-----BEGIN PGP SIGNED MESSAGE-----
In <34A8D6F1(_dot_)88FE21A9(_at_)netscape(_dot_)com>, on 12/30/97
at 03:11 AM, Tom Weinstein <tomw(_at_)netscape(_dot_)com> said:
William H. Geiger III wrote:
In <34A88EC3(_dot_)7B2C1260(_at_)netscape(_dot_)com>, on 12/30/97
at 01:03 AM, Tom Weinstein <tomw(_at_)netscape(_dot_)com> said:
While I support the ideal of building standards that use strong crypto,
it does nobody any good to create a standard which won't get
implemented. The export ciphers exist because in order for US software
manufacturers to use TLS, they have to be able to export the software
that includes it. It is certainly true that there are many software
developers who live in the free world, but those of us stuck in the US
still need to sell software.
But who in their right minds are going to buy it??
Products compete along more than one axis. It's a sad fact that much of
the most usable software is also some of the least secure. It would be
great if the most popular product could always be the most secure, but it
doesn't always work out that way. Do I really have to explain this to
anyone?
It all depends on who you are marketing your product to and for what use.
If you are adding crypto so joe sixpack can have warm fuzzies when he uses
his credit card on the internet then you could use ROT-13 for all the
difference it would make. On the other hand if you are trying to sell to
john doe for securing his banking transaction security consideration far
outweigh "usability". No matter how pretty you make your interface, if he
has any smarts at all he woun't settle for rc2/40 or some other weak
crypto. Look at the stink going on in Sweeden right now as the government
is just finding out the their Lotus Notes system is insecure.
I for one would *never* recomend to my overseas clients to use crippled
US export crypto products. There are just too many people writting
non-crippled software to justify it.
At the very least one would think that the US vendors would put thier
crypto code in one DLL and document the API so someone overseas could
replace it with somthing worth using. <sigh> I guess even that is too
much to ask.
If the US government would let us, you better believe we'd do it. We
have no vested interest in helping the NSA eavesdrop on people. We make
money by selling software that meet our customers' needs, and that
includes being secure.
The strategy you describe is called "crypto with a hole", and is
explicitly forbidden by the export regs.
I'll leave that one for the layers. :)
An interesting thought: What liability does a software/hardware vendor
have if they knowingly sell an insecure product and because of that the
customers security is breached and losses are sustained? Are they open to
charges of fraud if they market and sell a product as "Secure" while they
know it is not?
While US vendors make some sales in the short term unless things change
they are going to find themselves to be a big fish in an ever shrinking
pond. Once offshore security vendors become established meeting the
unsatisfied demand for secure products overseas, US vendors will be
fighting them for US market share (unless Freeh gets his way and restricts
imports of strong crypto and domestic use of strong crypto).
- --
- ---------------------------------------------------------------
William H. Geiger III http://users.invweb.net/~whgiii
Geiger Consulting Cooking With Warp 4.0
Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://users.invweb.net/~whgiii/pgpmr2.html
- ---------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a-sha1
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000
iQCVAwUBNKjwDI9Co1n+aLhhAQHIDQQAjvq/+Q+TS/iYT7a0FmWChN5wonVrYTJc
suu/u9ob6x7XyG6gP2XYnguhkzmm+0VvA5R8YaIunjDqSZWOUQdI6rFxauYkzhbF
6k8s2gGZzdFDUZ0erSZsNQ4BRLyw8ATlDbRcnd8g91cz3dgnHINcrJtFBEwmaml1
wj4Ys0IjD5k=
=mj1h
-----END PGP SIGNATURE-----