> We also tend to recommend that people simply use PGP for data at rest, and TLS for data in motion
When I complain about bad crypto (in API auth in particular) and my clients really really push for me to give them advice, I repeat this line verbatim.
They hate it because TLS with client-side certs for authentication (where you become the CA) is unfamiliar and has too many moving parts for them. They go and develop their hand-rolled API auth, I proceed to shoot holes in it and come across as a bit of dick (to be fair, I'm not hired as a security consultant, just a regular developer).
I can normally get a few developers on board, but have yet to convince a client to use TLS in this way in production.
Comments
> We also tend to recommend that people simply use PGP for data at rest, and TLS for data in motion
When I complain about bad crypto (in API auth in particular) and my clients really really push for me to give them advice, I repeat this line verbatim.
They hate it because TLS with client-side certs for authentication (where you become the CA) is unfamiliar and has too many moving parts for them. They go and develop their hand-rolled API auth, I proceed to shoot holes in it and come across as a bit of dick (to be fair, I'm not hired as a security consultant, just a regular developer).
I can normally get a few developers on board, but have yet to convince a client to use TLS in this way in production.