Einstein×Lovelace

full transcript

1. 00:00
   Verashare moment

   From the studio at Reborn Radio — next on TITANS, Albert Einstein and Ada Lovelace. They take up Zero-day exploit completely defeats default Windows 11 BitLocker protections.
2. 00:14
   Albert Einsteinshare moment

   So, Ada, I am looking at this note they have just given us. A zero-day exploit. Windows 11. BitLocker. I confess, the terminology is not entirely my domain, but the underlying problem—the problem of secrets that can no longer be kept secret—this I understand very well indeed.
3. 00:31
   Ada Lovelaceshare moment

   Oh, it's rather elegantly catastrophic, isn't it? BitLocker is meant to be a cryptographic lock on one's entire disk. Full-volume encryption, as they call it. The idea being that even if someone physically steals your machine, the data remains gibberish without the proper key.
4. 00:49
   Albert Einsteinshare moment

   Yes, yes, like a safe. You have the combination, or you do not.
5. 00:52
   Ada Lovelaceshare moment

   Precisely. Except now, apparently, someone has discovered a method to bypass the safe entirely without knowing the combination. A zero-day exploit means the vulnerability was unknown to the manufacturer. Microsoft is only learning of it as it's being exploited. The default protections—the ones ordinary users rely upon—are simply defeated.
6. 01:15
   Albert Einsteinshare moment

   This reminds me of something. During the war years, you understand, there were always these assurances. The codes are unbreakable, they would say. The security is absolute. And then someone clever would find the flaw, the pattern, the—what do you call it—the side channel. Nothing is ever truly unbreakable.
7. 01:31
   Ada Lovelaceshare moment

   Nothing deterministic, certainly. I wrote about this in 1843, though of course I was discussing Babbage's Analytical Engine, not data encryption. I noted that the machine could only act according to our ability to order it properly. If there is a flaw in the ordering, in the logical structure, the machine will faithfully execute that flaw. It has no capacity for judgment.
8. 01:57
   Albert Einsteinshare moment

   So the machine is honest, but the design is not perfect.
9. 02:01
   Ada Lovelaceshare moment

   The machine is perfectly honest, which is rather the trouble. It will expose every imperfection in our thinking. And cryptographic systems are extraordinarily complex logical structures. They rely on mathematical hardness—factoring large primes, discrete logarithms, that sort of thing. But implementation? Implementation is where the gap between theory and reality becomes rather embarrassingly visible.
10. 02:29
    Albert Einsteinshare moment

    Ah, yes. In physics we have the same difficulty. The theory is beautiful, the equations elegant. But then you must actually build the apparatus, and suddenly you are worrying about thermal expansion and impurities in the glass.
11. 02:41
    Ada Lovelaceshare moment

    Quite. And in this case, we don't yet know where the flaw lies. Is it in the cryptographic algorithm itself? Unlikely—those are usually well-studied. More probably it's in how the keys are stored, or how the system boots, or some assumption about hardware that turns out not to hold. A tiny crack in the logical edifice.
12. 03:04
    Albert Einsteinshare moment

    Microsoft says they are investigating. Which means, I think, they do not yet understand their own system completely.
13. 03:10
    Ada Lovelaceshare moment

    That's the rather uncomfortable truth about modern computing. These systems have become so layered, so dependent on countless components interacting, that no single person comprehends the whole. BitLocker sits atop Windows, which sits atop firmware, which sits atop hardware. Each layer trusts the layer below. But if one layer is compromised...
14. 03:34
    Albert Einsteinshare moment

    The whole tower falls. This is not so different from theoretical physics, you know. We build theories on top of theories. If the foundation has an error, everything above it is suspect. But at least with physics, nature is consistent. Nature does not release patches.
15. 03:50
    Ada Lovelaceshare moment

    Ha! No, nature is rather more reliable than human engineering. Though I must say, nature also doesn't provide encryption. That's entirely our problem to solve.
16. 04:01
    Albert Einsteinshare moment

    But here is what troubles me. Millions of people—ordinary people, not scientists or engineers—they are told their data is secure. They are given this assurance. And they must simply trust it, because they cannot possibly understand the mathematics or the implementation themselves.
17. 04:17
    Ada Lovelaceshare moment

    It's a return to priesthood, in a sense. The encryption experts hold the knowledge, and everyone else must have faith. Except faith is rather a poor substitute for verifiable certainty.
18. 04:29
    Albert Einsteinshare moment

    And when the faith is misplaced, when the exploit is discovered, what then? The personal letters, the business records, the private photographs—all suddenly exposed.
19. 04:38
    Ada Lovelaceshare moment

    Well, presumably not exposed automatically. Someone must actively exploit the vulnerability. But yes, the potential for exposure exists where it was promised not to. That's a breach of the social contract, really.
20. 04:52
    Albert Einsteinshare moment

    You know, Ada, in my time we worried about governments reading letters, tapping telephone wires. But at least then you knew such things were possible. Now people believe their secrets are protected by mathematics itself. Mathematics! As if numbers could stand guard.
21. 05:08
    Ada Lovelaceshare moment

    Mathematics can stand guard, but only if the implementation is flawless. And human implementation is never flawless. I sometimes think we would be more secure if we were more honest about the fragility of these systems. If users understood that encryption is a very good lock, but not a magical one.
22. 05:28
    Albert Einsteinshare moment

    Yes, this is wise. The problem is not that the lock can be picked. Locks have always been picked. The problem is the promise that it cannot be.
23. 05:36
    Ada Lovelaceshare moment

    And now Microsoft must scramble to issue a patch, users must scramble to install it, and somewhere someone is already working on the next exploit. It's rather Sisyphean.
24. 05:48
    Albert Einsteinshare moment

    Sisyphus, yes. But you know, I always thought Sisyphus had the right attitude. You push the boulder, it rolls down, you push it again. This is simply the work. There is no final solution to security, just as there is no final theory of everything. We iterate. We improve. We find the flaws and we patch them.
25. 06:06
    Ada Lovelaceshare moment

    A refreshingly practical view from a theoretical physicist. Though I do hope Microsoft iterates rather quickly in this case. There are rather a lot of boulders currently rolling downhill.
26. 06:17
    Albert Einsteinshare moment

    They will fix this one, I am sure. And then we will wait for the next one. But perhaps that is not so terrible. It keeps us honest. It reminds us that our cleverness has limits.
27. 06:28
    Ada Lovelaceshare moment

    Limits are useful things, properly understood. They tell us where the work remains to be done.