8
$\begingroup$

I asked advances in usability for cryptography/authentication and one of the commenters raises a good point: should this be in Security.SE?

Is there a good rule of thumb between the two? e.g. if it has actual algorithms in mind, should it stay here?

$\endgroup$
2

3 Answers 3

Reset to default
9
$\begingroup$

There are some questions which apply to both security.SE and crypto.SE, but will (should) receive different answers. For instance, if you ask about whether SHA-1 is appropriate for hashing passwords, the crypto.SE response will detail things about relevance of collisions and differentials and the Merkle-Damgard construction to the problem of hashing passwords; while the security.SE response will rather courteously but firmly insist on using bcrypt or PBKDF2.

The rule of thumb, here, being that you should post to crypto.SE if you want to understand the internals, and to security.SE if you want to know what you should do now.

$\endgroup$
2
  • $\begingroup$ +1. Though I would expand the part on Information Security from "what to do now" to also include "and the relevant tradeoffs and risks". $\endgroup$
    – AviD
    Aug 25, 2011 at 23:00
  • 2
    $\begingroup$ @ThomasPornin, But often we want to know what we should do now while understanding the internals. Then do you mean that we should ask the same question on both forums? $\endgroup$
    – Pacerier
    Jun 4, 2014 at 17:55
3
$\begingroup$

One gray area to all of this is cryptographic protocols. Here there can be little-to-no math, and it's more in the area of algorithm design.

General discussion of cryptographic protocols may be hard to decide which site to post to. Cryptography.SE and Security.SE provide two different (but related) groups of listeners, and there's reasons to want input from each.

$\endgroup$
1
$\begingroup$

I think if it is about theory, math, algorithm design, etc it is good here. But if it is about practice, implementation, coding, risk management, usability, etc. it should be on Security.SE. See Frequently Asked Questions - IT Security - Stack Exchange for the scope of that site.

Questions that are about usage of crypto applications may also be better suited for Superuser, if security/risk/etc isn't the focus. See e.g. How can I add my picture to my public key using GnuPG? - Crypto

$\endgroup$
1
  • $\begingroup$ Gee, I dunno. I would encourage this site to accept questions about practice, implementation, usability, etc. of cryptography, rather than making it a policy to migrate them to Security.SE. As @Zooko has pointed out elsewhere, if a field divorces itself from practice, then it risks losing touch with reality. I feel the question-asker should be given some deference about which community they'd like to receive answers from. (Of course, it's always fine to add a comment letting them know that they might receive more useful information about aspect X on the other site.) $\endgroup$
    – D.W.
    Aug 5, 2011 at 2:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .