Footguns and factorisation: how to make users of your cryptographic library successful
summary
Open source studies show concrete failures: Python and Android experiments find 20% of submitted code insecure while developers believe it's safe; analysis of 269 CVEs shows 83% of cryptographic bugs come from misuse, and 100% of plaintext disclosures occur at the application layer. Stack Overflow yields quick functional answers but often insecure ones. Libraries with abundant secure examples and peripheral features reduce errors, and simple runtime warnings nearly double secure outcomes by priming developers and guiding safer inputs and dependencies.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 8:22Security
- 12:11Stack Overflow
- 17:00Documentation
- 20:16Why does cryptographic software fail
- 27:05Results
- 34:22Runtime warnings
- 39:42Conclusion
related talks
40m 10 Things you Need to Know before Implementing Cryptography
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
36mUse Cryptography; Don't Learn It
44mCryptography Pitfalls
28mEpidemiology of Software Vulnerabilities: A Study of Attack Surface Spread
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
35mOpen source security: Opportunity or oxymoron?
37mStrengthening the Cybersecurity Ecosystem