Skip to main content
Cryptography

Return to Answer

Corrected some mistake.
Source Link
edit approved Dec 8, 2019 at 12:31
R1w
edit approved Dec 8, 2019 at 12:31
R1w
  • 2k
  • 4
  • 22
  • 45
  • it is more secure than plaintext that you had before (even if only by a slight margin, as you're not experienced in crypto).
  1. you're an interesting target yourself (for example: top politician, financial access  / banksbanks, celebrity status, have access to rare information, etc)
  2. you're perhaps not interesting yourself, but there is a lot of "you" using the same security method. In other words: popularity. Sure, facebookFacebook does not contain much of top secret-secret data, but having a way to access ANYONEs facebookanyone's Facebook account is going to be a very good incentive for hackers to try to crack its protections protection.
  3. bad luck (eg. some hacker is bored and just happen to take a pick on your site, transforming it to point 1. above)

Now, sure TLS1.3+AES256-GCM/SHA512 is great thing today. Nobody can spy on you (except NSA and friends, but if you made an enemy of them, you're done already). But there is an enormous amount of people using it, and thus it becomes enormously profitable to crack it. So it will happen.

However, your toy-crypto chat, used in the whole world only by you and your friend to talk about slightly embarrassing fetishes, will likely remain hidden from everyone but legitimate parties for all eternity. Simply because nobody cared enough to give it a minimum of effort needed to crack it, and it wasn't popular enough that is was decrypted by default by some PRISM-like mass surveillance.

But I'm wondering if, in the long run, we wouldn't all be much better if we had billions of obscure and insecure ciphers each used only by few people; as apposedopposed to few supposedly uncrackable ones that everybody uses (but which are secretly flawed - which is known only by 1984-ish govermentsgovernments and other murky elements.

As (anecdotal) "evidence", every month I help fix dozens of broken wordpressWordPress/joomlaJoomla/etc sites which were "sooo secure" just a few months/years ago. But strangely enough, every now and then I stumble upon properly written (eg. verifies input :) old perlPerl or even shell scripts, using insecure RC2 or even just hackish XOR, which still standstands strong after decades. Just because there were different (and not popular) and nobody cared enough to spend time to crack them.

As your biggest problem nowdaysnowadays is probably not that you will get targeted, but instead that some automated bot will exploit some hole in a popular piece of software which you didn't patch quick enough. As there is a limited amount of crypto-crackers, and there are most of the time chasing bigger cat than you. So you'd most likely become low-priority ticket and thus fade into oblivion.

  • it is more secure than plaintext that you had before (even if only by slight margin, as you're not experienced in crypto).
  1. you're interesting target yourself (for example: top politician, financial access  / banks, celebrity status, have access to rare information, etc)
  2. you're perhaps not interesting yourself, but there is a lot of "you" using same security method. In other words: popularity. Sure, facebook does not contain much of top secret data, but having a way to access ANYONEs facebook account is going to be very good incentive for hackers to try to crack its protections .
  3. bad luck (eg. some hacker is bored and just happen to take a pick on your site, transforming it to point 1. above)

Now, sure TLS1.3+AES256-GCM/SHA512 is great thing today. Nobody can spy on you (except NSA and friends, but if you made enemy of them, you're done already). But there is enormous amount of people using it, and thus it becomes enormously profitable to crack it. So it will happen.

However, your toy-crypto chat, used in the whole world only by you and your friend to talk about slightly embarrassing fetishes, will likely remain hidden from everyone but legitimate parties for all eternity. Simply because nobody cared enough to give it minimum of effort needed to crack it, and it wasn't popular enough that is was decrypted by default by some PRISM-like mass surveillance.

But I'm wondering if in the long run we wouldn't all be much better if we had billions of obscure and insecure ciphers each used only by few people; as apposed to few supposedly uncrackable ones that everybody uses (but which are secretly flawed - which is known only by 1984-ish goverments and other murky elements.

As (anecdotal) "evidence", every month I help fix dozens of broken wordpress/joomla/etc sites which were "sooo secure" just a few months/years ago. But strangely enough, every now and then I stumble upon properly written (eg. verifies input :) old perl or even shell scripts, using insecure RC2 or even just hackish XOR, which still stand strong after decades. Just because there were different (and not popular) and nobody cared enough to spend time to crack them.

As your biggest problem nowdays is probably not that you will get targeted, but instead that some automated bot will exploit some hole in popular piece of software which you didn't patch quick enough. As there is limited amount of crypto-crackers, and there are most of the time chasing bigger cat than you. So you'd most likely become low-priority ticket and thus fade into oblivion.

  • it is more secure than plaintext that you had before (even if only by a slight margin, as you're not experienced in crypto).
  1. you're an interesting target yourself (for example top politician, financial access/banks, celebrity status, have access to rare information, etc)
  2. you're perhaps not interesting yourself, but there is a lot of "you" using the same security method. In other words: popularity. Sure, Facebook does not contain much of top-secret data, but having a way to access anyone's Facebook account is going to be a very good incentive for hackers to try to crack its protection.
  3. bad luck (eg. some hacker is bored and just happen to take a pick on your site, transforming it to point 1. above)

Now, sure TLS1.3+AES256-GCM/SHA512 is great thing today. Nobody can spy on you (except NSA and friends, but if you made an enemy of them, you're done already). But there is an enormous amount of people using it, and thus it becomes enormously profitable to crack it. So it will happen.

However, your toy-crypto chat, used in the whole world only by you and your friend to talk about slightly embarrassing fetishes, will likely remain hidden from everyone but legitimate parties for all eternity. Simply because nobody cared enough to give it a minimum of effort needed to crack it, and it wasn't popular enough that is was decrypted by default by some PRISM-like mass surveillance.

But I'm wondering if, in the long run, we wouldn't all be much better if we had billions of obscure and insecure ciphers each used only by few people; as opposed to few supposedly uncrackable ones that everybody uses (but which are secretly flawed - which is known only by 1984-ish governments and other murky elements.

As (anecdotal) "evidence", every month I help fix dozens of broken WordPress/Joomla/etc sites which were "sooo secure" just a few months/years ago. But strangely enough, every now and then I stumble upon properly written (eg. verifies input :) old Perl or even shell scripts, using insecure RC2 or even just hackish XOR, which still stands strong after decades. Just because there were different (and not popular) and nobody cared enough to spend time to crack them.

As your biggest problem nowadays is probably not that you will get targeted, but instead that some automated bot will exploit some hole in a popular piece of software which you didn't patch quick enough. As there is a limited amount of crypto-crackers, and there are most of the time chasing bigger cat than you. So you'd most likely become low-priority ticket and thus fade into oblivion.

not enought crypto-crackers
Source Link
Matija Nalis
Matija Nalis
  • 201
  • 6
  • 12

As your biggest problem nowdays is probably not that you will get targeted, but instead that some automated bot will exploit some hole in popular piece of software which you didn't patch quick enough. As there is limited amount of crypto-crackers, and there are most of the time chasing bigger cat than you. So you'd most likely become low-priority ticket and thus fade into oblivion.

As your biggest problem nowdays is probably not that you will get targeted, but instead that some automated bot will exploit some hole in popular piece of software which you didn't patch quick enough.

As your biggest problem nowdays is probably not that you will get targeted, but instead that some automated bot will exploit some hole in popular piece of software which you didn't patch quick enough. As there is limited amount of crypto-crackers, and there are most of the time chasing bigger cat than you. So you'd most likely become low-priority ticket and thus fade into oblivion.

Source Link
Matija Nalis
Matija Nalis
  • 201
  • 6
  • 12

It is discouraged, for all the good reasons the people already answered you (so I won't repeat).

There is a twist, however (which is the point of this answer) - no matter how weak your cipher is (and it IS weak), it has two advantages going for it:

  • it is more secure than plaintext that you had before (even if only by slight margin, as you're not experienced in crypto).

and (this one is going to be controversial)

  • it might actually give you more of a chance of not being spied upon if you're not already interesting target for NSA or some other agency. (Now before you people downvote me to hell with "security though obscurity doesn't work" please allow me to explain :)

As mentioned above, if you're specifically targeted, using toy-cipher won't help you at all and you're practically as unprotected as when you were using unencrypted communications (or even slightly worse, as you might take more risk talking when believing you're protected).

However, beside (or one might argue: before) security of the cipher itself, and security of its implementation (those are two very different things, remember Debian GNU/Linux OpenSSL fiasco for example) there is one other key factor in determining if your communication is going to be de-privatized. And that is, "will anyone try"? And someone will try if any of the 3 things are true:

  1. you're interesting target yourself (for example: top politician, financial access / banks, celebrity status, have access to rare information, etc)
  2. you're perhaps not interesting yourself, but there is a lot of "you" using same security method. In other words: popularity. Sure, facebook does not contain much of top secret data, but having a way to access ANYONEs facebook account is going to be very good incentive for hackers to try to crack its protections .
  3. bad luck (eg. some hacker is bored and just happen to take a pick on your site, transforming it to point 1. above)

Now, sure TLS1.3+AES256-GCM/SHA512 is great thing today. Nobody can spy on you (except NSA and friends, but if you made enemy of them, you're done already). But there is enormous amount of people using it, and thus it becomes enormously profitable to crack it. So it will happen.

Not today, not in 5 years perhaps, but in 50 years random script kiddie would probably be able to decrypt your communications (as you didn't use PFS, doh!) with a simple click.

However, your toy-crypto chat, used in the whole world only by you and your friend to talk about slightly embarrassing fetishes, will likely remain hidden from everyone but legitimate parties for all eternity. Simply because nobody cared enough to give it minimum of effort needed to crack it, and it wasn't popular enough that is was decrypted by default by some PRISM-like mass surveillance.

But the other answers had it correct; best practice for continued secret communications currently is: "a) don't make enemies of various TLA government agencies. b) use secure popular ciphers implemented by competent programmers. c) keep upgrading both ciphers and implementations until at least the day you die" - although it is usually (with perilous results) often shortened just to half of point (b) "use secure popular ciphers".

But I'm wondering if in the long run we wouldn't all be much better if we had billions of obscure and insecure ciphers each used only by few people; as apposed to few supposedly uncrackable ones that everybody uses (but which are secretly flawed - which is known only by 1984-ish goverments and other murky elements.

As (anecdotal) "evidence", every month I help fix dozens of broken wordpress/joomla/etc sites which were "sooo secure" just a few months/years ago. But strangely enough, every now and then I stumble upon properly written (eg. verifies input :) old perl or even shell scripts, using insecure RC2 or even just hackish XOR, which still stand strong after decades. Just because there were different (and not popular) and nobody cared enough to spend time to crack them.

As your biggest problem nowdays is probably not that you will get targeted, but instead that some automated bot will exploit some hole in popular piece of software which you didn't patch quick enough.