Tag Archives: encryption

Savitech (盛微) 的 USB 音效驅動程式會安裝 Root CA (被發了 CVE-2017-9758)

在 Hacker News 上看到 CERT 的「Savitech USB audio drivers install a new root CA certificate」提到 Savitech USB audio driver 會安裝自己的 Root CA: Savitech provides USB audio drivers for a number of specialized audio products. Some versions of the Savitech driver … Continue reading

Posted in Computer, Murmuring, OS, Privacy, Programming, Security, Software, Windows|Tagged , , , , , , , , , , , , , , , |Leave a comment

AWS CloudHSM 支援 FIPS 140-2 Level 3 了

AWS CloudHSM 推出了一些新功能:「AWS CloudHSM Update – Cost Effective Hardware Key Management at Cloud Scale for Sensitive & Regulated Workloads」。 其中比較特別的是從以前只支援 Level 2 變成支援 Level 3 了: More Secure – CloudHSM Classic (the original model) supports the generation and use of … Continue reading

Posted in AWS, Cloud, Computer, Hardware, Murmuring, Network, Security, Service|Tagged , , , , , , , , , , , , |Leave a comment

Amazon EFS 也能加密了

Amazon EFS 也支援使用 KMS 加密了,這對於一些要求「落地要加密」的 certification 方便不少:「New – Encryption of Data at Rest for Amazon Elastic File System (EFS)」。 不過東京還沒有 EFS 啊... (繼續敲碗)

Posted in AWS, Cloud, Computer, Murmuring, Network, Service|Tagged , , , , , , , , |Leave a comment

Telegram 使用 CDN 加速下載

Telegram 說明他們將會使用 CDN 加速:「More Speed and Security!」。 資料在 CDN 的節點上是加密的,金鑰需要透過 Telegram 的 key server 提供: While these caching nodes are only used to temporarily store public media (imagine Telegram versions of superpopular YouTube hits), all data that goes through them … Continue reading

Posted in CDN, Computer, Murmuring, Network, Privacy, Security, Service, Software, WWW|Tagged , , , , , , , , , , , , , |1 Comment

AES-GCM-SIV

在「AES-GCM-SIV: Specification and Analysis」這邊看到 AES-GCM-SIV 的作者自己投稿上去的資料,是個已經被放進 BoringSSL 並且在 QUIC 上使用的演算法: We remark that AES-GCM-SIV is already integrated into Google's BoringSSL library \cite{BoringSSL}, and its deployment for ticket encryption in QUIC \cite{QUIC} is underway. 在 RFC 上的說明解釋了這個演算法的目的是希望當 nonce 沒有被正確實作時仍然可以有比 AES-GCM 強的保護: … Continue reading

Posted in Computer, Murmuring, Network, Security, WWW|Tagged , , , , , , , , , , , |Leave a comment

Amazon Redshift 可以讀 S3 裡被 KMS 加密過的資料了

清資料時發現支援了:「Amazon Redshift now supports encrypting unloaded data using Amazon S3 server-side encryption with AWS KMS keys」: The Amazon Redshift UNLOAD command now supports Amazon S3 server-side encryption using an AWS KMS key. 這樣資料丟上 Amazon S3 時可以透過 AWS KMS 加密保存,而 Amazon … Continue reading

Posted in AWS, Cloud, Computer, Database, Murmuring, Network, Security, Software|Tagged , , , , , , , , , |Leave a comment

Google Cloud Platform 提供 Cloud Key Management Service

GCP 提供 Cloud Key Management Service (目前是 beta),將對 key 的處理 (像是加解密) 變成服務的一部分。 費用的部份,比較大的量應該會在「Key use operations (Encrypt/ Decrypt)」這塊?每一萬次收 USD$0.03。 自己建會有一堆稽核問題要處理,有人建起來後直接用,拔責任直接拆開的確是比較方便...

Posted in Cloud, Computer, Murmuring, Network, Security|Tagged , , , , , , , , , , , |Leave a comment

前陣子在 Black Hat 上發表的 HEIST 攻擊 (對 HTTPS 的攻擊)

又是一個對 HTTPS 的攻擊:「HEIST attack on SSL/TLS can grab personal info, Black Hat」、「New attack steals SSNs, e-mail addresses, and more from HTTPS pages」。 一樣是 Compression 產生的 side-channel attack,只是這次是結合 TCP window size 的攻擊。投影片可以在「HTTP Encrypted Information can be Stolen through TCP-windows (PDF)」這邊看到。 這次的攻擊只需要在瀏覽器上插入 … Continue reading

Posted in Browser, Computer, Murmuring, Network, Security, Software, WWW|Tagged , , , , , , , , , , , , , , , , |Leave a comment

CIA 老大告訴參議員,在加密系統裡放後門是可行的,因為沒有公司可以逃離美國魔掌

如同標題講的,CIA 老大 John Brennan 告訴參議員,因為實務上不存在「Non-US encryption」,所以強制任何要進入美國的企業使用美版帶有後門的加密系統是可行的:「Non-US encryption is 'theoretical,' claims CIA chief in backdoor debate」。 CIA director John Brennan told US senators they shouldn't worry about mandatory encryption backdoors hurting American businesses. And that's because, according to Brennan, there's no … Continue reading

Posted in Computer, Murmuring, Network, Political, Security, Social|Tagged , , , , , , , , , |Leave a comment

Google 刻意讓 Allo 不安全的方法

兩篇文章與一則 tweet 剛好可以一起看。 兩篇文章分別是「Don't Use Allo」講 Google Allo 預設沒有加密的問題,與「How Technology Hijacks People’s Minds — from a Magician and Google’s Design Ethicist」講如何設計產品來改變人的行為。 在市場上的領先者 Whatsapp 已經啟用預設 end-to-end encryption 後,Google Allo 之所以不是預設加密的原因,是基於這樣的設計方法,因為 Google 並不想要加密: Businesses naturally want to make the choices they want you to … Continue reading

Posted in Computer, Murmuring, Network, Security, Social, Software|Tagged , , , , , , |2 Comments