[lhnz]

Whenever I have taken the small amount of cryptography knowledge I already have and tried to use it in a project, I've often been shutdown with "the system already does that" when it doesn't, or "this will be too complicated for the user, instead lets just roll our own [ad-hoc cryptography method]".

For those reading:

How do you convince people that it's worth using best practices?

Is there a good heuristic to measure the value of something, when deciding how much time and money to spend on securing it?

What are good library/SaaS solutions to help build secure applications with less chance of shooting yourself in the foot, better UX and lower cost? (Keybase, etc.)

[tptacek]

For normal application work, you should use NaCL (or it's repackaged version, libsodium) to the exclusion of all else.

[dhimes]

Why the hell is this being downvoted?