3 ms·
We're fighting 'the crypto wars' again because we've become complacent and content in the belief that a few experts have solved everything for us by providing a
by Falkon1313 11y ago
We're fighting 'the crypto wars' again because we've become complacent and content in the belief that a few experts have solved everything for us by providing a few systems. We didn't bother to fight before, we sat back and got lazy.
It's not a tech thing, cryptography has been in use since before the Roman Empire. But in recent decades, everyone only speaks of it in terms of tech. And we assume only a few tech wizards are smart enough to make it work.
For years, the standard line has been "never write your own crypto, use something written by the experts". So only a few algorithms are actually in use. That makes them big high-value targets. But almost everything that the experts have written or recommended has been backdoored, rainbow tabled, compromised, or worked around, and what hasn't, the government can demand to be broken.
Most websites used to store passwords as MD5 hashes (if not plaintext) because that was the standard recommendation. Minor changes in hardware to lead to rainbow tables that rendered that world-wide obsolete instantaneously for everyone. That was a mess. But what if only one site had used MD5? Even if it had been worth attacking, the results wouldn't have been nearly as bad. Flash was present in 98% of browsers, which made it a huge target for crackers, with constant zero-day exploits. It is now on life support and we know that we don't want something like that again. Something that everyone uses is an easy and valuable target.
Perhaps we should flip conventional wisdom on its head and go back to writing our own crypto. Maybe layer it with the stuff from the experts, so they can cover our weaknesses, but probably best not to trust them entirely. If there were thousands or millions of different crypto algorithms in use instead of just a few, they might not individually be stronger, but collectively, it would be harder to attack them. Mix that with steganography and codes, and the possibilities could be exponentially greater than if everyone is just using plaintext passed through the same standard government-approved cipher.
We need to be less lazy.