Oh, you're going to love this - I worked for a firm that developed electronic trading software, back in the late 90s. They "encrypted" their incoming connection

Oh, you're going to love this - I worked for a firm that developed electronic trading software, back in the late 90s. They "encrypted" their incoming connections with a simple XOR scheme that used a "key" which was, basically, a random number. You want to guess how they generated the random number? They seeded the random function with the current time... now, almost all of their clients would just leave their trading systems running overnight, so in the morning all the clients would reconnect at just about the exact same time (market open), so then 90% of the clients would end up using the same "key" to encrypt their sessions. Now, ordinarily it would be bad enough that almost all of your clients are using the same encryption key, but it got much worse from here - turns out there was a bug in a proxy server they had written, so that every once in a while client B's traffic would be routed into client A's session, and hilarity would ensue; because the "keys" were the same, Client B's traffic looked like normal traffic from client A, so nobody could ever figure out why Client A would call us up and complain that he was getting fills for orders that he'd never sent! It took me forever to figure out WTF was going on, but one day I was watching a logging display and noticed garbled traffic showing up in Client A's logs, and it was garbled because it was a user who actually didn't auto-logon at 0930 in the morning and subsequently had a different encryption "key" resulting in his traffic not being decoded properly. From there, it became obvious what the problem was. Edit: Yeah, yeah, I know - you're thinking "Wait, XOR? shared secret? But, but... how did they do key exchange?" Well, how the heck else would you send a client the secret key for the session - in plain text, when the client first logs on, of course!