Tag: cybersecurity

Posted on

Letter XXII: Provider, Provide — Do Not Prescribe

Monitor labeled USER LOGIN PORTAL - OVER COMPLICATED displays ten-step login procedure; tangled cables labeled PASSKEY FAILED, RE-VERIFY, USER BURDEN, and SYSTEM REDUNDANCY surround it.

By Martyn Walker
Published in Letters from a Nation in Decline

This morning, I attempted to log in to a different company account on QuickBooks.

It should have taken perhaps ten seconds. Instead, passkeys turned it into an intense five-to-ten-minute project involving repeated attempts, rejected routes and the usual digital guessing game in which the customer must discover what the software has decided to do on his behalf.

Eventually I checked the settings which I had previously disabled. They had somehow been re-enabled. I had not changed them. Perhaps an update had restored the provider’s preferred defaults; perhaps some other piece of helpful automation had intervened. Either way, my expressed choice had not survived.

A setting which silently reverses itself is not a setting. It is a temporary stay of execution.

Passkeys are presented as the civilised successor to passwords: simpler, safer and resistant to phishing. The cryptography is undoubtedly clever. A passkey is tied to the genuine website and cannot be handed innocently to a convincing imitation. This tackles a real problem, particularly among people who reuse memorable passwords or type credentials into whatever page appears before them.

But the sales pitch quietly substitutes one security problem for another. It concentrates identity, authentication and often account recovery in the same small object carried everywhere in a pocket.

Put down an unlocked telephone and someone else can pick it up. Phones are snatched from people’s hands by thieves on bicycles. Criminals observe PINs before stealing devices. Ministers, officials and businesspeople have all demonstrated that possession of an important telephone is not a theoretical risk confined to careless teenagers. Yet the technology industry increasingly treats possession of the device, assisted by a face, fingerprint or short PIN, as proof of possession of the identity.

The answer from security specialists is that a properly locked telephone still requires biometric or PIN verification. This is true in the same way that a properly locked front door keeps out a burglar who has neither the key nor a window. It describes the security model while avoiding the circumstances in which the security actually fails.

Once a thief gains access to a phone, he may acquire the passkey, email account, text messages, authenticator, password-reset route and banking applications together. We are told this is multifactor authentication. Physically, it is often several differently named functions living inside one stolen box.

I have used Bitwarden since its early days. I do not know any of my account passwords. Each is unique and generated by the password manager; I know only my personal master password. I have never been hacked. My family know that master password, so when I die they will be able to gain access to the accounts and information they will need.

That is not an accidental arrangement devised for my convenience. It is a considered security and succession policy. It has one deliberate trust anchor, controlled by me, with a comprehensible route for inheritance.

Passkeys intrude upon that arrangement by creating a parallel collection of credentials distributed among Apple, Google, individual devices, browser profiles, password managers and service providers. Some synchronise; some do not. Some can be deleted; some appear again. Some sites remember the right account; others offer a passkey for the wrong one. Death, incapacity, loss of a device or a disputed cloud account can turn the promised simplicity into an archaeological expedition through systems nobody consciously chose.

This is not merely an objection to passkeys. Those who want them should be free to use them. The objection is to prescription disguised as provision: automatic creation, persistent prompting, passkey-first login screens and updates which restore settings the customer has already rejected.

The provider benefits handsomely. Fewer forgotten-password calls reduce support costs. Phishing losses decline. Authentication is outsourced to devices and platform companies. The customer supposedly receives convenience, but when the machinery fails, the provider’s saving becomes the customer’s unpaid labour.

Multiply my lost five or ten minutes by millions of users, then add every compulsory application, broken identity portal, circular chatbot, unexplained verification request and setting restored after an update. None appears in the national accounts as waste. It is simply removed from the productive day in fragments too small to invoice and too dispersed to attract ministerial attention.

Britain can no longer indulge this casually. As Ross Clark puts it with admirable economy in the title of his forthcoming book, Britain Is Bust. His subject is the approaching sovereign debt crisis and the unavoidable rationalisation of public spending. Passkeys will neither cause nor cure that crisis. They are, however, a neat specimen of the culture accompanying it: institutions lower their own visible costs by exporting effort, delay and frustration to citizens and businesses, then call the result innovation.

A country does not become unproductive only through grand strategic errors. It also does so ten minutes at a time.

The proper policy is neither difficult nor technologically reactionary. Providers should offer passwords, independent authenticator applications, physical security keys and passkeys. They should explain the differences. They should allow the customer to choose. A rejected method should remain rejected, and an update should not constitute fresh consent. No credential should be created silently. No customer should be repeatedly funnelled towards the provider’s cheapest option.

Security should also permit genuine separation. The credential, the device approving its use and the route for recovery need not all occupy the same phone. People handling valuable businesses or sensitive information should be able to keep authentication on a separate device or physical key. Those planning sensibly for death or incapacity should not have their arrangements defeated by credentials imprisoned inside a dead person’s biometric ecosystem.

The password was not perfect. Neither is the passkey. The difference is that I was permitted to manage the former intelligently, whereas the latter is increasingly imposed upon me by organisations convinced that their preferred system must also be mine.

Let providers provide. Let customers decide. And when we have decided, leave the bloody setting alone.

Posted on

Professional Forensic Investigation: Challenging Digital Document Nonexistence

In a complex legal case involving employment litigation, I was engaged as an expert witness to address a critical forensic challenge: substantiating the potential nonexistence of a digital document. The defendant, currently detained in a Middle Eastern jurisdiction, faced substantial financial claims from a previous employer and was now confronting fraud allegations.

The case hinged on a nuanced digital forensics challenge: proving the nonexistence of an unsigned digital contract. The prosecuting lawyers asserted that the document never existed, while the defense sought to demonstrate the opposite.

During preliminary legal meetings, the opposing counsel presented their purported evidence with remarkable confidence. Their approach was strategic—they controlled the narrative, extensively explaining their perspective while notably avoiding direct questioning of my professional expertise. The singular query they posed was tellingly administrative: confirmation of my professional indemnity insurance.

Recognizing the fundamental impossibility of definitively proving a digital file’s nonexistence, I directly challenged their legal strategy. My response was succinct yet unequivocal: demonstrating absolute digital document nonexistence was fundamentally naive and legally unsound.

The subsequent interactions revealed the case’s complexity. I prepared a closing statement, which I recommended be shared with the prosecution, ultimately proved decisive. Upon reviewing the document, the opposing legal team elected to discontinue their prosecution.

This experience underscored the intricate challenges of digital forensic evidence and the critical importance of rigorous, logical analysis in legal proceedings involving digital documentation.

Ladies and gentlemen,

Today, I ask you to consider not only what is presented in this case, but also what is left out—the gaps, the blind spots, and the complexities glossed over by the sweeping assertions made by the opposing counsel. The claim that a digital document never existed because it cannot be found through their forensic investigation sounds definitive. But in reality, it is anything but.

Let me take you through why this notion, if accepted, becomes an oversimplification—a convenient but dangerous fallacy that disregards how digital evidence works in practice.

First, digital absence is not evidence of non-existence. Imagine walking into a library after a fire and failing to find a book. Would you confidently declare that the book never existed simply because it no longer sits on the charred shelves? Digital data is often more fragile than we care to admit, subject to deletions, overwrites, hardware failures, malicious tampering, and the ravages of time itself. A file can vanish, without a trace, under myriad circumstances—many of them beyond human control.

Second, we must discuss the limits of digital forensics itself. Forensic tools can be powerful, yes, but they are not infallible. There are countless ways data can evade recovery: encrypted files, corrupted drives, fragmented data clusters, obsolete storage formats, or even simple user error. A computer system is not a perfect archive; it is a dynamic, ever-changing entity shaped by software updates, file transfers, routine purges, and countless other interactions. No forensic team can guarantee recovery of every piece of data ever written and lost. The claim that “nothing was found, so nothing existed” disregards this reality entirely.

Third, let us reflect on human behaviour—an aspect inseparable from digital evidence. Files do not simply disappear without interaction. When documents are lost, altered, deleted, or concealed, there is often intent, or at the very least, human influence involved. The absence of a document does not exonerate or affirm innocence. Instead, it demands scrutiny of how it was handled, what procedures were undertaken, and what motives might be at play. To ignore these complexities is to risk overlooking the very essence of truth.

Moreover, consider this: digital footprints are complex trails, not straightforward paths. They can be altered, obscured, or even erased intentionally. The absence of a document in a forensic search could indicate deletion, tampering, or migration, none of which proves the document’s original existence or non-existence. Without more context, such claims hold no weight. Absence is not evidence. It is a shadow that requires light and context, not blind belief.

Lastly, let us remember what’s truly at stake. If we accept the claim that a file’s absence is definitive proof of its non-existence, we empower those who seek to manipulate data. We give cover to the destroyers of evidence and those who seek to shape narratives by erasing digital history. It sets a dangerous precedent that undermines justice, because the absence of evidence can be engineered. Letting such a claim stand risks turning justice into an arena for those most adept at making evidence disappear.

Ladies and gentlemen, justice is not a game of finding what is absent and calling it non-existent. It is a process of uncovering truths amidst complexity, human behaviour, and technical limitations. To rule in favour of this claim would not only be a mockery of truth—it would be an open door to future manipulations, erasures, and injustices that exploit what cannot be found.

I ask you to reject this facile and dangerous notion. Truth cannot and must not be found in what is absent alone, for it is a hollow foundation upon which no justice can stand.

Thank you.