Top all-time · #3
Bruce Schneier
Personal blog · schneier.com/blogsecuritypolitics
Bruce Schneier writes Schneier on Security, a personal blog at schneier.com about security and politics. Since 2007, 2,224 different Hacker News readers have linked it 4,590 times, most often “Data is a Toxic Asset”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Rarely recommended · 2 of 40 sampled comments recommend it?
Why HN links it
HN readers cite Schneier's posts as sources on surveillance, encryption and security theatre. One calls his data-as-toxic-asset post right, and another recommends a RIM security analysis.
- Recommended for · 2 comments
- one calls a RIM security analysis sound; one says he was right that data is a toxic asset
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Data is a Toxic Asset23 people · 32 mentions · first linked 2016-03-04
- Random Number Bug in Debian Linux (2008)22 people · 31 mentions · first linked 2013-07-04
- Write Down Your Password – Schneier on Security21 people · 25 mentions · first linked 2013-09-25
- Schneier on Security: The Security Mindset (2008)21 people · 24 mentions · first linked 2013-04-09
- The Doghouse: Crypteto (2009)21 people · 21 mentions · first linked 2013-06-24
- The Solitaire Encryption Algorithm (1999)19 people · 20 mentions · first linked 2016-07-12
- What LLMs Know About Their Users16 people · 17 mentions · first linked 2013-12-12
- “Schneier's Law”16 people · 16 mentions · first linked 2015-03-27
- Blockchain and Trust15 people · 17 mentions · first linked 2019-02-12
- When Will We See Collisions for SHA-1? (2012)15 people · 16 mentions · first linked 2013-09-10
What Hacker News says?
To all in-love-with-Apple downvoters, please read this Schneier sound analysis of the same type of situation that RIM(Blackberry) has been met with: https://www.schneier.com/blog/archives/2010/08/uae_to_ban_bl... /quote: "RIM's carefully worded statements about BlackBerry security are designed to make their customers feel better, while giving the company ample room to screw them." /endquote I have lost enough points…
Comment linking /blog/archives/2010/08/uae_to_ban_blac.html
on “A Message to Our Customers”Submitted 25 years of mass surveillance is enough as a story · 964 points
HN discussionIndeed, they are related. A 2006 book on eating healthier called "The Pleasure Trap: Mastering the Hidden Force that Undermines Health & Happiness" by Douglas J. Lisle and Alan Goldhamer helped me see that connection (so, actually going the other way at first). And a later book from 2010 called "Supernormal Stimuli: How Primal Urges Overran Their Evolutionary Purpose" by Deirdre Barrett also expanded that idea beyon…
Comment linking /blog/archives/2023/12/ai-and-trust.html
on “GPT-4o”Submitted New NSA Leak Shows MITM Attacks Against Major Internet Services as a story · 656 points
HN discussionIt appears they are using a 2^63 hash operation attack that has been well known for nearly a decade. (Brute force of SHA-1 is 2^69.) I wonder why they did not use the 2^52 operation attack that Schneier noted in 2009? https://www.schneier.com/blog/archives/2009/06/ever_better_c...
Comment linking /blog/archives/2009/06/ever_better_cry.html
on “Announcing the first SHA-1 collision”Submitted It's Time to Break Up the NSA (2014) as a story · 638 points
HN discussion[2012] Schneier - When Will We See Collisions for SHA-1? https://www.schneier.com/blog/archives/2012/10/when_will_we_... Pretty close in his estimation.
Comment linking /blog/archives/2012/10/when_will_we_se.html
on “Announcing the first SHA-1 collision”Submitted Schneier removed from TSA oversight meeting at TSA request as a story · 630 points
HN discussion"What would be on the news if he was a terrorist and they find out that he actually set off the explosives detector before doing his deed?" Yeah, Schneier calls it Cover Your Ass Security . It's not super effective .. https://www.schneier.com/blog/archives/2007/02/cya_security_...
Comment linking /blog/archives/2007/02/cya_security_1.html
on “Don't Fly During Ramadan”Submitted I hate password rules as a story · 564 points
HN discussionLet me put this in other terms. In the world you're talking of, the surveillance happened in person, within a village, with approximately one book per million inhabitants[1], with a typical travel and data transmission speed of roughly 3 mph, a peak of perhaps three times that, exceedingly low literacy (~5% in villages, perhaps 25% in towns[1]), and very low data transmission rates: verbal recitation. Though perhaps…
Comment linking /essays/archives/2016/03/data_is_a_toxic_asse.html
on “CIA malware and hacking tools”Submitted Today I Briefed Congress on the NSA as a story · 537 points
HN discussionThey attacked the Base Management Controller. There's an article by Bruce Schneier from 2013 warning about exactly this attack. Quoting: "Basically, it's a perfect spying platform. You can't control it. You can't patch it. It can completely control your computer's hardware and software. And its purpose is remote monitoring. At the very least, we need to be able to look into these devices and see what's running on th…
Comment linking /blog/archives/2013/01/the_eavesdroppi.html
on “The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple”Submitted The Internet Is a Surveillance State as a story · 528 points
HN discussion> Research we published earlier this year showed that 60% of participants fell victim to artificial intelligence (AI)-automated phishing, which is comparable to the success rates of non-AI-phishing messages created by human experts. Perhaps even more worryingly, our new research demonstrates that the entire phishing process can be automated using LLMs, which reduces the costs of phishing attacks by more than 95% whi…
Comment linking /academic/archives/2024/06/ai-will-increase-the-quantity-and-quality-of-phishing-scams.html
on “My AI skeptic friends are all nuts”Submitted Signal Adds Cryptocurrency Support as a story · 414 points
HN discussionI assume the main reason airlines require ID (for domestic flights) is to prevent ticket resale, and that "security" is just a convenient scapegoat. And I'm not alone[1]. [1] https://www.schneier.com/crypto-gram/archives/2003/0815.html...
Comment linking /crypto-gram/archives/2003/0815.html
on “Reverse engineering Ticketmaster's rotating barcodes”Submitted DOGE as a National Cyberattack as a story · 413 points
HN discussionAll these Ethereum/Namecoin/Whatever solutions aren't really solutions. They're subject to namesquatting, arbitrary prices, arbitrary decisions regarding TLDs and they end up being centralized in the end for various reasons. I think a good solution is to switch to using petnames instead of global names. https://www.schneier.com/blog/archives/2006/02/petnames.html
Comment linking /blog/archives/2006/02/petnames.html
on “Save .org”Submitted Inrupt, Tim Berners-Lee's Solid, and Me as a story · 384 points
HN discussionBruce Schneier had a series of blog posts on that subject, as part of a debate with Sam Harris. Pursuing a strategy that discounts the effects of false negatives leads to whole categories of failures in identifying risks. It's analogous to debates about medical screening - by narrowly focusing on detection, we discount the negative effects of over testing, which can lead to perverse outcomes where we hurt patients m…
Comment linking /blog/archives/2012/05/the_trouble_wit.html
on “Court: Suspicionless Searches of Travelers’ Phones and Laptops Unconstitutional”Submitted Microsoft is spying on users of its AI tools as a story · 367 points
HN discussionIf you've got an automated vetting process with a 99.999% success rate, but are dealing with billions of accounts, that's still tens of thousands of false positives. At that level, "percentage" is an insufficient measure. You want "permillionage", or maybe more colloquially "DPM" for "Defects Per Million" or even "DPB". You'll still get false positives though, so you provide an appeal process. But what's to prevent…
Comment linking /blog/archives/2006/08/security_is_a_t.html
on “Terraria on Stadia cancelled after developer's Google account gets locked”Submitted Banning facial recognition is missing the point as a story · 361 points
HN discussionI don't https://www.schneier.com/crypto-gram/archives/2003/0815.html... https://www.schneier.com/essays/archives/2006/11/the_boardin...
Comment linking /essays/archives/2006/11/the_boarding_pass_br.html
on “Bypassing airport security via SQL injection”Submitted Facebook Plans on Backdooring WhatsApp? as a story · 361 points
HN discussionThis applies fairly universally. As in any company based in country Z and operating in countries A through Y with differing laws. It's an intractable problem that's always been present, but what were once 'edge cases' are now front and centre as a result of technology bringing the world closer together, and therefore highlighting the areas of conflict. Case in point: Australia's law that enforces software companies…
Comment linking /blog/archives/2018/12/new_australian_.html
on “Zoom closes account of U.S.-based Chinese activist after Tiananmen event”Submitted How the Norwegians Reacted to Terrorism as a story · 354 points
HN discussionI generally share a smattering of links like these: Zoom banned from New York City schools due to privacy and security flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-yo... Google Told Its Workers That They Can’t Use Zoom On Their Laptops Anymore https://www.buzzfeednews.com/article/pranavdixit/google-bans... Elon Musk's SpaceX bans Zoom over privacy concerns https://www.reuters.com/article/us-spacex…
Comment linking /blog/archives/2020/04/security_and_pr_1.html
on “Zoom closes account of U.S.-based Chinese activist after Tiananmen event”Submitted Air Gaps as a story · 343 points
HN discussion
