IIUC the correct answer, according to the 2009 blog post that popularized the saying you're referring to, is to just use TLS anyway. In most cases it's better t

IIUC the correct answer, according to the 2009 blog post that popularized the saying you're referring to, is to just use TLS anyway. In most cases it's better to accept some extra complexity than to get crypto wrong. Edit: Here's that classic: https://web.archive.org/web/20090606064715/http://www.matasano.com/log/1749/typing-the-letters-a-e-s-into-your-code-youre-doing-it-wrong/ https://web.archive.org/web/20090606064715/http://www.matasa...