Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I'm helping with the design of protocols and API's within international standardization bodies. Over 30 years of general experience with computers, starting with MSX Basic at an early age.

I'm a professional user of Java and Java Card. I'm also proficient in XML, HTTP/HTML, Ant, Git, PKI, Linux (etc). I love trying out new languages, but I'm always returning to Java as it still seems the best language to develop secure applications.

Although I've studied computer science at the Vrije Universiteit, I'm mainly an autodidact.

If the code runs it does not mean it is secure. I would guess that about 10% of the code posted on StackOverflow could be secure.

If you want to learn cryptography I highly recommend Crypto I from Dan Boneh at Coursera as a (University level) introductory course.

The most common implementation mistake is treating binary as text and text as binary. So check if you correctly apply UTF-8 character encoding and base 64 encoding before asking a question. Validate that the received data, key and IV is identical (when converted to binary) during encryption and decryption.

Common security mistakes:

• using keys or IV's directly derived from text / passwords
• using ECB mode encryption
• using MD5, DES or other outdated cryptographic algorithms
• static IV's or IV's directly derived from the key
• performing password hashing (or key derivation) without applying PBKDF2, bcrypt or scrypt
• using ciphertext that is not protected by an authentication tag (as supplied by HMAC or GCM mode encryption)
• thinking that OTP (XOR-encryption) can be made secure (without reinventing a stream cipher)
• encryption without establishing trust (browser encryption)
• using textbook RSA or using RSA to encrypt a plaintext directly
• inventing transport based security instead of using (D)TLS
• not using a cryptographically secure random number generator

Worst documented API's (of well known libraries):

1. CCCrypt - missing information and everything printed in Apple light-gray-on-white makes this API horrible to use - it doesn't even have a high page rank on Google
2. (PHP's) mcrypt - I've rewritten the mcrypt_encrypt sample code, but it is still a complete mess and the API relies on an unmaintained C-library
3. OpenSSL - this library has existed for as long as I can remember and the documentation is still full of holes
4. Microsofts .NET classes - not responding to questions / requests while the API is just not describing what it really does

Get your act together guys!

Oh, yeah, and I like t-shirts too: #SOreadytohelp