Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I've helped with the design of protocols and API's within international standardization bodies. Over 30 years of general experience with computers, starting with MSX Basic at an early age. I've developed in Java for as long as the language exists (Kotlin is looking good too).
Copy/paste security doesn't exist.
All of the high scoring answers on StackOverflow have displayed grave security mistakes.
If the code runs it does not mean it is secure. I would guess that about 10% of the code posted on StackOverflow could be secure. If you want to learn cryptography I highly recommend Crypto I from Dan Boneh at Coursera as a (University level) introductory course.
The most basic and therefore most common security mistakes:
- not understanding the difference between encoding and encryption;
- using keys or IV's directly derived from text / passwords;
- using ECB mode encryption;
- using MD5, DES or other outdated cryptographic algorithms;
- not understanding on how to use an IV / nonce;
- performing password hashing (or key derivation) without applying PBKDF2, bcrypt or scrypt
- using ciphertext that is not protected by an authentication tag;
- thinking that OTP (XOR-encryption) can be made secure (without inventing an inefficient stream cipher);
- encryption without establishing trust (most browser based encryption);
- using textbook RSA or using RSA to directly encrypt messages;
- inventing transport based security instead of using (D)TLS;
- not using a cryptographically secure random number generator.
If you're making any of the above mistakes please hire a professional. Please do not rely solely on StackExchange answers.
Member for 4 years, 4 months
0 profile views
Last seen Apr 24 at 13:08
- Stack Overflow 66.1k 66.1k 1111 gold badges8888 silver badges184184 bronze badges
- Cryptography♦ 58.6k 58.6k 77 gold badges8585 silver badges213213 bronze badges
- Information Security 3.6k 3.6k 1212 silver badges2626 bronze badges
- Code Review 787 787 44 silver badges1212 bronze badges
- Super User 700 700 11 gold badge55 silver badges1616 bronze badges
- View network profile →
Top network posts
- 93 What is the difference between PKCS#5 padding and PKCS#7 padding
- 71 What is the difference between PKCS#5 padding and PKCS#7 padding
- 68 View past notifications
- 68 Are one-time pads crackable in theory?
- 63 How to encrypt and decrypt file in Android?
- 57 What is the difference between .pem , .csr , .key and .crt?
- 53 Byte and char conversion in Java
- View more network posts →