Schneier on Security
@schneier.com
📤 1000
đź“Ą 1
đź“ť 305
An automated feed of posts from Bruce Schneier's blog.
https://www.schneier.com/
Friday Squid Blogging: Squid Camouflage New research: Abstract: Coleoid cephalopods have the most elaborate camouflage system in the animal kingdom. This enables them to hide from or deceive both predators and prey. Most studies have focused on benthic species of octopus and cuttlefish, while…
loading . . .
Friday Squid Blogging: Squid Camouflage
New research: Abstract: Coleoid cephalopods have the most elaborate camouflage system in the animal kingdom. This enables them to hide from or deceive both predators and prey. Most studies have focused on benthic species of octopus and cuttlefish, while studies on squid focused mainly on the chromatophore system for communication. Camouflage adaptations to the substrate while moving has been recently described in the semi-pelagic oval squid (Sepioteuthis lessoniana).
http://www.schneier.com/blog/archives/2025/12/friday-squid-blogging-squid-camouflage.html
about 15 hours ago
0
2
1
IoT Hack Someone hacked an Italian ferry. It looks like the malware was installed by someone on the ferry, and not remotely.
loading . . .
IoT Hack
Someone hacked an Italian ferry. It looks like the malware was installed by someone on the ferry, and not remotely.
http://www.schneier.com/blog/archives/2025/12/iot-hack.html
1 day ago
1
2
0
Urban VPN Proxy Surreptitiously Intercepts AI Chats This is pretty scary: Urban VPN Proxy targets conversations across ten AI platforms: ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok (xAI), Meta AI. For each platform, the extension includes a dedicated "executor" script…
loading . . .
Urban VPN Proxy Surreptitiously Intercepts AIÂ Chats
This is pretty scary: Urban VPN Proxy targets conversations across ten AI platforms: ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok (xAI), Meta AI. For each platform, the extension includes a dedicated "executor" script designed to intercept and capture conversations. The harvesting is enabled by default through hardcoded flags in the extension's configuration. There is no user-facing toggle to disable this.
http://www.schneier.com/blog/archives/2025/12/urban-vpn-proxy-surreptitiously-intercepts-ai-chats.html
3 days ago
0
4
5
Denmark Accuses Russia of Conducting Two Cyberattacks News: The Danish Defence Intelligence Service (DDIS) announced on Thursday that Moscow was behind a cyber-attack on a Danish water utility in 2024 and a series of distributed denial-of-service (DDoS) attacks on Danish websites in the lead-up to…
loading . . .
Denmark Accuses Russia of Conducting Two Cyberattacks
News: The Danish Defence Intelligence Service (DDIS) announced on Thursday that Moscow was behind a cyber-attack on a Danish water utility in 2024 and a series of distributed denial-of-service (DDoS) attacks on Danish websites in the lead-up to the municipal and regional council elections in November. The first, it said, was carried out by the pro-Russian group known as Z-Pentest and the second by NoName057(16), which has links to the Russian state. Slashdot thread.
http://www.schneier.com/blog/archives/2025/12/denmark-accuses-russia-of-conducting-two-cyberattacks.html
4 days ago
0
2
2
Microsoft Is Finally Killing RC4 After twenty-six years, Microsoft is finally upgrading the last remaining instance of the encryption algorithm RC4 in Windows. of the most visible holdouts in supporting RC4 has been Microsoft. Eventually, Microsoft upgraded Active Directory to support the much…
loading . . .
Microsoft Is Finally Killing RC4
After twenty-six years, Microsoft is finally upgrading the last remaining instance of the encryption algorithm RC4 in Windows. of the most visible holdouts in supporting RC4 has been Microsoft. Eventually, Microsoft upgraded Active Directory to support the much more secure AES encryption standard. But by default, Windows servers have continued to respond to RC4-based authentication requests and return an RC4-based response.
http://www.schneier.com/blog/archives/2025/12/microsoft-is-finally-killing-rc4.html
5 days ago
0
2
0
Friday Squid Blogging: Petting a Squid Video from Reddit shows what could go wrong when you try to pet a -- looks like a Humboldt -- squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
loading . . .
Friday Squid Blogging: Petting a Squid
Video from Reddit shows what could go wrong when you try to pet a -- looks like a Humboldt -- squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
http://www.schneier.com/blog/archives/2025/12/friday-squid-blogging-petting-a-squid.html
8 days ago
0
3
0
AI Advertising Company Hacked At least some of this is coming to light: Doublespeed, a startup backed by Andreessen Horowitz (a16z) that uses a phone farm to manage at least hundreds of AI-generated social media accounts and promote products has been hacked. The hack reveals what products the…
loading . . .
AI Advertising Company Hacked
At least some of this is coming to light: Doublespeed, a startup backed by Andreessen Horowitz (a16z) that uses a phone farm to manage at least hundreds of AI-generated social media accounts and promote products has been hacked. The hack reveals what products the AI-generated accounts are promoting, often without the required disclosure that these are advertisements, and allowed the hacker to take control of more than 1,000 smartphones that power the company.
http://www.schneier.com/blog/archives/2025/12/ai-advertising-company-hacked.html
8 days ago
1
2
0
Someone Boarded a Plane at Heathrow Without a Ticket or Passport I'm sure there's a story here: Sources say the man had tailgated his way through to security screening and passed security, meaning he was not detected carrying any banned items. The man deceived the BA check-in agent by posing as a…
loading . . .
Someone Boarded a Plane at Heathrow Without a Ticket or Passport
I'm sure there's a story here: Sources say the man had tailgated his way through to security screening and passed security, meaning he was not detected carrying any banned items. The man deceived the BA check-in agent by posing as a family member who had their passports and boarding passes inspected in the usual way.
http://www.schneier.com/blog/archives/2025/12/someone-boarded-a-plane-at-heathrow-without-a-ticket-or-passport.html
9 days ago
0
2
0
Deliberate Internet Shutdowns For two days in September, Afghanistan had no internet. No satellite failed; no cable was cut. This was a deliberate outage, mandated by the Taliban government. It followed a more localized shutdown two weeks prior, reportedly instituted "to prevent immoral…
loading . . .
Deliberate Internet Shutdowns
For two days in September, Afghanistan had no internet. No satellite failed; no cable was cut. This was a deliberate outage, mandated by the Taliban government. It followed a more localized shutdown two weeks prior, reportedly instituted "to prevent immoral activities." No additional explanation was given. The timing couldn't have been worse: communities still reeling from a major earthquake…
http://www.schneier.com/blog/archives/2025/12/deliberate-internet-shutdowns.html
10 days ago
0
3
0
Chinese Surveillance and AI New report: "The Party's AI: How China's New AI Systems are Reshaping Human Rights." From a summary article: China is already the world's largest exporter of AI powered surveillance technology; new surveillance technologies and platforms developed in China are also not…
loading . . .
Chinese Surveillance and AI
New report: "The Party's AI: How China's New AI Systems are Reshaping Human Rights." From a summary article: China is already the world's largest exporter of AI powered surveillance technology; new surveillance technologies and platforms developed in China are also not likely to simply stay there. By exposing the full scope of China's AI driven control apparatus, this report presents clear, evidence based insights for policymakers, civil society, the media and technology companies seeking to counter the rise of AI enabled repression and human rights violations, and China's growing efforts to project that repression beyond its borders.
http://www.schneier.com/blog/archives/2025/12/chinese-surveillance-and-ai.html
11 days ago
0
1
0
Upcoming Speaking Engagements This is a current list of where and when I am scheduled to speak: I’m speaking and signing books at the Chicago Public Library in Chicago, Illinois, USA, at 6:00 PM CT on February 5, 2026. Details to come. I’m speaking at Capricon 44 in Chicago, Illinois, USA. The…
loading . . .
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m speaking and signing books at the Chicago Public Library in Chicago, Illinois, USA, at 6:00 PM CT on February 5, 2026. Details to come. I’m speaking at Capricon 44 in Chicago, Illinois, USA. The convention runs February 5-8, 2026. My speaking time is TBD. I’m speaking at the…
http://www.schneier.com/blog/archives/2025/12/upcoming-speaking-engagements-51.html
13 days ago
0
2
1
Friday Squid Blogging: Giant Squid Eating a Diamondback Squid I have no context for this video -- it's from Reddit -- but one of the commenters adds some context: Hey everyone, squid biologist here! Wanted to add some stuff you might find interesting. With so many people carrying around cameras,…
loading . . .
Friday Squid Blogging: Giant Squid Eating a Diamondback Squid
I have no context for this video -- it's from Reddit -- but one of the commenters adds some context: Hey everyone, squid biologist here! Wanted to add some stuff you might find interesting. With so many people carrying around cameras, we're getting more videos of giant squid at the surface than in previous decades. We're also starting to notice a pattern, that around this time of year (peaking in January) we see a bunch of giant squid around Japan.
http://www.schneier.com/blog/archives/2025/12/friday-squid-blogging-giant-squid-eating-a-diamondback-squid.html
15 days ago
0
0
0
Against the Federal Moratorium on State-Level Regulation of AI Cast your mind back to May of this year: Congress was in the throes of debate over the massive budget bill. Amidst the many seismic provisions, Senator Ted Cruz dropped a ticking time bomb of tech policy: a ten-year moratorium on the…
loading . . .
Against the Federal Moratorium on State-Level Regulation of AI
Cast your mind back to May of this year: Congress was in the throes of debate over the massive budget bill. Amidst the many seismic provisions, Senator Ted Cruz dropped a ticking time bomb of tech policy: a ten-year moratorium on the ability of states to regulate artificial intelligence. To many, this was catastrophic. The few massive AI companies seem to be swallowing our economy whole: their energy demands are overriding household needs, their data demands are overriding creators' copyright, and their products are triggering mass unemployment as well as new types of clinical…
http://www.schneier.com/blog/archives/2025/12/against-the-federal-moratorium-on-state-level-regulation-of-ai.html
15 days ago
1
1
0
Building Trustworthy AI Agents The promise of personal AI assistants rests on a dangerous assumption: that we can trust systems we haven’t made trustworthy. We can’t. And today’s versions are failing us in predictable ways: pushing us to do things against our own best interests, gaslighting us…
loading . . .
Building Trustworthy AIÂ Agents
The promise of personal AI assistants rests on a dangerous assumption: that we can trust systems we haven’t made trustworthy. We can’t. And today’s versions are failing us in predictable ways: pushing us to do things against our own best interests, gaslighting us with doubt about things we are or that we know, and being unable to distinguish between who we are and who we have been.
http://www.schneier.com/blog/archives/2025/12/building-trustworthy-ai-agents.html
15 days ago
0
3
2
AIs Exploiting Smart Contracts I have long maintained that smart contracts are a dumb idea: that a human process is actually a security feature. Here's some interesting research on training AIs to automatically exploit smart contracts: AI models are increasingly good at cyber tasks, as we've…
loading . . .
AIs Exploiting Smart Contracts
I have long maintained that smart contracts are a dumb idea: that a human process is actually a security feature. Here's some interesting research on training AIs to automatically exploit smart contracts: AI models are increasingly good at cyber tasks, as we've written about before. But what is the economic impact of these capabilities? In a recent MATS and Anthropic Fellows project, our scholars investigated this question by evaluating AI agents' ability to exploit smart contracts on…
http://www.schneier.com/blog/archives/2025/12/ais-exploiting-smart-contracts.html
16 days ago
0
3
0
FBI Warns of Fake Video Scams The FBI is warning of AI-assisted fake kidnapping scams: Criminal actors typically will contact their victims through text message claiming they have kidnapped their loved one and demand a ransom be paid for their release. Oftentimes, the criminal actor will express…
loading . . .
FBI Warns of Fake Video Scams
The FBI is warning of AI-assisted fake kidnapping scams: Criminal actors typically will contact their victims through text message claiming they have kidnapped their loved one and demand a ransom be paid for their release. Oftentimes, the criminal actor will express significant claims of violence towards the loved one if the ransom is not paid immediately. The criminal actor will then send what appears to be a genuine photo or video of the victim's loved one, which upon close inspection often reveals inaccuracies when compared to confirmed photos of the loved one.
http://www.schneier.com/blog/archives/2025/12/fbi-warns-of-fake-video-scams.html
17 days ago
0
2
1
AI vs. Human Drivers Two competing arguments are making the rounds. The first is by a neurosurgeon in the New York Times. In an op-ed that honestly sounds like it was paid for by Waymo, the author calls driverless cars a "public health breakthrough": In medical research, there’s a practice of…
loading . . .
AI vs. Human Drivers
Two competing arguments are making the rounds. The first is by a neurosurgeon in the New York Times. In an op-ed that honestly sounds like it was paid for by Waymo, the author calls driverless cars a "public health breakthrough": In medical research, there’s a practice of ending a study early when the results are too striking to ignore. We stop when there is unexpected harm.
http://www.schneier.com/blog/archives/2025/12/ai-vs-human-drivers.html
18 days ago
1
3
0
Substitution Cipher Based on The Voynich Manuscript Here's a fun paper: "The Naibbe cipher: a substitution cipher that encrypts Latin and Italian as Voynich Manuscript-like ciphertext": Abstract: In this article, I investigate the hypothesis that the Voynich Manuscript (MS 408, Yale University…
loading . . .
Substitution Cipher Based on The Voynich Manuscript
Here's a fun paper: "The Naibbe cipher: a substitution cipher that encrypts Latin and Italian as Voynich Manuscript-like ciphertext": Abstract: In this article, I investigate the hypothesis that the Voynich Manuscript (MS 408, Yale University Beinecke Library) is compatible with being a ciphertext by attempting to develop a historically plausible cipher that can replicate the manuscript’s unusual properties. The resulting cipherÂa verbose homophonic substitution cipher I call the Naibbe cipherÂcan be done entirely by hand with 15th-century materials, and when it encrypts a wide range of Latin and Italian plaintexts, the resulting ciphertexts remain fully decipherable and also reliably reproduce many key statistical properties of the Voynich Manuscript at once. My results suggest that the so-called "ciphertext hypothesis" for the Voynich Manuscript remains viable, while also placing constraints on plausible substitution cipher structures.
http://www.schneier.com/blog/archives/2025/12/substitution-cipher-based-on-the-voynich-manuscript.html
19 days ago
0
2
0
Friday Squid Blogging: Vampire Squid Genome The vampire squid (Vampyroteuthis infernalis) has the largest cephalopod genome ever sequenced: more than 11 billion base pairs. That's more than twice as large as the biggest squid genomes. It's technically not a squid: "The vampire squid is a…
loading . . .
Friday Squid Blogging: Vampire Squid Genome
The vampire squid (Vampyroteuthis infernalis) has the largest cephalopod genome ever sequenced: more than 11 billion base pairs. That's more than twice as large as the biggest squid genomes. It's technically not a squid: "The vampire squid is a fascinating twig tenaciously hanging onto the cephalopod family tree. It's neither a squid nor an octopus (nor a vampire), but rather the last, lone remnant of an ancient lineage whose other members have long since vanished." As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
http://www.schneier.com/blog/archives/2025/12/friday-squid-blogging-vampire-squid-genome.html
22 days ago
0
1
0
New Anonymous Phone Service A new anonymous phone service allows you to sign up with just a zip code.
loading . . .
New Anonymous Phone Service
A new anonymous phone service allows you to sign up with just a zip code.
http://www.schneier.com/blog/archives/2025/12/new-anonymous-phone-service.html
22 days ago
0
1
0
Like Social Media, AI Requires Difficult Choices In his 2020 book, "Future Politics," British barrister Jamie Susskind wrote that the dominant question of the 20th century was "How much of our collective life should be determined by the state, and what should be left to the market and civil…
loading . . .
Like Social Media, AI Requires Difficult Choices
In his 2020 book, "Future Politics," British barrister Jamie Susskind wrote that the dominant question of the 20th century was "How much of our collective life should be determined by the state, and what should be left to the market and civil society?" But in the early decades of this century, Susskind suggested that we face a different question: "To what extent should our lives be directed and controlled by powerful digital systems—and on what terms?"
http://www.schneier.com/blog/archives/2025/12/like-social-media-ai-requires-difficult-choices.html
25 days ago
0
4
1
Banning VPNs This is crazy. Lawmakers in several US states are contemplating banning VPNs, because...think of the children! As of this writing, Wisconsin lawmakers are escalating their war on privacy by targeting VPNs in the name of "protecting children" in A.B. 105/S.B. 130. It’s an age…
loading . . .
Banning VPNs
This is crazy. Lawmakers in several US states are contemplating banning VPNs, because...think of the children! As of this writing, Wisconsin lawmakers are escalating their war on privacy by targeting VPNs in the name of "protecting children" in A.B. 105/S.B. 130. It’s an age verification bill that requires all websites distributing material that could conceivably be deemed "sexual content" to both implement an age verification system and also to block the access of users connected via VPN.
http://www.schneier.com/blog/archives/2025/12/banning-vpns.html
26 days ago
0
4
4
Friday Squid Blogging: Flying Neon Squid Found on Israeli Beach A meter-long flying neon squid (Ommastrephes bartramii) was found dead on an Israeli beach. The species is rare in the Mediterranean.
loading . . .
Friday Squid Blogging: Flying Neon Squid Found on Israeli Beach
A meter-long flying neon squid (Ommastrephes bartramii) was found dead on an Israeli beach. The species is rare in the Mediterranean.
http://www.schneier.com/blog/archives/2025/11/friday-squid-blogging-flying-neon-squid-found-on-israeli-beach.html
29 days ago
0
1
0
Prompt Injection Through Poetry In a new paper, "Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models," researchers found that turning LLM prompts into poetry resulted in jailbreaking the models:
loading . . .
Prompt Injection Through Poetry
In a new paper, "Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models," researchers found that turning LLM prompts into poetry resulted in jailbreaking the models: <blockquoteAbstract: We present evidence that adversarial poetry functions as a universal single-turn jailbreak technique for Large Language Models (LLMs). Across 25 frontier proprietary and open-weight models, curated poetic prompts yielded high attack-success rates (ASR), with some providers exceeding 90%.
http://www.schneier.com/blog/archives/2025/11/prompt-injection-through-poetry.html
29 days ago
0
2
1
Huawei and Chinese Surveillance This quote is from House of Huawei: The Secret History of China's Most Powerful Company. "Long before anyone had heard of Ren Zhengfei or Huawei, Wan Runnan had been China's star entrepreneur in the 1980s, with his company, the Stone Group, touted as "China's IBM."…
loading . . .
Huawei and Chinese Surveillance
This quote is from House of Huawei: The Secret History of China's Most Powerful Company. "Long before anyone had heard of Ren Zhengfei or Huawei, Wan Runnan had been China's star entrepreneur in the 1980s, with his company, the Stone Group, touted as "China's IBM." Wan had believed that economic change could lead to political change. He had thrown his support behind the pro-democracy protesters in 1989.
http://www.schneier.com/blog/archives/2025/11/huawei-and-chinese-surveillance.html
about 1 month ago
0
1
0
Four Ways AI Is Being Used to Strengthen Democracies Worldwide Democracy is colliding with the technologies of artificial intelligence. Judging from the audience reaction at the recent World Forum on Democracy in Strasbourg, the general expectation is that democracy will be the worse for it. We…
loading . . .
Four Ways AI Is Being Used to Strengthen Democracies Worldwide
Democracy is colliding with the technologies of artificial intelligence. Judging from the audience reaction at the recent World Forum on Democracy in Strasbourg, the general expectation is that democracy will be the worse for it. We have another narrative. Yes, there are risks to democracy from AI, but there are also opportunities. We have just published the book Rewiring Democracy: How AI will Transform Politics, Government, and Citizenship…
http://www.schneier.com/blog/archives/2025/11/four-ways-ai-is-being-used-to-strengthen-democracies-worldwide.html
about 1 month ago
0
2
1
IACR Nullifies Election Because of Lost Decryption Key The International Association of Cryptologic Research -- the academic cryptography association that's been putting conferences like Crypto (back when "crypto" meant "cryptography") and Eurocrypt since the 1980s -- had to nullify an online…
loading . . .
IACR Nullifies Election Because of Lost Decryption Key
The International Association of Cryptologic Research -- the academic cryptography association that's been putting conferences like Crypto (back when "crypto" meant "cryptography") and Eurocrypt since the 1980s -- had to nullify an online election when trustee Moti Yung lost his decryption key. For this election and in accordance with the bylaws of the IACR, the three members of the IACR 2025 Election Committee acted as independent trustees, each holding a portion of the cryptographic key material required to jointly decrypt the results.
http://www.schneier.com/blog/archives/2025/11/iacr-nullifies-election-because-of-lost-decryption-key.html
about 1 month ago
0
3
0
Friday Squid Blogging: New “Squid” Sneaker I did not know Adidas sold a sneaker called "Squid." As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
loading . . .
Friday Squid Blogging: New “Squid” Sneaker
I did not know Adidas sold a sneaker called "Squid." As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
http://www.schneier.com/blog/archives/2025/11/friday-squid-blogging-new-squid-sneaker.html
about 1 month ago
0
2
0
More on Rewiring Democracy It's been a month since Rewiring Democracy: How AI Will Transform Our Politics, Government, and Citizenship was published. From what we know, sales are good. Some of the book's forty-three chapters are available online: chapters 2, 12, 28, 34, 38, and 41. We need more…
loading . . .
More on Rewiring Democracy
It's been a month since Rewiring Democracy: How AI Will Transform Our Politics, Government, and Citizenship was published. From what we know, sales are good. Some of the book's forty-three chapters are available online: chapters 2, 12, 28, 34, 38, and 41. We need more reviews -- six on Amazon is not enough, and no one has yet posted a viral TikTok review.
http://www.schneier.com/blog/archives/2025/11/71226.html
about 1 month ago
0
1
0
AI as Cyberattacker From Anthropic: In mid-September 2025, we detected suspicious activity that later investigation determined to be a highly sophisticated espionage campaign. The attackers used AI’s “agentic” capabilities to an unprecedented degree -- using AI not just as an advisor, but to…
loading . . .
AI as Cyberattacker
From Anthropic: In mid-September 2025, we detected suspicious activity that later investigation determined to be a highly sophisticated espionage campaign. The attackers used AI’s “agentic” capabilities to an unprecedented degree -- using AI not just as an advisor, but to execute the cyberattacks themselves. The threat actor -- Âwhom we assess with high confidence was a Chinese state-sponsored group -- Âmanipulated our Claude Code tool into attempting infiltration into roughly thirty global targets and succeeded in a small number of cases.
http://www.schneier.com/blog/archives/2025/11/ai-as-cyberattacker.html
about 1 month ago
1
2
0
Liars and Outliers (Paperback) NOTE: I'm teaching at the University of Toronto this school year, and will sign and ship books when I visit the US. Expect considerable delays.
loading . . .
Liars and Outliers (Paperback)
NOTE: I'm teaching at the University of Toronto this school year, and will sign and ship books when I visit the US. Expect considerable delays.
http://www.schneier.com/product/liars-and-outliers-paperback/
about 1 month ago
0
3
0
Scam USPS and E-Z Pass Texts and Websites Google has filed a complaint in court that details the scam: In a complaint filed Wednesday, the tech giant accused "a cybercriminal group in China" of selling "phishing for dummies" kits. The kits help unsavvy fraudsters easily “execute a large-scale…
loading . . .
Scam USPS and E-Z Pass Texts and Websites
Google has filed a complaint in court that details the scam: In a complaint filed Wednesday, the tech giant accused "a cybercriminal group in China" of selling "phishing for dummies" kits. The kits help unsavvy fraudsters easily “execute a large-scale phishing campaign,” tricking hordes of unsuspecting people into “disclosing sensitive information like passwords, credit card numbers, or banking information, often by impersonating well-known brands, government agencies, or even people the victim knows.”
http://www.schneier.com/blog/archives/2025/11/scam-usps-and-e-z-pass-texts-and-websites.html
about 1 month ago
0
1
1
Legal Restrictions on Vulnerability Disclosure Kendra Albert gave an excellent talk at USENIX Security this year, pointing out that the legal agreements surrounding vulnerability disclosure muzzle researchers while allowing companies to not fix the vulnerabilities -- exactly the opposite of what…
loading . . .
Legal Restrictions on Vulnerability Disclosure
Kendra Albert gave an excellent talk at USENIX Security this year, pointing out that the legal agreements surrounding vulnerability disclosure muzzle researchers while allowing companies to not fix the vulnerabilities -- exactly the opposite of what the responsible disclosure movement of the early 2000s was supposed to prevent. This is the talk. Thirty years ago, a debate raged over whether vulnerability disclosure was good for computer security.
http://www.schneier.com/blog/archives/2025/11/legal-restrictions-on-vulnerability-disclosure.html
about 1 month ago
0
0
0
AI and Voter Engagement Social media has been a familiar, even mundane, part of life for nearly two decades. It can be easy to forget it was not always that way. In 2008, social media was just emerging into the mainstream. Facebook reached 100 million users that summer. And a singular candidate…
loading . . .
AI and Voter Engagement
Social media has been a familiar, even mundane, part of life for nearly two decades. It can be easy to forget it was not always that way. In 2008, social media was just emerging into the mainstream. Facebook reached 100 million users that summer. And a singular candidate was integrating social media into his political campaign: Barack Obama. His campaign's use of social media was so bracingly innovative, so impactful, that it was viewed by journalist…
https://www.schneier.com/blog/archives/2025/11/ai-and-voter-engagement.html
about 1 month ago
0
1
0
More Prompt||GTFO The next three in this series on online events highlighting interesting uses of AI in cybersecurity are online: #4, #5, and #6. Well worth watching.
loading . . .
More Prompt||GTFO
The next three in this series on online events highlighting interesting uses of AI in cybersecurity are online: #4, #5, and #6. Well worth watching.
https://www.schneier.com/blog/archives/2025/11/more-promptgtfo.html
about 1 month ago
1
1
1
Friday Squid Blogging: Pilot Whales Eat a Lot of Squid Short-finned pilot wales (Globicephala macrorhynchus) eat at lot of squid: To figure out a short-finned pilot whale's caloric intake, Gough says, the team had to combine data from a variety of sources, including movement data from…
loading . . .
Friday Squid Blogging: Pilot Whales Eat a Lot of Squid
Short-finned pilot wales (Globicephala macrorhynchus) eat at lot of squid: To figure out a short-finned pilot whale's caloric intake, Gough says, the team had to combine data from a variety of sources, including movement data from short-lasting tags, daily feeding rates from satellite tags, body measurements collected via aerial drones, and sifting through the stomachs of unfortunate whales that ended up stranded on land.
https://www.schneier.com/blog/archives/2025/11/friday-squid-blogging-pilot-whales-eat-a-lot-of-squid.html
about 1 month ago
0
1
0
Upcoming Speaking Engagements This is a current list of where and when I am scheduled to speak: My coauthor Nathan E. Sanders and I are speaking at the Rayburn House Office Building in Washington, DC at noon ET on November 17, 2025. The event is hosted by the POPVOX Foundation and the topic is “AI…
loading . . .
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: My coauthor Nathan E. Sanders and I are speaking at the Rayburn House Office Building in Washington, DC at noon ET on November 17, 2025. The event is hosted by the POPVOX Foundation and the topic is “AI and Congress: Practical Steps to Govern and Prepare…
https://www.schneier.com/blog/archives/2025/11/upcoming-speaking-engagements-50.html
about 1 month ago
0
1
0
The Role of Humans in an AI-Powered World As AI capabilities grow, we must delineate the roles that should remain exclusively human. The line seems to be between fact-based decisions and judgment-based decisions. For example, in a medical context, if an AI was demonstrably better at reading a test…
loading . . .
The Role of Humans in an AI-Powered World
As AI capabilities grow, we must delineate the roles that should remain exclusively human. The line seems to be between fact-based decisions and judgment-based decisions. For example, in a medical context, if an AI was demonstrably better at reading a test result and diagnosing cancer than a human, you would take the AI in a second. You want the more accurate tool.
https://www.schneier.com/blog/archives/2025/11/the-role-of-humans-in-an-ai-powered-world.html
about 1 month ago
1
2
3
Book Review: The Business of Secrets The Business of Secrets: Adventures in Selling Encryption Around the World by Fred Kinch (May 24, 2004) From the vantage point of today, it's surreal reading about the commercial cryptography business in the 1970s. Nobody knew anything. The manufacturers didn't…
loading . . .
Book Review: The Business of Secrets
The Business of Secrets: Adventures in Selling Encryption Around the World by Fred Kinch (May 24, 2004) From the vantage point of today, it's surreal reading about the commercial cryptography business in the 1970s. Nobody knew anything. The manufacturers didn't know whether the cryptography they sold was any good. The customers didn't know whether the crypto they bought was any good.
https://www.schneier.com/blog/archives/2025/11/book-review-the-business-of-secrets.html
about 1 month ago
0
2
1
On Hacking Back Former DoJ attorney John Carlin writes about hackback, which he defines thus: "A hack back is a type of cyber response that incorporates a counterattack designed to proactively engage with, disable, or collect evidence about an attacker. Although hack backs can take on various…
loading . . .
On Hacking Back
Former DoJ attorney John Carlin writes about hackback, which he defines thus: "A hack back is a type of cyber response that incorporates a counterattack designed to proactively engage with, disable, or collect evidence about an attacker. Although hack backs can take on various forms, they are -- Âby definition -- not passive defensive measures." His conclusion: As the law currently stands, specific forms of purely defense measures are authorized so long as they affect only the victim’s system or data.
https://www.schneier.com/blog/archives/2025/11/on-hacking-back.html
about 2 months ago
0
0
0
Prompt Injection in AI Browsers This is why AIs are not ready to be personal assistants: A new attack called 'CometJacking' exploits URL parameters to pass to Perplexity's Comet AI browser hidden instructions that allow access to sensitive data from connected services, like email and calendar. In…
loading . . .
Prompt Injection in AIÂ Browsers
This is why AIs are not ready to be personal assistants: A new attack called 'CometJacking' exploits URL parameters to pass to Perplexity's Comet AI browser hidden instructions that allow access to sensitive data from connected services, like email and calendar. In a realistic scenario, no credentials or user interaction are required and a threat actor can leverage the attack by simply exposing a maliciously crafted URL to targeted users.
https://www.schneier.com/blog/archives/2025/11/prompt-injection-in-ai-browsers.html
about 2 months ago
0
3
1
New Attacks Against Secure Enclaves Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I've written about this before: Almost all cloud services have to perform some computation on our data. Even the simplest storage…
loading . . .
New Attacks Against Secure Enclaves
Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I've written about this before: Almost all cloud services have to perform some computation on our data. Even the simplest storage provider has code to copy bytes from an internal storage system and deliver them to the user.
https://www.schneier.com/blog/archives/2025/11/new-attacks-against-secure-enclaves.html
about 2 months ago
0
1
2
Friday Squid Blogging: Squid Game: The Challenge, Season Two The second season of the Netflix reality competition show Squid Game: The Challenge has dropped. (Too many links to pick a few -- search for it.) As usual, you can also use this squid post to talk about the security stories in the news…
loading . . .
Friday Squid Blogging: Squid Game: The Challenge, Season Two
The second season of the Netflix reality competition show Squid Game: The Challenge has dropped. (Too many links to pick a few -- search for it.) As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
https://www.schneier.com/blog/archives/2025/11/friday-squid-blogging-squid-game-the-challenge-season-two.html
about 2 months ago
0
0
0
Faking Receipts with AI Over the past few decades, it's become easier and easier to create fake receipts. Decades ago, it required special paper and printers -- I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized,…
loading . . .
Faking Receipts with AI
Over the past few decades, it's become easier and easier to create fake receipts. Decades ago, it required special paper and printers -- I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required some artistic skills to make the page look realistic. Now, AI can…
https://www.schneier.com/blog/archives/2025/11/faking-receipts-with-ai.html
about 2 months ago
2
3
0
Rigged Poker Games The Department of Justice has indicted thirty-one people over the high-tech rigging of high-stakes poker games. In a typical legitimate poker game, a dealer uses a shuffling machine to shuffle the cards randomly before dealing them to all the players in a particular order. As…
loading . . .
Rigged Poker Games
The Department of Justice has indicted thirty-one people over the high-tech rigging of high-stakes poker games. In a typical legitimate poker game, a dealer uses a shuffling machine to shuffle the cards randomly before dealing them to all the players in a particular order. As set forth in the indictment, the rigged games used altered shuffling machines that contained hidden technology allowing the machines to read all the cards in the deck.
https://www.schneier.com/blog/archives/2025/11/rigged-poker-games.html
about 2 months ago
1
2
1
Scientists Need a Positive Vision for AI For many in the research community, it's gotten harder to be optimistic about the impacts of artificial intelligence. As authoritarianism is rising around the world, AI-generated "slop" is overwhelming legitimate media, while AI-generated deepfakes are…
loading . . .
Scientists Need a Positive Vision for AI
For many in the research community, it's gotten harder to be optimistic about the impacts of artificial intelligence. As authoritarianism is rising around the world, AI-generated "slop" is overwhelming legitimate media, while AI-generated deepfakes are spreading misinformation and parroting extremist messages. AI is making warfare more precise and deadly amidst intransigent conflicts. AI companies are exploiting people in the global South who work as data labelers, and profiting from content creators worldwide by using their work without license or compensation.
https://www.schneier.com/blog/archives/2025/11/scientists-need-a-positive-vision-for-ai.html
about 2 months ago
0
1
0
Cybercriminals Targeting Payroll Sites Microsoft is warning of a scam involving online payroll systems. Criminals use social engineering to steal people's credentials, and then divert direct deposits into accounts that they control. Sometimes they do other things to make it harder for the victim…
loading . . .
Cybercriminals Targeting Payroll Sites
Microsoft is warning of a scam involving online payroll systems. Criminals use social engineering to steal people's credentials, and then divert direct deposits into accounts that they control. Sometimes they do other things to make it harder for the victim to realize what is happening. I feel like this kind of thing is happening everywhere, with everything. As we move more of our personal and professional lives online, we enable criminals to subvert the very systems we rely on.
https://www.schneier.com/blog/archives/2025/11/cybercriminals-targeting-payroll-sites.html
about 2 months ago
0
1
2
AI Summarization Optimization These days, the most important meeting attendee isn’t a person: It’s the AI notetaker. This system assigns action items and determines the importance of what is said. If it becomes necessary to revisit the facts of the meeting, its summary is treated as impartial…
loading . . .
AI Summarization Optimization
These days, the most important meeting attendee isn’t a person: It’s the AI notetaker. This system assigns action items and determines the importance of what is said. If it becomes necessary to revisit the facts of the meeting, its summary is treated as impartial evidence. But clever meeting attendees can manipulate this system’s record by speaking more to what the underlying AI weights for summarization and importance than to their colleagues.
https://www.schneier.com/blog/archives/2025/11/ai-summarization-optimization.html
about 2 months ago
0
2
1
Friday Squid Blogging: Giant Squid at the Smithsonian I can't believe that I haven't yet posted this picture of a giant squid at the Smithsonian. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
loading . . .
Friday Squid Blogging: Giant Squid at the Smithsonian
I can't believe that I haven't yet posted this picture of a giant squid at the Smithsonian. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.
https://www.schneier.com/blog/archives/2025/10/friday-squid-blogging-giant-squid-at-the-smithsonian.html
about 2 months ago
0
1
0
Will AI Strengthen or Undermine Democracy? Listen to the Audio on NextBigIdeaClub.com Below, co-authors Bruce Schneier and Nathan E. Sanders share five key insights from their new book, Rewiring Democracy: How AI Will Transform Our Politics, Government, and Citizenship. What's the big idea? AI can…
loading . . .
Will AI Strengthen or Undermine Democracy?
Listen to the Audio on NextBigIdeaClub.com Below, co-authors Bruce Schneier and Nathan E. Sanders share five key insights from their new book, Rewiring Democracy: How AI Will Transform Our Politics, Government, and Citizenship. What's the big idea? AI can be used both for and against the public interest within democracies. It is already being used in the governing of nations around the world, and there is no escaping its continued use in the future by leaders, policy makers, and legal enforcers.
https://www.schneier.com/blog/archives/2025/10/will-ai-strengthen-or-undermine-democracy.html
about 2 months ago
0
1
0
Load more
feeds!
log in
