Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto 101 – Introductory course on cryptography

crypto101.io

Post reply on HN
Print view View original

71–80 of 148 posts

Re: Crypto 101 – Introductory course on cryptography

#71

Post by clifanatic »

lvh wrote: post #63
CameronBanga wrote: post #39

Quick question, I had apparently Pinboarded this in March 2014. I see the PDF is still pre-release. Has anything changed with this, or is it kinda just coming up again because of recent political climate. I'm fine either way, just curious if this has changed drastically from what I had looked at previously.

Hi! I'm the author. I should stop calling it a pre-release. There's no useful "done" marker. It includes most of the material I wanted to talk about, and has for a while. You should update the PDF though; as the other commenter mentioned, it does get updated :)

> There's no useful "done" marker.

Well, maybe when there are no more "TODOs" ;)

Re: Crypto 101 – Introductory course on cryptography

#72

Post by serge2k »

dom0 wrote: post #20
eponeponepon wrote: post #19

Earlier quoted context omitted.

There's a difficult rabbithole here - eventually you have to draw a line and decide to trust someone . Otherwise it's just layer after layer of paranoia until you implode in a puff of Philip Dick :)

Of course; my point is (and I assume that's also the point of other people who assert similar stances on the topic) that the average programmer or software engineer should leave these things to recognized cryptographers. This also highlights a peculiarity with cryptography, in that it is very hard to understand for laymen (assuming laymen are ppl with some CS or math education), so most arguments in discussions of la…

> that the average programmer or software engineer should leave these things to recognized cryptographers

Study and experimentation are how you end up with recognized cryptographers.

This very sensible attitude of "Use the recommended library with recommended settings" seems to get pushed to the point where it becomes "Don't bother learning". I don't think it's intentional of course.

Re: Crypto 101 – Introductory course on cryptography

#73

Post by Gruselbauer »

eponeponepon wrote: post #3

This is about to eat my weekend, I think! :) Quite seriously, this is exactly what the tech world needs - personally, I know that in terms of understanding of crypto I'm streets ahead of the average Joe, but orders of magnitude behind people who actually know the field. I'm certain I'm far from alone in that set, but the way the world's going means that we with the generalised technical know-how have a moral impetus…

Logged in to post pretty much exactly this.

Since the author is reading this: thanks. Read the first few lines and am already hooked. I have been looking for a long time, but most texts on crypto are either way below my level of understanding or miles above. You're a godsend!

Re: Crypto 101 – Introductory course on cryptography

#74

Post by gist »

lvh wrote: post #60
TrinaryWorksToo wrote: post #9

With everything in Crypto I have to wonder: Is the information correct? I really have no way of verifying if I'm learning the correct DHE, and I know that it's easy to get wrong. Perhaps I can do some testing in code, but I may test it incorrectly too, and those small errors can be exploited.

Hi! I'm the author of Crypto 101. Firstly, I'm a real, honest-to-God cryptographer. I don't know if there are any particular people you had in mind whose recommendations you'd like to see, but there are a few HN bigwigs who'd probably be willing to generally endorse it :-) Also, it's been posted on HN a few times before, so it's had some scrutiny. That doesn't mean I don't make mistakes, but generally speaking, an ac…

My trust chain: I don't know crypto and didn't know who you were (so I might have asked the same question) but a few days ago I found out you are involved with tptacek with latacora.com so that was all I needed to know and trust what you said.

Re: Crypto 101 – Introductory course on cryptography

#75

Post by tscs37 »

eponeponepon wrote: post #3

This is about to eat my weekend, I think! :) Quite seriously, this is exactly what the tech world needs - personally, I know that in terms of understanding of crypto I'm streets ahead of the average Joe, but orders of magnitude behind people who actually know the field. I'm certain I'm far from alone in that set, but the way the world's going means that we with the generalised technical know-how have a moral impetus…

I'm not sure if it still applies, but there is a saying:

"There are maybe 5 people in the world that may call themselves cryptographers"

Re: Crypto 101 – Introductory course on cryptography

#76

Post by racl101 »

lvh wrote: post #60
TrinaryWorksToo wrote: post #9

With everything in Crypto I have to wonder: Is the information correct? I really have no way of verifying if I'm learning the correct DHE, and I know that it's easy to get wrong. Perhaps I can do some testing in code, but I may test it incorrectly too, and those small errors can be exploited.

Hi! I'm the author of Crypto 101. Firstly, I'm a real, honest-to-God cryptographer. I don't know if there are any particular people you had in mind whose recommendations you'd like to see, but there are a few HN bigwigs who'd probably be willing to generally endorse it :-) Also, it's been posted on HN a few times before, so it's had some scrutiny. That doesn't mean I don't make mistakes, but generally speaking, an ac…

Thanks for putting this together!

My g/f is getting interested in this sort of thing and she'll find this thrilling.

Re: Crypto 101 – Introductory course on cryptography

#77

Post by lhnz »

Whenever I have taken the small amount of cryptography knowledge I already have and tried to use it in a project, I've often been shutdown with "the system already does that" when it doesn't, or "this will be too complicated for the user, instead lets just roll our own [ad-hoc cryptography method]".

For those reading:

How do you convince people that it's worth using best practices?

Is there a good heuristic to measure the value of something, when deciding how much time and money to spend on securing it?

What are good library/SaaS solutions to help build secure applications with less chance of shooting yourself in the foot, better UX and lower cost? (Keybase, etc.)

Re: Crypto 101 – Introductory course on cryptography

#78

Post by andrewflnr »

wolf550e wrote: post #31
gmluke wrote: post #26

Earlier quoted context omitted.

This is slightly tangential since you specified a conspirator on the inside, but how easy is it to break a homegrown encryption algorithm if you don't have the source code? I assume there are tools (what are they?) that will break a simple caesar cipher if you have more than a sentence or so of plain text to work with. But if you strung together 2-3 broken algorithms and your attacker doesn't know which ones, is it s…

People who can break it won't spend the time breaking your homegrown crypto, so you won't get proof it's broken. But it's still broken. If lots of money or lives of political dissidents are at stake, it will be broken. To have really capable people work on breaking your crypto for free, you have to be an insider. You become an insider by breaking other people's crypto. You can publish a break in an insider's crypto e…

We're specifically talking about the scenario where you have a "tiger team" (strcredzero's phrasing) trying to break it. I interpreted GP as asking just how hard a time the tiger team would have if they don't have source code.

Re: Crypto 101 – Introductory course on cryptography

#79

Post by tptacek »

lhnz wrote: post #77

Whenever I have taken the small amount of cryptography knowledge I already have and tried to use it in a project, I've often been shutdown with "the system already does that" when it doesn't, or "this will be too complicated for the user, instead lets just roll our own [ad-hoc cryptography method]". For those reading: How do you convince people that it's worth using best practices? Is there a good heuristic to measur…

For normal application work, you should use NaCL (or it's repackaged version, libsodium) to the exclusion of all else.

Re: Crypto 101 – Introductory course on cryptography

#80

Post by tptacek »

gist wrote: post #74
lvh wrote: post #60

Earlier quoted context omitted.

Hi! I'm the author of Crypto 101. Firstly, I'm a real, honest-to-God cryptographer. I don't know if there are any particular people you had in mind whose recommendations you'd like to see, but there are a few HN bigwigs who'd probably be willing to generally endorse it :-) Also, it's been posted on HN a few times before, so it's had some scrutiny. That doesn't mean I don't make mistakes, but generally speaking, an ac…

My trust chain: I don't know crypto and didn't know who you were (so I might have asked the same question) but a few days ago I found out you are involved with tptacek with latacora.com so that was all I needed to know and trust what you said.

That's a little scary but I appreciate the compliment.
Post reply on HN