<?xml version="1.0" encoding="utf-8" ?> 
		    <rss version="2.0"> 
			<channel> 
			    <title>Encryption | Technologie - Technology News Aggregator</title> 
				<link>http://w3bguru.com/news/encryption</link> 
				<description></description><item>
			<title>Inside PRISM: Why the Government Hates Encryption</title>
			<link>http://w3bguru.com/news/article/inside-prism-why-the-government-hates-encryption</link>
			<description><![CDATA[Lauren Weinstein writes &quot;Now, what&#039;s really going on with PRISM? The government admits that the program exists, but says it is being &#039;mischaracterized&#039; in significant ways (always a risk with secret projects sucking up information about your citizens&#039; personal lives). The Internet firms named in the leaked documents are denying that they have provided &#039;back doors&#039; to the government for data access. Who is telling the truth? Likely both. Based on previous information and the new leaks, we can make some pretty logical guesses about the actual shape of all this. Here&#039;s my take.&quot;    Read more of this story at Slashdot.]]></description>
			<pubDate>Fri, 07 Jun 2013 21:07:49 EDT</pubDate>
			</item><item>
			<title>Just how secure is quantum cryptography?</title>
			<link>http://w3bguru.com/news/article/just-how-secure-is-quantum-cryptography</link>
			<description><![CDATA[Unlike classical encryption, quantum communication systems are known to offer the promise of virtually unbreakable encryption. Now, new research on this topic is shaking up the long-held notion that quantum communications are 100 percent secure. Researchers have recently demonstrated that quantum encryption may be susceptible to hacking.]]></description>
			<pubDate>Thu, 06 Jun 2013 21:07:54 EDT</pubDate>
			</item><item>
			<title>Los Alamos has been running a demo quantum key distribution system</title>
			<link>http://w3bguru.com/news/article/los-alamos-has-been-running-a-demo-quantum-key-distribution-system</link>
			<description><![CDATA[

      
			The first generation hardware. The authors are already building something that will be significantly smaller.
	
	  
  
 The encryption that we rely on to secure network transactions is based on a simple computational challenge: it&#039;s hard to find two prime numbers when you&#039;re only given the big number that they produce when multiplied. Although the growth in computer processing power means we&#039;ve needed to shift to bigger numbers, we can continue to do so as needed. This leaves eavesdropping as the biggest risk; to secure communication, each partner needs to get a copy of the relevant keys. If someone can break in on the key distribution process, they save themselves the need to do any math.
Quantum key distribution (QKD) is intended to be a way around this problem. By exchanging bits encoded in a quantum system—typically a photon—two parties can generate a unique key that can be used to encrypt communications. If anyone tries to eavesdrop on the process, their measurement of the photons used will leave a mark on the process that&#039;s easy to spot. (We have a more detailed description of the process in a past article.)
So far, QKD has largely remained a research project, although some progress is being made. Just last week, some researchers from Los Alamos National Lab described a system they&#039;ve had working for almost two years. It&#039;s not especially novel (which is why it actually works), but it uses some clever tricks to shift most of the burden to a central server while putting less expensive hardware into the clients.
Read 7 remaining paragraphs | Comments
   
]]></description>
			<pubDate>Mon, 06 May 2013 21:07:33 EDT</pubDate>
			</item><item>
			<title>Hideman lets you watch foreign TV and bypass censorship restrictions</title>
			<link>http://w3bguru.com/news/article/hideman-lets-you-watch-foreign-tv-and-bypass-censorship-restrictions</link>
			<description><![CDATA[There are many reasons why you’d want to hide your internet IP address. The most common one is that you’re trying to access services or web sites restricted to a specific country or territory -- this might be to catch up with UK BBC TV’s shows via iPlayer or for more fundamental reasons, such as bypassing a country’s censorship restrictions.
Spoofing your IP address so you appear to come from another country than the one you’re residing in isn’t by itself a difficult task -- all you need is a decent VPN service. But when it comes to simplicity and decent performance, you can’t beat a service called Hideman, available on Windows and Mac via the free Hideman 2.0 tool, and Hideman VPN 1.9.7 for Android.
Hideman isn’t new -- version 2.0 has just been released sporting a brand new user interface -- but it’s built a reputation as one of the better VPN services out there. Aside from providing you with the opportunity to spoof your own IP address, it also provides 256-bit encryption for all data received and transmitted, adding an extra layer of protection to your web browsing while also allowing you to surf safely via open public Wi-Fi hotspots.
The software is ridiculously easy to use. Fire it up, click the &gt; button to choose the country you wish to appear to be in, and let the software do the rest. Suddenly services restricted to your country of choice are available to you wherever you happen to be.
The service -- like most good VPN services -- isn’t completely free. However, for occasional use and testing purposes you can use the service for up to five hours per week -- note, however, that once you trigger one of your free hours, it will count down relentlessly in the background whether or not you use the service, and shutting down the program has no effect.
You can subsequently leave the program running in the background and trigger a fresh hour by clicking the Hours button, or completely close it from its Notification area icon, knowing the next time you launch it, the next hour’s countdown will begin.
There are other restrictions for free users to be aware of: first, you can only connect through six countries: the US, Germany, Russia, Ukraine, Panama and Singapore (four of which permit the use of P2P). Second, you can only download 2GB per month, and the connection speed may be limited to 512Kbps.
It’s also worth noting that free users’ access logs are stored encrypted for 14 days, and will be used in exceptional circumstances (see the FAQ for full details).
Should you want unlimited access with no logging to more than 20 countries (including Australia, the UK, Canada and Japan), support for port forwarding and changing IP on the fly, then invest in a paid-for account. Prices start from $3 for one week’s access from your computer, or $2.90 for one month’s access from your mobile (either through the Android app or by logging on through the Hideman website on your iPhone or iPad). Pricing plans go all the way up to a year’s access -- $69 for computers, $24.90 for mobiles.
Hideman 2.0 is available as a free, function-limited download for Macs and Windows. Hideman VPN 1.9.7 is a free app for Android users. Up to three devices can connect at one time through a single account.

 
]]></description>
			<pubDate>Thu, 07 Mar 2013 20:07:58 EST</pubDate>
			</item><item>
			<title>Android Ice Cream Sandwich encryption broken with the aid of a freezer</title>
			<link>http://w3bguru.com/news/article/android-ice-cream-sandwich-encryption-broken-with-the-aid-of-a-freezer</link>
			<description><![CDATA[When Google released Android 4.0 (Ice Cream Sandwich) back in 2011, it introduced a new data scrambling system designed to protect sensitive user information from snoopers who successfully managed to bypass the lock screen.
It’s strong security, but a team of German researchers have managed to crack the encryption by freezing a Galaxy Nexus and using a toolset called FROST (Forensic Recovery Of Scrambled Telephones) to retrieve contact lists, browser histories, and photos (basically everything you’d want to keep private).
The process, detailed here, involved firstly unlocking the bootloader and then packing the Galaxy Nexus into a freezer bag and putting the device inside a 15 degree Celsius freezer for an hour until the phone temperature was below 10 degrees. Once cold, they turned the phone on to check it was working, dismantled it, reassembled it, and put it into fastboot mode.
From there (still acting quickly) they connected it to a Linux PC via USB and flashed the pre-compiled, frost.img recovery image file and were able to use the software to decrypt the user partition.
There’s something amusing about breaking Ice Cream Sandwich encryption using a freezer (perhaps they tried Gingerbread with a cup of tea initially) but the method works because cooling the RAM chips slows down the speed that data fades from them, giving the crackers more time to access the phone’s contents.
Having cracked the Galaxy Nexus, the researchers say they plan to try out their system on other Android devices.
If you have a Galaxy Nexus and fancy trying it for yourself -- and are prepared to accept the risks involved with sticking your phone in a freezer -- you can download the FROST recovery image and everything else you&#039;ll need from the website.

 
]]></description>
			<pubDate>Thu, 07 Mar 2013 20:07:58 EST</pubDate>
			</item><item>
			<title>Locking the bad guys out with asymmetric encryption</title>
			<link>http://w3bguru.com/news/article/locking-the-bad-guys-out-with-asymmetric-encryption</link>
			<description><![CDATA[

      
	
			
							Aurich Lawson / Thinkstock				
	  
  
 Encryption, the transformation of data into a form that prevents anyone unauthorized from understanding that data, is a fundamental technology that enables online commerce, secure communication, and the protection of confidential information.
Encryption algorithms are the mathematical formulae for performing these transformations. You provide an encryption algorithm with a key and the data you want to protect (the plaintext), and it produces an encrypted output (the ciphertext). To read the output, you need to feed the key and the ciphertext into a decryption algorithm (sometimes these are identical to encryption algorithms; other times they are closely related but different).
Encryption algorithms are designed so that performing the decryption process is unfeasibly hard without knowing the key.
Read 55 remaining paragraphs | Comments
   
]]></description>
			<pubDate>Tue, 12 Feb 2013 09:07:53 EST</pubDate>
			</item><item>
			<title>Seven vulnerabilities found through Mega’s security bounty program</title>
			<link>http://w3bguru.com/news/article/seven-vulnerabilities-found-through-mega’s-security-bounty-program</link>
			<description><![CDATA[

      
			Mega really wants you to know it&#039;s safe...
	
	  
  
 Since Kim Dotcom debuted his Mega service, security experts (Ars included) let out a collective &quot;huh?!?&quot; regarding some risks taken by the digital locker site—its use of deduplication, the security of its encryption keys, etc. Dotcom heard the message loud and clear. Two weeks after launching, he responded to criticism by offering up to 10,000 euros ($13,362) to anyone who could break the site&#039;s security.
This weekend, Mega reported its first batch of successful challengers. Seven vulnerability fixes were highlighted on the Mega blog—several thousand dollars worth of fixes, if Dotcom makes good on his promise. (The post did not reveal who the successful hacks came from, much less whether they got paid.)
Along with describing the discoveries and fixes, Mega outlined six levels of vulnerabilities it uses for its security program. These range from level one (&quot;All lower-impact or purely theoretical scenarios&quot;) to level six (&quot;Fundamental and generally exploitable cryptographic design flaws&quot;). The seven newly identified vulnerabilities ranged from level one through level four (class descriptions added within brackets):
Read 2 remaining paragraphs | Comments
   
]]></description>
			<pubDate>Sun, 10 Feb 2013 17:07:51 EST</pubDate>
			</item><item>
			<title>Seven vulnerabilities found through Mega&#039;s security bounty program</title>
			<link>http://w3bguru.com/news/article/seven-vulnerabilities-found-through-megas-security-bounty-program</link>
			<description><![CDATA[

      
			Mega really wants you to know it&#039;s safe...
	
	  
  
 Since Kim Dotcom debuted his Mega service, security experts (Ars included) let out a collective &quot;huh?!?&quot; regarding some risks taken by the digital locker site—its use of deduplication, the security of its encryption keys, etc. Dotcom heard the message loud and clear. Two weeks after launching, he responded to criticism by offering up to 10,000 euros ($13,362) to anyone who could break the site&#039;s security.
This weekend, Mega reported its first batch of successful challengers. Seven vulnerability fixes were highlighted on the Mega blog—several thousand dollars worth of fixes, if Dotcom makes good on his promise. (The post did not reveal who the successful hacks came from, much less whether they got paid.)
Along with describing the discoveries and fixes, Mega outlined six levels of vulnerabilities it uses for its security program. These range from level one (&quot;All lower-impact or purely theoretical scenarios&quot;) to level six (&quot;Fundamental and generally exploitable cryptographic design flaws&quot;). The seven newly identified vulnerabilities ranged from level one through level four (class descriptions added within brackets):
Read 2 remaining paragraphs | Comments
   
]]></description>
			<pubDate>Sun, 10 Feb 2013 16:07:49 EST</pubDate>
			</item><item>
			<title>Researchers Devise New Attack Techniques Against SSL</title>
			<link>http://w3bguru.com/news/article/researchers-devise-new-attack-techniques-against-ssl</link>
			<description><![CDATA[alphadogg writes &quot;The developers of many SSL libraries are releasing patches for a vulnerability that could potentially be exploited to recover plaintext information, such as browser authentication cookies, from encrypted communications.The patching effort follows the discovery of new ways to attack SSL, TLS and DTLS implementations that use cipher-block-chaining (CBC) mode encryption. The new attack methods were developed by researchers at the University of London&#039;s Royal Holloway College. The men published a research paper and a website on Monday with detailed information about their new attacks, which they have dubbed the Lucky Thirteen. They&#039;ve worked with several TLS library vendors, as well as the TLS Working Group of the IETF, to fix the issue.&quot;    Read more of this story at Slashdot.]]></description>
			<pubDate>Wed, 06 Feb 2013 21:07:55 EST</pubDate>
			</item><item>
			<title>Twitter looks to add two-factor authentication to stop password hacks</title>
			<link>http://w3bguru.com/news/article/twitter-looks-to-add-twofactor-authentication-to-stop-password-hacks</link>
			<description><![CDATA[ Twitter is looking to add another layer of protection to its user authentication. After having at least 250,000 accounts&#039; passwords compromised in an attack against its service last week, Twitter apparently plans to implement two-factor authentication as an option to help users better protect their accounts—or at least it&#039;s hiring people to help do that.
In a job listing posted by Twitter this week, the company seeks software engineers to develop &quot;user-facing security features, such as multifactor authentication and fraudulent login detection.&quot; When contacted by Ars, a representative for Twitter said the company has no specific details to share about its plans at this time.
Twitter currently uses OAuth as its authentication protocol via applications (either mobile apps or other Web services), which prevents attackers from recording and replaying session information trying to hijack open user sessions. For direct user authentication, Twitter uses secure socket layer (SSL) encryption to pass user credentials from Web browsers and other Twitter clients.
Read 3 remaining paragraphs | Comments
   
]]></description>
			<pubDate>Mon, 04 Feb 2013 20:08:04 EST</pubDate>
			</item></channel> 
	                </rss>