<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[Schneier on Security]]></title>
    <link>http://securityratty.com/feed/f709ed61925ad1f5326694524099a96f</link>
    <description></description>
    <pubDate>Fri, 20 Jun 2008 12:56:09 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Friday Squid Blogging: Giant Squid Found off Santa Cruz Coast]]></title>
      <link>http://securityratty.com/article/dd1d317f6414c923e8314fa7adf70aee</link>
      <guid>http://securityratty.com/article/dd1d317f6414c923e8314fa7adf70aee</guid>
      <description><![CDATA[It's twenty-five feet long , with tenticles the size of human...]]></description>
      <content:encoded><![CDATA[It's <a href="http://www.santacruzsentinel.com/ci_9697779">twenty-five feet long</a>, with tenticles the size of human legs.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=FfhJdJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=FfhJdJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=14HDDJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=14HDDJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 04 Jul 2008 12:20:55 +0000</pubDate>
      <category domain="http://securityratty.com/tag/twenty-five feet">twenty-five feet</category>
      <category domain="http://securityratty.com/tag/human legs">human legs</category>
      <category domain="http://securityratty.com/tag/tenticles">tenticles</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/friday_squid_bl_133.html">Friday Squid Blogging: Giant Squid Found off Santa Cruz Coast</source>
    </item>
    <item>
      <title><![CDATA[Time Bomb Neckties]]></title>
      <link>http://securityratty.com/article/2cbbab4bc11783697bcd0ff00fd516d0</link>
      <guid>http://securityratty.com/article/2cbbab4bc11783697bcd0ff00fd516d0</guid>
      <description><![CDATA[Not recommended to wear at the...]]></description>
      <content:encoded><![CDATA[<a href="http://www.etsy.com/view_listing.php?listing_id=12792904">Not recommended</a> to wear at the airport.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=gIcCCJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=gIcCCJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=uBs7yJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=uBs7yJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 04 Jul 2008 10:18:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/airport">airport</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/time_bomb_neckt.html">Time Bomb Neckties</source>
    </item>
    <item>
      <title><![CDATA[Encrypting Disks]]></title>
      <link>http://securityratty.com/article/0412d7c6d75959351f8a0664ef7eaaca</link>
      <guid>http://securityratty.com/article/0412d7c6d75959351f8a0664ef7eaaca</guid>
      <description><![CDATA[The UK is learning : The Scottish Ambulance Service confirmed today that a package containing contact information from its Paisley Emergency Medical Dispatch Centre (EMDC) has been lost by the...]]></description>
      <content:encoded><![CDATA[The UK is <a href="http://www.scottishambulance.co.uk/MissingDisc/PressRelease.asp">learning</a>:

<blockquote>The Scottish Ambulance Service confirmed today that a package containing contact information from its Paisley Emergency Medical Dispatch Centre (EMDC) has been lost by the courier, TNT, while in transit to one of its IT suppliers.

The portable data disk contained a copy of records of 894,629 calls to the ambulance service's Paisley EMDC since February 2006. It was fully encrypted and password protected and includes the addresses of incidents, some phone numbers and some patient names. Given the security measures and the complex structure of the database it would be extremely difficult to gain access to any meaningful information.</blockquote>

News story <a href="http://news.bbc.co.uk/2/hi/uk_news/scotland/7470006.stm">here</a>.

That's what you want to do.  There is no problem if encrypted disks are lost.  You can mail them directly to your worst enemy and there's no problem.  Well, assuming you've implemented the encryption properly and chosen a good key.

This is much better than what the HM Revenue & Customs office <a href="http://www.timesonline.co.uk/tol/news/uk/article2910705.ece">did</a> in November.

I <a href="http://www.schneier.com/essay-199.html">wrote</a> about disk and laptop encryption previously.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=f7aWrJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=f7aWrJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=sZKK7J"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=sZKK7J" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 04 Jul 2008 09:10:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ambulance service">ambulance service</category>
      <category domain="http://securityratty.com/tag/scottish ambulance service">scottish ambulance service</category>
      <category domain="http://securityratty.com/tag/disk">disk</category>
      <category domain="http://securityratty.com/tag/portable data disk">portable data disk</category>
      <category domain="http://securityratty.com/tag/emdc">emdc</category>
      <category domain="http://securityratty.com/tag/paisley emdc">paisley emdc</category>
      <category domain="http://securityratty.com/tag/laptop encryption previously">laptop encryption previously</category>
      <category domain="http://securityratty.com/tag/meaningful information">meaningful information</category>
      <category domain="http://securityratty.com/tag/worst enemy">worst enemy</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/encrypting_disk.html">Encrypting Disks</source>
    </item>
    <item>
      <title><![CDATA[Hundreds of Thousands of Laptops Lost at U.S. Airports Annually]]></title>
      <link>http://securityratty.com/article/c9073d10b076742bcd87430314c09618</link>
      <guid>http://securityratty.com/article/c9073d10b076742bcd87430314c09618</guid>
      <description><![CDATA[This is a weird statistic : Some of the largest and medium-sized U.S. airports report close to 637,000 laptops lost each year, according to the Ponemon Institute survey released Monday. Laptops are...]]></description>
      <content:encoded><![CDATA[This is a <a href="http://www.pcworld.com/businesscenter/article/147739/laptops_lost_like_hot_cakes_at_us_airports.html_">weird statistic</a>:

<blockquote>Some of the largest and medium-sized U.S. airports report close to 637,000 laptops lost each year, according to the Ponemon Institute survey released Monday. Laptops are most commonly lost at security checkpoints, according to the survey.

Close to 10,278 laptops are reported lost every week at 36 of the largest U.S. airports, and 65 percent of those laptops are not reclaimed, the survey said. Around 2,000 laptops are recorded lost at the medium-sized airports, and 69 percent are not reclaimed.

Travelers seem to lack confidence that they will recover lost laptops. About 77 percent of people surveyed said they had no hope of recovering a lost laptop at the airport, with 16 percent saying they wouldn't do anything if they lost their laptop during business travel. About 53 percent said that laptops contain confidential company information, with 65 percent taking no steps to protect the information.</blockquote>

I don't know how to generalize that to a total number of lost laptops in the U.S.; let's call it 750,000.  At $1,000 per laptop -- a very conservative estimate -- that's $750 million in lost laptops annually.  Most are lost at security checkpoints, and I'm sure the numbers went up considerably since those checkpoints got more annoying after 9/11.

There aren't a lot of real numbers about the costs of increased airport security.  We pay in time, in anxiety, in inconvenience.  But we also pay in goods.  TSA employees <a href="http://www.cbsnews.com/stories/2004/09/13/eveningnews/main643165.shtml">steal out of suitcases</a>.  And opportunists steal hundreds of millions of dollars of laptops annually.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=LSh7nJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=LSh7nJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=DT8VQJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=DT8VQJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 04 Jul 2008 04:20:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/recover lost laptops">recover lost laptops</category>
      <category domain="http://securityratty.com/tag/lost laptops">lost laptops</category>
      <category domain="http://securityratty.com/tag/lost">lost</category>
      <category domain="http://securityratty.com/tag/laptops lost">laptops lost</category>
      <category domain="http://securityratty.com/tag/commonly lost">commonly lost</category>
      <category domain="http://securityratty.com/tag/airports">airports</category>
      <category domain="http://securityratty.com/tag/lost laptop">lost laptop</category>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/hundreds_of_tho.html">Hundreds of Thousands of Laptops Lost at U.S. Airports Annually</source>
    </item>
    <item>
      <title><![CDATA[Random Stupidity in the Name of Terrorism]]></title>
      <link>http://securityratty.com/article/c81bd0a4e004add0a54874f8bf604a84</link>
      <guid>http://securityratty.com/article/c81bd0a4e004add0a54874f8bf604a84</guid>
      <description><![CDATA[An air traveller in Canada is first told by an airline employee that it is &quot;illegal&quot; to say certain words, and then that if he raised a fuss he would be falsely accused: When we boarded a little...]]></description>
      <content:encoded><![CDATA[An air traveller in Canada is first <a href="http://www.theglobeandmail.com/servlet/story/RTGAM.20080627.blatch28/BNStory/specialComment/home">told</a> by an airline employee that it is "illegal" to say certain words, and then that if he raised a fuss he would be falsely accused:

<blockquote>When we boarded a little later, I asked for the ninny's name. He refused and hissed, "If you make a scene, I'll call the pilot and you won't be flying tonight."</blockquote>

More on the British <a href="http://www.theregister.co.uk/2008/06/23/police_photographer_stops/">war on photographers</a>.

A British man is forced to give up his <a href="http://uk.news.yahoo.com/skynews/20080624/tuk-bus-spotter-labelled-a-paedophile-45dbed5.html">hobby</a> of photographing busses due to harrassment.

<blockquote>The credit controller, from Gloucester, says he now suffers "appalling" abuse from the authorities and public who doubt his motives.

The bus-spotter, officially known as an omnibologist, said: "Since the 9/11 attacks there has been a crackdown.

"The past two years have absolutely been the worst. I have had the most appalling abuse from the public, drivers and police over-exercising their authority.

Mr McCaffery, who is married, added: "We just want to enjoy our hobby without harassment.

"I can deal with the fact someone might think I'm a terrorist, but when they start saying you're a paedophile it really hurts."</blockquote>

Is <a href="http://www.cnn.com/2008/WORLD/meast/07/02/israel.bulldozer/">everything</a> illegal and damaging now terrorism?

<blockquote>Israeli authorities are investigating why a Palestinian resident of Jerusalem rammed his bulldozer into several cars and buses Wednesday, killing three people before Israeli police shot him dead.

Israeli authorities are labeling it a terrorist attack, although they say there is no clear motive and the man -- a construction worker -- acted alone. It is not known if he had links to any terrorist organization.</blockquote>

Boston public school locked down after someone <a href="http://www.boston.com/news/odd/articles/2008/06/25/school_locked_down_after_ninja_sighted_in_woods/">saw</a> a ninja:

<blockquote>Turns out the ninja was actually a camp counselor dressed in black karate garb and carrying a plastic sword.

Police tell the Asbury Park Press the man was late to a costume-themed day at a nearby middle school.</blockquote>

And finally, not terrorism-related but a fine newspaper headline:  "<a href="http://ap.google.com/article/ALeqM5h1AqbvSMYPxJrla6-Fgym8WIzEsgD91KNJD00">Giraffe helps camels, zebras escape from circus</a>":

<blockquote>Amsterdam police say 15 camels, two zebras and an undetermined number of llamas and potbellied swine briefly escaped from a traveling Dutch circus after a giraffe kicked a hole in their cage.</blockquote>

Are llamas really that hard to count?<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=eQI3GJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=eQI3GJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=tEUVdJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=tEUVdJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 08:57:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/israeli police shot">israeli police shot</category>
      <category domain="http://securityratty.com/tag/giraffe">giraffe</category>
      <category domain="http://securityratty.com/tag/terrorist">terrorist</category>
      <category domain="http://securityratty.com/tag/israeli authorities">israeli authorities</category>
      <category domain="http://securityratty.com/tag/giraffe helps camels">giraffe helps camels</category>
      <category domain="http://securityratty.com/tag/authorities">authorities</category>
      <category domain="http://securityratty.com/tag/boston public school">boston public school</category>
      <category domain="http://securityratty.com/tag/terrorist organization">terrorist organization</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/random_stupidit.html">Random Stupidity in the Name of Terrorism</source>
    </item>
    <item>
      <title><![CDATA[Browser Insecurity]]></title>
      <link>http://securityratty.com/article/91edde737eae16c632b409b1ec1a9d10</link>
      <guid>http://securityratty.com/article/91edde737eae16c632b409b1ec1a9d10</guid>
      <description><![CDATA[This excellent paper measures insecurity in the global population of browsers, using Google's web server logs. Why is this important? Because browsers are an increasingly popular attack vector. The...]]></description>
      <content:encoded><![CDATA[This <a href="http://www.techzoom.net/publications/insecurity-iceberg/index.en">excellent paper</a> measures insecurity in the global population of browsers, using Google's web server logs.  Why is this important?  Because browsers are an increasingly popular attack vector.

The results aren't good.

<blockquote>...at least 45.2%, or 637 million users, were not using the most secure Web browser version on any working day from January 2007 to June 2008. These browsers are an easy target for drive-by download attacks as they are potentially vulnerable to known exploits.</blockquote>

That number breaks down as 577 million users of Internet Explorer, 38 million of Firefox, 17 million of Safari, and 5 million of Opera.  Lots more detail in the paper, including some ideas for technical solutions.

EDITED TO ADD (7/2):  More <a href="http://www.ofcourseimright.com/?p=29">commentary</a>.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=D1f9DJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=D1f9DJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=j7VCWJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=j7VCWJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 03:02:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/million">million</category>
      <category domain="http://securityratty.com/tag/million users">million users</category>
      <category domain="http://securityratty.com/tag/web server logs">web server logs</category>
      <category domain="http://securityratty.com/tag/drive-by download attacks">drive-by download attacks</category>
      <category domain="http://securityratty.com/tag/browsers">browsers</category>
      <category domain="http://securityratty.com/tag/technical solutions">technical solutions</category>
      <category domain="http://securityratty.com/tag/internet explorer">internet explorer</category>
      <category domain="http://securityratty.com/tag/global population">global population</category>
      <category domain="http://securityratty.com/tag/easy target">easy target</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/browser_insecur.html">Browser Insecurity</source>
    </item>
    <item>
      <title><![CDATA[Dan Wallach on Electronic Voting Machines]]></title>
      <link>http://securityratty.com/article/3dad39bfe648e88bc7d78abdacb0ed57</link>
      <guid>http://securityratty.com/article/3dad39bfe648e88bc7d78abdacb0ed57</guid>
      <description><![CDATA[It's been a while since I've written about electronic voting machines, but Dan Wallach has an excellent blog post about the current line of argument from the voting machine companies and why it's...]]></description>
      <content:encoded><![CDATA[It's been a while since I've written about electronic voting machines, but Dan Wallach has an <a href="http://www.freedom-to-tinker.com/?p=1304">excellent blog post</a> about the current line of argument from the voting machine companies and why it's wrong.

<blockquote>Unsurprisingly, the vendors and their trade organization are spinning the results of these studies, as best they can, in an attempt to downplay their significance.  Hopefully, legislators and election administrators are smart enough to grasp the vendors’ behavior for what it actually is and take appropriate steps to bolster our election integrity.

Until then, the bottom line is that many jurisdictions in Texas and elsewhere in the country will be using e-voting equipment this November with known security vulnerabilities, and the procedures and controls they are using will not be sufficient to either prevent or detect sophisticated attacks on their e-voting equipment. While there are procedures with the capability to detect many of these attacks (e.g., post-election auditing of voter-verified paper records), Texas has not certified such equipment for use in the state.  Texas’s DREs are simply vulnerable to and undefended against attacks.</blockquote><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=fSGUQJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=fSGUQJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=XVEwEJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=XVEwEJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 02 Jul 2008 02:15:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dan wallach">dan wallach</category>
      <category domain="http://securityratty.com/tag/attacks">attacks</category>
      <category domain="http://securityratty.com/tag/excellent blog post">excellent blog post</category>
      <category domain="http://securityratty.com/tag/vendors">vendors</category>
      <category domain="http://securityratty.com/tag/vendors behavior">vendors behavior</category>
      <category domain="http://securityratty.com/tag/equipment">equipment</category>
      <category domain="http://securityratty.com/tag/procedures">procedures</category>
      <category domain="http://securityratty.com/tag/machine companies">machine companies</category>
      <category domain="http://securityratty.com/tag/texass dres">texass dres</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/dan_wallach_on.html">Dan Wallach on Electronic Voting Machines</source>
    </item>
    <item>
      <title><![CDATA[Nugache Worm Writer Arrested]]></title>
      <link>http://securityratty.com/article/2438a880894c9db456171730f86f9e40</link>
      <guid>http://securityratty.com/article/2438a880894c9db456171730f86f9e40</guid>
      <description><![CDATA[A 19-year old from Wyoming will plead...]]></description>
      <content:encoded><![CDATA[A <a href="http://blog.wired.com/27bstroke6/2008/06/hacker-launches.html">19-year</a> <a href="http://www.jacksonholestartrib.com/articles/2008/06/30/news/wyoming/doc48656c8a93378754215938.txt">old</a> from Wyoming will plead guilty.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=U7MItJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=U7MItJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=CSsPBJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=CSsPBJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 08:57:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/plead guilty">plead guilty</category>
      <category domain="http://securityratty.com/tag/19-year">19-year</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/nugache_worm_wr.html">Nugache Worm Writer Arrested</source>
    </item>
    <item>
      <title><![CDATA[Kill Switches and Remote Control]]></title>
      <link>http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a</link>
      <guid>http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a</guid>
      <description><![CDATA[It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now...]]></description>
      <content:encoded><![CDATA[It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now everyone else wants to get their hooks into your gear.

OnStar will soon include the <a href="http://www.informationweek.com/news/mobility/showArticle.jhtml?articleID=202400922">ability</a> for the police to shut off your engine remotely. Buses are getting the <a href="http://www.nypost.com/seven/06082008/news/regionalnews/busting_terror_114567.htm">same capability</a>, in case terrorists want to re-enact the movie <cite>Speed</cite>. The Pentagon wants a kill switch <a href="http://blog.wired.com/defense/2008/06/the-pentagons-n.html">installed</a> on airplanes, and is worried about potential enemies <a href="http://spectrum.ieee.org/may08/6171">installing</a> kill switches on their own equipment. 

Microsoft is doing some of the most creative thinking along these lines, with something it's calling "<a href="http://arstechnica.com/news.ars/post/20080611-microsoft-patent-brings-miss-manners-into-the-digital-age.html">Digital Manners Policies</a>." According to its <a href="http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220080125102%22.PGNR.&OS=DN/20080125102&RS=DN/20080125102">patent application</a>, DMP-enabled devices would accept broadcast "orders" limiting capabilities. Cellphones could be remotely set to vibrate mode in restaurants and concert halls, and be turned off on airplanes and in hospitals. Cameras could be prohibited from taking pictures in locker rooms and museums, and recording equipment could be disabled in theaters. Professors finally could prevent students from texting one another during class. 

The possibilities are endless, and very dangerous. Making this work involves building a nearly flawless hierarchical system of authority. That's a difficult security problem even in its simplest form. Distributing that system among a variety of different devices -- computers, phones, PDAs, cameras, recorders -- with different firmware and manufacturers, is even more difficult. Not to mention delegating different levels of authority to various agencies, enterprises, industries and individuals, and then enforcing the necessary safeguards.

Once we go down this path -- giving one device authority over other devices -- the security problems start piling up. Who has the authority to limit functionality of my devices, and how do they get that authority? What prevents them from abusing that power? Do I get the ability to override their limitations? In what circumstances, and how? Can they override my override?

How do we prevent this from being abused? Can a burglar, for example, enforce a "no photography" rule and prevent security cameras from working? Can the police enforce the same rule to avoid another Rodney King incident? Do the police get "superuser" devices that cannot be limited, and do they get "supercontroller" devices that can limit anything? How do we ensure that only they get them, and what do we do when the devices inevitably fall into the wrong hands?

It's comparatively easy to make this work in closed specialized systems -- OnStar, airplane avionics, military hardware -- but much more difficult in open-ended systems. If you think Microsoft's vision could possibly be securely designed, all you have to do is look at the dismal effectiveness of the various copy-protection and digital-rights-management systems we've seen over the years. That's a similar capabilities-enforcement mechanism, albeit simpler than these more general systems.

And that's the key to understanding this system. Don't be fooled by the scare stories of wireless devices on airplanes and in hospitals, or visions of a world where no one is yammering loudly on their cellphones in posh restaurants. This is really about media companies wanting to exert their control further over your electronics. They not only want to prevent you from surreptitiously recording movies and concerts, they want your new television to enforce good "manners" on your computer, and not allow it to record any programs. They want your iPod to politely refuse to copy music to a computer other than your own. They want to enforce <em>their</em> legislated definition of manners: to control what you do and when you do it, and to charge you repeatedly for the privilege whenever possible. 

"Digital Manners Policies" is a marketing term. Let's call this what it really is: Selective Device Jamming. It's not polite, it's dangerous. It won't make anyone more secure -- or more polite.

This essay <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/06/securitymatters_0626">originally appeared</a> in Wired.com.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=JiKwGJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=JiKwGJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=aXm5MJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=aXm5MJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 02:48:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wireless devices">wireless devices</category>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/devices inevitably">devices inevitably</category>
      <category domain="http://securityratty.com/tag/digital manners policies">digital manners policies</category>
      <category domain="http://securityratty.com/tag/prevent">prevent</category>
      <category domain="http://securityratty.com/tag/prevent security cameras">prevent security cameras</category>
      <category domain="http://securityratty.com/tag/difficult security">difficult security</category>
      <category domain="http://securityratty.com/tag/cameras">cameras</category>
      <category domain="http://securityratty.com/tag/prevent students">prevent students</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/kill_switches_a.html">Kill Switches and Remote Control</source>
    </item>
    <item>
      <title><![CDATA[Friday Squid Blogging: Contaminated Squids]]></title>
      <link>http://securityratty.com/article/bf9432b242e2902c6c713797f8e340b3</link>
      <guid>http://securityratty.com/article/bf9432b242e2902c6c713797f8e340b3</guid>
      <description><![CDATA[We're contaminating the squid : The toxic chemicals that Vecchione and colleagues from the Virginia Institute of Marine Science found are a rogues gallery of scary initials: PCBs, TBTs, BDEs, and DDT...]]></description>
      <content:encoded><![CDATA[<p>We're <a href="http://scitech.blogs.cnn.com/2008/06/12/squids-and-octopods-beware-contaminants-now-in-your-world/">contaminating the squid</a>:</p>

<blockquote>The toxic chemicals that Vecchione and colleagues from the Virginia Institute of Marine Science found are a rogues gallery of scary initials: PCBs, TBTs, BDEs, and DDT among them. Scientists classify all of them as POPs, or persistent</blockquote><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=g4SplI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=g4SplI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=zdDdHI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=zdDdHI" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 20 Jun 2008 12:56:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/toxic chemicals">toxic chemicals</category>
      <category domain="http://securityratty.com/tag/rogues gallery">rogues gallery</category>
      <category domain="http://securityratty.com/tag/virginia institute">virginia institute</category>
      <category domain="http://securityratty.com/tag/squid">squid</category>
      <category domain="http://securityratty.com/tag/marine science">marine science</category>
      <category domain="http://securityratty.com/tag/scary initials">scary initials</category>
      <category domain="http://securityratty.com/tag/ddt">ddt</category>
      <category domain="http://securityratty.com/tag/tbts">tbts</category>
      <category domain="http://securityratty.com/tag/pops">pops</category>
      <source url="http://www.schneier.com/blog/archives/2008/06/friday_squid_bl_130.html">Friday Squid Blogging: Contaminated Squids</source>
    </item>
  </channel>
</rss>
