[{"_1":2,"_31":-5,"_32":-5},"loaderData",{"_3":4},"routes/__layout/tag.$name",{"_5":6,"_7":8},"tagName","air travel","posts",[9],{"_10":11,"_12":13,"_14":15,"_16":17,"_18":19,"_20":21,"_22":23,"_24":25,"_26":-5,"_27":28,"_29":30},"id",183,"title","Two related thoughts, part 1: DVDs and airline security","excerpt","The DVD industry's CSS encryption failed because they had to give users the tools to decrypt it. Airline security has the same flaw: publishing the rules tells attackers exactly what to work around. Security theater with a known ruleset is just a temporary inconvenience for a determined adversary.","body","\r\n\r\n

Case A:

\r\n

It's the late 90s. The DVD industry, worried about the security of their copyrights, creates a method of encrypting the movies on DVDs. Called CSS, this is supposed to prevent people copying DVDs. However, the industry still needs people to be able to play the DVDs in their legitimate players and on their DVD-equipped computers. Therefore, they have to give these very same people whom they don't trust not to violate copyrights the tools to unencrypt their encrypted copyrighted works.\r\n\r\n

Naturally, in reasonably short order, somebody reverse-engineers these tools and works out how to send the movies anywhere -- like another DVD, or their hard drive -- not just to the screen. Called DeCSS, this effectively ends any hope the industry has of technically restricting copyright violation, although they do briefly attempt legal restrictions, chiefly by making it illegal to use the software (or even link to it).\r\n\r\n

However, it is soon pointed out that the software is based on ideas so simple they can be expressed in any number of ways: a diagram, a movie, even an epic Haiku poem.\r\n\r\n

The DeCSS fiasco is rightfully viewed as one of the more outstanding moments in the recording and movie industry's long history of technological cluelessness.\r\n\r\n

Case B:

\r\n\r\n

It's 2006. The airline industry, worried about airline security, creates a systems of checks and controls to prevent people with dangerous items boarding planes. However, they still want ordinary customers to be able to board planes without inconvenience. Therefore, they give these same possibly potentially terrorist passengers a list of rules about what items can and cannot make it onboard a plane, so they don't accidentally pack things in the wrong bag and create delays.\r\n\r\n

This is fundamentally the same problem. You cannot attempt to bar certain items from the plane if people are aware of the rules you use to determine what goes on board, the system you use to detect the items, and the methods you use to search. Therefore, it is only a matter of time before somebody works out a way of creating an explosive or other dangerous device that still fits within these rules.\r\n\r\n

It doesn't matter that we can't take suncream and toothpaste on board anymore. It makes us safer only for the couple of months it takes for some reasonably clever person somewhere to come up with a way of getting around the system.","updated",["D",1157651012000],"created",["D",1157651012000],"codename","two_related_thoughts_part_1_dvds_and_airline_security","legacy_id","3516","thumbnailUrl","published",["D",1157651012000],"draft",false,"actionData","errors"]

Posts tagged “air travel”