[susam]

I have encountered my fair share of in-house RC4 implementations from the 90s. Every single one of them was vulnerable in some way. They suffered from all kinds of issues: improper IV initialisation, predictable keystreams, and even partial leakage of plaintext into ciphertext. RC4's deceptively simple specification made it enticing to implement, giving developers a false sense of confidence and security.

As another example, Microsoft Outlook 2003 infamously used CRC32 to "hash" the personal folder (.PST) passwords: <https://www.nirsoft.net/articles/pst_password_bug.html>. Naturally, it was trivial to find a CRC32 checksum collision and open someone else's PST.

Thankfully, the industry has come a long way since then. These days, rolling your own cipher is, quite rightly, considered a red flag!

[xnorswap]

I've seen far too many IVs statically declared as "<Product>IV" in my lifetime.

Bonus marks for when the key was also "<Product>Key".

[notarealllama]

Nirsoft saved my ass so many times on different things. I remember when I lived somewhere without (reliable or consistent) internet access, I scraped all the tools to take with me. They still are in my tools folder to this day!

[giancarlostoro]

> RC4's deceptively simple specification made it enticing to implement, giving developers a false sense of confidence and security.

I never like the idea of hand implementing crypto, ever. Why would I not just use existing libraries?

[harveyrook]

RC4 was as much of a political statement as a technical spec. At the time, governments were banning cyphers for various reasons. RC4 was simple enough that you could memorize it to get around any prohibitions.

[01HNNWZ0MV43FF]

Some languages like c++ don't have popular package managers, so adding even one dependency can be very difficult. Learning an unpopular package manager and asking your team to rely on it introduces the burden of teaching everyone how to use it, if the manager even allows it

In this hostile environment, many wheels are reinvented

C programmers actually consider this a point of pride