The wisdom of the ill informed

James A. Donald jamesd at
Sun Jun 29 19:18:04 EDT 2008

Arshad Noor wrote:
> While programmers or business=people could be ill-informed, Allen,
> I think the greater danger is that IT auditors do not know enough
> about cryptography, and consequently pass unsafe business processes
> and/or software as being secure.

Committees of experts regularly get cryptography wrong - consider, for 
example the Wifi debacle.  Each wifi release contains classic and 
infamous errors - for example WPA-Personal is subject to offline 
dictionary attack.

One would have thought that after the first disaster they would have 
hired someone who could do it right, but as Ian long ago pointed out, in 
"the market for silver bullets", they are unable to tell who can do it 
right.  The only people who know who the real experts are, are the real 
experts.   If you knew who to hire, you could do it yourself, and 
probably should do it yourself.  So they hire expert salesmen, not 
cryptography experts.

The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at

More information about the cryptography mailing list