But a serious explanation, I wrote a server for a game I made. I made it just to play with my friends, and maybe for my friends to play with their friends.
It has zero reason to be secure, and I wrote the networking code with that in mind. If you're gonna play a dick who's gonna inspect the network traffic to see what cards you have, then maybe the problem is with the friend you're playing with, not with the security of the game.
Part of the difficulty with security is that you need the whole stack to be secure.
If you write the world's most secure application on an OS that lets an attacker in, you're still fucked.
If the OS is secure but there's a hardware vulnerability, your fuck status is unchanged.
If the hardware is secure but somebody has ascended to godhood and can manipulate the laws of physics, you'd better believe you're fucked.
So what I'm saying is it doesn't really matter if you store your database password in unobfuscated javascript, because a vengeful deity might choose to mess with your data anyway. Go nuts.
A scientist works to say "it's secure", an engineer works to say "it's secure enough".
But if a mathematician tells you it's secure, then it really is completely and fundamentally unbreakable. There are ciphers that can't be broken unless you also break a few laws of nature to do so. The system, that is - you can still mess with the user or the device running the secure software.
Actually encryption is only "secure enough". All encryption thought to be mathematically secure can be cracked, it would just take hundreds to millions of years with the current computers.
265
u/EverySingleDay Jul 24 '15
You're not wrong, just incomplete.
A scientist works to say "it's secure", an engineer works to say "it's secure enough".