Embed Notice

My job involves auditing and developing cryptographic software.

Most developers don't understand cryptography.

Most developers shouldn't ever need to understand cryptography.

Most users understand it less than developers do!

A large unwritten part of my job responsibility involves talking developers down from the ledge when they think cryptography is easy.

Once in a blue moon, I have a conversation that looks like this:

Dev: "I don't get why more people don't add end-to-end encryption! It was really easy: I broke the plaintext into 256 byte blocks and encrypted them independently with their recipient's RSA 2048-bit public key. I wrote it using BigInts in my computer science class, and it just works."

Me: "Hey that's horrifying and all but before we get into the details, how do you know which public key to use?"

Dev: "Oh, I store it in MySQL! The encryption is done in JavaScript, so I never see plaintext."

Me: [crying inside]