TL;DR. A question with a title that asks specifically for crypto code, all answerers think it's reasonable to ignore security feedback, specifically because the question is poorly worded. Years in the making now this question/answers set is clearly propagating vulnerable C# code across Github. What can be done?
I think there is a better duplicate, others may disagree. Alternatively, I think it would be reasonable to change the title to match the answerers interpretation, not sure if OP would agree. Other solution? I think there is probably a broader discussion of security related answers on SO.
update: this specific example question has been adjusted in title and several of the high voted answers/proliferating bad copy 'n paste code samples are now no longer compiler ready (without minor editing).
full discussion:
There is this 8-year old question, with 190K views and almost 400 votes, Simple insecure two-way "obfuscation" for C# (original title "Simple 2 way encryption for C#"), which is problematic, both in question and all of its highly voted answers. If you look in the many comments in questions and answers, myself and other security minded individuals have had a long history of trying to give feedback on it.
The body of the question is really poorly worded with additional stipulations in what the OP wants, as he says "not mission critical" he just wants to "keep honest people honest" and conversely "anything I wrote would be less than worthless [...] and make it trivial to crack" which I feel invalidates the first part, and certainly the first part also isn't conveyed in the title.
"Keeping honest people honest" has allowed answerers to justify uninformed answers that use crypto APIs just plainly incorrectly, or answers that are merely obfuscation, despite many users including myself trying to point out the flaws.
For example, the accepted answer uses a hardcoded Initialization Vector
in CBC encryption. To use the API correctly the Initialization Vector
is supposed to be unpredictable. If it is predictable, it leaks data and also the avenues for attack start increasing. It also wrongly suggests that this is okay as long as you use a website to generate some new random bytes to hardcode into your app (nope still predictable).
However if you go to Github, you can find 53 repos in Github that have that exact hardcoded IV. How many other usages of this vulnerable code out there that can't be found, because they change the IV hardcode as the answer suggested? How many are in private repos? How many are in other projects due to being hidden in libraries? This becomes a bit of a public safety issue, because people are just reading the title "Simple two-way encryption for C#" and looking at the high number of votes.
My first thought was marking it as a duplicate of Encrypt and decrypt a string which is also 8 years old and has 500k views and 500 votes. This question also doesn't have an accepted answer, However all of its highly rating answers are reasonable security wise. I also have a long history with this question, and have noticed answerers on this question actually correcting or removing their answers based on feedback, I myself added an answer 5 years ago (full disclosure).
I think one of the superficial issues that might hinder marking it as being a duplicate is that the question in Simple two-way encryption says encrypting data, while the other specifically says encrypting string. I personally think this is superficial, because despite not saying so, the OP is clearly asking for a method to encrypt a string: he mentions wanting something better than rot13, and the OP's accepted answer only encrypts strings. However others may validly disagree.
My other thought, maybe if all the answerers of "Simple two-way encryption for C#" are resistant to fixing their objectively improper crypto constructions because the question stipulates "keeping honest people honest", that maybe this question could merely be titled "Simple two-way obfuscation for C#"; it would make everything more clear. The body of the question doesn't have to change; however, I don't feel like that's what the OP intended. So I'm not sure it would stay that way if I made that edit.
I've thought about flagging it for moderation, but I don't have a clue what to ask for in this case. I think this issue has reached this state due to the difficulty that most developers don't have expertise in security related programming, and don't have any idea how different it is. I don't feel like bad answers generally propagate to this great a degree on Stack Overflow, but maybe other people have different impressions on that as well.
I'd be really interested in other people's thoughts. I think that dealing with this question and its low quality answers is actually quite an important C# community issue, particularly due to the copy'n'paste propagation becoming a matter of public safety. Also maybe other people have experienced similar security issues in other language tags.