It is enough that one person in the world knows how to crack it and writes the code to automate it. And it doesnt have to be some underground hacker either, it could very well be one of the well founded computer security research initiatives in different countries' military intelligence. I've personally talked to such a research group and seen how they some times stick their heads together and whisper things like "is it one of ours or a public? can we talk about this?" when speaking about vulnerabilities in well-known systems and applications. I'm not saying such an organization will release tools to the hacker society, but my well-hidden point is that there are potentially a whole new world of vulnerabilities out there that only researchers who are not allowed to publish knows about. So far. Someone compared this with cryptography, which IMHO isnt such a bad comparison after all. Think of public key cryptography, Bletchley Park, etc.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/313/31393#31393