The Snake Oil Index

A simple method for rating potentially revolutionary contributions to cryptography.
Shamelessly copied from Inspired by John Baez's Crackpot Index. Many thanks to John for reviewing it.

  1. A -5 point starting credit.

  2. 1 point for not disclosing the source code.

  3. 1 point for a license explicitly prohibiting reverse-engineering your product (or containing any other legal measure to stop people from trying to discover how it works).

  4. 2 points for claiming "military-grade" security.

  5. 5 points for each claim that your product "provides unbreakable encryption" or "is the world's strongest" or "is 100% secure".

  6. 5 points for organizing a cracking contest.

  7. 5 points for claiming that your product is secure because nobody bothered participating to the cracking contest.

  8. 5 points for claiming that your product has been reviewed by "security experts" without providing scholarly references.

  9. 5 points for storing user passwords or private keys on your servers.

  10. 5 points for seeding a PRNG with a predictable value.

  11. 10 points for not divulging the cryptographic algorithms you use (because "hackers could break it").

  12. 10 points for any other implementation of security through obscurity.

  13. 10 points for beginning the description of your product by saying how long you have been working on it. (10 more for emphasizing that you worked on your own.)

  14. 10 points for each new term you invent and use without properly defining it.

  15. 10 points for using absurd key lengths (e.g. 1 million bits).

  16. 10 points for using one-time pads.

  17. 10 points for using known broken ciphers.

  18. 10 points for encrypting by XORing the key with the data.

  19. 10 points for storing passwords in plaintext, or in another trivially accessible way.

  20. 10 points for having a key recovery feature, or a key escrow mechanism.

  21. 20 points for designing your own cryptographic algorithm.

  22. 20 points for mailing your cryptographic algorithm to someone you don't know personally and asking them to review it and/or find any flaws.

  23. 20 points for every pseudo-mathematical statement that is either nonsensical, vacuous, or inconsistent.

  24. 20 points for naming something after yourself (e.g. talking about the "Evans shift operation" when your name happens to be Evans.)

  25. 20 points for emailing me and complaining about the Snake Oil Index.

  26. 20 points for not being able to tell the difference between symmetric and public-key cryptography.

  27. 20 points for not being able to tell the difference between pseudorandom and random.

  28. 20 points for any other evidence of extreme cluelessness about cryptography.

  29. 30 points for designing your own cryptographic protocol based on a new paradigm (e.g. neural networks, chaos theory, quantum entanglement).

  30. 30 points for declaring your own cryptographic protocol secure just because you couldn't break it.

  31. 30 points for replying to those who argue against your product by pointing out your academic credentials, how long you've been in business, or how many clients you have -- as if these were arguments. (30 more if you're caught sockpuppeting.)

  32. 30 points for mistaking obfuscation (e.g. ROT13) for encryption.

  33. 30 points for providing a feature that bypasses all security (e.g. a master password).

  34. 40 points for designing your own cryptographic protocol based on a new branch of mathematics you invented. (40 more for stating, without proofs, that you solved the Riemann hypothesis or the Goldbach's conjecture thanks to it.)

  35. 40 points for claiming extraordinary feats (e.g. breaking 2048-bit RSA encryption, or being a revolutionary breakthrough) without proofs.

  36. 40 points for putting a backdoor on your product.

  37. 50 points for making it to Schneier's Doghouse.