Cryptography › Module 4 › Lesson 1
Common Crypto Mistakes
Avoid homebrew crypto, reused nonces, and rolling your own protocols
Opening
Don’t invent cryptography at 2 a.m.
Attackers rarely need to break AES-256 head-on. They exploit reused IVs, ECB mode screenshots, hardcoded keys, custom “XOR encryption,” and disabled certificate checks. Recognizing these mistakes is a defender superpower.
1. Hall of Shame Patterns
Homebrew ciphers
Custom algorithms and “secret” encodings fail quickly.
ECB mode for images/data
Patterns leak; penguin outlines survive.
Nonce/IV reuse
Can destroy confidentiality in stream/GCM-like modes.
verify=False everywhere
Turns TLS into theater against active attackers.
Keys in source/chat
Repos leaks equal total compromise.
Use boring, vetted libraries
Prefer well-maintained crypto APIs with safe defaults. Novelty belongs in research papers, not payment apps.
Knowledge Check
A common real-world crypto failure is:
Multiple choice
Knowledge Check
True or False: Disabling TLS verification in production is safe if the code is Python.
True or False
Knowledge Check
Hardcoding API/crypto keys in git is dangerous because:
Multiple choice