> NIST have an interesting history around security. One such example would be AES. They favored Rijndael over Serpent, despite Serpent clearly winning on techni

> NIST have an interesting history around security. One such example would be AES. They favored Rijndael over Serpent, despite Serpent clearly winning on technical merit. Rijndael won because cryptography is first and foremost a discipline that makes tradeoffs between usability and security. A security measure is not helpful if no one uses it, either because it's a pain in the ass to configure or because it increases your own costs to implement and use. Serpent is technically more secure because it uses 32 rounds of encryption (among other things) while Rijndael uses 10, 12 or 14 (depending on key size). But they're both substitution-permutation networks, and Rijndael is secure enough while offering a significant speed increase. There hasn't been a meaningful cryptanalysis on Rijndael since it was published. > You can even use this to defeat keyloggers. Open up a prompt that you can type in, then type a bunch of a character. Then use your mouse to select the number of characters that represents your buffer character length, or a portion of it. Then copy-paste as required. Keyloggers will capture cntr-v but they won't capture how many characters you selected. I don't really follow. If a keylogger has compromised your machine, you're already approaching worst-case scenario territory. More importantly, of course a keylogger can capture how many characters you select. Even if they didn't, they can just capture exactly what's in the browser form field before it's sent in the login request.