3 ms·
> If Bank A makes my PIN number automatically the last 4 of my SSN, and Company B discloses that information By Kerckhoffs's principle > https://en.wikipedia.
by wolfgke 8y ago
> If Bank A makes my PIN number automatically the last 4 of my SSN, and Company B discloses that information
By Kerckhoffs's principle
> https://en.wikipedia.org/w/index.php?title=Kerckhoffs%27s_principle&oldid=844528755 https://en.wikipedia.org/w/index.php?title=Kerckhoffs%27s_pr...
a cryptosystem has to stay secure even if everything about the system, except the key, is public knowledge. So Bank A is at fault, because it neglected basic guiding principles for designing security systems.
- bdcravens 8y agoWhich gets to the frivolity of the lawsuit. The primarily responsible party, the exchange, is likely a less lucrative target than AT&T.
- dsfyu404ed 8y agoSuing the people with the money is rule #1 of lawsuits.
- pc86 8y agoWhich would be the case if Kerckhoff's principle was enshrined in law, which it's not.
- wolfgke 8y agoBut it is deeply central for designing any secure system that one can really argue that it is a disregard of due diligence when not followed.