Sometimes one-time pads are insecure, yes. There was a case where a bunch of messages the Soviets had encrypted with one-time pads were cracked by American cryptanalysts, because they had reused some of the pads, because of the difficulties involved with sending fresh pads by guaranteed secure courier. (If that weren’t a difficult problem, after all, you could just use the guaranteed secure couriers for the actual messages. That’s why people don’t normally use one-time pads in practice.)
Now you could say any scheme is insecure if used improperly, and that’s true as far as it goes. But the corollary is that part of the practical security of a scheme is that it be easy to use properly.
Here’s another example of a measure that actually reduces security: password inputs replacing the letters with asterisks as you type. Yes I know it’s designed to improve security in an environment where untrusted third parties may look over your shoulder, and if you are in that sort of environment, then it’s necessary. But if you are not, then it compromises security by harshly penalizing the use of long passwords. If people would actually understand that usability is part of security, maybe they would understand the need for a setting to disable that feature.
Sometimes one-time pads are insecure, yes. There was a case where a bunch of messages the Soviets had encrypted with one-time pads were cracked by American cryptanalysts, because they had reused some of the pads, because of the difficulties involved with sending fresh pads by guaranteed secure courier. (If that weren’t a difficult problem, after all, you could just use the guaranteed secure couriers for the actual messages. That’s why people don’t normally use one-time pads in practice.)
Now you could say any scheme is insecure if used improperly, and that’s true as far as it goes. But the corollary is that part of the practical security of a scheme is that it be easy to use properly.
Here’s another example of a measure that actually reduces security: password inputs replacing the letters with asterisks as you type. Yes I know it’s designed to improve security in an environment where untrusted third parties may look over your shoulder, and if you are in that sort of environment, then it’s necessary. But if you are not, then it compromises security by harshly penalizing the use of long passwords. If people would actually understand that usability is part of security, maybe they would understand the need for a setting to disable that feature.