If you think we are pretty good at encryption, I'm worried that you're not paying attention. Matt Green captures the spirit of what a lot of us feel who are on

If you think we are pretty good at encryption, I'm worried that you're not paying attention. Matt Green captures the spirit of what a lot of us feel who are on the front lines of infosec defense: https://twitter.com/matthew_d_green/status/709919895002042368 https://twitter.com/matthew_d_green/status/70991989500204236... "We can barely encrypt." This problem is not new. Put some time in and read Matt Blaze's paper "Why (Special Agent) Johnny (still) can't encrypt." http://www.crypto.com/papers/p25sec.pdf http://www.crypto.com/papers/p25sec.pdf >>Also, as far as 'showing you a way' ... My point is apparently poorly made, so let me try improving. Encryption is a feature- but our ability to properly implement it is woefully inadequate. Many developers think very much like you seem to be- I have a secret, so I need to encrypt. But they forget about (or have no awareness of ) offensive methods for intercepting a secret with a debugger. They think in terms of network transport or file system objects. So many a developer says "I'll just take out my copy of applied cryptography and go to work." And then security experts get more fuel for yelling about the danger of rolling your own crypto (even if you're just implementing what you see in Applied Crypto). Finally- I was obviously not talking about conditional statements. Read it again and pay attention. Hypothetical "if only" scenarios are great and amusing way to burn brain cycles with no real application. It is also a tactical error, because it indulges people in considering things that don't exist as potentially real.