BYOI (Bring You Own Identity):To serve and protect (or not?)

2 Flares Twitter 0 Facebook 0 LinkedIn 0 Buffer 2 Email -- 2 Flares ×

BYOI is a series I’ve decided to create to “talk” about #identitymanagement so it is about #security, #governance, #management and many other aspects of the #IAM realm.

“We change our behavior when the pain of staying the same becomes greater than the pain of changing. Consequences give us the pain that motivates us to change.”
― Henry Cloud

36288_01_google_begins_encrypting_search_results_especially_in_china_full Tweaktown image

I’m not going to write my first post of 2015 on what happened in Paris recently, neither want to introduce a new chapter on my blog post talking about politics but reading the news this morning I felt the urge to write this.

from the news this morning:

The British prime minister David Cameron has suggested that if his Conservative Party wins the upcoming general election, it will not allow encrypted communications that cannot be read by the security services.

that was immediately “linked” to:

Vladimir Putin has promised a “comprehensive piece of legislation” to close the “safe spaces” used by suspected terrorists to communicate online with each other.

If he wins the election, Mr Putin said he would increase the authorities’ power to access both the details of communications and their content.

of course they are not the only two who will propose, and unfortunately, in some cases succeed down this path. This is a long time historical behavior as the incipit in this blog post says “consequences give us the pain that motivates us to change…”.

Let me try to put all this in context.

Security of people and as direct relation of nations are related to the capability of control who gets in and who act and how if one (the police) suspect this one may be a potential danger for the nation itself.

In an old post of mine I used to associate a Swiss regulation date 1200 a.d to manage the common tenure of land ( to the use of BYOD into corporate networks. The post was directly related on how introducing a regulation that was too strict or too loose ended up in a failure.

If we consider this to the public results of the “alcohol prohibition regulation” in US ( we will notice that an excessive reaction to a problem lead, in the end to the failure of the policy itself.

why end-to-end encryption traffic is not the problem

Let’s take this clear, the issue is not about the traffic itself but who is going to use it, period.

If I have to monitor 1500 suspect every single day in real time, the issue is not about what they use but how many resources I need to establish to be able to control them. It’s not about the volume of data that makes the difference but the quality we may obtain from it so in the very end what we really need is to put things in context and define a different strategy.

In another post I used the fuzzy square to define the risk analysis approach so I’ll make a new use of it to explain my point here.

Let say that monitor a suspect is, in the very end, a binary decision:

  • we will assume the value of 1 if a certain thing is going to happen
  • we will assume the value of 0 if a certain thing is not going to happen

based on this we have the following use cases:

  • the suspect will start offensive action
  • the location is known
  • the suspect will not start an offensive action
  • the location is unknown

as you may see the “provider” of the communication is not mentioned so far.

Our fuzzy square appear like this:


we assume that our resources are in a number sufficient to control every single possibility that appears along the line. Now based on this what is  the point below?


If I am a you I would say that the most common sense hypothesis maybe:

  • the use of an end-to-end encryption transmission to communicate to the third party the location of the attack
  • the use of a new electronic identity to start the attack
  • the use of a location outside the nation boundaries to start the attack
  • the use of another attacker to start the real action

may be one of this or even all of them, our square appears this way now:


The easiest path would be to ban all the potential threat like end-to-end encryption with only a small problem.

well let me use one of the most known quotes in the realm of security to explain this:

“Good luck, I’m behind 7 proxies”

banning a known transmission protocol or software will simply move the point from the perimeter to the center it’s a context shift not a solution.

If we add the variable of the “unknown” status simply restricting this to a specific context like end-to-end encryption transmission our square will appears like this:


Where the possible variables are:

  • I know the method
  • I don’t know how to “read” the message
  • I know how to “read” the message
  • I don’t know the method

It exist four context square of  that have as center point the four angles of the fuzzy square. Based on this it’s clear that ban the method does not solve anything if not simply add more variables to control instead of reducing them. Like any “honey pot” if I subtract the attacker will add so my strategy should be not to restrict but to attract the attacker.

Based on the point we just reached we may understand now what we miss in the picture that is not the context but the behavior. I don’t know the method used but I know why an attacker should prefer a method against another. Like for the context a behavioral context square exist and solve the following use cases:

  • I know why the attacker should behave like this
  • I don’t know why the attacker should behave like this
  • I know when the attacker will behave like this
  • I don’t know when the attacker will behave like this

our square will seems like this now:


What demonstrate this? that it’s not about the number of resource or the level of restriction of the policy that will help, it’s a non solvable problem if approached this way. So our politics should start to look back at the history and learn from the past instead of blindly act in the urge to “fix” things.

The freedom to communicate has an important value that is double linked to the freedom of expression and ban any free method of communication will simply lead people to find other “ways” like already happen with the various anonymous proxy, browser etc, helping, in the very end, the attacker strategy.

“We change our behavior when the pain of staying the same becomes greater than the pain of changing. Consequences give us the pain that motivates us to change.”
― Henry Cloud


This quote is about change not restrict…it’s about find a way to change things not damage them.

sorry if this is not a proper post about identity management but just a rant, but in the end this is what about a blog..the freedom to rant sometimes.