Many people are surprised to learn that weak cryptography systems (including any systems of any ostensible strength with mandated or other backdoors) are vastly more dangerous than using NO cryptography at all.
Why? Because if someone is lulled into complacency and passes their private information through a compromised system as defined above, it becomes vulnerable to criminal and/or illicit government abuse.
On the other hand, if you KNOW that a communications channel is not encrypted, you know what the limits are about what you should or should not pass through that channel.
@lauren I wonder how much another issue would compound this: encrypted systems are harder to debug. With weak cryptography you get the downsides of reduced debugability but not the upside of actual security. Attackers will be more likely to create tooling to circumvent encryption and thus be able to reverse engineer than the engineers actually working on the product.
@mrcompletely
It's common in many safety things. Like a barrier at an edge. It either needs to be robust enough for someone to lean heavily on it, or not be there.
Add comment