4 ms·

It's 2014. How are people still rolling their own, terrible, encryption schemes?

by flebron 12y ago

duaneb 12y ago
More importantly, how did the government certify the terrible encryption scheme?
woof 12y ago
It's Samsung, they have been adding crap on top of Android for years...
- joncrocks 12y ago
  It's interesting as they are contributing knox to core android (I think, see http://android-developers.blogspot.co.uk/2014/07/knox-contribution-to-android.html http://android-developers.blogspot.co.uk/2014/07/knox-contri...)
  - scott_karana 12y ago
    The API has been "adapted", and the new data separation will be "analogous", but it appears that it's an adaptation of the current AOSP/Google cryptography to fit a similar need, not a direct contribution from Samsung.
Tloewald 12y ago
I imagine that as the number of programmers is growing exponentially a lot of wheels will be reinvented unnecessarily, but this is a security product from a top-tier company selling products at premium prices.
Spearchucker 12y ago
Just because a company is big, or even a government agency does not mean they have the skill. I've worked for both, and the real security expertise (when they bother) is usually brought in through consultants. The apathy around security in both the public and private sectors is astounding. I keep hearing that it's difficult to get right. It's not. It does take some up-front thought though (security is not a bolt-on/refactor thing, it needs to be built in from the start), and a LOT of work. I know because I've gone through it (https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-4117-af17-c923ff855456 https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-411...).
- munin 12y ago
  > I keep hearing that it's difficult to get right. It's not. ... > and a LOT of work ????????
  - Spearchucker 12y ago
    Difficult (intellectually challenging) != hard work (back-breaking, sweat-inducting).
    - shard 12y ago
      That's cherry-picking non-intersecting definitions though. Difficult can also be work that involves a lot of physical or mental effort, not necessarily confined to just intellectually challenging. Hard work can also refer to work that requires mental effort or mental stamina, and does not only refer to highly physical labor.
      - Spearchucker 12y ago
        That is indeed cherry-picking, and was my intent. Bluntly, most devs I ask about their lack of ability in the security space think they're not smart enough to get it right, so don't even bother to try.

It's 2014. How are people still rolling their own, terrible, encryption schemes?

by flebron 12y ago

It's 2014. How are people still rolling their own, terrible, encryption schemes?

duaneb 12y ago

More importantly, how did the government certify the terrible encryption scheme?

woof 12y ago

It's Samsung, they have been adding crap on top of Android for years...

joncrocks 12y ago
It's interesting as they are contributing knox to core android (I think, see http://android-developers.blogspot.co.uk/2014/07/knox-contribution-to-android.html http://android-developers.blogspot.co.uk/2014/07/knox-contri...)
- scott_karana 12y ago
  The API has been "adapted", and the new data separation will be "analogous", but it appears that it's an adaptation of the current AOSP/Google cryptography to fit a similar need, not a direct contribution from Samsung.

Tloewald 12y ago

I imagine that as the number of programmers is growing exponentially a lot of wheels will be reinvented unnecessarily, but this is a security product from a top-tier company selling products at premium prices.

Spearchucker 12y ago

Just because a company is big, or even a government agency does not mean they have the skill. I've worked for both, and the real security expertise (when they bother) is usually brought in through consultants. The apathy around security in both the public and private sectors is astounding. I keep hearing that it's difficult to get right. It's not. It does take some up-front thought though (security is not a bolt-on/refactor thing, it needs to be built in from the start), and a LOT of work. I know because I've gone through it (https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-4117-af17-c923ff855456 https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-411...).

munin 12y ago
> I keep hearing that it's difficult to get right. It's not. ... > and a LOT of work ????????
- Spearchucker 12y ago
  Difficult (intellectually challenging) != hard work (back-breaking, sweat-inducting).
  - shard 12y ago
    That's cherry-picking non-intersecting definitions though. Difficult can also be work that involves a lot of physical or mental effort, not necessarily confined to just intellectually challenging. Hard work can also refer to work that requires mental effort or mental stamina, and does not only refer to highly physical labor.
    - Spearchucker 12y ago
      That is indeed cherry-picking, and was my intent. Bluntly, most devs I ask about their lack of ability in the security space think they're not smart enough to get it right, so don't even bother to try.