Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Wow. That's some horrible lawmaking right there. Massive costs to everybody just because some busybody wanted everyone to use his/her crypto standard.


How else should they've done it? Remember this is a time when mainstream browsers are only shipping 56-bit crypto because of US export regulations. They needed a standard and a standard implementation (because having generalist developers, even good ones, implementing crypto is a recipe for disaster). Netscape didn't have extensions (only plugins); activex was likely the only extension API that offered the right hooks for implementing something like this.


They should have made policy to require a certain level of security and fund efforts to implement such a system/standard. The policy would have been valid even after other systems (or newer, exportable browsers) appeared that offered similar or better security.


Why should the Government legislate what crypto you use?


Funnily enough that's precisely why another government legislated what crypto their citizens should use.


Companies want protection. Companies want to demonstrate that they are not negligent. Companies want clear rules that state "doing it THIS way is good and safe and in the event that it all goes wrong will leave you blameless because you totally followed the rules". The big rulemaker in any society is government. You could have worked this out on your own.


Because they want to be able to read your shit.


Extreme, maybe, but a local proxy server would work.


It seems that the standard behind that was first published in 1998 (http://en.wikipedia.org/wiki/SEED) whereas crypto export restrictions were lifted only 2000.

Before the export restrictions, browsers outside the US were restricted to 40-bit RC4 (which could be hacked in a matter of days) instead of 128-bit version that was available within the US. So I think it is fair to say that it was not just some busybody wanting everyone to use his/her crypto standard.


Sure, there may be a good argument for South Korea's Government having implemented their own Cryptography at that time.

There is no argument for passing legislation forcing everyone to use it even when better alternatives exist.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: