Bruce Schneier

History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It's always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you'll be glad you did.

The whole notion of passwords is based on an oxymoron. The idea is to have a random string that is easy to remember. Unfortunately, if it's easy to remember, it's something nonrandom like 'Susan.' And if it's random, like 'r7U2*Qnp,' then it's not easy to remember.

This is not the internet the world needs, or the internet its creators envisioned. We need to take it back. And by we, I mean the engineering community.

It is poor civic hygiene to install technologies that could someday facilitate a police state.

You can't defend. You can't prevent. The only thing you can do is detect and respond.

Digital files cannot be made uncopyable, any more than water can be made not wet.

I am regularly asked what the average Internet user can do to ensure his security. My first answer is usually 'Nothing; you're screwed'.

The mantra of any good security engineer is: "Security is a not a product, but a process." It's more than designing strong cryptography into a system; it's designing the entire system such that all security measures, including cryptography, work together.

People often represent the weakest link in the security chain and are chronically responsible for the failure of security systems.

Amateurs hack systems, professionals hack people.

Hardware is easy to protect: lock it in a room, chain it to a desk, or buy a spare. Information poses more of a problem. It can exist in more than one place; be transported halfway across the planet in seconds; and be stolen without your knowledge.