Hacker News Reader

Why do people use AES-ECB? I keep seeing this when even the Wikipedia entries explain very well what’s wrong with it. It’s not like AES-CTR or even a decent block chained mode like CBC is hard to use.

Cryptographic libraries shouldn’t even expose it except in a subpackage or namespace called “hazmat.”

View on HN

It is (or was) the default mode, and, unlike CTR, you don't need anything more than a key to use it; no nonces, no IVs, no parameters. Put yourself in the shoes of someone who doesn't know much about cryptography, and it's a natural choice.

Hmm... so poor defaults strike again. Makes sense if you know nothing that simple AES-ECB seems to work and has the simplest API of any of the modes.

But then I'd have to say... why is a company doing a secure password saver not employing anyone who knows the very basics of how to use cryptography? :)

> why is a company doing a secure password saver not employing anyone who knows the very basics of how to use cryptography?

Because that isn't important for success. Perception is reality. Very few people can tell the difference between good and bad crypto work. So instead of wasting money on that, invest it into something that is understood by more of your customers. It's a sad reality.

Reply on news.ycombinator.com