Except that the authorities <i>do</i> want companies to use bad crypto. The only reason they&#x27;ve had to fall back on demanding an attack vector is because they haven&#x27;t yet been able to force their preferred solution (bad crypto) to be implemented.<p>Demanding an attack vector should be seen as the same concept as demanding bad crypto, because the intent behind the request is the same. They&#x27;re trying to convince us that these are different requests, but the end result is the same. A workaround to attack good security is the same as having bad security to begin with. I can&#x27;t imagine why anybody would think that &quot;bad crypto&quot; and &quot;attack vector&quot; are not very nearly the same thing.