Slashdot Log In
Schneier's Keynote At Linux.conf.au
Posted by
kdawson
on Tue Jan 29, 2008 09:49 PM
from the necessary-security-theater dept.
from the necessary-security-theater dept.
Stony Stevenson writes "Computer security expert Bruce Schneier took a swipe at a number of sacred cows of security including RFID tags, national ID cards, and public CCTV security cameras in his keynote address to Linux.conf.au (currently being held in Melbourne, Australia). These technologies were all examples of security products tailored to provide the perception of security rather than tackling actual security risks, Schneier said. The discussion of public security — which has always been clouded by emotional decision making — has been railroaded by groups with vested interests such as security vendors and political groups, he claimed. 'For most of my career I would insult "security theater" and "snake oil" for being dumb. In fact, they're not dumb. As security designers we need to address both the feeling and the reality of security. We can't ignore one. It's not enough to make someone secure, that person needs to also realize they've been made secure. If no-one realizes it, no-one's going to buy it,' Schneier said."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
In other words . . . (Score:3, Insightful)
Video of Presentation (Score:2, Informative)
Re:In other words . . . (Score:5, Insightful)
If you want real security to be provided, you have to learn to sell it at least as well as the snake-oil. You have to make it sufficiently visible, but non-impeding, that people feel safe.
It's about understanding the human/political side of the equation that can make the difference between a successful deployment and a perceived failure.
Parent
Re:In other words . . . (Score:5, Insightful)
Parent
Re: (Score:2)
Re:In other words . . . (Score:4, Informative)
Parent
Re: (Score:2)
Re: (Score:2)
I do.
Mind you, I think it's bullshit. But the people at the airport are not the ones who caused the problem. The people around me have nothing to do with the decision making that went into it. The people it's appropriate to get mad at are nowhere around. A hostile reaction to the security theater while being subjected to it is itself an emotional, illogical response to the situation.
So, why get worked up about it while there?
Re: (Score:3, Interesting)
Re: (Score:2)
Re:In other words . . . (Score:4, Insightful)
1. the sole of a shoe can contain any significant amount of explosive
2. that walking on such a shoe would not cause the explosive to go off
3. that airport scanner technology can tell the difference between explosives and leather
None of which are the case. The only thing you could maybe fit in the sole of a very hard soled shoe would be a knife.. which hopefully people realize doesn't give a would-be hijacker any more of an advantage than being unarmed - if 50 scared passengers rush you, it doesn't matter that you have a knife. And that's what should have been the lesson of 9/11: if you allow yourself to be victimized you will die.. but if you step up and stop hijackers there is no way to hijack a plane.
All in all, I wish the government would just let the market decide. There should be a "no security" terminal where people can catch a plane much as you catch a bus.. buy your ticket, get on the next available flight. If you want to be harrassed, go to the security theater terminal.
Parent
Re: (Score:2)
All in all capitalism with it's "lowest common denominator" economics and decisionmaking is a poor tool against an irrational force like terrorism.
I don't see how terrorism is irrational. It is very rational. In fact, it is most rational thing some people can do. It's quite as simple as:
1. We meddle in other countries' affairs.
2. We tick the locals off.
3. The locals want to kill us.
It's as old as the "an eye for an eye." Are you saying that the oldest legal code in the western tradition is irrational? Are you saying that the Bible is irrational?
Well, maybe they are. But, if they are, then these terrorists are not any more irrational than the people h
Re: (Score:2)
I think this comes from the Bible (The Old Testament). Its point of origin is known as the Middle East.
I don't know about western traditions - the Gauls or others
Re: (Score:2)
The people didn't "allow" themselves to victimized. They went in with the expectation that this would be like any other hijacking up to that time.
And let them selves be a victim of it because they figured it would be over soon. In other words, they failed to take action because they believed no action was necessary.. but if they had always taken action then no hijackings, ever, would have occurred because hijackers would have known that airline passengers are not willing to be victims. As it is now, airline passengers are willing to be victimized before they even get on the plane!
Re: (Score:3, Informative)
I think this comes from the Bible (The Old Testament). Its point of origin is known as the Middle East.
I don't know about western traditions - the Gauls or others
Egh. I was feeling lazy, but here is the Wikipedia page [wikipedia.org] about it. While most people may know it first from the Bible, I think it's the Codex Hammurabi that's often credited for having that written down first.
I am not a lawyer or a law student (so whatever I speak of "tradition of legal code" would be out of my arse), but this is the first written code of law to the west of China (and that's what I mean by "western"; like it or not, the Middle "East" and Muslims had frequent interaction with Europe, at leas
Go *fish! (Score:3, Informative)
And Blowfish [wikipedia.org] is still unbroken after 15 years.
I should be such a crappy cryptographer!
Re: (Score:2)
love this line... (Score:3, Funny)
CCTV - Worth its weight in gold (Score:5, Interesting)
Re: (Score:3, Funny)
These guys would NEVER have been convicted without CCTV.
Absolute PROOF that CCTV works.
Re: (Score:2)
Re:CCTV - Worth its weight in gold (Score:4, Interesting)
Burglars choose easy targets. CCTV and alarms make the target more difficult so most move on. Experienced thieves require more then just a sign to keep them away but still, they are for the most part looking for the easy target.
Terrorism is not a crime of opportunity. You can make the target appear as difficult as you want, all that does is make them plan a little more. The stupid restrictions at the airport do nothing to deter terrorists.
Parent
Re: (Score:2)
Re:CCTV - Worth its weight in gold (Score:5, Interesting)
Just the rumor that we were putting a camera system in our school practically eliminated graffiti
vandalism in a vulnerable area. The vandalism then took other forms, which were actually more of a problem.
Parent
Re: (Score:2)
Schnier's List (Score:4, Funny)
Re: (Score:2)
Sacred Cows? (Score:2)
Around here, they're more like whipping boys. Now, if he'd started in on Linux security...
Re: (Score:2)
Well yes, kinda difficult to think of any forum where this type of presentation would be considered 'risky material'. But that does not stop it being any less true or needing to be said.
I do wish that Bruce would choose his targets a bit more carefully though. He has a tendency to come out with sweeping statements that sound good but don't mean quite what he intends them to mean.
Electronic Voting Security Theater (Score:5, Interesting)
To be secure it would have to be open. In the case of voting platforms that means every line of code, every encryption algorithm, and all the hardware has to be open, published, and known. Nobody has yet figured out how to make enough money from such a system to outspend Diebold's lobbyists and earn considered from election officials.
Re: (Score:3, Interesting)
Re: (Score:2)
Show us a modern closed encryption algorithm which does not have significant vulnerabilities. Off the top of my head I am not aware of one. However, there are plenty of examples of closed algorithms which are abject failures. Like what's used on DVDs, HD-DVDs, or Phillips' RFID tags. There
Re: (Score:2)
We nerds and geeks need to wake up to theater (Score:5, Interesting)
Take Linux for instance. I have had varying levels of success getting non-geeks to use it, but what is missing is the warm and fuzzies that make it psychologically comfortable to not be using Windows or a Macintosh.
There are two sides to change of any kind. (1) The actual details of change. (2) The psychological affirmation that it is worth the effort. No matter how valid the argument presented by the first, if it does not provide the second, it will fail.
If we wish to push Linux, we have to create theater around it.
Re: (Score:2)
Re: (Score:2)
Take Linux for instance.
Don't you mean GNU/Linux? There is already a "theater" fo GNU/Linux: Freedom. We are not just fighting for technical superiority, we are fighting for the freedom of the people—just like a secure e-voting machine would, by the way of allowing fair and efficient election to be held.
Why would you go looking for a "theater", when you have such a ready-made cause (one that's been around for over two decades, no less!) for you? All you have to do is join.
Re: (Score:2)
Yes, I used to have that attitude, but in the past few years, I have sort of changed my mind. When you think that half the people you meet are below average intelligence.
Time and again, I've seen people too afraid or too unenthusiastic to use or stay with Linux. I've told them the arguments, they all say they agree, they all say they hate Windows, but they go back because they are comfortable with it. That's what "Cheerleaders" a
Re: (Score:3, Interesting)
A colleague of mine has something called "Comodo" on some kind of paranoid mode on his computer, and whenever I use his computer (we share it because in addition to being his office computer, it's also used for some common task), it's annoying. I think I usually see something around 1 popup a minute, like "pidgin.exe is writing to XXX", allow or deny? "blah.com attempted to connect to xxx.xx
Re: (Score:3, Insightful)
The Reality and Perception of Security (Score:4, Insightful)
It's Still Dumb! (Score:3, Interesting)
I will take the reality over a false perception, any day.
Ah...NOW I get it! (Score:3, Insightful)
I guess this would explain why just about everybody in Canada thinks crime is on the increase, even though the numbers conclusively prove otherwise.
You can't sell security hardware and convince nervous old women to throw away their rights if they know there's a long list of things more important than so-called "security". And a lot of those "nervous old women", by the way, are male, in their 30's, and convinced that everything will be fine if we just forget all that due process nonsense and start trusting the cops to throw the right people in jail.
Re: (Score:2, Interesting)
I guess this would explain why just about everybody in Canada thinks crime is on the increase, even though the numbers conclusively prove otherwise.
You can't sell security hardware and convince nervous old women to throw away their rights if they know there's a long list of things more important than so-called "security".
I often think about the political impact of the population ageing in Europe (where I live). There is a lot of political analysis about everything but never around the fact that, well, the population is getting on average older, and that older people tend to have a more conservative take on life, and IMO are easier to be made afraid of "different new stuff" (like having more non-Caucasians and/or Muslims living in their society).
The other day I read about strong xenophobic language being used by politici
Re: (Score:2)
RFIDs have bugger all to do with security, but plenty of people are trying to push the perception that they can. Read this alarmist article [upi.com]. Check out its opening sentence:
Lucky all terrorists are RFID-tagged!
Re: (Score:2)
Might not do those RFID tags much good, either.
Re: (Score:3, Insightful)
It's all about your frame of reference.
I think of these things as kind of like an electric heater. Most people would argue that an electric heater is one of the most inefficient devices known
Re: (Score:2)
Put it this way: an electric heater is basically designed to waste power by transducing electrical energy into heat and spewing it into the immediate environment. A heater does this with virtually no losses.
Have you heard of Heat pumps [wikipedia.org]? These things can put actually more heat into a house than the amount of electrical (anything other than thermal) energy spent.
This is one of the reasons that one shouldn't use the word "efficiency" with any device that actually turns work into heat. The best thing to an accurately representative "efficiency" would be the ratio of heat output per work, with that of Carnot heat pump at the top and that of electric heater at the bottom.
On the topic of the thread though, I do agre
Re: (Score:2)
I'm trying, but I can't imagine what might qualify as "waste" when all energy output is by definition the desired output. What are the things that you're thinking of that lead you to insert "virtually" and "almost" into the above?
Re: (Score:2)
Someone has to do it (Score:3, Insightful)
And the problem with this is what? Given how badly people misunderstand computer security we don't have enough people doing this kind of job.