News for hackers. Stuff that matters.

A comment on Login.gov encryption is badly designed. Parent comment

Re:Login.gov encryption is badly designed by mgkimsal on Sunday September 10, 2017 @11:28PM (#15215694)
If there's a legal requirement (FISMA is pointed to as a requirement) that would be rather compelling, no?
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by grantwu on Sunday September 10, 2017 @11:32PM (#15215708)
A design that technically violates a law, but is not actually dangerous - suppose the law constrains designs in a way that requires them to be less effective or safe - is not necessarily a poor design, unless "complies with law" is a higher priority design objective than "functions safely as intended".
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by rebuilder on Monday September 11, 2017 @12:08AM (#15215830)
"Complies with law" absolutely does seem like a requirement for a government service.
[ Parent | on HN ]
Re:Login.gov encryption is badly designed by mgkimsal on Monday September 11, 2017 @09:34AM (#15218361)
Not to be too flippant, but "complies with law" sort of seems like a requirement for non-government services too. But I may be reading this too broadly?
[ Parent | on HN ]