Cryptography is the science of secrets. In the distant past, it was simply about scrambling messages so adversaries couldn’t read them. In the modern computing era (a span of time that stretches less than 50 years), cryptography has become a keystone of computer security, encompassing all the ways we hide data, verify identities, communicate privately, and prevent message tampering.

Something else has changed, too. Today, every developer needs a solid grasp of security and cryptography basics. The stakes are simply too high to ignore them. You can’t reverse an exploit that’s already happened. And you can’t bolt security onto a system after the fact, no matter how many highly paid consultants you’re willing to hire.

To help you brush up on your security smarts, I’ve compiled a few of my favorite bits of cryptography wisdom. Many of them are a decade or two old. But their advice stands the test of time.

1. On secrets

“Every secret creates a potential failure point.” — Bruce Schneier

One of the most dangerous security mistakes a programmer can make (other than rolling their own crypto) is trusting that the things that are secret during development can stay secret forever.

Imagine you write an algorithm to verify promotional codes. As soon as someone discovers its rules of logic — by research, reverse engineering, trial-and-error, or just asking questions — it ceases to be a reliable test for finding fakes. No secret lasts forever, and every secret is just one exploit away from being compromised.

This concept can seem confusing at first, because computer security does rely on secret ingredients like passwords and keys. But if you look more carefully, you’ll find that these are the exact weak points of a system, to be minimized, managed, or avoided wherever possible. Passwords are a notorious failure point — all it takes is one email spoofing attack or improperly discarded hard drive to pinch one. (Biometric data, which isn’t secret but isn’t easy to acquire, is far more secure.)

#encryption #cryptography #computer-science #computer-security #data-science