While I have a hard time imagining Bruce just lifted someone else's blog post without crediting (more likely it was passed on to him in conversation?), this post predates Schneier's by over a year: http://tcoverride.blogspot.com/2011/05/security-questions.ht....