Bruce Schneier Quotes

Bruce Schneier delivers plain-spoken, witty takes on security, digital copying, and the politics of fear.

24 quotes

1. When my mother gets a prompt 'Do you want to download this?' she's going to say yes. It's disingenuous for Microsoft to give you all of these tools [in Internet Explorer] with which to hang yourself, and when you do, then say it's your fault.

2. Chaos is hard to create, even on the Internet. Here's an example. Go to Amazon.com. Buy a book without using SSL. Watch the total lack of chaos.

3. ... if anyone thinks they can get an accurate picture of anyplace on the planet by reading news reports, they're sadly mistaken.

4. Digital files cannot be made uncopyable, any more than water can be made not wet.

5. Technical problems can be remediated. A dishonest corporate culture is much harder to fix.

6. Beware the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers. Seems like you can scare any public into allowing the government to do anything with those four.

7. The point of terrorism is to cause terror, sometimes to further a political goal and sometimes out of sheer hatred. The people terrorists kill are not the targets; they are collateral damage. And blowing up planes, trains, markets or buses is not the goal; those are just tactics. The real targets of terrorism are the rest of us: the billions of us who are not killed but are terrorized because of the killing. The real point of terrorism is not the act itself, but our reaction to the act. And we're doing exactly what the terrorists want.

8. More people are killed every year by pigs than by sharks, which shows you how good we are at evaluating risk.

9. The mantra of any good security engineer is: 'Security is a not a product, but a process.' It's more than designing strong cryptography into a system; it's designing the entire system such that all security measures, including cryptography, work together.

10. It is sort of interesting that in our society this days we are very quick to apply the term 'war' to places where thare are no actual wars, and loath to apply the term 'war' when we are actually fighting wars.

11. There are two types of encryption: one that will prevent your sister from reading your diary and one that will prevent your government.

12. The real targets of terrorism are the rest of us: the billions of us who are not killed but are terrorized because of the killing. The real point of terrorism is not the act itself, but our reaction to the act. And we're doing exactly what the terrorists want [...] Our politicians help the terrorists every time they use fear as a campaign tactic. The press helps every time it writes scare stories about the plot and the threat. And if we're terrified, and we share that fear, we help.

13. Surveillance is the business model of the Internet.

14. History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It's always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you'll be glad you did.

15. ID can be hijacked, and cards can be faked. All of the 9/11 terrorists had fake IDs, yet they still got on the planes. If the British national ID card can't be faked, it will be the first on the planet.

16. Terrorism is a crime against the mind. We win by refusing fear.

17. It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

18. The very definition of news is something that hardly ever happens. If an incident is in the news, we shouldn't worry about it. It's when something is so common that its no longer news - car crashes, domestic violence - that we should worry.

19. Computer security can simply be protecting your equipment and files from disgruntled employees, spies, and anything that goes bump in the night, but there is much more. Computer security helps ensure that your computers, networks, and peripherals work as expected all the time, and that your data is safe in the event of hard disk crash or a power failure resulting from an electrical storm. Computer security also makes sure no damage is done to your data and that no one is able to read it unless you want them to.

20. Hardware is easy to protect: lock it in a room, chain it to a desk, or buy a spare. Information poses more of a problem. It can exist in more than one place; be transported halfway across the planet in seconds; and be stolen without your knowledge.

21. Security is a process, not a product.

22. Microsoft made a big deal about Windows NT getting a C2 security rating. They were much less forthcoming with the fact that this rating only applied if the computer was not attached to a network and had no network card, and had its floppy drive epoxied shut, and was running on a Compaq 386. Solaris's C2 rating was just as silly.

23. Something that looks like a protocol but does not accomplish a task is not a protocol—it’s a waste of time.

24. If the FBI parks a van bristling with cameras outside your house, you are justified in closing your blinds.