Hacker News new | ask | show | jobs
by zactral 4629 days ago
It is completely possible that mentioning Windows in the article was meant to be only a smokescreen. I'm sure a person in his position would absolutely not want to publicly declare the exact solution he is using. In reality, it might as well be something completely else, like Slackware or some USB-bootable distro. Yes, this might be security through obscurity but considering that he admitted that he isn't familiar with the inner workings of Truecrypt etc, it is the safest bet. Not disclosing what exactly you are using doesn't allow an adversary with unlimited resources to adapt and optimize to break this specific scheme.
2 comments
dublinben 4629 days ago
I have no insight into Schneier's top security setup, but I know for a fact he uses Windows on a regular basis. His portable computer is a standard Sony Vaio runing Windows.
link
hyperpape 4629 days ago
That doesn't seem plausible. He could non-specifically say "don't use Windows. Ideally use [some stock linux distro] or investigate other unix operating systems that can be configured for safety." That wouldn't really give away anything.
link
aliakbarkhan 4629 days ago
It's not about giving things away -- it's about delaying your adversary. If the NSA takes Schneier at his word and targets him accordingly, then (assuming this is a diversionary tactic) any 0days or other attacks they attempt to send his way will fail. Now obviously that's not a long-term strategy, but it does provide an extra layer of protection against naïve attacks based on his public statements. To be clear, I'm not sure I buy the smokescreen idea, either, but your reason for disbelieving is flawed.
link
hyperpape 4629 days ago
It's fair that this would make some difference. But it's not as "he's not on Windows, but we have no clue what he is on?" is a recipe for quick success. He doesn't have to say what linux distro he uses, just give a placeholder for a decent one, and he doesn't even have to use Linux.

In any case, is it worth potentially misleading a lot of people for the sake of such a marginal increase in his own security? He could have an even more secure setup if he didn't talk about instituting an air gap. He's already giving away information.

link