9

Many encryption systems in the 20th century used to rely on obscurity of the algorithm. This was a bad approach, as you have to keep the whole program secret, which is technically impossible if you want to distribute the program. If someone obtains a copy of the program, then you have to rewrite the program. In 21st century encryption, the only secret is ...


8

You should not include keys in your open source project. You should include a file location where your code expects a key, and the user (or an included utility) creates or copies their own unique key into the expected location. Imagine a thousand people download your project and stand up their own versions of your open-source server -- what's the point of ...


5

The reason open cryptography is considered safer than its closed alternatives is because open cryptography is open to reviews and auditing from security experts all over the world. Closed algorithms are subject to internal company reviews, and paid experts reviews only. Which, by definition, is a small set than "security experts all over the world". The ...


4

Even if your algorithm is in the open, each user keeps a secret: the password (or other secret that is used as key to en- and decryption). You want that the algorithm works safe, even if it is known. Because it is always possible through decompiling to get the algorithm. Why is the algorithm safe even if it is known? Because it works with mathematics, that ...


3

If someone sued Red Hat, for example, if Red Hat (or the computer) crashed and the person lost all of their stuff, that the ruling would likely absolve Red Hat of responsibility IANAL/IANYL. Nonetheless, I think that's likely, and it is because almost all free software licences include a clear and unambiguous liability disclaimer. Here's the one from the ...


1

It's not only about OSS crypto is safer than non-opensource crypto, it's about the algorithm you are using. It's very easy to build up an encryption algorithm at your own and it's very easy to fail complete while doing it. A good example is Mifare Classic. So using a public and proofed algorithm can save you some headage. Good algorithm splitting up the ...


Only top voted, non community-wiki answers of a minimum length are eligible