Web Security, Privacy & Commerce, 2nd Edition

What Cryptography Can’t Do

Cryptography is an incredibly powerful technology for protecting information, but it is only one of many technologies that play a role in web security and commerce. Unfortunately, cryptography plays such an important role that many people assume that any computer system is automatically secure, and that any system that does not use encryption can’t be made secure. As a matter of fact, the phrase secure web server is often used interchangeably with the phrase cryptographically enabled web server.

Encryption isn’t all-powerful. You can use the best cryptography that’s theoretically possible, but if other mistakes are made in either systems design or data handling, confidential information may still be revealed. For example, a document might be encrypted so that it could only be decoded by one person, but if that person prints out a document and then throws it out without first shredding the paper, the secrets that the document contains could still end up on the front page of the local newspaper.

Likewise, cryptography isn’t an appropriate solution for many problems, including the following:

Cryptography can’t protect your unencrypted documents

Even if you set up your web server so that it only sends files to people using 1024-bit SSL, remember that the unencrypted originals still reside on your web server. Unless you separately encrypt them, those files are vulnerable. Somebody breaking into the computer on which your server is located will have access to the ...