Hacker News Reader

Comment by OskarS | Hacker News Reader

Yeah, this part rings totally true:

> I actually do a double-take when a company says "Military-Grade", as I start to question how well they know cryptography, and if they may have picked an inferior algorithm thinking it's safe.

"Military grade" might sound good to marketing people, but to everyone that's actually involved in digital security, it sounds like it's made by people who have no idea what they're doing.

Another phrase like that is "patented technology" or "patent-pending". Maybe it sounds good to some people, but to to engineers it's a big red flag.

View on HN

I'm fine with the phrase "military grade" if the combination of software and hardware is FIPS 140-2 Level 4 certified.

When it is FIPS 140-2 level 4 certified, they will let you know early enough so when it's missing you can easily tell.

Yeah, anything I've ever encountered that had certifications didn't say "military grade" or whatever, instead they always listed the certifications relatively prominently.

What part of the device is certified? The logic unit, the whole asic, the board, the appliance? Software too? Or what??

My worst red flag is "proprietary". It gives me an instant head ache because it makes me think of bad quality, terrible documentation and just over all pain.

In the context of encryption, "proprietary" means "home grown". Or rather "home groan".

Propretary is a huge red flag. Never roll your own crypto!

I've noticed this even with fast food commercials which say things like "our proprietary blend of spices" in a tone implying you should be excited about it.

I'm fine with proprietary spice blends. At worst, it doesn't taste the way I want. But with encryption, "proprietary" means "untested", and that's a really bad idea.

Military grade makes me think of symmetric key encryption which unlikely to be used in most of these situations.

In regards to "Patent Pending" or "Patented Technology" - these are phrases that are legally defined.

Neither are snake oil (unless used in a fraudulent manner..), and can generally be interpreted as the product in question is objectively innovative.

When it comes to cryptography, "innovative" generally means "broken in new and interesting ways".

If you want security, use something which is old and well tested.

It is a sign they are more interested in lawyering than engineering.

Reply on news.ycombinator.com