3 ms·
Proposal: we should drop support for known bad/unsafe cryptographic primitives from popular cryptography libraries moving forward. When the companies using the
by brobinson 4y ago
Proposal: we should drop support for known bad/unsafe cryptographic primitives from popular cryptography libraries moving forward.
When the companies using these bad/unsafe primitives inevitably complain, informed consumers will know to avoid their products and will broadcast a warning to others. The companies will be forced to migrate to safer primitives.
We've kind of already seen this with things like TLS 1.3 (only AEAD ciphers allowed).
- cedilla 4y agoCompanies would just stay on even older versions of those libraries. Maybe with security patches backported, but probably not.
- k_sze 4y agoHow about ratifying some law that says, once a company has been warned about their use of unsafe crypto for X amount of time, if they still don't fix things, then they are fair game to black hats (as in, no black hat will be prosecuted for exploiting the unsafe crypto)? I know it might sound crazy.
- CuriousSkeptic 4y agoWhats next, enforce fire-safety regulations by arsonists?