3 ms·

I completely disagree as well. A security professional will often be in charge of evaluating various vendors encryption products for potential use within a com

I completely disagree as well. A security professional will often be in charge of evaluating various vendors encryption products for potential use within a company. If they know nothing about key management, for example, how would they even know how to evaluate the security (or lack thereof) of any given encryption solution?

tptacek 16y ago
This is exactly the thing I am saying "give me a break" about! Knowing what public key is, or that DH can be "man in the middled" is not enough to assess vendor crypto. It's not even close. More importantly, knowing the answers to these questions isn't even an indicator that you might know enough to assess vendor crypto. And that's fine. Very few people (even in appsec) have that qualification. By way of example: I don't consider myself one of those people; I know three of them, total. Colin Percival might not consider himself one of those people. What's not fine is pretending you've assessed a qualification that you don't understand.
- iuguy 16y ago
  To add to your argument... Most of the infosec people I work with would score exceptionally low on the questions in TFA. That's because to do their job they have to argue with management, get buy in etc. Unless there's a gaping hole they're going to go with whatever the product does. They're not going to get involved with key exchange algorithms because the tool abstracts that. They're going to get involved with compliance. That's why we have things like FIPS-140-2, Common Criteria, EAL, CAPS etc. Is that a bad thing? Possibly. One would hope that such products do a proper job. The realisation is not always so. We've broken two FIPS-140-2 products in the past 3 years, one of which was used in the Chinese olympics bid with dangerous results. Personally I think knowing your boundaries and being able to express them (for example whenever people mention crypto I tell them I'm not the right guy, and if it was transatlantic I'd definitely say tptacek would be someone more worth talking to in that area) is more important than attempting to be a one-stop shop for all things security.

tptacek 16y ago

This is exactly the thing I am saying "give me a break" about! Knowing what public key is, or that DH can be "man in the middled" is not enough to assess vendor crypto. It's not even close. More importantly, knowing the answers to these questions isn't even an indicator that you might know enough to assess vendor crypto. And that's fine. Very few people (even in appsec) have that qualification. By way of example: I don't consider myself one of those people; I know three of them, total. Colin Percival might not consider himself one of those people. What's not fine is pretending you've assessed a qualification that you don't understand.

iuguy 16y ago
To add to your argument... Most of the infosec people I work with would score exceptionally low on the questions in TFA. That's because to do their job they have to argue with management, get buy in etc. Unless there's a gaping hole they're going to go with whatever the product does. They're not going to get involved with key exchange algorithms because the tool abstracts that. They're going to get involved with compliance. That's why we have things like FIPS-140-2, Common Criteria, EAL, CAPS etc. Is that a bad thing? Possibly. One would hope that such products do a proper job. The realisation is not always so. We've broken two FIPS-140-2 products in the past 3 years, one of which was used in the Chinese olympics bid with dangerous results. Personally I think knowing your boundaries and being able to express them (for example whenever people mention crypto I tell them I'm not the right guy, and if it was transatlantic I'd definitely say tptacek would be someone more worth talking to in that area) is more important than attempting to be a one-stop shop for all things security.