7 ms·

I guess the question is - who do you trust to make these calls? In this case, the answer probably is OWASP which is a great and often overlooked resource, cont

I guess the question is - who do you trust to make these calls? In this case, the answer probably is OWASP which is a great and often overlooked resource, contributed to by a lot of experts in the area. They have a lot of pages in their wiki that address crypto concerns... https://www.owasp.org/index.php/Guide_to_Cryptography https://www.owasp.org/index.php/Guide_to_Cryptography https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_... https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

tptacek 15y ago
OWASP is a great resource with a terrible track record for application cryptography.
- chrismsnz 15y ago
  Whoops, I will stand corrected. Casting my eye over the recommendations in the pages I linked - yes some of it seems to be a little behind the times (for instance, adaptive hashing isn't mentioned once in terms of securing passwords), but none of it seems outright terrible. Is this something that the crypto community/experts can come together and improve the same way as the vuln/exploit security community have made OWASP what it is? Or is the real truth that executing proper crypto techniques are simply to difficult to boil down into a pile of cheatsheets?