Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security The Internet

Current Crypto Trends with Bruce Schneier 196

Posted by Zonk from the my-password-is-***** dept.
Saint Aardvark writes "SecurityFocus has published an interview with Bruce Schneier. Fascinating stuff, especially the level-headed assessments of the NSA, spam and the impact of full disclosure: 'Q: Since most crypto protocols on the internet, such as SSL or SSH, uses public-keys to build a secure channel, wouldn't a unexpected public disclosure create a chaos on the internet ? A: No. Chaos is hard to create, even on the Internet. Here's an example. Go to Amazon.com. Buy a book without using SSL. Watch the total lack of chaos.'"
This discussion has been archived. No new comments can be posted.

Current Crypto Trends with Bruce Schneier More

Current Crypto Trends with Bruce Schneier

Comments Filter:

  • Article text, ROT13'd for the paranoid (Score:5, Funny)

    by Anonymous Coward on Tuesday May 10, 2005 @05:57PM (#12493066)
    Pbhyq lbh vagebqhpr lbhefrys ?

    V'z n frphevgl grpuabybtvfg. Zl pnerre unf orra n frevrf bs trarenyvmngvbaf. V fgnegrq jbexvat va pelcgbtencul: zngurzngvpny frphevgl. Gura V ernyvmrq gung nyy gur pelcgbtencul va gur jbeyq jba'g uryc vs gur pbzchgre vf vafrpher, naq nyy gur pbzchgre frphevgl jba'g uryc vs gur argjbex vf vafrpher. Fvapr gura, V unir orra pbapragengvat zber ba gur fbpvny naq rpbabzvp nfcrpgf bs frphevgl, ernyvmvat gung nyy gur grpuabybtl va gur jbeyq jba'g uryc vs gubfr nera'g qbar evtug.

    Zber ba zl onpxtebhaq pna or sbhaq ba fpuarvre.pbz

    AFN yvprafrq Pregvpbz'f RP cngragf sbe $25 zvyyvba ynfg lrne, naq erpragyl naabhaprq gur arj HF tbireazrag fgnaqneq sbe xrl nterrzrag naq qvtvgny fvtangherf, pnyyrq Fhvgr O. Vg hfrf Ryyvcgvp Pheir Qvssvr-Uryyzna (RPQU) naq Ryyvcgvp Pheir Zrarmrf-Dh-Inafgbar (RPZDI) sbe xrl nterrzrag, naq Ryyvcgvp Pheir Qvtvgny Fvtangher Nytbevguz (RPQFN) sbe fvtangher trarengvba/irevsvpngvba. Qb lbh guvax gung AFN vf cebzbgvat RPP onfrq pelcgb orpnhfr gurl pnaabg penpx EFN/QFN onfrq bar ?

    V qb abg. V oryvrir gur AFN oryvrirf gung RPP vf fgebat. V jebgr nobhg RPP urer:
    uggc://jjj.fpuarvre.pbz/pelcgb-tenz-9911.ug zy#Ryyv cgvpPheirChoyvp-XrlPelcgbtencul

    Nygubhtu V jebgr gung va 1999, V nz fgvyy fxrcgvpny nobhg ryyvcgvp pheirf.

    Be znlor whfg orpnhfr gurl pna penpx EFN/QFN gurl cersre gb cebgrpg HFohfvarff jvgu RPP (fhccbfrq gb or uneqre gb penpx)?

    Jvgu fhssvpvrag xrl yratguf, nyy bs guvf vf hapenpxnoyr. V qba'g oryvrir gung gur AFN unf nal frperg zngurzngvpf gung gurl hfr gb oernx EFN/QFN be RPP.

    Jbhyq n dhnaghz pbzchgre qb gur wbo ?

    Va gurbel, lrf. Va cenpgvpr, jr unir ab vqrn ubj gb ohvyq bar gb qb vg. Znlor va svsgl lrnef. Be gjragl-svir.

    Fbzr gvzr ntb lbh pb-nhguberq n cncre ba fbsgjner zbabcbyl evfxf. Jung nobhg pelcgb zbabcbyl? Qba'g lbh guvax gung univat whfg n pbhcyr bs choyvp-xrl nytbevguzf onfrq ba gur fnzr zngu ceboyrz pbhyq yrnq gb n pngnfgebcur vs penpxrq ?

    Gur frphevgl nqinagntrf bs n pbzzba pelcgbtencuvp nytbevguz sne bhgjrvtu gur qvfnqinagntrf. V'ir jevggra nobhg gung nf jryy:

    uggc://jjj.fpuarvre.pbz/pelcgb-tenz-9904.ugzy#qv ss rerag.

    Jung jbhyq lbh qb vs lbh sbhaq n fbyhgvba gb gur snpgbevmngvba ceboyrz?

    Nal pelcgbtencure, vs gurl sbhaq fbzrguvat fb fvtavsvpnag nf n fbyhgvba bs gur snpgbevmngvba, jbhyq choyvfu gurve erfhygf. Fhpu n qvfpbirel jbhyq yvxryl erfhyg va cebsbhaq punatrf va ubj jr ivrj ahzore gurbel, naq jbhyq or gur zngurzngvpny qvfpbirel bs gur qrpnqr...naq znlor rira zber vzcbegnag.

    Fvapr zbfg pelcgb cebgbpbyf ba gur vagrearg, fhpu nf FFY be FFU, hfrf choyvp-xrlf gb ohvyq n frpher punaary, jbhyqa'g n harkcrpgrq choyvp qvfpybfher perngr n punbf ba gur vagrearg ?

    Ab. Punbf vf uneq gb perngr, rira ba gur Vagrearg.

    Urer'f na rknzcyr. Tb gb Nznmba.pbz. Ohl n obbx jvgubhg hfvat FFY. Jngpu gur gbgny ynpx bs punbf.

    Va gur frphevgl pbzzhavgl gurer ner inevbhf jnlf bs guvaxvat nobhg ihyarenovyvgvrf qvfpybfher (choyvp-, shyy-, erfcbafvoyr-, ab-). Jung vf gur fvghngvba va gur pelcgb pbzzhavgl ? Jung glcr bs qvfpybfher cebprff vf gurer ?

    Zbfg frphevgl cebsrffvbanyf oryvrir va shyy qvfpybfher, naq pelcgbtencuref ner ab rkprcgvba. Gur nqinaprzrag bs gur fpvrapr vf orfg freirq ol gur serr rkpunatr bs vqrnf.

    Jul vf bsgra hfrq n zbarl-erjneqrq punyyratr gb irevsl n pelcgb nytbevguz?

    Orpnhfr vg'f serr pbafhygvat jbex, naq zbarl vf na nggrzcg gb nqq fbzr svanapvny vapragvir. Zbfg bs gur gvzr vg'f n funz. Juvyr gurer ner fbzr yrtvgvzngr pbagrfgf, zbfg ner whfg nggrzcgf gb tnva choyvpvgl.

    Erpragyl fbzr cncref nqqerffvat unfu shapgvbaf jrer choyvfurq, naq lbh fhttrfgrq ba lbhe oybt gung vg'f gvzr gb trg gb jbex ercynpvat FUN. Lbh jebgr: "Gur AVFG nyernql unf fgnaqneqf sbe ybatre -- naq uneqre gb oernx -- unfu shapgvbaf: FUN-224, FUN-256, FUN-384, naq FUN-512. Gurl'er nyernql tbireazrag fgnaqneqf, naq pna nyernql or hfrq. Guvf vf n tbbq fgbctnc, ohg V'q yvxr gb frr zber." Jul q
    • Am I the only person out there who really likes the character frequency of ROT13'd english text?

      mmmm, the letter V.....

      --
      lds
    • In case, the article is /.ed ROT13 the encrypted text to get back the article :)
      ROT13 en/decoder [rot13.com]

    • Re:Article text, ROT13'd for the paranoid (Score:4, Funny)

      by wpiman ( 739077 ) * on Tuesday May 10, 2005 @06:19PM (#12493261)
      I decrypted it- it says "remember to drink your oOovaltine".

      Man- what a letdown.

    • Re:Article text, ROT13'd for the paranoid (Score:5, Funny)

      by Sonicated ( 515345 ) on Tuesday May 10, 2005 @06:38PM (#12493399)

      You think thats secure? For the ultra paranoid I've encrypted it into ROT26:

      Could you introduce yourself ?

      I'm a security technologist. My career has been a series of generalizations. I started working in cryptography: mathematical security. Then I realized that all the cryptography in the world won't help if the computer is insecure, and all the computer security won't help if the network is insecure. Since then, I have been concentrating more on the social and economic aspects of security, realizing that all the technology in the world won't help if those aren't done right.

      More on my background can be found on schneier.com

      NSA licensed Certicom's EC patents for $25 million last year, and recently announced the new US government standard for key agreement and digital signatures, called Suite B. It uses Elliptic Curve Diffie-Hellman (ECDH) and Elliptic Curve Menezes-Qu-Vanstone (ECMQV) for key agreement, and Elliptic Curve Digital Signature Algorithm (ECDSA) for signature generation/verification. Do you think that NSA is promoting ECC based crypto because they cannot crack RSA/DSA based one ?

      I do not. I believe the NSA believes that ECC is strong. I wrote about ECC here:
      http://www.schneier.com/crypto-gram-9911.html#Elli pticCurvePublic-KeyCryptography [schneier.com]

      Although I wrote that in 1999, I am still skeptical about elliptic curves.

      Or maybe just because they can crack RSA/DSA they prefer to protect USbusiness with ECC (supposed to be harder to crack)?

      With sufficient key lengths, all of this is uncrackable. I don't believe that the NSA has any secret mathematics that they use to break RSA/DSA or ECC.

      Would a quantum computer do the job ?

      In theory, yes. In practice, we have no idea how to build one to do it. Maybe in fifty years. Or twenty-five.

      Some time ago you co-authored a paper on software monopoly risks. What about crypto monopoly? Don't you think that having just a couple of public-key algorithms based on the same math problem could lead to a catastrophe if cracked ?

      The security advantages of a common cryptographic algorithm far outweigh the disadvantages. I've written about that as well:

      http://www.schneier.com/crypto-gram-9904.html#diff erent [schneier.com].

      What would you do if you found a solution to the factorization problem?

      Any cryptographer, if they found something so significant as a solution of the factorization, would publish their results. Such a discovery would likely result in profound changes in how we view number theory, and would be the mathematical discovery of the decade...and maybe even more important.

      Since most crypto protocols on the internet, such as SSL or SSH, uses public-keys to build a secure channel, wouldn't a unexpected public disclosure create a chaos on the internet ?

      No. Chaos is hard to create, even on the Internet.

      Here's an example. Go to Amazon.com. Buy a book without using SSL. Watch the total lack of chaos.

      In the security community there are various ways of thinking about vulnerabilities disclosure (public-, full-, responsible-, no-). What is the situation in the crypto community ? What type of disclosure process is there ?

      Most security professionals believe in full disclosure, and cryptographers are no exception. The advancement of the science is best served by the free exchange of ideas.

      Why is often used a money-rewarded challenge to verify a crypto algorithm?

      Because it's free consulting work, and money is an attempt to add some financial incentive. Most of the time it's a sham. While there are some legitimate contests, most are just attempts to gain publicity.

      Recently some papers addressing hash functions were published, and you suggested on your blog that it's time to get to work r

      • provable crypto (Score:3, Interesting)

        by 0ptix ( 649734 )
        in the last 25 years there has been another development in cryptography which bruce has seemingly left. namely the formal what is often refered to as provable cryptography. i.e. the proccess:
        1) Formaly defining both the working model (network, involved parties, computational & other capbabilities...)
        2) Defining the variouse forms of security to be achieved. (For example a protocol must be secure if run once, many times in a sequential manour or even in a concurrently manour. Each is a different

    • Re:Article text, ROT13 for the paranoid (Score:5, Informative)

      by Dark Coder ( 66759 ) on Tuesday May 10, 2005 @06:40PM (#12493423)
      For the uninitiated... ROT13 encoder/decoder is available as a FireFox plugin over at MNenhy [mozdev.org]

  • Interesting interview... (Score:5, Insightful)

    by nacturation ( 646836 ) <nacturation AT gmail DOT com> on Tuesday May 10, 2005 @05:58PM (#12493076) Journal
    Is it just me, or does the interview read mostly like "Stop asking me dumb questions"?
  • Oh crap, the article must be encrypted!

  • within (Score:4, Funny)

    by JustOK ( 667959 ) on Tuesday May 10, 2005 @06:00PM (#12493098) Journal
    even within chaos, there may appear to be order...in fact, I think I'll order another beer.

  • Whoops! (Score:5, Informative)

    by Saint Aardvark ( 159009 ) * on Tuesday May 10, 2005 @06:02PM (#12493113) Homepage Journal
    OP here -- that link to Schneier's blog should be:

    http://www.schneier.com/blog [schneier.com]

    Sorry about that!

  • Wrong URL (Score:5, Informative)

    by eyegor ( 148503 ) on Tuesday May 10, 2005 @06:02PM (#12493116)
    It's http://www.schneier.com/ [schneier.com]

  • Nothing constructive from Schnier anymore (Score:4, Interesting)

    by Ars-Fartsica ( 166957 ) on Tuesday May 10, 2005 @06:03PM (#12493126)
    Every posting in his cryptogram seems to be telling me the same thing - nothing anyone is doing is actually secure, and no currently proposed measures are going to help. So basically he's telling me to live in a shack in the woods like the Unabomber if I want security. Also he seems to be drifting more and more into political banter...and I don't consider him to be any more informed that the next blogger.
    • I stopped reading the monthly cryptograms a while ago. I think BS is becoming a victim of his own pseudo-popularity. He still makes some valid points though, but its mostly reiteration of earlier things he said about peer review/disclosure, snake oil salesman, and the like.

      Then part of me wonders if maybe he just doesn't care anymore and is sick and tired of people asking the same questions. Its gotta be tiring having to answer the same series of policy questions over and over again, especially when, as
      • nothing is ever going to be 100% secure

        But everyone already knows that, hell, in the end you can just torture people to get the passphrase/keycard or whatever dodad is being used to create the secure loop. Whats missing is some information on what can be practically done to create adequate security, to which I hardly ever hear BS refer.

      • Then part of me wonders if maybe he just doesn't care anymore and is sick and tired of people asking the same questions. Its gotta be tiring having to answer the same series of policy questions over and over again...

        Having read his last book (Beyond Fear [slashdot.org]), I can't imaging that BS has any difficulting repeating the same thing over-and-over-again (Maybe it's different when he's being paid by the word ;^).

    • Re:Nothing constructive from Schnier anymore (Score:5, Informative)

      by snorklewacker ( 836663 ) on Tuesday May 10, 2005 @07:05PM (#12493648)
      > So basically he's telling me to live in a shack in the woods like the Unabomber if I want security.

      Go read "Beyond Fear". That's precisely the opposite of what he's saying. He's saying security is not a binary all-or-nothing thing, and that for the vast majority of people, there really is such a thing as "secure enough". Not that the current state of the art is anywhere close to that, but that it's not some platonic ideal, it's in fact quite reachable now.
    • For decades, in some cases centuries, there have been known bad and good approaches to security and still people violate evidence and common sense on security.

      Security professionals know there are certain basic ideas to apply towards security. If they consult, they apply the same basic lessons again and again to several people and often repeat themselves to repeat customers. If the work as a security profession in one organization, they repeat the same thing for their whole career.

      The good thing about S

    • You want security?

      Read up on ninjutsu. They had the philosophy down pat in Japan eight hundred years ago.

    • nothing anyone is doing is actually secure,

      Which is very obviously true.

      and no currently proposed measures are going to help.

      This however is not true, and Schneier hasn't said it that I've seen.

      He *has* said that a large fraction of the "security measures" introduced by various firms these days are useless or worse.

      He has also said (numerous times) that the correct question is not: "How can we become secure?" but instead: "How can we bring the risks down to an acceptable level ?"

      Driving a

  • Please stop abusing the English language (Score:5, Insightful)

    by lelitsch ( 31136 ) on Tuesday May 10, 2005 @06:10PM (#12493187)
    I am certainly no grammar Nazi--actually, English is my third language, so I am far from perfect. But for the love of God, could the people at Security Focus please try to do some rudimentary editing and proofreading? I don't mind typos, but some of their questions are so wrong that they are very hard to read and understand.

    "Do you think that NSA is promoting ECC based crypto because they cannot crack RSA/DSA based one?"

    What?

    "Or maybe just because they can crack RSA/DSA they prefer to protect USbusiness with ECC (supposed to be harder to crack)?"

    Huh?

    "What about crypto monopoly? Don't you think that having just a couple of public-key algorithms based on the same math problem could lead to a catastrophe if cracked ?"

    This doesn't follow any European-language grammar.

    But the next question takes the cake:

    "Why is often used a money-rewarded challenge to verify a crypto algorithm?"

    • parent poster writes:
      "Don't you think that having just a couple of public-key algorithms based on the same math problem could lead to a catastrophe if cracked?"

      This doesn't follow any European-language grammar.

      But the next question takes the cake: "Why is often used a money-rewarded challenge to verify a crypto algorithm?"

      The last quote has got to be German via Babelfish.

      --Pat

    • But the next question takes the cake:

      "Why is often used a money-rewarded challenge to verify a crypto algorithm?"
      Just because somebody is dyslexic doesn't mean fun should you make of their grammar.

    • Re:Please stop abusing the English language (Score:5, Funny)

      by gnuman99 ( 746007 ) on Tuesday May 10, 2005 @06:24PM (#12493306)
      But the next question takes the cake:
      "Why is often used a money-rewarded challenge to verify a crypto algorithm?"

      Yeah, but can the ate it too?

    • how about

      "Shouldn't be better looking for what is known as a good thing, and block all the rest without analyzing it? "

    • "Or maybe just because they can crack RSA/DSA they prefer to protect USbusiness with ECC (supposed to be harder to crack)?" I never understood parentheses within quotes. Did he whisper that part, or are we talking about an interview on an IRC channel? I've once tried to read a book that was filled with parentheses within quotes. Those books should be ritually burned.

    • "What about crypto monopoly? Don't you think that having just a couple of public-key algorithms based on the same math problem could lead to a catastrophe if cracked ?"

      This doesn't follow any European-language grammar.

      Huh? Those two sentences make perfect sense to me, and neither of them break any rules of English grammar (or even any rules of English style that I can think of). What do you think is wrong with them?

  • Good interview, better links (Score:5, Interesting)

    by podperson ( 592944 ) on Tuesday May 10, 2005 @06:13PM (#12493214) Homepage
    I thoroughly recommend reading the linked articles. Some fascinating stuff (e.g. on why elliptic curve crypography is current considered secure and why this may not last).
    • There's something he doesn't mention there though. Elliptic curve algorithms have been proven to be fully exponential with key length if the underlying problem is - something that isn't the case for RSA or DH. (in fact factorisation is definately not exponential) This makes me trust them a bit more.

  • bad example (Score:5, Interesting)

    by markov_chain ( 202465 ) on Tuesday May 10, 2005 @06:14PM (#12493228)
    Go to Amazon.com. Buy a book without using SSL. Watch the total lack of chaos.
    Right, but since SSL is not known to be broken, nobody is really trying to exploit the Amazon channel. Let's see him buy that book after an SSL disclosure is made.

    • Re:bad example (Score:3, Insightful)

      by lukewarmfusion ( 726141 )
      I read a couple of his SSL articles and understand where he's coming from. But I don't agree with the mentality that "it's not perfect, so why bother" that he seems to have.

      WEP and SSL aren't perfect - but that doesn't mean you shouldn't use them. Some degress of "chaos" would result if you stopped altogether. Just head on down to Panera, the library, or a college campus and pick up all the email accounts, credit cards, etc. that you desire.
      • Security is all about the Threat Model, and depending on that model, "don't worry about it" is a perfectly valid response.

        Over all, I don't think he's got a "why bother" attitude, or else why would he be trying so hard to educate people on reasonable, effective security?

        An interesting read from one of his essays:


        Threat models

        A good design starts with a threat model: what the system is designed to protect, from whom, and for how long. The threat model must take the entire system into account--not just

    • Re:bad example (Score:3, Interesting)

      by swillden ( 191260 ) *

      Let's see him buy that book after an SSL disclosure is made.

      Wouldn't change much. Even if you assume that SSL was so badly broken that there was no difference between using SSL and just sending everything in plaintext (very unlikely -- it's much more likely that decrypting an SSL link would still take some non-trivial amount of computation), Amazon.com probably woudn't even bother to remove the option of using SSL.

      If Amazon did remove SSL entirely (to save CPU time?), people would still buy books fr

      • Well it depends on how we define chaos. In his particular example he is not afraid of buying a book without SSL. Now if SSL is broken, sure, maybe it won't be the end of the world, but if he is suddenly unwilling to buy the same book then his example has a problem. The issue is not so much about the cryptographic security of the connection as much as the rate of attacks.

    • Re:bad example (Score:5, Insightful)

      by JoeBuck ( 7947 ) on Tuesday May 10, 2005 @08:24PM (#12494270) Homepage
      You think that Internet commerce will break down if someone can sniff your credit card number. But then, when you go to a restaurant, you hand over your physical credit card to some waiter you don't know from Adam.
      • > But then, when you go to a restaurant, you hand over your physical credit card to some waiter you don't know from Adam.

        Yes, and I'm pretty sure I've heard of that being exploited by naughty waiters, too. This is why I never let the card go out of my sight, and it's also why I favour a nice strong crypto connection to websites whilst shopping.

      • You think that Internet commerce will break down if someone can sniff your credit card number. But then, when you go to a restaurant, you hand over your physical credit card to some waiter you don't know from Adam.

        This analogy is horribly flawed in both the attack vector and the viability of attack.

        When you go to a restaurant and hand your credit card to the waiter, the waiter swipes your card and returns it to you. There is the opportunity for the waiter himself, and potentially one or two other people

  • AA Roadwarrior Bruce Schneier article (Score:5, Funny)

    by bazonkers ( 744424 ) on Tuesday May 10, 2005 @06:16PM (#12493242)
    Somewhat unrelated to the above, but saw this article Bruce wrote for American Airlines magazine when he won 3rd place in the annual Road Warriors competetion. He's a pretty funny guy. I had no idea. My apologies to AA for pasting the below but it's prob better than having your webserver taken out back and shot.

    "Bruce Schneier
    Minneapolis, Minnesota

    I had a free day on a business trip to Seoul, so I decided to do a bit of sightseeing. Yoseu, a random town at the end of a train line, seemed as good a place as any to explore, so I bought a round-trip ticket.

    The market was still crowded even though it was dusk by the time my train arrived. I stopped in front of what looked to be a restaurant. On the floor in front of the store were water-filled pails with things inside. I recognized squid in one, oysters in another, and clams in a third. There were three others: orange bulbous things with puckers, long brown things with puckers, and long smooth white things that half floated and half sank. I assumed they were all alive.

    The woman who sat behind this menagerie looked up at me. I pointed to the orange things, pointed to the brown things, pointed at the tables inside of the store, and smiled.
    She smiled back, got up, and walked into the restaurant. I followed her.

    There were four long tables, all empty. I sat down at the far table. The woman brought three orange things and three brown things and proceeded to clean them. She set two bowls of water out in front of her: a green one and a white one. She cut open the orange things and put the orange insides in the green bowl, and the orange outsides in the white bowl. Then she cut open the brown things and put the brown outsides in the green bowl with the orange insides, and the brown insides in the white bowl with the orange outsides. I didn't have the foggiest idea which bowl was for eating and which was for throwing away.

    After she was finished, she started cutting up the orange insides and the brown outsides. All I could think at this point was: Please cook this. Whatever you do, please cook this. Then I noticed that there wasn't a stove anywhere.

    She put the orange and brown things on a plate and set it in front of me. Then she gave me a bowl of hot sauce, a bowl of kimchi, and a cup of cold tea.

    I looked at my plate. I didn't even know what phylum the stuff came from.

    She then presented something to me with a flourish and a big smile. It was a fork. Well, I had to take it. I really didn't want it, but she'd probably had this fork for years, it was probably her only one, and I was probably the first American brave enough to eat there. I couldn't spoil it for her.

    I took the fork and stabbed a brown thing. She was watching me as I put it in my mouth. It was chewy, but it tasted pretty good. I tried an orange thing. It wasn't as good. I smiled at her. She smiled back and went outside.

    She poked her head in from time to time. Once she brought a friend. She told her something in Korean. Probably something like: "Look at that. I gave him the orange insides and the brown outsides, and he doesn't even know the difference."

    I just smiled. What else could I do?

    Chief Technical Officer, Counterpane Internet Security, Inc.
    Age: 41"

  • He didn't answer the question (Score:5, Interesting)

    by ChipMonk ( 711367 ) on Tuesday May 10, 2005 @06:22PM (#12493290) Journal
    Q: Since most crypto protocols on the internet, such as SSL or SSH, uses public-keys to build a secure channel, wouldn't a unexpected public disclosure create a chaos on the internet ? A: No. Chaos is hard to create, even on the Internet. Here's an example. Go to Amazon.com. Buy a book without using SSL. Watch the total lack of chaos.

    [Emphasis mine.]

    How is that an unexpected public disclosure? With that example, he alters the conditions of the experiment, just like opening Schroedinger's box.

    If 5,000 people went to Amazon.com and bought something with the expectation that the connection was via SSL, and it turns out it wasn't, the smarter of those 5,000 people would be closing their credit card accounts and their Amazon.com accounts, and demanding restitution from Jeff Bezos for their compromised personal information. Amazon.com would fight them tooth and nail.

    Now, tell me that isn't chaos.

    With such a pronouncement "from on high" like that, my respect for Mr. Schneier took a serious hit.

    • Re:He didn't answer the question (Score:5, Insightful)

      by Spiked_Three ( 626260 ) on Tuesday May 10, 2005 @07:07PM (#12493662)
      Not true. I send my credit card through un-encrypted email all the time. People on the receiving end freak out and go into panic. Guess what? Never had a bit of trouble.
      I hate to say it, but most of the people running around crying 'the secure sky is falling' are clueless (vast majority) or are trying to make money from it (Schneier et al.)
      Crypto is part of a total solution. And as is always the case, the weakest link determines the overall strength. You can have the best military encryption on the planet, and if you write your password on a sticky note and tack it to the bottom of your keyboard the encryption doesnt do dick. There are far too many weak points on the internet, for someone who knows what is really going on, to get very excited about encryption.
      How many of the thousands of ID thefts that occurred recently (Bank of America) were originated on a secure (SSL?) link? Answer: probably all of them. See? SSL isn't really all that helpful. Its one of those markets that was created to make money, and the vast majority of the public believe they are buying value.
      While I generally take everything Scnierer says with a grain of salt (because I know he says what someone pays him to say) I'd have to agree with him on this one. No panic, no chaos, no big deal.

      • Not true. I send my credit card through un-encrypted email all the time. People on the receiving end freak out and go into panic. Guess what? Never had a bit of trouble.

        That's an interesting take. For the sake of putting one's money where one's mouth is, would you mind repeating all relevant data (name, card type, number, expiration date, security code) here?

        Assuming you won't, why is that? And why doesn't that apply to the e-mail scenario you provide?

        Thank you.

      • ... I generally take everything Scnierer says with a grain of salt (because I know he says what someone pays him to say) ...

        Interesting. What do you base that on?

        The rest of your post makes a lot of sense, so I'm taking the chance that I'm being trolled here...

      • Bad idea.

        Try running your own mail server some time. You'll notice that all the ones that are currently in use pretty much include their own little programming language. Besides simply reading the mail spool, or sniffing the wire, the server itself could be set up to report anything that looks like a card number.

        So, you haven't had any problems yet. That can mean several things. Perhaps nobody is sniffing your current link, or they missed your data, or they got it but didn't use it, or they made a small c
    • I've sent a credit card number unencypted over the Internet and - nothing bad happened!

      It's just a matter of probability - if you have a 1 in 1000000000000000 chance of having a number stolen because of a problem with SSL, you probably have a 1 in 1000000000 chance of having THE packet with your credit card number stolen in transit because some baddie is snooping on the connection.

      Of course, once your CC number arrives on the destination server, whether it arrives via SSL or plain-text HTTP, it is logged

    • the smarter of those 5,000 people would be closing their credit card accounts and their Amazon.com accounts, and demanding restitution from Jeff Bezos for their compromised personal information.

      Actually, the smarter of those 5,000 people would do absolutely nothing, knowing that the odds of their information being compromised in transit are negligible (more likely to be stolen by a waiter), and further that the effect on them of having their credit card number stolen, if it were to happen, is likewise n

  • Uncrackable? (Score:3, Insightful)

    by hoka ( 880785 ) on Tuesday May 10, 2005 @06:37PM (#12493391)
    Puh-leaze. While in a reasonable amount of time he is contextually correct, "uncrackable" indicates that there is no way of cracking the code, which isn't true. These things can all be brute forced, even though it might take a really, really long time to crack.
    • How about a key whose brute-forcing time is comparable to the age of the universe (assuming all existing computers would work on it) ?

      This is actually doable with todays' algorithms, with reasonably large keys. Sure, it won't be realtime, but still ...

    • Re:Uncrackable? (Score:3, Insightful)

      by Jack9 ( 11421 )
      And a door that is shut but isn't airtight, is technically still open? Do you actually think that was insightful?

      Ex: Election data encrypted and transmitted. You intercept it. If you the quickest you can decrypt, alter, re-encrypt and resend it, is 100 years after that election is concluded, how is it different from the algorithm being "uncrackable"?

      I dont apply a time constraint to the usefulness algorithm alone, when thinking about security, I also have to apply it to the useful lifespan of the data. As
  • Isn't it funny how the people who really know security are rarely seen making doom and gloom predictions about the end of society as we know it? Most times I see a real security wizard speaking either at a conference or in an interview, they're pragmatic and reasoned in their answers to questions, even stupid ones. Why is it that the people in the best position to know about the security or insecurity of our networks are so calm and circumspect and the remainder of the industry seems hell bent of FUD?
    • Why is it that the people in the best position to know about the security or insecurity of our networks are so calm and circumspect and the remainder of the industry seems hell bent of FUD?

      Because real security experts don't need to get people to panic to sell their security expertise. Marketing people who sell security products, OTOH, need to sell as much as possible.

  • It's not a paradox... (Score:5, Funny)

    by ramam ( 882415 ) on Tuesday May 10, 2005 @06:52PM (#12493515)
    Why is it that the more I know about a topic on slashdot the less intelligent the slashdot community seems?
  • from the my-password-is-hunter2 dept.
  • Here's an example. Go to Amazon.com. Buy a book without using SSL. Watch the total lack of chaos.

    What prevents the user from getting pissed off at not getting the book and going on a shooting rampage in an apartment complex? That, my friend, would cause a lot of chaos.

  • Doing well on the SPAM problem? (Score:5, Interesting)

    by cbreaker ( 561297 ) on Tuesday May 10, 2005 @07:10PM (#12493694) Journal
    This guy obviously doesn't run any mail servers.

    Sure, new spam filters can be pretty effective. But it takes a lot of resources to deal with spam in terms of hardware and network bandwidth. 75% of all e-mail traffic is SPAM. Millions upon millions a day.

    SPAM is a real problem and it's not getting better, it's getting worse. The better we get at blocking it the more spam gets sent to counter this.

    Some people might think that if we get good enough at blocking spam, it won't be profitable to send it anymore. I beg to differ. It costs almost nothing to send a million spams. And with all the bot-nets and hijacked mail servers, it's not hard to get them out.

    So, because of this very brushed-off response and attitude like he's an authority, I can't take any of his other responses seriously.
    • Let me rephrase you statement:

      "Dear Mr. Schneider, just because you don't see the 500 people working in front of your house trying hard to secure the barrage doesn't mean that you have no problem with the high water levels."

      And yes, I ran a mailserver too. Changed the job. No fun there.

      His book "Secrets and Lies" though I found quite interesting and inspring. It helped me to see securitiy problems I didn't see before.

    • Re:Doing well on the SPAM problem? (Score:4, Insightful)

      by ajs ( 35943 ) <ajs.ajs@com> on Wednesday May 11, 2005 @09:06AM (#12497857) Homepage Journal
      "Sure, new spam filters can be pretty effective. But it takes a lot of resources to deal with spam in terms of hardware and network bandwidth. 75% of all e-mail traffic is SPAM. Millions upon millions a day."

      And how does this have anything to do with what Schneier said? Yes, extracting signal from noise is expensive, presents problems of diminishing returns and the cost/benefit doesn't favor an end to the problem any time soon. However, he's correct: as far as the average person is concerned, spam is a relatively solved problem.

      I heard an interesting quote recently: "any problem that can be solved by throwing money at it is not a real problem." Spam is not a real problem. It's a complication, but not a problem. Does it raise the price of business communications? Yes. Is that a problem? Not really, it just changes the economics.

      The real problem is that the people in the trenches who are the recipients of said money develop a sense that they are fighting some sort of holy war against an adversary that will one day be defeated. I have news for you: you are a machine that takes a noise source with weak signal in and produces an amplified version of the signal with some noise reduction. Noise is not evil, and signal will never be "pure".
      • Wow.

        What the fuck is the deal with you fucktards trying to make it look like everyone that has real problems to deal with is fighting a "holy war"? I am a mail administrator for a large company, and I know more about the spam problem then you.

        I mean, get off it.

        There's more to the spam problem then warding off some porn e-mail. Spam and viruses are becomming less seperated. It costs any sizable company millions of dollars to keep it away and pay for dealing with it. There's legal implications if y
        • "What the fuck is the deal with you fucktards trying to make it look like everyone that has real problems to deal with is fighting a "holy war"? I am a mail administrator for a large company, and I know more about the spam problem then you."

          I could not have asked for a more striking example of my point, thank you.

          FWIW, I'm a mail administrator too, though I've moved away from the trenches recently.

          My point is that mail adminstrators like us can lose sight of the fact that spam and email aren't seperate p

  • Well, in defense of Schneier's succinct responses (Score:5, Insightful)

    by MmmmAqua ( 613624 ) on Tuesday May 10, 2005 @07:11PM (#12493698)
    I don't think the interviewer has much knowledge about cryptography, or even security in general. I am judging solely based on the questions asked:

    I mean TCP/IP does not use crypto, while a VPN does. Do you think that in the future we'll use crypto for every type of communication?
    Which displays a fairly simplistic, and unfortunately common, grasp of security principles, which is: crypto makes things secure, and everything must be secure. The reality is that cryptography is part of a greater security process, and that not every communication *must* be secure. Do you care if someone hears you discussing the newest Family Guy episode at the office, or hears you say "Hi" to your coworkers? No. So why should you be concerned if you're transmitting SYN/ACK or a comment to Slashdot in a relatively clear manner? Secure processes should be implemented where they are needed, and nowhere else, or else security becomes a burden forcing users to find ways to circumvent it.

    Should we use crypto to stop the spam problem ?
    I hardly know where to begin. How should we use cryptography to prevent spam? There are ways and ways to reduce spam, and perhaps cryptography in the form of some type of message authentication will play a role in that or not, but this is like asking "Should we use hydrogen molecules to cure cancer?". Hydrogen molecules in what context or construct?

    I'm no cryptographer, but (call me crazy) I expect a guy writing for SecurityFocus to know more than I do. Or at least to ask questions in an intelligent manner.

    • Re:Well, in defense of Schneier's succinct respons (Score:3, Insightful)

      by Anonymous Coward
      Quoth the poster: "The reality is that cryptography is part of a greater security process, and that not every communication *must* be secure."

      Ah, but sometimes not having every communication secure can cause an insecurity in another way.

      1. The fact that some of your communications are encrypted/secured gives an observer the information that you are transmitting something secret/sensitive when that occurs. That in itself can be valuable knowledge. For example, if the Army normally sends messages unencry

    • Obviously the interviewer didn't know much about crypto. His main focus was fear mongering about the NSA and break-ins. But Schneier seems to discount quantum cryptanalysis out of hand. Doesn't he realize that quantum programs have been written already to do factoring and list searches? It's just a matter of overcoming manufacturing/quality issues with qubit design.

    • Do you care if someone hears you discussing the newest Family Guy episode at the office, or hears you say "Hi" to your coworkers? No. So why should you be concerned if you're transmitting SYN/ACK or a comment to Slashdot in a relatively clear manner?

      That depends on how paranoid you are. If most of your messages are unencrypted, then the few encrypted ones stand out. Selective encryption is like putting a big sign on the encrypted messages telling eavesdroppers that they're worth listening to. If you

  • Oblig. bash.org quote (Score:5, Funny)

    by GroeFaZ ( 850443 ) on Tuesday May 10, 2005 @07:19PM (#12493748)
    244321 [bash.org]

    Cthon98: hey, if you type in your pw, it will show as stars
    Cthon98: ********* see!
    AzureDiamond: hunter2
    AzureDiamond: doesnt look like stars to me
    Cthon98: AzureDiamond: *******
    Cthon98: thats what I see
    AzureDiamond: oh, really?
    Cthon98: Absolutely
    AzureDiamond: you can go hunter2 my hunter2-ing hunter2
    AzureDiamond: haha, does that look funny to you?
    Cthon98: lol, yes. See, when YOU type hunter2, it shows to us as *******
    AzureDiamond: thats neat, I didnt know IRC did that
    Cthon98: yep, no matter how many times you type hunter2, it will show to us as *******
    AzureDiamond: awesome!
    AzureDiamond: wait, how do you know my pw?
    Cthon98: er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
    AzureDiamond: oh, ok.
  • Has anyone got any recommendations for sites/books that take you right from beginner to advanced crypto?

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close