5 ms·

One of the things I see you regularly talk about, and something that bothers me a little, is this idea of crypto "pedigree". That is, folks without crypto back

One of the things I see you regularly talk about, and something that bothers me a little, is this idea of crypto "pedigree". That is, folks without crypto backgrounds attempting to write crypto software tend to, in my observation, evoke your ire, and the ire of many others in the field. Taking that for granted for a moment, would this security audit be for the folks who've already become part of this class of "elites", or is this something one would do in an effort to be taken seriously in the security community by those currently in it?

tptacek 12y ago
Give me a break. 12,000 people have signed up for our crypto challenges, in which they write 6-7 batches of 8 crypto exploits each in the language of their choosing --- people have invented new programming languages to do them in, and we've gotten them through all of the challenges --- and, by directly engaging us over email, get both validation of each of their challenge responses and 1:1 support. I am off the charts tired of people acting like my issue with incompetent crypto is a form of "elitism". The fact that you managed to inject that bogus complaint into this particular story, which, if you'd read the just 142 words I wrote a little carefully, is obviously the exact opposite of what you're "concerned" about, is all the more annoying. What "draws my ire" is cryptographic incompetence. Cryptographic incompetence gets people hurt. I do not give a shit about how those developers feel. For whatever it's worth to anyone else reading this: you will rarely ever see me get pissy about an incompetent amateur breaking crypto. Breaking crypto is what you're supposed to do to get good at crypto.
- diminoten 12y ago
  Your last statement is exactly what's always bothered me about your attitude, and how it contradicts directly with the sentence prior. I'm not going to give you a break so long as you don't give folks who are trying to create things a break. Bad crypto gets people killed, but no crypto does too, and perhaps your elitist attitude (and it's not just you, it's the community at large) is why we have only TrueCrypt and nothing else.
  - hluska 12y ago
    You might want to think a little deeper about your last statement. If you don't have access to crypto, you can take other precautions. If you use bad crypto, you can be lulled into a false sense of security. There is nothing more dangerous than thinking you are secure, when in actuality, you aren't.
    - diminoten 12y ago
      What if, due to the bullying nature of a niche industry, there are no other precautions to take?
      - sdevlin 12y ago
        Just to be clear, are you suggesting that there is an elite cadre of cryptobullies browbeating the general public into broadcasting compromising information all over the cleartext internet?
        diminoten 12y ago
        Nope, I'm suggesting that a negative and hostile attitude, like the one exhibited towards the CryptoCat team by tptacek and others is not healthy to the industry.
        tptacek 12y ago
        Negativity and hostility towards poorly constructed cryptographic applications is unhealthy in what way?
      - hluska 12y ago
        Good question. First, I think that if you cannot think of an alternative to crypto, you should think twice about doing anything that could get you or your friends killed. Second, I urge you to consider the difference between these two developers: Developer A is just learning crypto. She makes many mistakes and builds some truly horrible systems. But, she is just learning and she never actually intends for anyone to use her systems. Developer B thinks she is a crypto god. She releases a tool and claims it is incredibly secure. However, it contains fatal flaws. If someone bullies developer A, I think that many people would jump to her defense. On the other hand, developer B is a very dangerous person whose hubris has created a dangerous situation.
noonespecial 12y ago
In crypto, its justified. Crypto is like flying a plane. You can't do it just because you read lots of books and try really hard. Extra smart people have very little advantage over those of average intelligence. Most importantly, due to the nature of the beast, the first mistake is the last. It doesn't matter if you get everything right for 99.9% of the flight and only make a mistake during 0.1% of it, the result is still a 0% success. Pilots are also a bunch of elitist snobs. I wouldn't fly with anyone else.
- biff 12y ago
  I think what's especially dangerous about it, as a software developer, is that broken crypto runs identically to properly-implemented crypto. If one is in the mentality of rewriting a program until runs without crashing a few times, well, that seems sufficient to land a gig to code printer drivers, but falls short of the rigor I'd hope would go into implementing a secure system. Nevertheless, at this moment there's a PHP programmer somewhere in the world writing new code that stores passwords hashed with one round of MD5.

tptacek 12y ago

Give me a break. 12,000 people have signed up for our crypto challenges, in which they write 6-7 batches of 8 crypto exploits each in the language of their choosing --- people have invented new programming languages to do them in, and we've gotten them through all of the challenges --- and, by directly engaging us over email, get both validation of each of their challenge responses and 1:1 support. I am off the charts tired of people acting like my issue with incompetent crypto is a form of "elitism". The fact that you managed to inject that bogus complaint into this particular story, which, if you'd read the just 142 words I wrote a little carefully, is obviously the exact opposite of what you're "concerned" about, is all the more annoying. What "draws my ire" is cryptographic incompetence. Cryptographic incompetence gets people hurt. I do not give a shit about how those developers feel. For whatever it's worth to anyone else reading this: you will rarely ever see me get pissy about an incompetent amateur breaking crypto. Breaking crypto is what you're supposed to do to get good at crypto.

diminoten 12y ago
Your last statement is exactly what's always bothered me about your attitude, and how it contradicts directly with the sentence prior. I'm not going to give you a break so long as you don't give folks who are trying to create things a break. Bad crypto gets people killed, but no crypto does too, and perhaps your elitist attitude (and it's not just you, it's the community at large) is why we have only TrueCrypt and nothing else.
- hluska 12y ago
  You might want to think a little deeper about your last statement. If you don't have access to crypto, you can take other precautions. If you use bad crypto, you can be lulled into a false sense of security. There is nothing more dangerous than thinking you are secure, when in actuality, you aren't.
  - diminoten 12y ago
    What if, due to the bullying nature of a niche industry, there are no other precautions to take?
    - sdevlin 12y ago
      Just to be clear, are you suggesting that there is an elite cadre of cryptobullies browbeating the general public into broadcasting compromising information all over the cleartext internet?
      - diminoten 12y ago
        Nope, I'm suggesting that a negative and hostile attitude, like the one exhibited towards the CryptoCat team by tptacek and others is not healthy to the industry.
        tptacek 12y ago
        Negativity and hostility towards poorly constructed cryptographic applications is unhealthy in what way?
    - hluska 12y ago
      Good question. First, I think that if you cannot think of an alternative to crypto, you should think twice about doing anything that could get you or your friends killed. Second, I urge you to consider the difference between these two developers: Developer A is just learning crypto. She makes many mistakes and builds some truly horrible systems. But, she is just learning and she never actually intends for anyone to use her systems. Developer B thinks she is a crypto god. She releases a tool and claims it is incredibly secure. However, it contains fatal flaws. If someone bullies developer A, I think that many people would jump to her defense. On the other hand, developer B is a very dangerous person whose hubris has created a dangerous situation.

noonespecial 12y ago

In crypto, its justified. Crypto is like flying a plane. You can't do it just because you read lots of books and try really hard. Extra smart people have very little advantage over those of average intelligence. Most importantly, due to the nature of the beast, the first mistake is the last. It doesn't matter if you get everything right for 99.9% of the flight and only make a mistake during 0.1% of it, the result is still a 0% success. Pilots are also a bunch of elitist snobs. I wouldn't fly with anyone else.

biff 12y ago
I think what's especially dangerous about it, as a software developer, is that broken crypto runs identically to properly-implemented crypto. If one is in the mentality of rewriting a program until runs without crashing a few times, well, that seems sufficient to land a gig to code printer drivers, but falls short of the rigor I'd hope would go into implementing a secure system. Nevertheless, at this moment there's a PHP programmer somewhere in the world writing new code that stores passwords hashed with one round of MD5.