Does changing the cipher in production for an open-source project nullify the moral purpose of transparency (in terms of security and privacy) even if it may improve security? I’m aware of the usual issues involve such as whether the developer is trusted and so forth, but I’m curious about how other people perceive this.
Additionally, I do the same for my private projects, I modify the process of the encryption and hashing hoping to enforce better security, I’m quite confident about doing it because I have certain knowledge in cryptography from fool-proofing, testing and trying to break it myself. I’m a very security-privacy paranoid and perfectionist person myself. What could go wrong?
This mindset comes from the idea: “If they don’t know the encryption, how can they reverse the process?”