosure. Problem solved.