5 ms·
Yeah, this part rings totally true: > I actually do a double-take when a company says "Military-Grade", as I start to question how well they know cryptography,
by OskarS 7y ago
Yeah, this part rings totally true:
> I actually do a double-take when a company says "Military-Grade", as I start to question how well they know cryptography, and if they may have picked an inferior algorithm thinking it's safe.
"Military grade" might sound good to marketing people, but to everyone that's actually involved in digital security, it sounds like it's made by people who have no idea what they're doing.
Another phrase like that is "patented technology" or "patent-pending". Maybe it sounds good to some people, but to to engineers it's a big red flag.
- solarkraft 7y agoMy worst red flag is "proprietary". It gives me an instant head ache because it makes me think of bad quality, terrible documentation and just over all pain.
- DonHopkins 7y agoIn the context of encryption, "proprietary" means "home grown". Or rather "home groan".
- LandR 7y agoPropretary is a huge red flag. Never roll your own crypto!
- opan 7y agoI've noticed this even with fast food commercials which say things like "our proprietary blend of spices" in a tone implying you should be excited about it.
- mcv 7y agoI'm fine with proprietary spice blends. At worst, it doesn't taste the way I want. But with encryption, "proprietary" means "untested", and that's a really bad idea.
- kweks 7y agoIn regards to "Patent Pending" or "Patented Technology" - these are phrases that are legally defined. Neither are snake oil (unless used in a fraudulent manner..), and can generally be interpreted as the product in question is objectively innovative.
- Blackstone4 7y agoMilitary grade makes me think of symmetric key encryption which unlikely to be used in most of these situations.
- jonathanstrange 7y agoI'm fine with the phrase "military grade" if the combination of software and hardware is FIPS 140-2 Level 4 certified.
- madez 7y agoWhen it is FIPS 140-2 level 4 certified, they will let you know early enough so when it's missing you can easily tell.
- dkersten 7y agoYeah, anything I've ever encountered that had certifications didn't say "military grade" or whatever, instead they always listed the certifications relatively prominently.
- goalieca 7y agoWhat part of the device is certified? The logic unit, the whole asic, the board, the appliance? Software too? Or what??