Email

Lauren King/Coglianese Photos

Encryption will try to handle the 1 3/16 miles of the Grade 3 Skip Away.

Trainer Kelly Breen has contenders in both of the undercard dirt stakes for older males on Saturdays program at Gulfstream Park.

:: FLORIDA DERBY DAY: Get PPs, watch Saturdays Gulfstream card live

In the Grade 3, $150,000 Skip Away Stakes at 1 3/16 miles, Breen will run Encryption, who came off a long layoff to win a second-level allowance race by eight lengths at 1 1/16 miles on Feb. 22. He will face Commissioner, the runner-up in the 2014 Belmont Stakes, and Sr. Quisqueyano and East Hall, the one-two finishers from the Sunshine Millions Classic.

In the $100,000 Sir Shackleton Stakes, Breen will run Pants On Fire, who shortens up to seven furlongs, the distance of his most recent victory last September at Charles Town.

Pants On Fire will have to tackle Valid, a multiple stakes winner who finished third, beaten a length, behind Honor Code in the Gulfstream Park Handicap last out.

War Correspondent, beaten a length in the Grade 1 Gulfstream Park Turf, and Lochte, a four-time winner over Gulfstream Parks turf course, head the field for the Grade 3, $100,000 Appleton Stakes at a mile on turf.

Read the rest here:
Encryption stretches out for Skip Away

A crowdfunded third-party security audit of popular (and shuttered) personal encryption tool TrueCrypt has concluded. The effort, led by cryptographic expert Matthew Green found that "TrueCrypt appears to be a relatively well-designed piece of crypto software," and that the audit "found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances."

The software isn't perfect. The audit team did find "a few glitches and some incautious programming" related to the Windows random number generator, and vulnerability to cache timing attacks. Neither problem poses much in the way of issues to users unless encryption and decryption are performed on a shared machine, or a physically insecure machine where miscreants can run code directly on the encrypting computer.

TrueCrypt was an open-source freeware application used for on-the-fly encryption. It could create a virtual encrypted disk within a file, encrypt a disk partition, or the entire storage device with pre-boot authentication. In the wake of the Snowden revelations, a non-profit agency was crowdfunded and created to audit the utility's encryption methodology, with the first phase of the report having been completed in April.

Speculation about the shutdown of the popular encryption software was wide-ranging, with the most prevalent theory being that the shutdown was a "warrant canary," meaning that the group may have received a subpoena from US courts demanding encryption keys. Internet skeptics believe that the group may have chosen to shut down, rather than fight or concede the keys to the court.

The repository hosting the utility, SourceForge, claims that there is "no indicator of account compromise" and "current usage is consistent with past usage." Additionally, the last major update was over two years ago with limited support on newer operating systems, so all signs point to the program being abandoned, rather than interfered with by external forces.

By Electronista Staff

Original post:
TrueCrypt code security audit complete; software free of back doors

Encryption Server Njrat Clean 2015 04 02 From Hamada
Encryption Server Njrat Clean 2015-04-02 From Hamada ...

By: hamada mohamed

Read the original here:
Encryption Server Njrat Clean 2015 04 02 From Hamada - Video

NodeJS - Using BCrypt for Database Encryption - Tutorial 9
Encrypting passwords using BCrypt to save in our mongoDB. Tutorial Source can be found @ https://github.com/BrentAureli/Youtube-Tutorials Credit: Various code snippets from http://scotch.io...

By: Brent Aureli

Here is the original post:
NodeJS - Using BCrypt for Database Encryption - Tutorial 9 - Video

A2 Film Production (Shortened) 2 - #39;Encryption #39;
My A2 Film Production. We had to create a film piece based on our own investigation. My investigation title was: #39;A study of a non-linear narrative film such as, #39;Pulp Fiction #39; compared to...

By: CLimeTrees

Continued here:
A2 Film Production (Shortened) 2 - 'Encryption' - Video

DEFINITION of 'Encryption'

Encryption is a means of securing data using a password (key). The encryption process is simple data is secured by translating information using an algorithm and a binary key. When the data needs to be read back, the code is decrypted using either the same key or a different key depending on the type of encryption used.

Encryption strength is based on the length of the security key. In the latter quarter of the 20th century,40 bit encryption, which is a key with 240possible permutations,and 56 bit encryption was standard. Those keys were breakable through brute force attacks by the end of the century, and the 128 bit system became standard in web browsers. The Advanced Encryption Standard (AES) is a protocol for data encryption created in 2001 by the U.S. National Institute of Standards and Technology. AES uses a 128 bit block size, but key lengths of 128, 192 and 256 bits. AES uses a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data.128-bit encryption is standard but most banks; militaries and governments use 256-bit encryption.

Read the original:
Encryption

The latest version of Firefox has a new security feature that aims to put a band-aid over unencrypted website connections. Firefox 37 rolled out earlier this week with support for opportunistic encryption, or OE. You can consider OE sort of halfway point between no encryption (known as clear text) and full HTTPS encryption that's simpler to implement.

For users, this means you get at least a modicum of protection from passive surveillance (such as NSA-style data slurping) when sites support OE. It will not, however, protect you against an active man-in-the-middle attack as HTTPS does, according to Mozilla developer Patrick McManus, who explained Firefox's OE rollout on his personal blog.

Unlike HTTPS, OE uses an unauthenticated encrypted connection. In other words, the site doesn't need a signed security certificate from a trusted issuer as you do with HTTPS. Signed security certificates are a key component of the security scheme with HTTPS and are what browsers use to trust that they are connecting to the right website.

The impact on you: Firefox support is only half of the equation for opportunistic encryption. Websites will still have to enable support on their end for the feature to work. Site owners can get up and running with OE in just two steps, according to McManus. But that will still require enabling an HTTP/2 or SPDY server, which, as Ars Technica points out, may not be so simple. So while OE support in Firefox is a good step for users it will only start to matter when site owners begin to support it.

Beyond support for OE, the latest build of Firefox also adds an improved way to protect against bad security certificates. The new feature called OneCRL lets Mozilla push lists of revoked certificates to the browser instead of depending on an online database.

The new Firefox also adds HTTPS to Bing when you use Microsoft's search engine from the browser's built-in search window.

ian@ianpaul.net, PCWorld

Ian is an independent writer based in Tel Aviv, Israel. His current focus is on all things tech including mobile devices, desktop and laptop computers, software, social networks, Web apps, tech-related legislation and corporate tech news. More by Ian Paul

Your message has been sent.

There was an error emailing this page.

See the original post here:
Firefox 37 supports easier encryption option than HTTPS

A security audit of TrueCrypt has determined that the disk encryption software does not contain any backdoors that could be used by the NSA or other surveillance agencies. A report prepared by the NCC Group for Open Crypto Audit Project found that the encryption tool isnot vulnerable to being compromised.

However, the software was found to contain a few other security vulnerabilities, including one relating to the use of the Windows API to generate random numbers for master encryption key material. Despite this, TrueCrypt was given a relatively clean bill of health with none of the detected vulnerabilities considered sever enough to lead "to a complete bypass of confidentiality in common usage scenarios".

NCC's report reveals a total of four vulnerabilities in TrueCrypt, with two of them being marked as severe. The most worrying -- although it must be stressed that the report does not suggest that there is real cause for concern -- stems from the fact that random numbers are generated based on values from a Windows API. Should this API fail for any reason, TrueCrypt may continue to generate keys with the possibility of an element of predictability -- clearly not ideal for encryption software.

Moving forward, the report stresses the importance of improving error handing in the software:

Because TrueCrypt aims to be security-critical software, it is not appropriate to fail silently or attempt to continue execution in unusual program states. More than simply aborting the application, attempt to gather relevant diagnostic information and make it available for submission to developers to diagnose root-causes. This is especially important as it is difficult to fully test code on multiple operating systems and configurations.

With an increased interest in the activities of the NSA, and particularly in the suggestion that hardware and software should have backdoors built in by default, the report will comes as good news overall for TrueCrypt users.

Photo Credit: Lightspring / Shutterstock

Read more here:
TrueCrypt doesn't contain NSA backdoors

The vast majority of Federal Government websites have poor levels of encryption, putting the private details of taxpayers at risk, an independent audit finds.

An audit of the websites by two independent systems administrators found only four government websites out of more than 850 fully protected visitor communications.

The results have surprised other internet security experts who said the Government needed to beef up their levels of encryption.

Last year, while standing in Australia's new cyber security centre in Canberra, Prime Minister Tony Abbott announced Australia's internet security policies would be put under scrutiny.

The cyber security centre had been announced the year before by former prime minister Julia Gillard, who promised a "world class" facility to tackle a growing overseas cyber threat.

But it appears not all cyber issues are being looked at, as the two system administrators found when they reviewed the encryption capabilities of Federal Government websites.

After retrieving a list of more than 850 government domains via a Freedom of Information request, the pair scanned and reviewed the security of each of those websites.

They were looking for the basics, such as whether the site encrypted communications between the server and the user, similar to the way Twitter, Facebook or banks do.

And if they did provide encryption, the pair wanted to know if the sites used the latest software to protect against vulnerabilities or known weak encryption ciphers.

"Ninety per cent of the sites had no security at all," Ashley Hull, one of the those behind the security scan said.

Continued here:
Federal Government websites have poor levels of encryption, independent audit finds

Developers of the Firefox browser have moved one step closer to an Internet that encrypts all the world's traffic with a new feature that can cryptographically protect connections even when servers don't support the HTTPS protocol.

OE, as opportunistic encryption is often abbreviated, was turned on by default in Firefox 37, which was released this week. The move comes 17 months after an Internet Engineering Task Force working group proposed OE become an official part of the HTTP 2.0 specification. The move garnered critics and supporters alike, with the former arguing it may delay some sites from using the more secure HTTPS protections and the latter saying, in effect, some protection is better than none. The chief shortcoming of OE is its lack of authentication for cryptographically validating that a connected server is operated by the organization claiming ownership.

In a recent blog post, Mozilla developer Patrick McManus laid out some of the thinking and technical details behind the move to support HTTP 2 in Firefox:

OE provides unauthenticated encryption over TLS for data that would otherwise be carried via clear text. This creates some confidentiality in the face of passive eavesdropping and also provides you much better integrity protection for your data than raw TCP does when dealing with random network noise. The server setup for it is trivial.

These are indeed nice bonuses for http:// - but it still isn't as nice as https://. If you can run https you should - full stop. Don't make me repeat it 🙂 Only https protects you from active man in the middle attackers.

But if you have long tail of legacy content that you cannot yet get migrated to https, commonly due to mixed-content rules and interactions with third parties, OE provides a mechanism for an encrypted transport of http:// data. That's a strict improvement over the cleartext alternative.

Two simple steps to configure a server for OE

When the browser consumes that response header it will start to verify the fact that there is a HTTP/2 service on port 443. When a session with that port is established it will start routing the requests it would normally send in cleartext to port 80 onto port 443 with encryption instead. There will be no delay in responsiveness because the new connection is fully established in the background before being used. If the alternative service (port 443) becomes unavailable or cannot be verified Firefox will automatically return to using cleartext on port 80. Clients that don't speak the right protocols just ignore the header and continue to use port 80.

This mapping is saved and used in the future. It is important to understand that while the transaction is being routed to a different port the origin of the resource hasn't changed (i.e. if the cleartext origin was http://www.example.com:80 then the origin, including the http scheme and the port 80, are unchanged even if it routed to port 443 over TLS). OE is not available with HTTP/1 servers because that protocol does not carry the scheme as part of each transaction which is a necessary ingredient for the Alt-Svc approach.

McManus may be overstating the ease many site operators will have in supporting OE. At the moment, implementing HTTP 2 is anything but trivial, mainly because popular Web servers such as Apache and nginx don't yet ship with HTTP 2 support. Still, Mozilla's overture is a start. In February, McManus said nine percent of all Firefox release channel HTTP transactions were already happening over HTTP 2, as users with Firefox 35 or 36 beta connected to sites, such as Google and Twitter, that had implemented the updated protocol. Now that Mozilla offers fuller support in version 37, OE could gain wider use.

See more here:
New Firefox version says “might as well” to encrypting all Web traffic