(1909) Edward and Derek Meet

[Derek Menzies]

"I thought it prudent to save you the trouble of seeking me out since the last Court gathering. As you've no doubt heard, I too have been inducted into the cult of the machine, as it were. You mentioned to the Hierophant that you work in Cybersecurity, correct? I myself have been known to wear hats of varying colors."

"Tell me, what do you think of Fido 2's development of WebAuthn and the shift towards biometrics as an encryption standard? Particularly how you expect it may effect Kindred use of personal devices?" he asks curiously.

[Edward Heinrich]

He chuckled at hearing his own joke thrown back at him. At the mention of hats, he nodded, "haven't we all."

It was hard to know how expert Derek was, there were many fraudsters in the business, and as so many were self-taught only about half recognized they were fraudsters. His referencing of Biometrics as "an encryption standard" rather than access control was concerning.
Start slow, then increase the tempo. Let's see if I want to work with you, Mr. Mitnik.

"I admire the goal, but the solution is myopic. The vast majority of failures are from social engineering. Part of the art of creating an effective security system is user-proofing. With that mindset, it's a bad idea to give users a single device which can only be accessed a single way, which contains all their passwords. For any usability, this will require a backdoor, but such a backdoor is the introduction of an exploit. An exploit that will reveal all user passwords if ever found. Imagine the incentive for governments and cybercriminals to find such a backdoor. With that much incentive, it's only a matter of time." He had slipped into his work voice, toneless and rhythmic.

"As for Biometrics, universal adoption will cause a sharp increase in kidnappings. Especially if the WebAuthn is adopted. Further, unless the laws are changed, I wouldn't recommend it. The courts can demand your body, but the first amendment protects passwords."

"For us Kindred, the most promising lines of research in Biometrics don't require we be alive. I don't foresee issues unless countermeasures against using dead bodies are introduced, which wouldn't surprise me although offhand I can't think of any effective ones." Didn't want to give bad incentives to bad actors.

He smiled in a way that turned his face into something between apologetic and ironic, "I have not looked into the matter with great depth. For the last few years I've been working mostly with legacy systems, and so I'm not as up to date as I'd like to be. Does the matter interest you? What are your thoughts?"

[Derek Menzies]

Derek remembers there being quite the controversy over governments installing backdoors in smart phones several years ago. But kidnapping is an interesting choice for a workaround.

"I have the same problem. It's very difficult to keep up with the progress of the Kine's march towards modernizing. New standards, trends, and platforms emerge overnight only to reinvent the web a decade later. But by the sound of it, you believe there will always be vulnerabilities to exploit. I do believe the WebAuthn standard will be adopted over time. Ecommerce, the race for 5G, high-profile data breaches, it all creates a demand for consumer reassurances. Looking ahead to solutions for it is simply a necessity. Though interesting you mention backdoors. Ever hear of Triada? A Trojan installed by third-parties during the production process, effectively making a factory fitted backdoor on Android phones. Pretty advanced stuff."

Derek shrugs, trying to downplay his excitement. "Sorry to bring up such a obscure topic. It was on my mind. For me, exploiting vulnerabilities in system architecture is a means for survival. But for you, I wonder if it is different?"

[Edward Heinrich]

He didn't really feel any need to comment further, so he took the topic change in stride. "I have, it was an especially interesting case study for watching the race the bottom. Not a game the bad actors could win, the good guys controlled the bottom." It was an advanced case, and a good one to show that a security expert worth their salt had to understand the full system — anything less and vulnerabilities multiplied.

"It sounds Mr. Mitnick, that you might just be one of those bad actors," He said this with a half-smile, "not that I mind. If it's true, you're the reason I have a job."

"Ever played Core War?" It was a sudden transition, but that gave Derek an out to not respond if he didn't want to. "We should play sometime." Who knows, it could be fun.

[Derek Menzies]

"Indeed. So then you do hold that profession still? I suppose you'd have to be to stay active in that community and to maintain those connections. As Mekhet I suppose I have the habit to stay close to the shadows protected by anonymity. But that can be limiting. Which is why it might be beneficial to make friends with someone without those restrictions," he suggests, showing his metaphorical hand a bit.

"Core War? With Redcode? I've heard of it, but never played. That is quite the blast to the past. I think that would be fun to try." Like a modernized chess in a way. Assembly language is quite the beast in its own right. It challenged one to leave behind the luxuries of high-level command structure and compilers to think like the machine. Derek only used them for hardware manipulation, much like the example they had spoken about. Interesting.

"If I recall, the idea is to pit two programs against one another? Like a Game of Life exercise, only with an opponent?"

[Edward Heinrich]

"I do, as you say, the pace of change is disorienting — you miss out on one week's news and the next you've been targetted by an exploit." Then again, the same damn TLS vulnerabilities were being used today as half a decade ago, so that depended on perspective.
"And I'm confident such a bond would be mutually advantageous." He even meant it too.

"I'm pleased you think so, and you recall rightly. There are parallels, in this case, the victor is the survivor." Specifically, the first program to attempt the execution of an impossible instruction loses.

"Have you played other programming games? I find interest during extended spells of consulting. Does your interest remain after a day's work?"

[Derek Menzies]

Program to survive. How appropriate.

"Not programming games, really. Video games, occasionally. Mostly to keep my mind from either overthinking a problem or remaining too idle. Sometimes if I'm stuck on debugging a module or isolating an exploit, stepping away from the problem can sometime yield a solution upon returning to it. But please, tell me what other programming games you enjoy? It's so pleasant to meet another of our kind who enjoys the craft. Was it your profession that brought you to Sacramento? And what do you hope to accomplish here during your stay?"

The curiosity seems genuine in Derek's voice, his stiff posture beginning to relax.

[Edward Heinrich]

"I understand the feeling, back when I breathed I often took naps. Gaming is frowned upon in the office." Napping was tolerated among those with a reputation for meeting deadlines.

"TIS-100 and Duskers recently," if you counted Duskers, "I've fiddled with chess engines, which assists in reminding me why A.I. is not my specialty" he smiles at his own expense. "CoreWars has always remained my go-to. It's quiet."

"To one of my ilk," he gestures at the curl of barbed wire over his breast, "it is essential to present a united front. Even slight disagreement from a supplicant reflects poorly upon the master. Rather than be pressed into a betrayal of either principles or Sire, I left. No city or place called to me, but friends from a long time ago live here. With no more compelling a reason, here I am."

That was more than enough sharing, his deeper personal goals for living here would have to wait. "I'm reflecting on how to start a lifestyle business given my condition. Doing some consulting to get a feel for what niches there are for software, then making and marketing some, appeals to me." Edward was bringing a friend around to the idea; a friend who went and became a corporate lawyer.

[Derek Menzies]

"I'm afraid my skills don't quite meet the level of A.I. development either. It is still a field in its infancy, though fast growing by the sound of it," he remarks.

Eyes dart down to the barbed pin, recalling significance behind the symbol and sympathizing with the story.

"My Sire too was of the First Estate. And it is difficult to achieve success without making some enemies, I understand all too well. Though perhaps it will yield fruit yet. Our proximity to Silicon Valley has many opportunities for someone of your background, if that industry is your goal. Should you remain and do well in Her Grace's Domain, perhaps we might collaborate on a mutual investment. Just something to consider."

[Edward Heinrich]

"It's tendrils reach everywhere," Edward remarked in agreement.

There were interesting possibilities with working both sides. Edward markets his services, and Derek performs an attack. When Edward is hired, Derek after can inform Edward what the exploit was, he can patch it. Legal money flows in, they each take half. Give Derek some throwaway title for a job in the company to make his income look legit, and you're done. That is all to say, "You're right beyond doubt. Plus, our hours aren't exactly exceptional in this business. If I get anything off the ground, I will contact you, Mr. Mitnik. I shall remain in Her Grace's domain for the forseeable future."

It was a dangerous game to play over the long term, and imprisonment is a death sentence for their kind. Not something to take on lightly.

"How long have you been in Her Grace's domain?"