Disclaimer: I went to the conference (well it's actually my school). The followings are supposed to be addressed during the QA but I could only ask one question... sorry for the long baffling.

This is the golden age for cryptography, thanks to education and hardworking people.

People are actively attacking our cryptographic knowledge and our implementations. As controversial as it may sound, if it weren't all the active attacks on our cryptographic infrastructure, we probably will be okay with RC4 and MD5. Of course we know they are weak and they are not reliable.

So let's thanks everyone, including the state-sponsored attackers.

This is golden age because we long know that relying on mathematical hardness assumptions is not safe. Maybe a decade later someone discover a theorem to factor large number very efficiently and then boom all the encrypted communications using RSA will be broken. We are slowly moving from that kind of dependencies. We think there are better ways to solve our encryption. Much like in 20th century the arm race gave rise to active advancement in all disciplines of engineering and science, cryptography is also growing.

Thanks to all the attackers out there we now know it is important to teach everyone about computer and web literacy. We know this should be part of education. In addition, we must make tools more accessible to users. At #realworldcrypto 2014 someone said PGP has been around what two decades? Why hasn't everyone in the tech community using it? Why are my non-geek friends not using it? Why am I not using it? Servers that retain user data or transfer user data should all be over HTTPS now. Implement 301 redirect on http end points and on HTTPS endpint add HSTS header. Implement Content-Security-Policy to harden what resources can be loaded on your website. Add X-Frame-Options to control whether you want your site to be frame/iframed or not. I can go on and on but you get the point. This is a long battle and not easy to fix.

Cryptography is not dead. What is dead is our assumption that we can rely on assumptions and that kind of dependency is going to harm us some time in the future. For how many more years? We don't know. It is possible no one can ever come up with an efficient algorithm to break factoring.

Yes. One problem in cryptography has to do with the key storage. I see that in the future HSM will be cheaper and people can enjoy that as opposed to a plaintext file in your $USER/.ssh/ directory. Look, cryptography is not silver bullet. You can't eliminate people from making mistake, but we can look at what things can be improved to make mistake fail quick and safely. Idea? Maybe instead of one key, we have multiple partial keys stored on multiple servers? But key management and key synchronization is going to be a headache. And look, if someone inject a malware in the network and has some insight knowledge of the network, there is very little you can do.

Never confuse NSA revelation means we must implement things so secure that we can't even tell Bob is Bob. We can't have 100% anonymity and we can't enforce that. The world needs interaction. The ability to choose is the right direction and I hope companies will start to realize that we don't live in the 80s anymore.

The hardest problem to solve is to tell whether the server is doing what it is said. People are working on verifiable search but what about whether site is actually hashing your password? Client-side encryption is important and mufti-identity remain to be solved. Personally, I'd like to see Persona widely used so I can just set up my own federated authentication server to authenticate my own email.

Again, as controversial as it may sound, knowledge exists because we can think and because we can think we have desire and goals. Knowledge doesn't grow out of the trees. The are always accidental and incidental. We don't start inventing things out of the thin air. I like the idea of knowledge as Yin-Yang. We don't start having cryptography because there is such a thing called cryptography. Because we want secret to be hidden and safe from evedropper, we invented substitution cipher schemes. Because we now have digital communication and we need to prevent MitM we need a better cryptography and this is why RSA and DHE are useful. We know SHA is never meant for hashing password because it's fast so we invent other kinds of cryptographically hard hashing algorithms like bcrypt and scrypt. If it weren't Miller's paper on fuzzing, we probably would neglect fuzzing testing and our unix command line tools will probably continue to fail hard. If it weren't NSA, how many of us would ever pay attention to the problem in OpenSSL and RNG? There is always a constant Yin-Yang interaction in the pursuit of knowledge. One nice property of security proof is that we always have to model the evil in our proof construction...