Reader Comments (rss)

(Flattened / Threaded)

1.  

   

   Anonymous Coward, Jan 23rd, 2008 @ 2:37pm

   
   

   Yes, they should have. But that's how governments the world over work. The real experts tend to want better pay than a government job, or more freedom than a government job allows.
   
   People aren't willing to treat government agencies like real businesses. They view it as something sacred. To me, sure the government shouldn't be arbitrarily changed. But you're talking about the AGENCIES and stuff that aren't stipulated in the Constitution. Which is why you get redundant crap like "Homeland Security".
   
   But all well, I've become cynical enough to just give up on humanity at this point.

   [ reply to this | link to this | view in thread ]

2.  

   It'd be worse if...

   

   Rich Kulawiec, Jan 23rd, 2008 @ 4:07pm

   
   

   ...a country actually made this same, classic mistake while trying to implement a system to do something critically important, like, oh...hmmm...let me think...voting?

   [ reply to this | link to this | view in thread ]

3.  

   Re:

   

   Anonymous Coward, Jan 24th, 2008 @ 3:16am

   
   

   "The real experts tend to want better pay than a government job, or more freedom than a government job allows."
   
   The thing is they have the money to pay permanent staff however in my experience they'd much rather piss that money away on overpaid contractors and consultants.
   
   The reality is paying £900 per day for someone won't guarantee they're actually any good at their job and in many cases they may even be a graduate with little to ZERO experience. I know when I graduated and worked for a large IT consultancy on massive public sector projects my charge out rate was nearly £700 per day!

   [ reply to this | link to this | view in thread ]

4.  

   Why amateurs should not do crypto.

   

   GDK, Jan 24th, 2008 @ 5:52am

   
   

   Your premise is not supported by the facts in the story. You claim that not using a known secure algorithm is folly, because the algorithm is discoverable, whereas a published, widely known, algorithm that doesn't need to be reverse engineered is better. You go on to cite a successful BRUTE FORCE attack on a known algorithm as proof that a proprietary algorithm is less secure than a publicly vetted one. You base that claim on the fact that once an algorithm is known, a brute force attack is possible. You don't seem to acknowledge that the open crypto algorithms you tout are ALREADY subject to such attacks, no reverse engineering required.
   
   Maybe the point you were trying to make is simply that the Dutch used a key that was too small. Perhaps, you meant that they thought they could get away with a shorter key because they thought their algorithm was secret, but you didn't make that point.
   
   The rational argument against a proprietary crypto algorithm is that absent expert peer review of the details, it is likely that the algorithm can be broken without having to do a brute force attack.

   [ reply to this | link to this | view in thread ]

5.  

   Re: Why amateurs should not do crypto.

   

   Tim Lee, Jan 24th, 2008 @ 8:03am

   
   

   Sorry, I guess I wasn't as clear as I could have been. My point was that relying on the secrecy of the algorithm is a bad idea, and that I suspect the government officials in this case assumed that the relatively short key wasn't an issue because the secrecy of the algorithm gave them extra protection. It's true that the ultimate problem is the longer key size, but I suspect that if they'd been more open when they were developing the algorithm, someone probably would have pointed out that a 48-bit key is too short.

   [ reply to this | link to this | view in thread ]

Add Your Comment