4 ms·
Fascinating article, the more I learn about crypto and security the more obvious it becomes how hard this stuff is to get right.
by bognition 10y ago
Fascinating article, the more I learn about crypto and security the more obvious it becomes how hard this stuff is to get right.
- nxzero 10y agoThere is no getting it "right" just less wrong; aka "perfect" security does not exist.
- drewbug 10y agoIsn't that still an open question?
- JustSomeNobody 10y agoMaybe in the sense that one can ever really prove it to be "perfect".
- userbinator 10y ago"perfect" security does not exist. For that matter, I think what "perfect security" could be like is the world in Orwell's 1984 --- definitely not something I'd want existing either.
- msh 10y agoEven that was not perfect.
- zeveb 10y agoYou know, I'm not really all that certain that it's intellectually difficult to get crypto right; it feels more likely that it's organisationally and process-wise difficult to get crypto right. What I mean is that folks want to take an existing product and layer crypto atop it, when really they need to start from the crypto and built a product over it. They want to do things which are mathematically impossible (e.g. let you read data, but not let you say that data to someone else). They want to hand the crypto to a junior developer instead of someone who knows what he's doing. Crypto's not hard to do; organisations are bad at doing crypto.
- LoSboccacc 10y agospot on with one minor nitpick: crypto is not hard to use (as in, relying on existing libraries/standards/practices) - doing, as in writing your own crypto, otoh...
- brainbrane 10y agoCrypto is indeed hard to use. https://www.nds.rub.de/media/nds/veroeffentlichungen/2011/10/22/HowToBreakXMLenc.pdf https://www.nds.rub.de/media/nds/veroeffentlichungen/2011/10... https://en.wikipedia.org/wiki/CRIME https://en.wikipedia.org/wiki/CRIME
- amelius 10y ago> You know, I'm not really all that certain that it's intellectually difficult to get crypto right; it feels more likely that it's organisationally and process-wise difficult to get crypto right. Replace "crypto" by just about any software engineering endeavor, and what you say is still correct.
- userbinator 10y agoI think that might not be such a bad thing after all, since the flaws make it harder for companies to secure their products against the user, as they are apt to do. Something to ponder: would you rather live in a world of "perfect security" where encryption like this is unbreakable but so is DRM and other mechanisms of corporate/government control; or something closer to what we currently have, where "flaws" in encryption are periodically discovered but things like iOS jailbreaking and Android rooting still exist along with their associated freedoms? Personally, I lean towards the latter. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html
- SixSigma 10y agoI'd rather live in the unbreakable world because then the oppression is out in the open / forced. People expect stuff to just turn up on Pirate bay, extraction tools etc.