---
title: "Cryptography Engineering Has An Intrinsic Duty of Care"
url: https://daily.dev/posts/cryptography-engineering-has-an-intrinsic-duty-of-care-ngqm7opuv
source_url: https://soatok.blog/2026/02/25/cryptography-engineering-has-an-intrinsic-duty-of-care/
type: article
source: "Dhole Moments"
published: 2026-02-25T22:00:42.441Z
updated: 2026-02-25T22:01:43.559Z
tags: ["security", "open-source", "cryptography"]
reading_time: 9
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cryptography Engineering Has An Intrinsic Duty of Care

**[Dhole Moments](https://daily.dev/sources/soatok)** · 9 min read · 0 upvotes · 0 comments

## Summary

Cryptography engineers have a duty of care to their users that many are failing to meet. Three case studies illustrate the problem: insecure AES implementations in aes-js/pyaes with cavalier developer responses, a research paper eviscerating LastPass, Bitwarden, and Dashlane's cryptographic security, and Matrix's dismissive response to disclosed vulnerabilities. The core failure is that most cryptographic software lacks clear threat models, vague security goals, and poor transparency about maturity. A minimum bar is proposed: write obviously secure ('boring') code, state security goals and assumptions explicitly, and be transparent about project maturity. Being open source does not absolve developers of responsibility when their cryptographic code is widely adopted.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://soatok.blog/2026/02/25/cryptography-engineering-has-an-intrinsic-duty-of-care/>

## Similar posts on daily.dev

- [Carelessness versus craftsmanship in cryptography](https://daily.dev/posts/carelessness-versus-craftsmanship-in-cryptography-rh1tygiet) · Hacker News · 0 upvotes · 0 comments
- [Schneier on Security](https://daily.dev/posts/schneier-on-security-6isljxxwl) · Schneier on Security · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#cryptography](https://daily.dev/tags/cryptography)

[View this post on daily.dev](https://daily.dev/posts/cryptography-engineering-has-an-intrinsic-duty-of-care-ngqm7opuv)