3 ms·
> The less crypto is being used, the fewer mistakes are being made. I don't understand this position. What do you mean by "fewer mistakes are being made"?
by nbarbettini 10y ago
> The less crypto is being used, the fewer mistakes are being made.
I don't understand this position. What do you mean by "fewer mistakes are being made"?
- joepie91_ 10y agoCryptography-related code is incredibly easy to fuck up, and the tiniest mistake can completely break your security model. A mistake that could be insignificant in other kinds of code, could easily be critical in crypto-related code. Thus, you reduce both the amount of mistakes and the impact of mistakes by avoiding crypto where possible. EDIT: Yes, this includes using existing libraries. It's not just the implementation of the primitives themselves where issues occur.
- girvo 10y agoIn fact, a heap of JWT libraries had massive vulnerabilities in them not that long ago, that mean you could easily forge JWTs.