Hacker News Reader

Comment by mckiddy | Hacker News Reader

Exactly, this will fail just as fast as a single cipher when your users inevitably use 'password123' for their password.

View on HN

This is like saying, "A self driving car is a bad idea, because the user might enter the bottom of the ocean as their destination.".

Except this also adds very little benefit. Sure, 3 ciphers might be better than one, but as the top comment said the cipher is already the strongest part of the entire process.

If the user enters the bottom of the ocean as their destination, it would be bad for a self-driving car to take them there. "The user is an idiot and so we killed him" is not going to be such a great defense in court...

In all seriousness, if a man puts a GLOCK 21 in his mouth and pulls the trigger, is it GLOCK that "killed him"?

If I take my car and intentionally drive into the ocean, I expect it to continue until the engine dies, and then I do shortly after. Why should machines start prohibiting me from doing stupid things, if I want to do them? I think Isaac Asimov wrote a parable about such a future.

None of the mistakes people make in crypto are intentional. We need better interfaces to help them not make those mistakes.

There's no a priori need for password-derived key material in a library like this. To require it unilaterally is to introduce a security risk, since people have proven to be poor sources of entropy.

I don't really understand the self-driving car analogy. A better analogy would probably be three cars hitched together.

This is like saying "adding triple redundant GPS to a self driving car is a bad idea because the GPS is the component least likely to cause you to end up at the bottom of the ocean."

Reply on news.ycombinator.com