[cryptography] ICIJ's project - comment on cryptography & tools

Peter Gutmann pgut001 at cs.auckland.ac.nz
Sun Apr 7 21:06:45 EDT 2013


"Kevin W. Wall" <kevin.w.wall at gmail.com> writes:

>I think you're giving the NSA way too much credit on why security sucks. Even
>if we were to restrict 'security' to the scope of cryptography, even there, I
>think the NSA has much less to do with dumbing down crypto security than
>other factors. 

Exactly.  If the NSA didn't exist at all the only difference we'd notice is
that there'd be less of this weird obsession with ECDSA (via pressure to adopt
Suite B).  Computer security as a whole wouldn't suck any less.

>IMO, the biggest factor is that 95% or more of developers are completely
>ignorant of best practices in cryptography.

At the other end of the scale, 99.9% of developers who do know security have
no idea how to create *usable* security.  At the moment there are exactly two
crypto-using products I can think of that I'd feel confident a random member
of the public could walk up and use, those being Skype and iMessage.

(Unfortunately to the crypto-purists they're not good enough because they're
MITM-able.  You should be tunnelling SIP over OpenVPN, it's really easy,
here's a pointer to a list of links to 100-page discussion threads on web
boards for ways of doing this that may work sometimes).

Incidentally, the NSA is, from all the reports I've seen, even worse than we
are at making security usable.  My favourite publication on security
usability, Laura Heath's "An Analysis of the System Security Weaknesses of the
US Navy Fleet Broadcasting System, 1967-1974, as exploited by CWO John
Walker?", goes into this in more detail.

Peter.


More information about the cryptography mailing list