It's a perfect example of why security is never just about the algorithm