Some snake oil
I was surprised that I did not find an article on Habré on the so-called. “Snake oil”, then - the translation of the article , which seemed to me interesting, because the concept can be extrapolated to the production of any products, so ...
In cryptography, snake oil refers to any commercial encryption method that is fake or fraudulent.
The name comes from the "Snake oil", a patented drug that was widespread in the 19th century in the United States.
The difference between secure and insecure encryption is difficult for an ordinary user to notice. Many cryptographers, in particular Bruce Schneier and Phil Zimmerman, have taken the responsibility to provide information to a wide audience about how secure encryption is implemented, as well as to highlight marketing moves that distort the reality regarding certain cryptographic products.
The Snake Oil FAQ defines itself as a “collection of common traits of snake oil manufacturers.” It does not provide a 100% guarantee for determining product safety, as there are exceptions in any rules. But if the behavior corresponds to several signs at once, then most likely you are dealing with snake oil. ”
Some examples (partial list ):
UPD: decided to place another translation under the spoiler, containing a more detailed excursion into the history of the origin and etymology of the phrase.
In cryptography, snake oil refers to any commercial encryption method that is fake or fraudulent.
The name comes from the "Snake oil", a patented drug that was widespread in the 19th century in the United States.
A bit of history
There are two main hypotheses of the origin of the term.
')
According to the most common, it originated in the western regions of the United States and is derived from the name of a local medicine made using an extract of the Chinese water snake ( Enhydris chinensis ), which was used by slaves to relieve joint pain. In the northern part of the United States, the agent was distributed by traveling salesmen who used “decoy ducks” in the audience to advertise its useful qualities.
Another source, Dr. William S. Haubrich, in his book, Medical Meanings, proves that the name came from the east of the United States. Native Americans in the regions of New York and Pennsylvania were rubbing petroleum products in cuts and abrasions collected in places where oil was leaking to the surface. European settlers, observing their behavior, began to pack this substance in bottles and sell as a means of “from everything”. In the middle of the 19th century, the drug was marketed under the name "Seneca oil" . Haubrik insists that because of the wrong pronunciation, it turned into “Sen-ake-a oil” , and after that into “snake oil” .
However, Haubrick’s statement is a case of folk etymology, since more evidence of this transformation was found.
Chinese slaves used in the construction of the First Transcontinental Railway were the first to give snake oil to Europeans as a remedy for joint pain.
It supposedly brought relief when rubbed into the skin in the area of the painful joint. This was refuted by competitors-competitors, and overnight they began to call snake oil products, advertised as a panacea or as a means of miraculous healing,
the ingredients of which were kept secret, and which had an unknown effect, did not meet the stated characteristics and, in general, were inert or ineffective.
Medicines patents come from England, where the patent was granted for the elixir of Richard Stoughton in 1712. Since there was no federal law in the United States that would regulate the safety and efficacy of medicines, before the Food and Drug Act of 1906 was passed, hardly any vendor or manufacturer would have a talent for analytical chemistry to analyze the composition of snake oil, and so it became the fake archetype .
The snake-oil merchant has become a typical character in Western films: a traveling doctor with a dubious reputation sells fake drugs, skillfully creating a stir, often taking advantage of near-scientific facts.
In order to increase sales, the accomplice, who plays the role of a “decoy duck” in a crowd, often confirmed the effect of the product, thereby trying to awaken demand.
The "doctor" left the city before buyers discovered deception.
The composition of snake oil varied depending on the brands and manufacturers.
"Stanley Snake Oil" - produced by Clark Stanley , the "king of rattlesnakes" - was tested by the US government in 1917. In the composition was found:
The composition resembles modern capsaicin liniments or vaseline-based gels. None of the oil contained the squeeze of at least some real snake.
The government has filed a lawsuit against the manufacturer for using an inappropriate trademark and misrepresenting a product. The claim was satisfied in the amount of $ 20. Shortly after the court decision, the term "snake oil" became synonymous with counterfeit medicines, and "seller of snake oil" - a common noun for charlatans.
')
According to the most common, it originated in the western regions of the United States and is derived from the name of a local medicine made using an extract of the Chinese water snake ( Enhydris chinensis ), which was used by slaves to relieve joint pain. In the northern part of the United States, the agent was distributed by traveling salesmen who used “decoy ducks” in the audience to advertise its useful qualities.
Another source, Dr. William S. Haubrich, in his book, Medical Meanings, proves that the name came from the east of the United States. Native Americans in the regions of New York and Pennsylvania were rubbing petroleum products in cuts and abrasions collected in places where oil was leaking to the surface. European settlers, observing their behavior, began to pack this substance in bottles and sell as a means of “from everything”. In the middle of the 19th century, the drug was marketed under the name "Seneca oil" . Haubrik insists that because of the wrong pronunciation, it turned into “Sen-ake-a oil” , and after that into “snake oil” .
However, Haubrick’s statement is a case of folk etymology, since more evidence of this transformation was found.
Story
Chinese slaves used in the construction of the First Transcontinental Railway were the first to give snake oil to Europeans as a remedy for joint pain.
It supposedly brought relief when rubbed into the skin in the area of the painful joint. This was refuted by competitors-competitors, and overnight they began to call snake oil products, advertised as a panacea or as a means of miraculous healing,
the ingredients of which were kept secret, and which had an unknown effect, did not meet the stated characteristics and, in general, were inert or ineffective.
Medicines patents come from England, where the patent was granted for the elixir of Richard Stoughton in 1712. Since there was no federal law in the United States that would regulate the safety and efficacy of medicines, before the Food and Drug Act of 1906 was passed, hardly any vendor or manufacturer would have a talent for analytical chemistry to analyze the composition of snake oil, and so it became the fake archetype .
The snake-oil merchant has become a typical character in Western films: a traveling doctor with a dubious reputation sells fake drugs, skillfully creating a stir, often taking advantage of near-scientific facts.
In order to increase sales, the accomplice, who plays the role of a “decoy duck” in a crowd, often confirmed the effect of the product, thereby trying to awaken demand.
The "doctor" left the city before buyers discovered deception.
From funds "from everything" to quackery
The composition of snake oil varied depending on the brands and manufacturers.
"Stanley Snake Oil" - produced by Clark Stanley , the "king of rattlesnakes" - was tested by the US government in 1917. In the composition was found:
- mineral oil
- 1% animal fat (presumably beef tallow)
- Red pepper
- turpentine
- camphor
The composition resembles modern capsaicin liniments or vaseline-based gels. None of the oil contained the squeeze of at least some real snake.
The government has filed a lawsuit against the manufacturer for using an inappropriate trademark and misrepresenting a product. The claim was satisfied in the amount of $ 20. Shortly after the court decision, the term "snake oil" became synonymous with counterfeit medicines, and "seller of snake oil" - a common noun for charlatans.
The difference between secure and insecure encryption is difficult for an ordinary user to notice. Many cryptographers, in particular Bruce Schneier and Phil Zimmerman, have taken the responsibility to provide information to a wide audience about how secure encryption is implemented, as well as to highlight marketing moves that distort the reality regarding certain cryptographic products.
The Snake Oil FAQ defines itself as a “collection of common traits of snake oil manufacturers.” It does not provide a 100% guarantee for determining product safety, as there are exceptions in any rules. But if the behavior corresponds to several signs at once, then most likely you are dealing with snake oil. ”
Some examples (partial list ):
- Secret system
Some encryption systems claim the use of secret algorithms, techniques, or devices that fall under the category of "security through obscurity."
Criticism:
first, there is the principle of Shannon, proven by time, which can be expressed by the statement “the enemy knows the system”, and this secrecy does not give the user any advantages;
secondly, secret methods that are not open to public review and cryptanalysis may contain security flaws and holes that may go unnoticed for a long time. - "Tehnotrep"
Snake oil sellers often resort to technoprep because cryptography is a complex subject. - Invulnerability
The declaration of a cryptographic system or method as invulnerable is almost always erroneous and is generally perceived as a sure sign of "snake oil". - Code Vernama
This is a popular cryptographic method used in advertising, since disposable notepads used correctly cannot ideally be cracked.
Problems arise when trying to implement it, which is rarely done correctly. Cryptosystems using a one-time notepad scheme are usually suspicious, especially without a description of the implementation or when describing an erroneous implementation. - Bit statements
Cryptographic products are often accompanied by statements about the use of a large number of bits for encryption, most often referring to the length of the key used.
Nevertheless, it is necessary to remember about the ambiguity of the notion of the “length” of a key for symmetric and asymmetric encryption.
Also, implementation details can make the system vulnerable. For example, in 2008 it was discovered that a large number of sold hard drives with built-in 128-bit AES encryption actually used XOR operation, subject to easy cracking. AES was used only to store a key that could be recovered without breaking into AES.
UPD: decided to place another translation under the spoiler, containing a more detailed excursion into the history of the origin and etymology of the phrase.
Source: https://habr.com/ru/post/215035/
All Articles