Schneier on Security

Does anyone have any links to serious security researchers discussing this adversarially or critically? Or, if it's too soon as it's such a recent release, links to the types of serious security researchers who publish that sort of thing. The discussion here would seem to suggest there's definitely a need for such a thing. Bruce Schneier comes to mind, and doing a search of: "cloud" site:https://www.schneier.com/ did have a few results. Would be interested in more trustworthy figures to have a read of.

Bruce Schneier is a must read if you are interested in security. https://www.schneier.com/

I love how security expert Bruce Schneier (https://www.schneier.com) has implemented it. This also gives you an ability to see how popular an article is (based on the sharing numbers) if you want, which is another purpose these widgets serve.

While I can sort of see where you are coming from, I think there is something else worth pointing out that does make this at least somewhat Hacker News worthy. Bruce Schneier is a world leader in cryptographic analysis[1]. He is very much a part of the hacker community. He is well known for being quite analytical and to the point in a fashion that other "reporters" are without. I, for one, very much appreciate when he talks about issues of this magnitude, for that very reason, and I don't think I am alone here. [1] - http://schneier.com

Also recommended reading are Bruce Schneier's book "Beyond Fear" which provides a great mental framework for thinking about security (mainly IRL, but with applications in computing) http://www.schneier.com/book-beyondfear.html and his blog: http://www.schneier.com/

Hey, wanted to reply and drop you a note. I'm a co-founder at Aptible, and we spend a lot of time thinking about how to help developers in your situation. In terms of general reading, I'd suggest: -------------- Blogs: Bruce Schneier [0] Brian Krebs [1] -------------- Whitepapers: - Google's BeyondCorp paper touches on issues that most cloud-first companies will find familiar [2] - AWS has a few that are good for seeing how a large company communicates the scope of it's security program to customers and potential customers. [3] I'd start with "Introduction to AWS Security Processes" aka "Overview of Security Processes" and "AWS Risk and Compliance". - Verizon's Data Breach Investigations Reports [4] -------------- Standards: - Request your IaaS provider's SOC 2 Type II report - ISO 27001 is worth buying - The Cloud Security Alliance's CCM tries to cross-map different frameworks, and is a good reference for a high-level rundown of various security management controls and activities [5] -------------- In terms of books, conferences, and meetups, I'm sure there is good stuff out there that I'm not aware of because of limitations on my time, sorry. I hope this is helpful. Good luck! You (or anyone reading) can reach out to me at the email in my profile to chat about any of this. p.s. Shameless plug: We are launching a product for managing infosec + compliance programs at companies like yours. -------------- [0] https://www.schneier.com/ [1]…

The user doesn't conflate the two, the developers do, and that's why we turn off telemetry, because its damn close to tracking. Knowing what (vulnerable) version of software a user is using transmitted in the clear was absolutely a part of the NSA monitoring error information from windows crash logs https://www.schneier.com/blog/archives/2017/08/nsa_collects_ms.html - so forgive me if I do not trust the developer to know what makes me unsafe or not. If you enable telemetry by default I will do my best to never use your product.

Reminds me of that quote: “There is considerable overlap between the intelligence of the smartest bears and the dumbest tourists.” [0] [0] https://www.schneier.com/blog/archives/2006/08/security_is_a_t.html

Humans are the benchmarks for AGI and yet a lot of people are outright dumb: > Said one park ranger, “There is considerable overlap between the intelligence of the smartest bears and the dumbest tourists.” [1] https://www.schneier.com/blog/archives/2006/08/security_is_a_t.html

Just to follow up, Schneier thinks something is weird as well. https://www.schneier.com/blog/archives/2025/09/us-disrupts-massive-cel…

> No matter how much accessible information security training we try to provide and the EDR controls we implement, >95% of our incidents involve an end-user following (sometimes extremely obvious) phishing links. That just shows that security training is insufficient and admins need to design their systems and networks to account for that fact. Clicking links is part of everybody's job and should not pose a risk to your organization. Enable 2FA for everything exposed to the internet to mitigate phished credentials. Stop trying to fix the user: https://www.schneier.com/wp-content/uploads/2016/09/Stop-Trying-to-Fix…

We are not "silent", we're just not being heard. Those are not the same things. You'll find plenty of critique and analysis, anticipating and commenting on the unfolding cybsersecurity calamity [0,1,2] ... [0] https://www.schneier.com/ [1] https://cybershow.uk/blog/ [2]https://www.dataandpolitics.net/trump-is-a-critical-vulnerability When those who own and control the means of discourse are donors to, and so in collusion with the problem, don't expect to hear opposition.

p 11 (/30), makes a terrible case in handwaving. It ignores the requirement that secret data needs to stay secret for 30 years, or 100 years, or long into the future, and attacks only get better. https://www.schneier.com/blog/archives/2009/07/another_new_aes.html > They also describe an attack against 11-round AES-256 that requires 2^70 time—almost practical. >> AES is the best known and most widely used block cipher. Its three versions (AES-128, AES-192, and AES-256) differ in their key sizes (128 bits, 192 bits and 256 bits) and in their number of rounds (10, 12, and 14, respectively). >> In the case of AES-128, there is no known attack which is faster than the 2^128 complexity of exhaustive search. However, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2^176 and 2^119 time, respectively.

I didn't see this oldie listed. Schneier on Security - https://www.schneier.com/ There are alot of fresh suggestions in this thread, I will be checking them all out. Thanks guys.

> Not sure I wanted to know... Oh that's Unicode for you. It's not that they're "roundtrip unsafe", it's just that Unicode is a total and complete clusterfuck. Bruce Schneier in 2000 on Unicode security risks: https://www.schneier.com/crypto-gram/archives/2000/0715.html#9 Of course the attacks he envisioned materialized, like homoglyph attacks using internationalized domain names. My favorite line from Schneier: "Unicode is just too complex to ever be secure". And, no matter if you love Unicode or not, there's lots of wisdom in there. When design-by-committee gives birth to something way too complex, insecurity is never far behind.

I think the news about that particular counter example is too recent to be easily understood. https://www.schneier.com/blog/archives/2024/09/remotely-exploding-page… Still, I think your point is excellent. The sort of group interested in tracking someone(s) over Tor certainly might have the capability to do so despite the difficulty.

That used to be the norm! My personal favorite story along those lines was how they proposed changes to DES S-boxes without any detailed explanation. The open community was skeptical but it later turned out that the changes they proposed protected against differential cryptanalysis[1], which was at the time not known outside the intelligence community. That said, they did cut the key size dramatically which ended up weakening DES to the point that it could be trivially brute forced by the early 2000s, which led to 3DES and AES. 1: https://www.schneier.com/blog/archives/2004/10/the_legacy_of_d.html

Current trend seems to be that we regulate the AI, not the people who control the AI. We should absolutely regulate the people behind the AI. One excellent writing: https://www.schneier.com/blog/archives/2023/12/ai-and-trust.html

LLMs can be fed a conversation and understand the intent of its participants, even if no particular keywords are used. Before this, surveillance was limited by how many human agents you could have sifting through recorded data. Put another way: most people only get charged with a crime if it's worth a law-enforcement officer's time to catch you, but many small violations are ignored in favor of higher priorities. We may have to contemplate a future where AI is clever enough to notice everything that can be construed as a violation of some law and put on a prosecutor's backlog. Schneier talks about this as well: https://www.schneier.com/blog/archives/2023/12/ai-and-mass-spying.html

You might be interested in Bruce Schneier's take on trust and what prevents predatory behaviour. In his book Liars and Outliers he gives a taxonomy of 4 elements: law, reputation, morality, and security. Reputation and law are similar in that they're imposed by a community, but differ in that law follows a formally codified code, and of course the consequences imposed tend to differ. Morality is the internal motivation not to wrong others. Security describes physical/electronic measures that cause the predatory behaviour not to be practical in the first place, or at least raise the bar. Schneier's own summary: https://www.schneier.com/blog/archives/2012/03/liars_and_outli_5.html A review, hosted on Schneier's site: https://www.schneier.com/news/archives/2012/12/liars-and-outliers-by-b…

https://en.wikipedia.org/wiki/High-trust_and_low-trust_societies Trust is a technology, the transition to a high-trust society unlocks so much potential that was previously used on "basic" tasks like guarding your property, making sure your food is fit to eat, not getting scammed in a trade etc. Bruce Schneier has written a book about trust https://www.schneier.com/books/liars-and-outliers/ ; I don't want to oversell it, I didn't find it amazing, but it has some very relevant discussion on how trust has evolved into our society and institutions. Ultimately a society where people can't trust each other and communicate efficiently will be outcompeted by a society where people can, either through individual altruism, societal norms or institutional enforcement.

Or make everyone go through metal detectors and millimeter wave scanners at the airport, take their shoes off, treat any liquid over whatever the small limit is like it’s bomb-making material (but still let that person fly; checkmate, would-be bomber!)…it’s all security theater. Notice how they don’t release their testing rates on how many of the test weapons and threats make it through TSA security, because then it would be too easy to point to that and rightfully assert that they utterly fail at their mission while wasting untold lifetimes worth of human time and make travel that much more miserable. https://www.schneier.com/blog/archives/2015/06/reassessing_air.html (2015) is a good read on that if you don’t already know. My point is that when politicians do something “to save the children”, it’s rarely about actually helping anyone but themselves.

Move fast and break things, including basic security. Why anyone trusts Azure that all these prompts won't eventually be leaked is beyond me. No one goes broke trusting Azure, but I'd love it if someone was held responsible. https://www.schneier.com/blog/archives/2023/08/microsoft-signing-key-s…

NIST recommended getting off SMS in 2016. I’d say 7 years is plenty of time that folks really shouldn’t be using it. https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html

Unfortunately the article fails to mention the most import aspect of security ... WHAT IS YOUR THREAT MODEL? Who/what are you protecting against? Without a clear answer to that, you're probably wasting your time. And check out Bruce Schneier for intelligent advice. https://www.schneier.com/

For those who are looking for more in-depth material, I'd recommend looking at Bruce Schneier's post about a workshop he organized on this topic a few months ago. The comments include notes on the presentations: https://www.schneier.com/blog/archives/2022/12/reimagining-democracy.h…

Your link to Schneier got me browsing through his "voting" tag. I found it quite interesting to compare these two posts and comments, from November 25, 2016 [0] and November 27, 2020 [1]. The topic is nearly the same, - some people found some irregularities in some counties - but the tone and treatment of the claims is drastically different. It's worth considering how we discuss election security through a partisan lens. [0] https://www.schneier.com/blog/archives/2016/11/hacking_and_the.html [1] https://www.schneier.com/blog/archives/2020/11/undermining-democracy.h…

You need to think more about your model of trust. You will quickly discover that all security is built on trusting someone, even in the examples you mention above. You can compile your own kernel, but you trust kernel developers to not have put exploits in the source code. You can't audit the source code itself. You also trust your compiler to accurately compile the source code. You also trust compiler developers to not have put exploits into the compiler itself. You also trust the compiler they used to bootstrap their toolchain to compile the compiler. Fundamentally, all security is based on trusting somebody, understanding their incentives and intentions and weighing risk and reward. An excellent book on the subject is Bruce Schneier's "Liars and Outliers" https://www.schneier.com/books/liars-and-outliers/.

White-listing what addresses a web browser can reach seems to go against the intended use - you know, to browse the web. Edit: Also, I don't think this is as much about trust as it is about avoiding being part of the huge target that the centrally hosted Firefox Sync servers must be. While Firefox developers and Mozilla might be wholly trustworthy, they might become compromised by some configuration error or zero day vulnerability. So someone might steal the sweet sweet treasure that is in the Sync servers. Now, that is encrypted of course, but they might have made a simple error[1] in how encryption is implemented and the encryption may be defeated. [1]: See for example: https://www.schneier.com/blog/archives/2008/05/random_number_b.html

I agree with your explanation, but actually bootstrapping the compiler might not even be enough, as pointed out by Ken Thompson in his classical essay in 1984 [1] "Reflections on Trusting Trust. Bruce Schneier already said that in 2006 [2]: > It’s interesting: the “trusting trust” attack has actually gotten easier over time, because compilers have gotten increasingly complex Since 2006 compilers have become even more sophisticated, but also much more complex, thus even harder to validate. [1]: https://archive.org/details/reflections-on-trusting-trust [2]: https://www.schneier.com/blog/archives/2006/01/countering_trus.html