Bruce Schneier Talks Brain Heuristics and Security

ancientribe writes "Bruce Schneier is at it again: the security icon shares his latest research and insight on the interplay between psychology and security in this article in Dark Reading. The focus of Schneier's latest research is on brain heuristics and perceptions of security, which may be the basis for the best-selling author's next book. His goal for the topic, which he'll be presenting at the RSA Conference next week, is to focus on how people think, and feel, about security, and how neuroscience can help explain how our perception of risk doesn't always match reality."

Re:Encryption and ease of use.

[Em Adespoton]

The interesting thing about this is that I tend to at least use digital signatures now, and started for one big reason:

I have to enter my passphrase before I send something I might regret. This has been a boon to me on innumerable occasions. It means I send fewer emails than I otherwise would, but I don't tend to send anything I'll regret years down the road.

Perception

[bwthomas]

Part of the problem is with our perception of probability. We see it mathematically, but we still expect cause and effect rather than randomosity. Most users will say things like "why would someone monitor me," not realizing that there's usually no direct causal relation between who they are and interest others might have in their information, and the question is better put, "how probable is it that someone like me might be monitored."

In other words, we feel relatively safe in a crowd. We are completely visible, but because we cannot see why someone would single us out as unique, we feel obfuscated. All the while not realizing that it's more opportunity than it is causality.

This is why we feel safe sharing information on websites like myspace, or using our credit cards over insecure wireless connections, because we believe that because everyone else is engaging in this fundamentally insecure behavior, we have safety in numbers. No one will read our blog for information about our identity, no one will try to use our amazon account to buy electronics.

But they will, with a probabilistically determined frequency.

fear and power

[wall0159]

Seems to me it would be good if more people understood the ways that their gut reaction to fear is often incorrect. It would at least make it harder for politicians to manipulate the populace.

It was interesting how Schneider said "you can feel secure even if you're not" - maybe this is also known as herd-mentality..

Re:Its all in your..

[aeoo]

Ultimate security cannot be guaranteed through protection from ill will. Once ill will has formed, there is insecurity already.

The best path is to prevent ill will from forming. That is done by convincing the disenfranchised people that they are cared for.