Carnival atmosphere in security

Summertime is the season for traveling circuses and local fairs, so I shouldn't be surprised that this carnival atmosphere has spread to security. A company named Permanent Privacy just announced a $1 million prize to the person who can crack its algorithm and uncover the underlying encryption keys.

Now I realize there is some history here. In January 1999, a group of academics cracked the 56-bit Data Encryption Standard in just over 22 hours and won a prize of $10,000. That said, I am not a big fan of security showmanship like this from unknown security start-ups.

Why? First of all, this "challenge" isn't really a challenge at all. Permanent Privacy technology is based upon the AES (Advanced Encryption Standard) algorithm and since no one has cracked AES, it's highly unlikely that anyone will crack AES with an additional proprietary security wrapper . Furthermore, information security is no longer an academic playground for brainiacs at Berkeley and MIT. Rather, it's serious business that impacts everything we do. Given this level of criticality, I'd rather see things like Common Criteria or FIPS certification than a publicity gimmick.

As a start-up, I understand that Permanent Privacy needs to generate buzz and all PR is good PR. Heck, I did the same thing as VP of marketing at a misguided CLEC during the boom. Security isn't like other technologies however, it's more about law, order, and safety. Oracle was dragged through the mud when it advertised its database as "unbreakable." Perhaps it's just me, but I think Permanent Privacy deserves a similar treatment in the market.

[knotbeer]

Word homie. I think all them peeps oughta be hung rung and flung out to dry a rotten smeltering death because they think they have a product that companies like ours can use to gain multi-million dollar contracts with. Banish those bastards to hell for thinking they can provide security that would be a good selling point for us I.T. dumbspits to our superiors who don't know anything about computers & security but want their passwords to be "boss" or "HeMan" and sign checks all day. Gee. What were they thinking by believing people would want something that can be a solid security feature.

[christopherafernandez]

good one

[christopherafernandez]

one of the greatest articles