Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

Agree, BUT, people should not use absolute statements (like "just use" or "don't use") cause sometimes (sadly) it easily leads to a religious approach.


The point of "just use" in this case is the implied, but often unstated, first part: don't learn crypto, just use _____. Because when you think you've learned "enough" crypto to know what to do (whether writing a library or just picking one), is exactly when you're the most dangerous. Either really learn crypto (i.e. the 10000 hours way)--and don't build any cryptosystems until you have--or just avoid the problem-space altogether, and do exactly what the experts tell you. Which, in this case, is "use bcrypt."

The experts don't say "use bcrypt" because it's the best pluggable key derivation function. They say it because it's a satisfactory key derivation function, with viable APIs for every language you can think of. It's the McDonalds of crypto packages: a known quantity, anywhere you want it. Which is exactly what you want to point at if you want people doing as they're told ("just use...") instead of trying to learn what a "pluggable key derivation function" is... and following that path until, inevitably, they become dangerous.

An analogy, to take that last idea further: imagine if there was a universe like that of Harry Potter, with young witches and wizards capable of learning powerful, dangerous magics. But these magics require no wands, nor any other implement or component that could be taken away from the magician; once the spells are learned, they are irrevocably in the magician's possession, even if the corresponding safety lessons for use of that spell are never absorbed. And then, imagine that most learning of magic occurred through autodidacty...


Dan did such a great job on the Stanford Crypto course, it's worth learning the basics to learn the important bits.

https://www.coursera.org/course/crypto


I just have a 30 seconds mind-trip in this dystopian universe and it was horrifying :)




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: