Little Brother

throwaway email address from one of the new Brazilian anonymizers.
    > Found her, thanks. You didn't tell me she was so h4wt.
    "Who's that from?"
    I laughed. "Zeb," I said. "Remember Zeb? I gave him Masha's email address. I figured, if they're both underground, might as well introduce them to one another."
    "He thinks Masha is cute ?"
    "Give the guy a break, he's clearly had his mind warped by circumstances."
    "And you?"
    "Me?"
    "Yeah — was your mind warped by circumstances?"
    I held Ange out at arm's length and looked her up and down and up and down. I held her cheeks and stared through her thick-framed glasses into her big, mischievous tilted eyes. I ran my fingers through her hair.
    "Ange, I've never thought more clearly in my whole life."
    She kissed me then, and I kissed her back, and it was some time before we went out for that burrito.

Afterword by Bruce Schneier

    I'm a security technologist. My job is making people secure.
    I think about security systems and how to break them. Then, how to make them more secure. Computer security systems. Surveillance systems. Airplane security systems and voting machines and RFID chips and everything else.
    Cory invited me into the last few pages of his book because he wanted me to tell you that security is fun. It's incredibly fun. It's cat and mouse, who can outsmart whom, hunter versus hunted fun. I think it's the most fun job you can possibly have. If you thought it was fun to read about Marcus outsmarting the gait-recognition cameras with rocks in his shoes, think of how much more fun it would be if you were the first person in the world to think of that.
    Working in security means knowing a lot about technology. It might mean knowing about computers and networks, or cameras and how they work, or the chemistry of bomb detection. But really, security is a mindset. It's a way of thinking. Marcus is a great example of that way of thinking. He's always looking for ways a security system fails. I'll bet he couldn't walk into a store without figuring out a way to shoplift. Not that he'd do it — there's a difference between knowing how to defeat a security system and actually defeating it — but he'd know he could.
    It's how security people think. We're constantly looking at security systems and how to get around them; we can't help it.
    This kind of thinking is important no matter what side of security you're on. If you've been hired to build a shoplift-proof store, you'd better know how to shoplift. If you're designing a camera system that detects individual gaits, you'd better plan for people putting rocks in their shoes. Because if you don't, you're not going to design anything good.
    So when you're wandering through your day, take a moment to look at the security systems around you. Look at the cameras in the stores you shop at. (Do they prevent crime, or just move it next door?) See how a restaurant operates. (If you pay after you eat, why don't more people just leave without paying?) Pay attention at airport security. (How could you get a weapon onto an airplane?) Watch what the teller does at a bank. (Bank security is designed to prevent tellers from stealing just as much as it is to prevent you from stealing.) Stare at an anthill. (Insects are all about security.) Read the Constitution, and notice all the ways it provides people with security against government. Look at traffic lights and door locks and all the security systems on television and in the movies. Figure out how they work, what threats they protect against and what threats they don't, how they fail, and how they can be exploited.
    Spend enough time doing this, and you'll find yourself thinking differently about the world. You'll start noticing that many of the security systems out there don't actually do what they claim to, and that much of our national security is a waste of money. You'll understand privacy as essential to security, not in opposition. You'll stop worrying about things other people worry about, and start worrying about things other people don't even think about.
    Sometimes you'll notice something about security that no one has ever thought about before. And maybe you'll figure out a new way to break a security system.
    It was only a few years ago that someone invented phishing.
    I'm frequently amazed how easy it is to break some pretty big-name security systems. There are a lot of reasons for this, but the big one is that it's impossible to prove that something is secure. All you