3 ms·
Is there any valid reason to still be using 3DES in 2026? It was formally deprecated in 2018 and has been surpassed in just about every single way by AES long
by Klathmon 3mo ago
Is there any valid reason to still be using 3DES in 2026?
It was formally deprecated in 2018 and has been surpassed in just about every single way by AES long before that.
At this point I feel like it's use is such a huge red flag
- Pxtl 3mo agoI mean they're still using Inno Setup which was pretty cool in 2004.
- XorNot 3mo agoI mean I still build windows installers with NSIS which has somehow just-worked for decades.
- pjmlp 3mo agoUnfortunately plenty of folks still didn't got the memo MSI and MSIX exist.
- indrora 3mo agoUnfortunately, WiX is still a pain in the ass to use and there's a lot of simple tooling that makes NSIS/InnoSetup/etc shockingly easy to use while the same MSI experience is garbage. msix is just a different beast entirely too.
- pjmlp 3mo agoWhat about using the Visual Studio packaging tools? I live on .NET/C++ universe in regards to Windows development, so it might be it isn't as nice for not blessed stacks.
- Pxtl 3mo agoDidn't they discontinue those around VS 2015 or so? Its been a while since I tried. Iirc that's what got replaced with WiX and ClickOnce, both of which are 100X more complicated to use.
- pjmlp 3mo agoNope, it is the other way around, MSI became the official replacement for exe installers, and MSIX is the evolution of APPX from UWP/Windows Store and the "best practices" format going forward. By VS packaging tools I mean tbe application project type that generates a MSIX as build outcome.
- mook 3mo agoFor some reason, that holds an appxbundle per the article. I'd suspect they needed to run some pre- or post-install code (maybe to check for their hardware?).
- IncRnd 3mo agoIt was an architectural problem, not an encryption problem. Even with AES instead of 3DES, the same issue would exist, which is spoofing the commands of any of the legitimate MSI services.
- Klathmon 3mo agoYeah it wouldn't have changed this specific case but still why use it? It's slower even without AES NI!
- mike_hock 3mo agoIs there a valid reason to use any encryption at all if you generally can't sniff the traffic unless you can also sniff the key, and if the key is arbitrary and not verified against anything?
- Klathmon 3mo agoAES is so cheap with hardware acceleration that I could see an argument that it prevents casual sniffing of the traffic. Personally I think the false sense of security would outweigh those benefits, but I'm not in their shoes. But DES is so broken that it's more of a giant flashing beacon saying "look here there are terrible decisions being made!"
- mike_hock 3mo agoWhat casual sniffing? It's a pipe. If you can sniff that, you can sniff all the traffic because the very first message is the key in plaintext.