Bruce Schneier

You can't defend. You can't prevent. The only thing you can do is detect and respond.

It's frustrating; terrorism is rare and largely ineffectual, yet we regularly magnify the effects of both their successes and failures by terrorizing ourselves.

There are two types of encryption: one that will prevent your sister from reading your diary and one that will prevent your government.

Think of your existing power as the exponent in an equation that determines the value of information. The more power you have, the more additional power you derive from the new data.

Air travel survived decades of terrorism, including attacks which resulted in the deaths of everyone on the plane. It survived 9/11. It'll survive the next successful attack. The only real worry is that we'll scare ourselves into making air travel so onerous that we won't fly anymore.

The user's going to pick dancing pigs over security every time.

Privacy is a fundamental human need.

If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology.

Despite fearful rhetoric to the contrary, terrorism is not a transcendent threat. A terrorist attack cannot possibly destroy our country's way of life; it's only our reaction to that attack that can do that kind of damage.

When people are scared, they need something done that will make them feel safe, even if it doesn't truly make them safer. Politicians naturally want to do something in response to crisis, even if that something doesn't make any sense. But unfortunately for politicians, the security measures that work are largely invisible.

No one can duplicate the confidence that RSA offers after 20 years of cryptanalytic review.

It is poor civic hygiene to install technologies that could someday facilitate a police state.