News for hackers. Stuff that matters.

A comment on Login.gov encryption is badly designed.

Re:Login.gov encryption is badly designed by justonepost on Sunday September 10, 2017 @11:26PM (#15215683)
I don't think "NIST" approved is that compelling of an argument.

If the author wishes to identify known vulnerabilities, that would be interesting.

FIPS has some various issues that actually increase vulnerability and not decrease it. Eg, FIPS approved OpenSSL was always an anchor that caused more problems than it solved.

[ Parent | on HN ]
Re:Login.gov encryption is badly designed by alaithea on Sunday September 10, 2017 @11:42PM (#15215745)
The OP seems to misunderstand the function of NIST, as well. NIST does not "approve" other agencies' software systems. NIST is a standards-setting organization only. They create and publish standards, but do not enforce them.
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by sdrapkin on Monday September 11, 2017 @10:31AM (#15218766)
The OP is referring to the OP-linked 18F writeup (you might want to read it), which says "Based on consultation with NIST we follow these steps..."
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by mgkimsal on Sunday September 10, 2017 @11:28PM (#15215694)
If there's a legal requirement (FISMA is pointed to as a requirement) that would be rather compelling, no?
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by grantwu on Sunday September 10, 2017 @11:32PM (#15215708)
A design that technically violates a law, but is not actually dangerous - suppose the law constrains designs in a way that requires them to be less effective or safe - is not necessarily a poor design, unless "complies with law" is a higher priority design objective than "functions safely as intended".
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by rebuilder on Monday September 11, 2017 @12:08AM (#15215830)
"Complies with law" absolutely does seem like a requirement for a government service.
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by mgkimsal on Monday September 11, 2017 @09:34AM (#15218361)
Not to be too flippant, but "complies with law" sort of seems like a requirement for non-government services too. But I may be reading this too broadly?
[ Parent | on HN ]