Bruce Schneier Quotes

29 Sourced Quotes

If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology.

Bruce Schneier
People don't understand computers. Computers are magical boxes that do things. People believe what computers tell them.

Bruce Schneier
The whole notion of passwords is based on an oxymoron. The idea is to have a random string that is easy to remember. Unfortunately, if it's easy to remember, it's something nonrandom like 'Susan.' And if it's random, like 'r7U2*Qnp,' then it's not easy to remember.

Bruce Schneier
A colleague once told me that the world was full of bad security systems designed by people who read Applied Cryptography

Bruce Schneier
The system didn't fail in the way the designers expected.

Bruce Schneier
If the goal of security is to protect against yesterday's attacks, we're really good at it.

Bruce Schneier
Something that looks like a protocol but does not accomplish a task is not a protocol—it's a waste of time.

Bruce Schneier
The very definition of news is something that hardly ever happens. If an incident is in the news, we shouldn't worry about it. It's when something is so common that its no longer news - car crashes, domestic violence - that we should worry.

Bruce Schneier
Technical problems can be remediated. A dishonest corporate culture is much harder to fix.

Bruce Schneier
It is poor civic hygiene to install technologies that could someday facilitate a police state.

Bruce Schneier
Cryptography products may be declared illegal, but the information will never be

Bruce Schneier
People make bad security trade-offs when they're scared.

Bruce Schneier
It is insufficient to protect ourselves with laws; we need to protect ourselves with mathematics.

Bruce Schneier
More people are killed every year by pigs than by sharks, which shows you how good we are at evaluating risk.

Bruce Schneier
Only amateurs attack machines; professionals target people.

Bruce Schneier
It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

Bruce Schneier
Microsoft made a big deal about Windows NT getting a C2 security rating. They were much less forthcoming with the fact that this rating only applied if the computer was not attached to a network and had no network card, and had its floppy drive epoxied shut, and was running on a Compaq 386. Solaris's C2 rating was just as silly.

Bruce Schneier
In China, programs have to be certified by the government in order to be used on computers there, which sounds an awful lot like the Apple store.

Bruce Schneier
Despite fearful rhetoric to the contrary, terrorism is not a transcendent threat. A terrorist attack cannot possibly destroy our country's way of life; it's only our reaction to that attack that can do that kind of damage.

Bruce Schneier
The more technological a society is, the greater the security gap is.

Bruce Schneier