Re:Open-source crypto is no better than closed-source crypto
by msla on Thursday October 04, 2018 @05:07PM
(#18143675)
Open-source crypto wins because it's never just crypto. It's a whole system with crypto as one element.
The crypto may be the only hard part, but it's still just one part. Like in a password manager: Even if the crypto is somehow known-good, if the whole thing's closed-source, I don't know if the non-crypto parts aren't exfiltrating my plaintext passwords so my accounts can be sold to botters. In an open-source project, there's a good chance something like that will be caught without some bored person deciding to run Wireshark at the same time they're running a password manager.
The crypto may be the only hard part, but it's still just one part. Like in a password manager: Even if the crypto is somehow known-good, if the whole thing's closed-source, I don't know if the non-crypto parts aren't exfiltrating my plaintext passwords so my accounts can be sold to botters. In an open-source project, there's a good chance something like that will be caught without some bored person deciding to run Wireshark at the same time they're running a password manager.