Schneier Discusses Ethics of Crypto PR Tactics 54
vaxzilla writes "There's a really great article in Bruce Scheiner's January 15th
CRYPTO-GRAM newsletter. He questions the ethics of various security companies who use announcements of security problems to bolster the sales of their products and services. When I read about the recent articles talking about the weakness of the current web browers, I pretty much thought, "Yeah, so what?" But nCipher looks to be pushing the hype to help push their product. The article is worth reading. "
Bruce Schneier & publicity (Score:1)
BS is also the nominal head of a number of security companies (e.g. Syndata), cos they look good with him there, and it doesn't exactly not benefit him now, does it?
Not only that, but he regularly mails what seems like half the world his opinions on various things (e.g., this nCipher article) and sometimes some more interesting stuff (e.g. the attack trees, but models of attacks such as this are well known in security research anyway).
Always wonder what the writer of the article has to gain from it -- Bruce Schneier I'd say -- always publicity.
my opinions are nothing to do with my employer.
DVD Companies (Score:2)
Hmm, sounds familiar (Score:3)
The person Bruce Schneier demonstrated that stories that aren't headline-grabbing tend to get ignored, and that the best way to publish your research is to do it quietly without any reward. Bruce Schneier's Cryptogram talked of a "blatant attempt ... to get some free publicity". Huh? Why is this news? It's not the fact that we aren't all aware of advertising. That's obvious, companies have to do it. It's not the fact that Bruce Schneier was running out of things to say. That's obvious, too. It's not the news that companies that sell anti-virus solutions (that scan for competitors products) want to sell their products. We've seen dozens of these attacks in 1999. But wait ... Bruce Schneier sells a solution to the same problem that nCipher does. Okay, now I understand.
I call this kind of thing a publicity attack. It's a blatant attempt by Bruce Schneier to influence thousands of people against buying hardware crypto, and instead relying on "security professionals" to provide an "integrated and adaptive set of information security services". You don't want a secure webserver where the keys can't be compromised. You want a comprehensive assessment of your information security environment and tailored, integrated intrusion detection. It's a blatant attempt by Bruce Schneier to remind us all that he is the foremost authority on cryptography, information security and writing security bulletins (forget Fred Cohen!), and to scare e-commerce vendors into not purchasing other solutions. And people fall for this, again and again.
This kind of thing is happening more and more, and I'm getting tired of it. Here are some more examples:
* Follow the Money (Score 3) by DreamerFi basically restates Bruce Schneier's last sentence.
* Zigg asks Bruce Schneier to "preach on, brother"
* okay, I'm bored, but you get the point
Now this is not meant to be a total troll, just to remind you of what Bruce Schneier was trying to say.
And above all - never trust anybody.
---
My employer is not responsible for anything I say here.
Bruce's Allegations About Me (Score:4)
Re:PGP for furriners (slightly off-topic) (Score:2)
...phil
Food for thought (Score:3)
However, I think that the underlying threat has a measure of validity, too. Insecure memory does leave the door open to a lot of potential vulnerabilities. (Actually, IMHO, nabbing the key as it goes through is probably the least of these.)
IMHO, it's important to see where a security company is using scare tactics, but it's also important not to dismiss the tiny (sometimes infinitesimal) kernal of truth that's in there, in the process of throwing away the lies.
(Sometimes it's just so much easier to throw away everything, but if that leads you away from something important, it might be worth spending the extra time and effort.)
What was the topic again? (Score:2)
--
A few points (Score:2)
- Most people are so stupid and trusting that they self-panic at the first sign of a security breach or if someone breaks a trust. Unless you read the original press release, your experience of the event is coloured by, at least, honest mis-understanding and fear.
- Explaining tecnical things, like obscure computer security problems, to the managers that actually hold the purse strings is impossible. You have to bully and scare them into buying your product. Heck, no-one buys a security product if they feel safe.
- Why shouldn't these companies make money providing better security? Most of the ways people earn a living are borderline dishonest, or actually involve breaking the law (to just take people on the roads: truck drivers taking drugs to pull illegal hours, taxis speeding, buses changing lanes in intersections and running red lights, workmen parking illegally because they "need close access to the site", tow-trucks parking on freeways/motorways...) If all they're doing is scaring people into buying better security, then that's harmless in the grand scheme of things. Ask yourself when the last time you did something morally questionable, or even illegal, in the process of doing your work - I bet it was in the last week, probably today, and possibly in the last hour.
I think that this article has simply been a soft option to fill a slot in an e-mail newsletter who's primary purpose is to draw people (back) to a security company's web site...Media Ignorance => Hype. (Score:3)
Re:Bruce should write about himself (Score:3)
So, yeah, his ego gets stroked a bit, and he's definetly sided with his algorithms in the AES submission process, but in the end his only motivation is for pride's sake, rather than blatantly chasing the dollar signs.
Pot, meet Kettle? (Score:1)
G.
The Real Problem... (Score:3)
Let me go off on a tangent for just a sec (Score:2)
Whoa. Now you got me on rant mode. Run for your life.
<rant>
I've yet to meet a geek, nerd or hacker who is a socialist in this sense. Fervorous libertarianism seems to be the norm around here. This is good.
And before you get all "where was your beloved free market when the DoJ had to intervene to stop Microsoft?", let me say that I never, not once, advocated the DoJ's meddling with. As much as I hate what Microsoft does, at least I'm consistently radical.
</rant>
Re:Let me go off on a tangent for just a sec (Score:2)
Historical anecdotes (Score:3)
LL
Re:Bruce should write about himself (Score:1)
There is nothing wrong with being proud of your ideas and advocating them. The problem is when he uses his cryptography newsletter to advocate his own pet algorithms. Nothing wrong with that, but maybe he should be more open and mention when he's talking about products he developed.
-Nathan Whitehead
Re:A question (Score:3)
2. If it is a new vulnerability notify the vendor responsible.
3. Wait an appropriate amount of time (opinions vary on this part). If the vendor fails to respond post the info & the exploit if you have one to Bugtraq or similar list.
4. If the vendor does release a patch/notice release your details as well.
At no point should leaking it to the press to make a fuss be an issue. Full disclosure is a good thing, but in the appropriate forums. Some vendors are very cooperative & release patches (or at least a notification) very rapidly. Others never get around to addressing security holes.
Legislating ethics... (Score:1)
I think difficult solution to the problem is educating consumers and media professionals so that they don't get taken advantage of in these ways.
Not sure I agree (Score:4)
I usually agree completely with everything that BS writes (and I was pleased to see that his first paragraph validated my Slashdot post in the nCipher string), I do think that he is being a little hypocritical about this subject. While the whole nCipher thing was obviously just "hacksationalism", it seems to me that the dividing line between cases where he is and isn't OK with publishing cracks depends competely on where party is making money or not.
Ethics to the side, and as much as we all love being closet-Socialists here, capitalism is what makes our world go round. I wish all research could be funded for altruistic reasons, but in the real world the lure of profit IS often necessary. This is why we stand the fact that medical patents often keep poor people from being able to afford treatment, its for the greater good of having the medicines developed at all.
It might not be perfect to have companies researching for security holes so they can validate the sales of there products, but at least the holes are being found and published, which, IMHO, is a hell of lot better then letting them linger until somebody who would rather use them than publish them finds them. Use Open Source and you can be sure you can patch around before the hackers hit you when the problem hits the press.
I also see no mention in the article about BS own new Internet security company, Counterpane Internet Security, and how he plans to change his behaviour now (though he points fingers at LOFT for doing the same). He might have discussed this before though.
If anything, I think one of the biggest faulty parties here is Slashdot. A lot of journalists read this site, so when the editors post a story like the nCipher one, it does a great deal to spread it further. May I recommend that the
-
We cannot reason ourselves out of our basic irrationality. All we can do is learn the art of being irrational in a reasonable way.
"Hackers, Crackers and Lamers" (Score:3)
Release later this year I hope.
Re:Not sure I agree (Score:1)
Not too sure I agree with that <grin>. What he seems to *me* to be saying is that he disagrees with either
I think what it comes down to is this - if a major bug is reported to the world that can't be patched out of existance, and you appear with a hard or soft solution that fixes it without introducing more problems, then everyone will stand behind you and applaud. If *YOU* came up with the problem report, and everyone else thinks it is such a long-odds occurance it gets a backburner-status until more pressing problems are sorted, don't be *too* surprised if everyone looks a bit suspicious when you trot out your "solution".
<...block snipped...>
If anything, I think one of the biggest faulty parties here is Slashdot. A lot of journalists read this site, so when the editors post a story like the nCipher one, it does a great deal to spread it further. May I recommend that the /. staff consider taking a Cypherpunk onboard to weed through stories about such issues to make sure they are real and not just sensationalist. /. know to take a PR release with a grain or two of salt, and given most of the time one of the people respected in whatever field the post is in will either confirm or debunk a story within a few dozen posts (and rapidly get moderated up) why not just let /. take it's normal course and add an UPDATE: tag to the story if it looks too far out from the dock? With the possible exception of petrified females, the /. Delphi effect seems to work much better than a paid staff member could hope to, and it's cheaper too :+)
Not too sure about that either - most readers of
--
Re:Let me go off on a tangent for just a sec (Score:1)
Lack of experience in the media (Score:4)
This is often regardless of credentials, and I've seen some journalists maintain a tenacious grip on a flawed notion of bad security because bad security makes a good story. Copy gets churned out that all too often recites doomsaying of the original source, without reference to any independent expertise.
It's even worse when there's actually a story in there, but it isn't the story that they're choosing to write.
Sensible, timely reporting of security issues, and pentrating questions aimed at those who seek to deflect them are sensible and useful. Grabbing the latest 'see here security disaster!' hype isn't.
Starts insightful and degrades from there (Score:2)
I'm a subscriber to CRYPTO-GRAM; I suggest anyone who cares at all about security subscribe as well. Bruce is a true luminary in his field and usually when he points something out, it's worth looking into.
That said, I quickly read the nCipher bit this morning when CRYPTO-GRAM arrived. The first few paragraphs had me nodding and saying ``preach on, brother'' (under my breath of course; when I do it out loud my wife looks at me strangely...) But the remaining examples led me to believe that perhaps Bruce had written himself in a corner and was desperately trying to close his essay with nothing else to say.
nCipher is an example of an extreme that is easy for everyone to point out and understand. But the rest of Bruce's article left me saying ``so what?'', especially when peppered with constant ``I am probably the last person to say this, but...''s and ``I normally don't condemn this, but...''s. It left me feeling that the problem he highlights really isn't as widespread as he wanted to make it out to be.
My advice, Bruce: continue to highlight the insane for our benefit; but don't beat a subject after it's dead. (``We will kill you until you are dead!'') :-)
Follow the Money (Score:4)
Including on Slashdot
-John
Re:PGP for furriners (slightly off-topic) (Score:1)
Re:False Authority Syndrome (Offtopic Comment) (Score:1)
ARGH! This annoys me to no end. Unless you heard Bruce somewhere reading it, it wasn't any kind of "read". When I hear someone say this, I get a mental picture of the guy in the TV commercial that insists on pronouncing France the foo-foo way. (Fronce) Try going into your favorite restaurant, and after dinner, tell the chef it was "A Great Eat". See him swell with pride. :)
That rant has been building for some time. Don't take it personally. Yours was just the final straw, so to speak. :)
Nipok Nek
Re:False Authority Syndrome (Offtopic Comment) (Score:1)
Pronunciation: 'fran(t)s, 'fr[a']ns
country W Europe between English Channel & the Mediterranean; a republic capital Paris area 212,918 square miles (551,458 square kilometers), population 54,257,300
Tomato, Tomotto....
Nipok Nek
A question (Score:4)
The author makes some valid points to the degree of contradicting himself. I would hope that most of the people on slashdot can spot posturing and sensationalizing when they see it.
"I call this kind of thing a publicity attack. It's a blatant attempt by nCipher to get some free publicity for the hardware encryption accelerators, and to scare e-commerce vendors into purchasing them. And people fall for this, again and again."
Yes nCipher didn't really point out anything new, yes it's a blatent attempt to get free publicity and yes it does stink of the whole virus scare thing we went through 10 years ago. However the issue here is where do you draw the line between a publicity stunt and genuine alerting the world to a problem. I feel that just telling those with a responsibility to fix a problem is not the solution, as the writer correctluy points out:
"Of course, the downside is that these bugs get less attention from Microsoft and Netscape, even though they are as serious as many others that have received more press attention and thus get fixed quickly by the browser makers."
However this causes a problem, if the only way of attacking a true problem is to make it public with all the fuss involvoed how can you expect the public to tell the difference between this and someone grabing for publicity, we maybe able to tell the difference but joe public is usualy a little out of their depth when dealing with cryptography.
What I would like to know is if you (the person reading this post) found a gaping security whole in something large like Explorer or Navigator what would you do:
Ad hominem. (Score:2)
This is just lame. If there're problems with the essay, point them out. Otherwise shut up.
Re:False Authority Syndrome (Offtopic Comment) (Score:1)
I apologise unreservedly for my use of a common phrase
BTW...did you see the new BMW yet? I heard it's a great drive. And Q3 on a Xeon? That's what I call a great frag.
False Authority Syndrome (Score:4)
PGP for furriners (slightly off-topic) (Score:1)
-pf
Re:Bruce should write about himself (Score:1)
j
"It's not whether or not you're paranoid. It's whether or not you're paranoid enough."
Re:Bruce should write about himself (Score:2)
j
"It's not whether or not you're paranoid. It's whether or not you're paranoid enough."
Re:Lack of experience in the media (Score:2)
You mean like Y2K and credit card information theft?
Regarding credit card theft, I'm tired of hearing about the theft of the information. I don't care who steals my credit card number but who uses my credit card number. The information of the fraudulent charges racked up on stolen CC numbers is painfully missing in most stories telling how 250k CC numbers were stolen from random-site.com.
CRYPTO-GRAM (Score:1)
Re:A question (Score:1)
I would:
1 - Report it to the vendor;
2 - One week later, post it somewhere so as to make it public;
3 - One week after that, release an exploit, if I were capable to, just to make sure the vendor *does* something about the hole.
-------------------------
Re:Bruce should write about himself (Score:1)
Not Surprising. (Score:2)
It's their job to increase sales, and this is an appropriate method to do so given what they are trying to sell.
To put it another way, when we were kids and they'd show those action figure commercials where the figures seemed like they were really flying, you didn't really believe they could actually fly, did you?
It's advertising, plain and simple. If a person gets suckered into purchasing something simply by viewing the ad, they really have nobody to blame but themselves. Likewise, if a person is willing to spend their money without doing their own research, then perhaps they deserve to be suckered.
In case anyone is interested, here are some further readings on the subject of psychology as it is involved with advertising:
Re:Bruce should write about himself (Score:1)
I definately agree that Blowfish is a reasonable algorithm, but Twofish just hasn't been tested like Blowfish, and the other myth, that Twofish is an improvement of Blowfish is not true at all. Twofish is an entirely different algorithm.
He might not be making any direct money from his implementations, but being able to say "Counterpane, the guys that invented the new AES standard, implemented in all new major encryption products", is worth quite a bit of money..
Re:Bruce should write about himself (Score:1)
That was a long time ago.. way before even the end of the first round of AES.
Bruce should write about himself (Score:3)