Earlier quoted context omitted.
Interesting. We usually say that a good consultant should be senior enough to stand up to the customer and at least be able to inquire the basis for something. And also disagree when the customer is clearly wrong. But your way of doing it clearly removes the initial head-on. One could always reason about things. But to promise to investigate (and then deliver) looks (and is) professional. But I will never say yes whe…
So, to follow the diplomatic approach here: Client: "Encrypt our data using the md5 cipher." Consultant: "I will investigate the feasibility of this." ... two days pass ... Consultant: "I have considered your proposal. I believe we should encrypt your data with SHA-256. md5 is insecure, here's several references. SHA-256 is much more secure and more popular. It is a NIST standard, and just as cheap." Client: (probabl…
And at this stage start to enquire what security the customer think their system/product/service needs and try to move forward from that point. And we usually also talk about MD5 and its brokenness. Than if a secure hash function is needed, there are several good ones to choose from. And if they really don't need a secure hash function, there are others, much faster hash functions to use.
The point is that sometimes things need to be handled directly and up front. This for me is one of those things.