When your homemade encryption algorithm is all that protects user passwords

Description

Meme photo of a crudely built wooden helicopter sitting on uneven ground; its panels are rough plywood with a slap-dash paint stripe. A man dressed in dark clothing stands in the doorway, one hand raised in a reassuring gesture. Bold white-on-black caption over the helicopter reads "My selfwritten encryption algorithm" while an equally bold caption over the man reads "User Password." The visual joke equates a rickety, questionably airworthy craft with rolling your own crypto to safeguard credentials, highlighting the security risk of ignoring established cryptographic standards

Common Tags

Encryption CryptographyAlgorithms SecurityBestPractices SecurityFlaws ReinventingTheWheel NotInventedHereSyndrome WeakPasswords

Comments

Anonymous ★ Top Pick We could’ve just used bcrypt, but management loved my ROT13-then-base64-then-pray() cipher - nothing like boarding a plywood helicopter to prove you’re innovating

Anonymous ★ Top Pick

We could’ve just used bcrypt, but management loved my ROT13-then-base64-then-pray() cipher - nothing like boarding a plywood helicopter to prove you’re innovating
Anonymous

The same developer who rolled their own crypto is now explaining to the security audit team why XOR with the company founding date counts as "military-grade encryption."
Anonymous

This perfectly encapsulates the cardinal sin of security engineering: spending months implementing AES-512-GCM with custom key derivation and perfect forward secrecy, only to watch it all crumble because users authenticate with 'Password123'. It's the cryptographic equivalent of installing a bank vault door on a cardboard box - technically impressive, fundamentally pointless. As Bruce Schneier would say, 'Security is a chain; it's only as strong as the weakest link.' And that link is almost always the human choosing 'admin' as their password, not your beautifully crafted - but ultimately unnecessary - custom encryption scheme that probably has timing attacks you haven't discovered yet
Anonymous

Rolling your own crypto: because libsodium couldn't handle your bespoke side-channel leaks
Anonymous

Homegrown encryption for passwords is the plywood helicopter of security - looks airborne until the first pen test adds wind
Anonymous

Roll-your-own crypto: your user’s password boarding a plywood helicopter - no proofs, no constant-time, no FIPS - one headwind from incident response
@Varty_G 5y

I have no algorithm. I always lead my users to the edge of the abyss and then push them right into it
@Bodziek 5y

plaintext rox
@mmddvg 5y

it's better not to store password at all
@cheapgemmer 5y

passwords are not encrypted, they are hashed
1. @AndoroidP 5y
  
  They are being encrypted while they are sent from client to server
2. @RiedleroD 5y
  
  one could argue that hashing with cryptographic algorithms counts as encryption
  
  @RiedleroD 5y
  
  however, if we define encryption purely as a method of bidirectional data locking (i.e. you can get the original data back from the encrypted data with a key), then yeah, passwords are not encrypted. Or at least they shouldn't be, I know some companies still do it anyway because stupidity.
  
  dev_meme 5y
  
  Or coz "DB leak will never happen to us" Or coz "Would be cool to have an access to user passwords, so let's also store encryption private keys IN THE SAME FUCKING TABLE"
3. dev_meme 5y
  
  That's a part of the joke, mate