Beyond Fear 152
Beyond Fear: Thinking Sensibly About Security In an Uncertain World | |
author | Bruce Schneier |
pages | 256 |
publisher | Copernicus Books |
rating | 7 |
reviewer | Preston Tollinger |
ISBN | 0387026207 |
summary | A worthwhile introduction to real-world (not just computer) security, aimed at a literate but non-technical audience. |
The Book
Beyond Fear is described very well by its subtitle: this book helps you think sensibly about security. Don't expect the highly technical material you have seen in Schneier's previous books, but rather the more accessible material, much like you might read in his monthly newsletter. That doesn't mean the book is breezy: In Schneier's wordy but well-written manner, he describes a five-step process to analyze any particular security system or practice. The process helps you make sure you understand what you are protecting, what the tradeoffs are, and whether, in the end if it is worthwhile to implement the system.He then goes on to apply this method to a series of security issues while covering the various types of security and their weaknesses. For the most part this not a technical evaluation of the tools used, but rather an analysis for each example of what the security goals are and how the tools and technology achieve or fail to achieve those goals. Even more importantly, he deals with the tradeoffs inherent in any security system.
Schneier applies this method not only to the global issues that have come up since 9/11, from airline security to protecting government secrets, but also to personal issues, including tradeoffs in personal home security. By doing so, he takes principles which might be hard for some to understand in the abstract and makes it clear how they apply in situations almost everyone has thought about.
By drawing parallels, for instance, between how you might select a home alarm system to how you might evaluate the use of face recognition at the airport, Schneier shows that you don't have to be a security "expert" to think logically about security. He brings to the forefront the tradeoffs that you made in these personal choices; for example, the downside of dealing with deactivating an alarm system every time you come home. Then, in turn, he shows how you must consider the problem of people being falsely identified by the face recognition system at the airport.
Given this strong framework, he then uses his method to analytically and dispassionately tear apart most of the silly and stupid security methods (note my dispassion here) that have been put in place or considered in the past few years, from airline security methods to national ID cards. With a combination of funny yet pointed anecdotes, clear statistics and the occasional Harry Potter reference, Schneier uses his talent for cogent, rational explanation to show how people can think about security in the modern world, instead of simply panicking at every ominous news report.
To Read Or Not To Read
So it sounds like a good book and probably would be for some, but there was not enough new content for me to make it worth my limited reading time. Perhaps due to my general interest in security or just because waiting in line at the airport has already given me a lot of time to think, but I have already considered most of the ideas Schneier raises in Beyond Fear. I own a shredder, but not an alarm system, because I have considered the risks and costs. I dislike the idea of a National ID card because I was already afraid of what someone might do who got access to it, and already monitor my credit report. I have written my local representative that while his recent bill to remove SSNs from insurance cards is nice, it's far too late (and how about just getting people to stop using SSN's as passwords?).If this describes you, skip the book. However you might note above I didn't say this was a waste of my money. This book is soon going to find its way into hands of friends and relations who need to think about security. It is a great introduction to a way of thinking that is critical in a post-9/11 world. It should be required reading for members of Congress before any more security laws are passed based only on the need to do something instead of rational thought.
Summary
If you think consciously about security, know who Schneier is, or have ever noticed (and complained) that many airport security measures make no sense, you probably don't need this book. If you have only considered this topic in general, though, and want a book to focus your thoughts, Beyond Fear will do that. Finally, if you have friends who don't yet think this way (admit it, we all do), get this book into their hands.
You can purchase Beyond Fear from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Fellow slashdotters (Score:1, Funny)
Best example of how to speak about Security (Score:5, Informative)
However, most "normal people" relate well to anecdotes, and general examples, and this book is full of them. Instead of trying to describe how 256 bit keys are safer than 64 bit keys to non-technical friends and relatives, I've learned lots of metahphors involving door locks, car theft, and every day risk assesment that will help me to get my point across a lot more clearly.
I think this is the point of this book. It's not technical. It's Security for the Everyman.
Re:Best example of how to speak about Security (Score:2)
Re:Best example of how to speak about Security (Score:4, Insightful)
Here's a book idea: Come up with metaphors for computer-related ideas which will stand up reasonably well even as the user/cluebie/PHB makes assumptions based on them. I'd buy two compies, one for work and one for home, and keep 'em right next to the phone. I can't tell you how often it'd be useful...
Re:Best example of how to speak about Security (Score:2)
For example, almost everyone can understand that no car is completely immune from accidents, along with unavoidable injury if an accident is bad enough. Hence, lessen injury by wearing seat belts or driving a car with air bags. You may still have injuries in an accident, but the injury is far less damaging than without belts or bags.
Re:Best example of how to speak about Security (Score:2)
Better analogy:
Once you've gotten your co-worker to agree to a statement like that, point out tha
Re:Best example of how to speak about Security (Score:3, Informative)
Security works like that. You take something that works in one environment (Abrams on the battlefield getting shot at) and put it in a different environment, one it wasn't designed for (on the
Re:Best example of how to speak about Security (Score:1)
Remember: this is not a book about computer security. It's not trying to teach you about password management techniques (although he does use password lists as yet another example, since they're yet another everyday security issue for most of us) or firewall configuration. It's trying to teach you how to think about security in general.
To
Re:Best example of how to speak about Security (Score:2)
In most cases, any of those bit lengths will be effective, so there's no reason trying to explain how one is safer to friends and relatives unless they're protecting really big secrets like the timetable for the next 9/11.
Re:Best example of how to speak about Security (Score:2)
If it's like Applied Cryptography [schneier.com] there are tons. For a few weeks after reading AC [schneier.com] all I dreamt of Bob, Alice, Trent, Peggy and that kid Alice kidnapped.
Process vs Organized Security (Score:4, Insightful)
This came true on a national scale with 9/11 of course. The public went whole hog for the idea of airport screeners but those airport screeners have the brains of a mall security guard.
I'd love to see a simple process for evaluating new proposed 'security' practices in my organization to help debunk the idea that these proposals provide any security at all.
Re:Process vs Organized Security (Score:5, Interesting)
My freaky experience: I took a trip to Florida, and in my carryon luggage (a backpack) was a buck knife with a 4-inch serrated-edge blade. I wasn't trying to smuggle it through on purpose... the last time I had used the backpack was on a camping trip (where knives are handy) and I simply hadn't unpacked the front zipper pocket, where the knife was.
Anyway, the knife made it cleanly through airport security. Twice. At two different "high-security" airports... and yes, it went through all the detectors and everything. I didn't even find the damned thing until I was on my last connecting flight. So yes, there are some major issues there.
To tie this back in with your post... I hate to generalize based on one incident, but the extra security just ain't giving us a whole lot of extra security. Which leads me to believe that you're right... one of the main "benefits" of all this was just to allow the authorities to take actions "in the name of security" that only serve to give them more power.
What that experience taught me is that I can't rely on those in authority to protect me, either me physically or my data or anything like that. Which means that citizens are going to have to start safeguarding themselves, and sometimes that may be in opposition to the "best interests" of the state. Which sure as heck don't seem to be our best interests much these days.
Paradox (Score:2, Redundant)
But seriously, I can't imagine convincing an Ashcroftian to sit down and consider the other side, but I might read it just for some common sense ammunition. You know, some security...against those...who..want..more..security... Uh, yeah.
Re:Paradox (Score:2)
For the people that you are talking about, external agendas are the determining feature, and this book won't do anything for them. Neither will any other form of argument that doesn't address their real agendas. But for many people, this will be welcome. (Many is, again, much less than all people, or even all literate English speakers. But it's probably significantly larger than bot
Re:Here is a way for security (Score:2)
Re:Here is a way for security (Score:1)
11. If you've been hiding in the North Carolina woods, never venture out into an open parking lot to go dumpster diving for food.
Re:Here is a way for security (Score:2, Funny)
Re:Here is a way for security (Score:2)
Maybe we'll be able to identify them by their tinfoil hats now?
Re:Here is a way for security (Score:2)
Re:Here is a way for security (Score:2)
You're confusing "security" with "privacy". A few points which are clearly anti-security:
3. Use cash to pay your share of rent/utilities
4. Use throw-away cell phones paid with cash
5. Use calling cards vended for cash via
vending machines
7. Work for cash
Carrying all that cash around makes you a target.
7. Work for cash (under the counter
That makes you a target known to less than honest types (if they're willing to pay unde
A better lifestyle... (Score:3, Funny)
Re:A better lifestyle... (Score:1)
Do you want to spend the rest of your life jerking-off and eating at Wendy's? Take a fuckin' chance!
Re:A better lifestyle... (Score:1)
Everybody would freeze up with paranoia if anybody said anybody elses' real name at the barbeque.
It was and is pathetic. It seems to hearken back to a fear of computers that people still harbour.
Re:A better lifestyle... (Score:3, Insightful)
What's wrong with national IDs? (Score:5, Insightful)
In the modern world, we are counted and registered with our government. What is wrong with having a standardized card to show who we are?
I don't know if these cards would stop anybody from crashing airplanes, but they do help against things like identity theft, which is quite common in America but almost unheard of here. We don't have to have "three kinds of photo id" to go to bank, we don't consider our mother's maiden name or SS#'s security secrets, and we don't need to bring the electic bill to rent a movie.
Granted, my country is much smaller than the US, but I would support having an EU wide Identity card standard. I cannot see sensible argument against it.
Re:What's wrong with national IDs? (Score:4, Insightful)
I think it's a combination of 1) people are used to what they're used to and when you accustomed to not having an Official State Identification Number there's unease about suddenly getting one and 2) many Americans, my own family included, fled here from countries where the government's concern with tracking you was less than entirely helpful.
At the same time, there are obvious advantages to having a standard identity, which is why driver's licenses (state governments are trusted much more than the federal government) and social security numbers have taken on far more importance than they were ever intended to have. Essentially, the combination of the two already serves as an official identity.
By the way, I have no idea of the relative rate of identity theft in the US and Europe, but it's certainly not "common" in any sense in which I'd use the word. If there's a significant difference, it's probably due to the fact that Europeans don't routinely have 15 different credit accounts.
Re:What's wrong with national IDs? (Score:2)
Re:What's wrong with national IDs? (Score:5, Interesting)
In addition the people of the USA have a tradition of just being criminals. Practically anyone has a smuggler or a bootlegger or a bookie in their family tree somewhere. These things were illegal but not really dishonorable. And in the beginning days of the country, it was possible for someone to fuck up their lives in one area and simply start over further west. So we've gotten used to ignoring the laws and taking advantage of anonymity.
The situation changes if the government suddenly becomes organized and informed. If the government has a good way to track who we are and what we are doing, all those things that are illegal will suddenly matter. So the reaction is to resist tracking and information programs. Of course, this is the incorrect reaction: what we should really be doing is reigning in our government and repealling stupid laws until we feel that we can trust it again. But that answer isn't as obvious.
I'll end with a short example: last year I got on an SF MUNI streetcar at a station where the toll machines were broken. I paid my $1, but the machine didn't give me a ticket. No attendant was on duty so I just boarded the train anyway. Well, lo and behold here comes Fare Inspection Shitwit to check my ticket, which I didn't have, through no fault of my own. Inspector Shitwit gives me a ticket ($90 fine) for failure to have a ticket on the streetcar. Naturally I rebuked him profanely and threw the ticket in the trash. I don't have any intention of dealing with such rubbish. But now, six months later, there's a warrant for my arrest which will never be served by the SFPD and I will be unable to renew my driver's license, which is expired, until a year after the incident. If the government were *really* well organized I might even get arrested. I'm really afriad that in some well-organized, well-tracked future government regime, people will get in *real trouble* for not having a piece of paper that says you paid $1 to get on the bus.
Re:What's wrong with national IDs? (Score:1, Informative)
Re:What's wrong with national IDs? (Score:2)
Re:What's wrong with national IDs? (Score:1, Informative)
There is no statute of limitations on avoiding court-ordered penalties. You now have a court-ordered penalty by virtue of your neglect in clearing the matter (therefore the "charge" of freeloading your Muni ride stood).
I al
How to get your driver's license back (Score:5, Funny)
Re:How to get your driver's license back (Score:2)
Re:What's wrong with national IDs? (Score:2)
Next time, pay the extra $1 (well, $1.25 now) to use another turnstile that actually gives you a transfer. Or, if you like taking the risk, at least go to court when you get a ticket. Failing to pay a ticket or show up for a court date just because you couldn't be bothered to pay $1 is pretty pathetic, and is far from a valid reason for not wanting a national ID card.
Re:What's wrong with national IDs? (Score:1)
Re:What's wrong with national IDs? (Score:4, Insightful)
Most of what you cite is convenience. It may be convenient to have one card for everything, but that doesn't mean making it mandatory is a good idea. Identity theft can be stopped in other ways, and it isn't even clear to me that a national ID card would do much to stop it here at all.
The US started differently than European nations, and has a long history of distrust of the government. I still believe this is a valuble thing.
The only party getting value out of national ID cards is the government. Why should I quietly give that to them? I have no reason to.
Re:What's wrong with national IDs? (Score:2)
The problem with ID theft in North America is that the only way they tend to identify you is by using your SSN and drivers license.
Both are easy to get by and in the end nobody is really asking.
The CBC had an interview this week with someone who did ID theft for a couple of years as a living. It's almost chilling to hear how easy it is to loose your identity and get your
Re:What's wrong with national IDs? (Score:2)
Yes, I'm well aware of that - I've had a mild form happen to me (someone got enough info to open two credit cards, and I caught it quickly - it wasn't as bad as it could have been).
In Germany for example medical records are not allowed to be kept for more than 5 years (bit me in the ass a while ago when I tried to get some results from some yea
Re:What's wrong with national IDs? (Score:2)
If you think that these days nobody can already build a complete profile of you you're pretty wrong.
the SSN and your drivers license alone are enough to track you.
What needs to be done is to re-do the privacy laws in the US (and Canada) instead of hoping that the companies are "honest"
Re:What's wrong with national IDs? (Score:2)
That's by no means unique to Americans. I'm European, and I distrust the US government, too.
Re:What's wrong with national IDs? (Score:5, Interesting)
You may trust your government enough to know everything about you and to keep it all in one great big database but you have to keep in mind that here in America we don't so much. In fact we are an entire country founded on the thought that the government should get the fuck out of our lives. National IDs do nothing for security they do nothing to prevent idenitity theft they do nothing but put all of your personal info in one database that can be abused by those who have access to it and broken into and abused by those who do not. In Beyond Fear Bruce goes through this with the 5 step process. You spend a large amount of money and get nothing in return.
Think about it for a moment and I can only speak for the US but I'll walk you through the process.
I have a drivers license and a Social Security card. With those two forms of ID I can get any other form of ID that we have here in the US. Those two pieces of ID are in turn based on a birth cert. You can get a birth cert for a couple of hundred dollars. To implement a national ID they would have to figure out someway to figure out who everybody is and at this point it is impossible to prove who anyone is beyond accepting what their current IDs say. See the problem yet?
So national IDs will just give you another ID that says that you are who you claim to be. But if I don't like being that person anymore it would take a couple of hundred dollars and a bit of time to be someone else. There is *no* way that you can prove that anyone is anyone. Trying to do so is pointless and will merely cause problems for honest folks.
Re:What's wrong with national IDs? (Score:1)
Yes and no.
The national ID would be the only ID you would need. No more SSN or Drivers License (which is stupid anyways), no more haggeling over it, AND because the document is a federal government it should be harder to forge (doesn't mean it can't be).
The idea of a National ID card isn't that bad, the problem just is that the way data in the US is handled it won't accomplish a thing. At least not for the people who
Re:What's wrong with national IDs? (Score:2)
Re:What's wrong with national IDs? (Score:1)
there is a national ID system (Score:2)
Who knows. Probably a combination of stupidity, xenophobia ("the Europeans are doing it--it can't be any good"), crooks like it (and they get to vote and lobby, too), and because it is enormously profitable for some, like companies that make
Re:there is a national ID system (Score:2)
Why would they? Just because you have an ID card doesn't have anything to do with the collection of personal data. I have a national ID card, and neither is that itself used to create a personality profile of me, nor does it hinder lots of companies to earn money by spying on me. The only
Re:there is a national ID system (Score:2)
First of all, a national ID system would almost certainly come with stronger privacy legislation, something that would make a lot of the current data collection and exchange practices in the US illegal.
Also, a large part of the work involved in keeping databases on people has to do with figuring out who they are and whether two pieces of information refer to the same person. A reliable, secure identification system would mean that institutions might not have to outsource that work at all.
Re:there is a national ID system (Score:4, Interesting)
Logically, every other state in the union should refuse to recognize a CA drivers license as a valid ID, except maybe as proof of the ability to drive a car (about the same utility as the "international drivers license" you can get). I'm sure Californians will be real happy when TSA stops accepting their DLs as valid ID next time they try to board a plane.
You want a national ID? Get a passport.
Re:there is a national ID system (Score:2)
Which would do wonders for fraud in California. You see, the problem is that the California driver's license, for no damn good reason, is trusted way too much. I could do more harm with a California license than any other state ID or license card.
California issues out no less than 25,000 ID cards per day and even at an amazing rate of accuracy and security, you would still be looking at
Re:there is a national ID system (Score:2)
You are absolutely right: what a marvelous benefit. That alone makes me want to support that proposal.
Driver's licenses are for driving an automobile, not for anything else. If California's move causes people not to use them for other purposes, that's a great step forward. Let's hope the other 49 states will "devalue" their driver's licenses in the same way.
Re:What's wrong with national IDs? (Score:3, Interesting)
IMO, simple legislation that provides baseline standards for government-issued ID cards (eg, driver licenses) to have anti-fraud features are all that's needed.
I live in NJ, the state with the license that's easiest to forge. It's easy for someone to walk into a DMV, claim to be so-and-so, and say that they've lost their license. All you need is something like mothe
Re:What's wrong with national IDs? (Score:2)
You obviously don't track this stuff closely. There've been a couple of states that have done something along these lines, complete with "unforgeable" drivers licenses.
The result was DMV offices being broken into and blank cards and the machines to make them being stolen.
Re:What's wrong with national IDs? (Score:2)
Yes...but the advantage is that NJ doesn't have very much severe fraud committed with the photo driver's licenses (and non-photo licenses.) Everyone knows they can be easily forged so no one trusts them for all that much. As things go, I rather have some under age alcohol consumption than serious credit/financial fraud (which is far more severe in states with much more "secure" licenses, like California or Texas.)
Re:What's wrong with national IDs? (Score:2)
I wouldn't say that, but it's a sham argument to distract us. They already have a national id card. Actually, more than one. If you're a male it's illegal for much of your life not to carry a draft card. Certainly for the ages that they are most concerned about (18-35), I'm not sure about later. Women are generally more trusted, so they rely on the secondary id's: Driver's license and "taxpayer ID #" (it was originally the social service ID, and we were prom
Re:What's wrong with national IDs? (Score:1)
You will soon see....
Re:What's wrong with national IDs? (Score:1)
I don't understand why Americans are so afraid of national ID cards. Where I live we have standardized national ID cards that are used in most situations, and I can't say how it has made me any less free.
In the modern world, we are counted and registered with our government. What is wrong with having a standardized card to show who we are?
It is the counting and registering that bothers many Americans, not the card. Americans have good reason to be distrustful of the federal government's attempts
Re:What's wrong with national IDs? (Score:2, Insightful)
Read the book. This is one of the cases that he analyzes. The questions to ask about national ID cards is the same as for any security measure: what assets are you trying to protect, what threats are you trying to protect against, how well does this measure work to reduce the risks from those threats, what new threats does it introduce, and so on.
I can see ways in which a national ID card could be useful. I do not see that it could
Re:What's wrong with national IDs? (Score:2)
It should be said at this point that every country's experience with ID cards is very different. Many European countries use them for mostly bureaucratic functions (functions which are done in other countries, without difficulty, without ID cards. In fact, I like to say, if you don't have ID card fraud, t
"Not for you"? (Score:5, Insightful)
This might seem like common sense, but a IMO *lot* of otherwise Clueful people could use having this sort of process tatooed in reverse on their forehead so they'd have to review it every morning when they looked in the mirror.
The trouble with any job that involves detail and careful attention is that the forest tends to duck behind all the damned trees, and this is especially true for IT. Hell, look at all the /.'ers in our recent discussions about programs or products that are "useless" or "should have waited longer to be released" because it doesn't provide absolute security, whereas in reality security is a *step by step* type of deal, not one of absolutes.
Anyhow, in my experience it often benefits even the "experts" to have the blatently obvious spelled out in this way and laid out before them. Security isn't alone here -- this goes for just about all disciplines, IT or not. Given that, I think it's dangerous to dismiss something like this as too basic.
Boldly over-optimistic (Score:3, Funny)
Oh sure,if he's from soviet russia and he, for one, welcomes 1-2-3-profiting from first posts, I'm sure most Slashdot readers know him.
Is he reading too much into people? (Score:4, Insightful)
One mistake Schnier tends to make is to ascribe certain thoughts to others that may not be there at all. For example, he seems to think that anyone who has a security system of any kind (software, hardware, etc.) assumes that system will be invincible. He then goes on to attack that assumption, without stopping to realize that the assumption he is attacking is not one that is actually held by most people. Now his new attack, on "fear" this time (that he thinks everyone with security systems must have), is of the same form.
However, over the years his all-or-nothing approach has mellowed, fortunately; since he is so influential, it's good that he is starting to see things less as black and white and more in terms of tradeoffs. The old view that poor security equals no security is easily debunked by pointing out that virtually all security systems in place everywhere are penetrable, yet they remain effective in the aggregate.
Bottom line: Beyond Fear is just a good title. Let's hope he doesn't really think that locking your car door is firm evidence that you are quaking in your boots.
Re:Is he reading too much into people? (Score:2, Insightful)
Schnier has spent years in the fields of Crypto and security. He's seen a lot of people who have exa
Re:Is he reading too much into people? (Score:1)
Your security system example provides a good case in point. Many people do buy them out of fear. A security system at best provides a limited time for the intruder to spend on a premises before risking apprehension.
Crypto (Score:3, Interesting)
This is precisely why I don't bother with any encryption that isn't built in. Browser encryption - fine. Using PGP or RMSPG on my email -- as Dogbert asked, "Who would want to read your mail?" There is too much hassle involved, just on my end, never mind getting my sister or mother in law to read encrypted email. Unless you make a fetish of it for your own sake or you're sending something genuinely worth protecting, who cares?
Re:Crypto (Score:5, Insightful)
Well, the idea is if you only send important email in encrypted form, then the important email is easy to spot and brute force. But if you encrypt everything, then brute force is not such a viable option.
That's the idea anyway, but I'm with you. I tried to use PGP for a while, but none of the people I emailed had any idea what it was, and didn't have the inclination to learn.
Re:Crypto (Score:1)
Something about:
Or do I have the meme wrong?
Re:Crypto (Score:2)
N.B.: you said "built into the browser". I translated that into "built into the e-mail program". I hope this was correct. Browser based encryption is present in most browsers. (In Mozilla it's represented by that little padlock icon. If the padlock is closed, then you're in encrypted mode.)
N.B.B.: I'm not sure about the v
Re:Crypto (Score:1)
No, I meant that I use encryption when it's given to me seamlessly. As you say, using a browser in encrypted mode is routine, so I'm happy to use it. Same for ssh and sftp. If email clients provided that same level of routine integration, great! Obviously, though, it's a lot easier to implement encryption when the hard work can be delegated to a server admin, as with ssh or httpd.
Re:Crypto (Score:1)
Re:Crypto (Score:1)
People don't generally perceive a need for that. My mom, for instance, only emails people she has met IRL and exchanged addresses with anyway. Spam and other scam mails (including the ever-popular "Customers want to use credit cards, so give us your bank account number", supposedly from Merchant
Re:Crypto (Score:1)
Re:Crypto (Score:1)
Personally I hope that if I start using signing / encrypting and get my friends to do the same, I've helped the privacy advocates a little. I say this because I loath the idea " If you are honest, what do you have to hide? ".
I lived in a communist country and I know what it meens government control and I don't want other contries to go on tha
Bias (Score:2)
Re:Bias (Score:1)
I for one do not want airframe-piercing tools anywhere in the plane. If, against all the odds, someone manages to smuggle a gun in and takes over the plane, I'd rather have it stop there. I don't want a fucking gunfight inside the plane.
this leaves out the potential for positive social and economic intervention to weaken extremist positions.
Positive social and econom
Disgruntled pilots? (Score:2)
Better to keep the pilots unarmed. Have air marshals on random flights, and secure the cockpit door vs. even them.
Re:Disgruntled pilots? (Score:1)
Re:Disgruntled pilots? (Score:2)
My point about drunk pilots (at least two sets on commercial airlines in the last few years) was that they are not perfectly reliable. As a class, they are more reliable than most any other grouping, but it's too big a group. I think the odds of a dangerous wingnut also being drunk are low. Either variable - drunk, or win
The administration doesn't want you to read this (Score:3, Insightful)
For US government regulatory purposes, the value of a human life ranges from about $1.1 million to about $6 million. (1999 dollars). The current administration would prefer smaller numbers, because environmental and safety regulations are measured against those values. (1 CFR s305-88-7). So the Enron collapse, at $40 billion, equates to about 7,000 lives. [fsu.edu]
Yet Ken Lay is still at large.
Re:The administration doesn't want you to read thi (Score:2)
North Korea I'll go along with, maybe even Enron. But SARS!? Underreacted? Were there ever more than a handful of SARS cases in the US?
Re:The administration doesn't want you to read thi (Score:2)
Re:The administration doesn't want you to read thi (Score:2)
Guys like Bernie Ebbers or the Tyco looters commit the finanicial equivalent of tens of thousands of bank robberies. What are the chances they'll spend as much time in jail as the average bank robber?
Re:The administration doesn't want you to read thi (Score:1)
Re:The administration doesn't want you to read thi (Score:2)
Quote the book when you write your representatives (Score:2)
Next best thing: quote it in letters to my representatives.
Wait until the RIAA hears about this (Score:1)
This book is soon going to find its way into hands of friends and relations who need to think about security
Oh yeah..... (Score:2)
"Hi, I'm Bruce Schneier! You may have remembered me from my other books, 'A Long Day's Journey Out From Fright', and 'Security is a Well-Patched Mac'."
We NEED to use SSN's as identifiers (Score:3, Insightful)
The cat's out of the bag already. Pretending that SSN's are somehow secret was dubious enough thirty years ago, but is just plain reckless today. It's this coy game of 'if you know your SSN you must be you even though we know that's not true' that has allowed identify theft [pbs.org] to proliferate.
Instead we need to just say, "this is my National ID # - use it for whatever you damn well please" - at that point people will have to start looking for real security solutions instead of the crazy half-baked ineffective one they're trifling with now.
Of course, this can't be done electively - there needs to be a national cutover date with probably 2 years notice (then at least 2 years of delays). All that needs to be done is to get Congress, the IRS, the President, and 'Privacy Advocates' on board. No problem.
Bruce Schneier (Score:2)
Didn't he play the cop in all those Jaws movies?
I also liked him as Heywood Floyd in "2010".
Beyond Fear (Score:3, Interesting)
Talking to non-techies (Score:3, Interesting)
When I gave security-related presentations to non-techies, I got in the habit of asking for a show of hands asking who had locked their front door when they left home that morning. Needless to say, all hands went up. I'd then point out that a thief could break a window, tunnel through a wall, dig up through the floor, cut a hole in the roof, or batter down a door if they were determined enough to get inside...so why did they bother locking the front door? Thinking about this got people into a more reasonable mindset to discuss cost/benefit ratios and attack scenario analysis.
Re:I am sure... (Score:3, Informative)
Bruce Schneier is well known as an expert in security and cryptography. In particular, he is possibly best known for writing the bible of cryptography: Applied Cryptography [amazon.com].
For other examples of his work, see here [amazon.com].
Re:I am sure... (Score:2, Informative)
Re:I am sure... (Score:1)
You could have dreamt up the stealth plane that was designed in 1970s?
Do no underestimate the military research...
Re:In the review summary (Score:1)