Schneier on Security

Friday Squid Blogging: Natural Squid Steganography

Fri, 10 Oct 2008 16:58:41 -0600

Squid can communicate with each other without any other fish noticing: Squid and their relatives have eyes that are sensitive to polarised light and to them and are known to use it to signal to one another. Their predators on the other hand, like seals or whales, don't share this ability and cannot see the squids' signals. Most of all,...

The More Things Change, the More They Stay the Same

Fri, 10 Oct 2008 12:30:19 -0600

Guess the year: Murderous organizations have increased in size and scope; they are more daring, they are served by the most terrible weapons offered by modern science, and the world is nowadays threatened by new forces which, if recklessly unchained, may some day wreck universal destruction. The Orsini bombs were mere children's toys compared with the later developments of infernal...

Data Mining for Terrorists Doesn't Work

Fri, 10 Oct 2008 06:35:43 -0600

According to a massive report from the National Research Council, data mining for terrorists doesn't work. Here's a good summary: The report was written by a committee whose members include William Perry, a professor at Stanford University; Charles Vest, the former president of MIT; W. Earl Boebert, a retired senior scientist at Sandia National Laboratories; Cynthia Dwork of Microsoft Research;...

Nonviolent Activists Are Now Terrorists

Thu, 09 Oct 2008 13:07:17 -0600

Heard about this: The Maryland State Police classified 53 nonviolent activists as terrorists and entered their names and personal information into state and federal databases that track terrorism suspects, the state police chief acknowledged yesterday. Why did they do that? Both Hutchins and Sheridan said the activists' names were entered into the state police database as terrorists partly because the...

"New Attack" Against Encrypted Images

Thu, 09 Oct 2008 06:44:14 -0600

In a blatant attempt to get some PR: In a new paper, Bernd Roellgen of Munich-based encryption outfit PMC Ciphers, explains how it is possible to compare an encrypted backup image file made with almost any commercial encryption program or algorithm to an original that has subsequently changed so that small but telling quantities of data 'leaks'. Here's the paper....

Chinese Monitoring Skype Messages

Wed, 08 Oct 2008 06:55:52 -0600

This is the best article I've read on the story....

Do-Not-Call Lists

Tue, 07 Oct 2008 15:51:16 -0600

Turns out you can add anyone's number -- or remove anyone's number -- to/from the Canadian do-not-call list. You can also add (but not remove) numbers to the U.S. do-not-call list, though only up to three at a time, and you have to provide a valid e-mail address to confirm the addition. Here's my idea. If you're a company, add...

The Seven Habits of Highly Ineffective Terrorists

Tue, 07 Oct 2008 05:48:53 -0600

Most counterterrorism policies fail, not because of tactical problems, but because of a fundamental misunderstanding of what motivates terrorists in the first place. If we're ever going to defeat terrorism, we need to understand what drives people to become terrorists in the first place. Conventional wisdom holds that terrorism is inherently political, and that people become terrorists for political reasons....

Clickjacking

Mon, 06 Oct 2008 13:45:02 -0600

Good Q&A on clickjacking: In plain English, clickjacking lets hackers and scammers hide malicious stuff under the cover of the content on a legitimate site. You know what happens when a carjacker takes a car? Well, clickjacking is like that, except that the click is the car. "Clickjacking" is a stunningly sexy name, but the vulnerability is really just a...

New Cross-Site Request Forgery Attacks

Mon, 06 Oct 2008 05:42:04 -0600

Interesting: CSRF vulnerabilities occur when a website allows an authenticated user to perform a sensitive action but does not verify that the user herself is invoking that action. The key to understanding CSRF attacks is to recognize that websites typically don't verify that a request came from an authorized user. Instead they verify only that the request came from the...

Friday Squid Blogging: Close-Up of a Long-Finned Squid Tentacle

Fri, 03 Oct 2008 16:25:00 -0600

Wow....

Article in the Irish Times

Fri, 03 Oct 2008 13:43:49 -0600

On Wednesday I was interviewed by the Irish Times....