FIPS 140-3 is not a security guarantee, and auditors know it
FIPS 140-3 is not a security guarantee, and auditors know it2026-08-05 · 14 minA sales engineer at one of the major HSM vendors told me recently that over 90 percent of their customers who buy FIPS-enabled HSMs run them with FIPS mode disabled. They pay a premium for the certificate, then switch off the configuration it describes. By the end of this article you will understand why that is often the correct engineering decision.On September 21, 2026, every remaining FIPS 140-2 certificate moves to NIST’s historical list, and modules on that list should no longer be included in new federal procurements.
- ▪FIPS 140-3 is not a security guarantee, and auditors know it2026-08-05 · 14 minA sales engineer at one of the major HSM vendors told me recently that over 90 percent of their customers who buy FIPS-enabled HSMs run them with FIPS mode disab
- ▪They pay a premium for the certificate, then switch off the configuration it describes.
- ▪By the end of this article you will understand why that is often the correct engineering decision.On September 21, 2026, every remaining FIPS 140-2 certificate moves to NIST’s historical list, and modules on that list should no longer be in
Hacker News (Front Page) files mainly under programming. We currently carry 1,178 of its stories. Top-voted stories on Hacker News.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Story provenance
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | 808bits |
| Canonical URL | https://808bits.com/articles/fips-140-3-not-a-security-guarantee/ |
| Publication time | Tue, 04 Aug 2026 23:21:33 +0000 |
| Retrieval time | 2026-08-05T00:00:48.112Z |
| Last seen | 2026-08-05T00:00:48.112Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | epvWzMKxUKxr · 1 stories |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
FIPS 140-3 is not a security guarantee, and auditors know it2026-08-05 · 14 minA sales engineer at one of the major HSM vendors told me recently that over 90 percent of their customers who buy FIPS-enabled HSMs run them with FIPS mode disabled. They pay a premium for the certificate, then switch off the configuration it describes. By the end of this article you will understand why that is often the correct engineering decision.On September 21, 2026, every remaining FIPS 140-2 certificate moves to NIST’s historical list, and modules on that list should no longer be included in new federal procurements. Procurement teams are spending this summer chasing vendors for FIPS 140-3 paper, and vendors are spending it in a validation queue.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at 808bits.
Discussion
0 commentsMore from 808bits
