There are many hashing algorithms commonly used in cryptography and they have names like SHA1, MD5 and so on. These hashing methods have advanced in the past couple of decades, and although we commonly use the older ones in our everyday lives, it’s worth briefly looking at newer and better alternatives.

We explored the basic properties of hashing functions in the previous post about cryptographic hashing functions, what characteristics made them desirable, what types of programming applications they are commonly used in, and for what purpose.

Read More

How often should you change your password? Should you use a password manager? Should you store passwords in your browser? There are many common questions about passwords and password managers, so let’s take a look at a few of them.

How to choose a password manager? Do you really need one? 22% of 12,500 people surveyed, from 21 countries, said they wrote their passwords down in a notepad, 11% said they wrote it on a sticky note or piece of paper, and 11% said they stored it in a file on dropbox or similar. None of these behaviors is secure in the way that using a password manager is, so go ahead and make the switch.

Read More

Hashing is an essential part of modern software systems, and we’re going to explain what you need to know to use them in your programs. We’ll be focusing mainly on the terrific hashlib module in Python. We also want to stick to the most secure and most widely used cryptographic hashing functions, although there certainly are plenty of others.

This is probably going to be a three part series of posts because I want to first explain what hashing is, why it’s useful and what types of things we would use it for. Hashing functions are widely used in programming and it’s not always clear why things are done the way they are, so a quick intro to the basic ideas will probably go a long way to address that. Slightly different types of hashing functions are useful for different tasks due to the subtle differences in their underlying properties, so it’s useful to compare and contrast specific hashing functions and look at specific progamming use cases.

Read More

Passwords have been the preferred method of authenticating users since the earliest days of the Internet, and they continue to be used to this day to authenticate users. The security issues are well known, but few people consider the privacy pitfalls.

Our most private digital data are protected by passwords, yet people are generally lacking in the skills needed to use passwords effectively. This is due partly to the ever growing number of websites we need to access with credentials, and partly due to the need to use increasingly complex passwords.

Password cracking using common programs is amazingly easy for bad passwords. A best practice is to check a password you’re about to use against a database of compromised passwords, because these lists of common, cracked passwords are often used to try to guess yours – but we’re getting ahead of ourselves.

Read More

Smart cities hold great potential and solve all sorts of problems that our analog cities suffer from. So say the technologists that envision highly connected systems of sensors and devices that are managed by AI systems. How smoothly and efficiently our cities will be run they say, offering us many advantages based on that interconnectivity and alleviating so many current problems.

Smart cities seem to come with some inherent dangers too, such as the risk of security flaws being exploited. Being smart also means having lots of information about what is going on in the city, and this increases the odds of privacy issues arising from the gathering, transmitting, analyzing and storing of so much information including data about the people in a smart city.

Read More

China is pioneering efforts to track and surveil their citizens using AI systems with data from facial recognition systems paired with other tracking technologies. Body movement or gait analysis technology has been deployed already in Shanghai and Beijing, and perfectly complements facial recognition technology for this purpose.

One company, Watrix, has software that can identify people based on physical characteristics from up to 50 meters away, whereas facial recognition technologies require a relatively close view of a person’s face. However once scanned at close range, an identified person can be tracked at a distance using gait recognition software from pretty much any system of cameras.

Read More

The Simple Mail Transfer Protocol (SMTP) has survived to this day due to widespread use, enabling us to send email messages quickly to people all over the planet. Yet email remains a sore spot for privacy advocates and a nightmare for security professionals. Email was the first real application on the Internet, and remained the most popular app even after the web became popular in the 1990s.

In the 1970s when the Internet was still being developed, people read and sent email by logging in to a central computer on a console and used a text-based email program. This basic technique of sending text messages and reading them using simple email programs continued to be the primary method of communicating online through the 1990s. But now, with yearly email messages sent somewhere on the order of one hundred trillion , it has grown into an unrecognizable beast.

Read More

Google filed a patent application for “Smart-home automation system that suggests or automatically implements selected household policies based on sensed observations”. This is a futuristic look at automated systems that monitor “temperature, humidity, lighting, water, power usage, sound signals, ultrasound signals, radio-frequency, other electromagnetic signals or fields, GPS, proximity, motion, light signals, fire, smoke, other gas, etc.”

Google’s smart home vision includes modules to allow setting household policies that are marketed as controls aimed at empowering parents to limit children’s activities; e.g. no television before doing homework. This is accomplished via a household manager module, that infers everything from occupants’ activities to their emotional states.

Read More

Welcome back to another Python programming post. This is a followup to my previous posts about using scapy – that versatile network traffic utility. We went through the basics of creating custom packets, using the basic scapy commands, and then looking at how to build a simple DNS query program using scapy. Feel free to go back and look at those if you missed them – I’m learning as I go, so I tried to be thorough.

In this post we’ll take a quick look at a couple of useful but completely different python utilties called Dshell and Impacket. They’re both unfortunately written for Python2.x, but they are both powerful tools that I’ve recently played around with and they’re worth knowing about. Let’s start with Dshell.

Read More

What will facial recognition systems look like in five or ten years? Welcome to the first post in this whole biometrics series to consist entirely of idle speculation! After building up a basic description of the status quo, it’s time to extrapolate forward based on nothing more than intuition.

Some trends are obvious: increasing resolution of cameras, continued miniaturization of cameras, improvement of facial matching algorithms, the rise of machine learning (ML) systems to manage these tasks at scale, the explosion of affordable satellites, increasing availability of personal biometric data due to breaches from governments that they just cannot resist collecting and warehousing, and development of complementary technologies such as gait recognition.

Read More

Interest in steganography is increasing. In some ways that’s a good thing, but advanced pesistent threat (APT) groups are showing more interest than ever and that is troubling. These threat actors have the means to invest in the time and expertise needed to use these techniques to be highly effective at covertly moving information in and out of networks.

Covert movement of data past network boundaries might mean communicating with command and control (C2) servers. It certainly can be used for sneaking malicious payloads into networks. Equally concerning is the prospect of steganography being used to exfiltrate sensitive data without being detected. There’s good reason to believe that this activity is rarely detected too. Let’s take a look at some recent incidents to see how bad actors are using well known techniques to accomplish these things.

Read More

We would be remiss if we did not mention specialized search sites in one of these posts. There are so many websites that index links in a particular industry or links to specific types of documents like patent applications. They don’t fit neatly into other categories but are incredibly useful for people with specific research needs and niche industry players.

There are of course specialized job search websites aplenty, but they’re annoying and chocked full of trackers and their entire goal often seems to be to collect personal information that is specific and current for the sole purpose of resale to data brokers. Same can be said for various shopping comparison and coupon sites. You know who they are already if you care, so we’re just going to move on.

Read More