Opinion: DIY security is not security

I spend a lot of time working in software houses. One of the nastiest things that I see again and again and again, is developers attempting to roll their own security and authentication mechanisms.

Spend a moment and think about how many security incidents the big companies (Google, Apple, Microsoft, etc.) have had over the years. Now think about how much effort they’ve put into doing it right, yet they still have issues at times.

The scary part about trying to do this yourself is that you often don’t even know how scary what you are doing is.

Apart from the ones who do a reasonable job of password hashing, etc. I also see a surprising number who still store plain text passwords, or think that applying some “special algorithm that they wrote” to “encrypt” passwords or other private information is acceptable.

It’s not.

I cringe every time I see someone who’s written a algorithm that does obfuscation on a value before storing it. Worse is when they refer to it as “encryption” within the organization.

So my post today is just a simple plea:

Please don’t do this.

The minute you find yourself writing “encryption algorithms” or authentication code, just stop. Just because you think you’ve got away with it for years, don’t tell yourself that you don’t have an issue.

I’ve seen the outcome at sites where this all goes wrong, and it’s not pretty. You do not want to be anywhere near it when the finger-pointing starts. It all ends in tears.

[caption id=“attachment_3687” align=“alignnone” width=“560”] Image by Tom Pumford[/caption]

2018-07-17