igaPSPKBJhysh.jpg

igaPSPKBJhysh.jpg:
source · faved by fx0101

Bolsa em Queda? Fique Tranquilo...

Backpack Algorithms And Public-Key Cryptography Made Easy

Backpack Algorithms And Public-Key Cryptography Made Easy:
E-commerce runs on secrets. Those secrets let you update your blog, shop at Amazon and share code on GitHub. Computer security is all about keeping your secrets known only to you and the people you choose to share them with.
We’ve been sharing secrets for centuries, but the Internet runs on a special kind of secret sharing called public-key cryptography. Most secret messages depend on a shared secret—a key or password that everyone agrees on ahead of time. Public-key cryptography shares secret messages without a shared secret key and makes technologies like SSL possible.
Cryptography is a scary word: it conjures thoughts of complex equations and floating-point arithmetic. Cryptography does have a lot of math, but it’s more about keeping and sharing secrets.

A Simple Secret

Telling my best friends a secret is easy: I find a private place and whisper it in their ears. As long as no one is listening in, I’m totally secure. But the Internet is full of eavesdroppers, so we need codes.
We’ve all been inventing codes since we were children. I created this simple number code (actually a cipher) when I was 5:

a=1, b=2, c=3, d=4, e=5…

It fooled my friends, but not my parents. Simple substitution ciphers are based on a lack of knowledge. If you know how they work, then you can decode every message. The experts call this “security through obscurity.” Letter and number substitutions don’t work on the Internet, because anyone can look them up on Wikipedia. For computer security, we need codes that are still secure even if the bad guys, or your parents, know how they work.
The most secure code is still easy to use: a “one-time pad.” One-time pads have been used for centuries, so they don’t even need computers. They played a big part in World War II, when each pad of paper with the key numbers was used only once.
Let’s say I wanted to send you this secret message:

I love secrets

First, I’d turn the message into numbers using my simple cipher from when I was 5. (I’ve heard rumors that other people had this idea first, but I don’t believe it.)

Then I’d mash my keyboard to generate a random key string for my one-time pad.

Now I can add the two strings together. If my number is greater than 26, I would just wrap it around to the beginning. So, i(9) + e(5) = n(14), and o(15) + t(20) = i(35 - 16 = 9). The result is an encrypted string:

Decrypting the string to get the secret back is easy. We just subtract the one-time pad: n(14) - e(5) = i(9). Follow that pattern through the entire message, and you can securely share a secret. You don’t even need a computer: just work it out with a pen and paper.
This function is called a symmetric-key algorithm, or a shared-key algorithm, since it uses the same key to encrypt and decrypt the message. Modern systems can safely use the pad more than once, but the basic idea is the same.
The one-time pad is totally secure because the bad guys don’t know how we got the encoded letter. The n could be i + e, j + d or any other combination. We can use our shared secret (the one-time pad) once to share another secret.
But there’s a fatal flaw. We need to share the one-time pad ahead of time before we can start sharing secrets. That’s a chicken-and-egg problem because we can’t share the pad without worrying that someone will snoop. If the bad guys get the one-time pad, then they would be able to read everything.
One-time pads help me share secrets with my best friends, but I can’t use them with strangers such as Amazon or Facebook. I need a way to share something publicly that doesn’t compromise my one-time pad. I need a public key.

The Public-Key Backpack

Public-key encryption focuses on a single problem: how do I prove that I know something without saying what it is? An easy concept to help us understand this is a backpack full of weights.

I want to prove that I know which weights are in my pack, but I don’t want to tell you what they are. Instead of showing you all of the weights separately, I’ll just tell you the total. Now you can weigh the pack and see if I’m right without ever opening it.
If the pack weighs 20 kilos, then you wouldn’t know if it has one 20-kilo weight, twenty 1-kilo weights or something in between. With a large number, you can be pretty confident that I know what’s in the pack if I know the total; you don’t have to see inside. The weight of the backpack is the public part, and the individual weights are the private part.
This basic backpack enables us to share a secret without really sharing it. If we each have a backpack, then we can both share secrets.
The backpack works well enough for smaller numbers, but it isn’t useful in the real world. Backpack algorithms were a mere curiosity for decades. Then RSA changed everything.

RSA

RSA was the first public-key encryption system that worked in the real world. Invented more than 30 years ago, it coincided with the introduction of the more powerful computers that were needed to run the big numbers. RSA is still the most popular public-key encryption system in the world.
The basic premise of RSA is that factoring large numbers is difficult. Let’s choose two prime numbers: 61 and 53. I’m using the numbers from Wikipedia’s article on “RSA” in case you want more details.
Multiply these two numbers and you get 3233:

61 × 53 = 3233

The security of RSA comes from the difficulty of getting back to 61 and 53 if you only know 3233. There’s no good way to get the factors of 3233 (i.e. the numbers that multiply to make the result) without just looking for all of them. To think of this another way, the weight of our backpack is 3233 kilos, and inside are 61 weights weighing 53 kilos each. If you make the resulting number large enough, then finding the numbers that produced it would be very difficult.

Public And Private Keys

Unlike the one-time pad, RSA uses the public key to encrypt information and the private key to decrypt it. This works because of the special relationship between the public and private keys when they were generated, which allows you to encrypt with one and decrypt with the other.
You can share the public key with anyone and never reveal the private key. If you want to send me a secret message, just ask for my public key and use it to encrypt the message. You can then send it to anyone you want, and you’ll know that I’m the only one who can decrypt the message and read it.
I could send you a message in the same way. I would ask for your public key, encrypt the message using it and then send it to you to decrypt. The popular program Pretty Good Privacy (PGP) worked like that. We’re secure as long as we both keep our private keys private.
Exchanging keys is made even easier by special key servers that allow you to search for people and find their public keys.
Public-key encryption also works in reverse to provide digital signatures. Let’s say I want to write a message and prove that I wrote it. I just encrypt it with my private key and post it. Then anyone who wants to check can decrypt it with my public key. If the decryption works, then it means I have the private key and I wrote the message.
RSA is relatively simple: take two numbers (the private key), apply some math, and get a third number (the public key). You can write out all of the math in a few lines, and yet RSA changed the world. Business doesn’t work on the Internet without public-key encryption.

RSA And HTTPS

We use public-key encryption every day with HTTPS. When you access Facebook, Twitter or Amazon with HTTPS, you’re using a simple encryption mechanism like the one-time pad, but you’re creating the pad with public-key encryption. Without HTTPS, anyone else at Starbucks could read your credit-card number, Facebook password or private email while sipping a latte.
Amazon has a certificate from a company named VeriSign. The certificate certifies that Amazon is Amazon, and it contains its public key. Your browser creates a special key just for that session and encrypts it using Amazon’s public key. Then it sends it over the Internet, knowing that only Amazon can decrypt the session key. Once you’ve exchanged that secret key, you can use it as the one-time pad to protect your password and credit-card number.

You could keep using public-key encryption for the whole session, but because of all the math, it’s much slower than the one-time pad.

RSA And GitHub

Another place many of us use RSA is GitHub. Every time you push a change to GitHub or pull from a master branch, GitHub has to make sure you have permission to make the change. It gets its security through a secure command shell using RSA.
Remember when you set up your GitHub account and followed some commands to generate keys?

You used the SSH-Keygen tool to generate a new RSA private/public key pair. Then you went to your GitHub account page and entered your public key.
Now, when GitHub needs to authenticate you, it asks your computer to sign something with your private key and return the signed data. With your public key, GitHub can confirm that the signature is authentic and could only have been produced by someone who has the corresponding private key—even though GitHub itself doesn’t have that private key.
That’s better than a simple password because nobody can snoop it. And if GitHub ever gets hacked, your private key won’t be in danger because only you have it.

Sharing Passwords

When WordPress.org was “hacked”, it wasn’t really hacked. WordPress plugin developers, like everyone else, have accounts on other websites. They also reuse their passwords. When hackers cracked those other websites, they used the stolen passwords to log into WordPress.org and make malicious changes to plugins.
Most people use the same user name and password on multiple websites. That makes your website only as secure as everyone else’s. Public-key encryption changes that. Because you never have to share your private key, it doesn’t matter if other websites get hacked. If an attacker breaks into GitHub and gets your public key, they can’t use it to impersonate you or log in as you on other websites. Only someone with your private key can do that, which is why your private key remains safe on your computer. Using public-key cryptography makes GitHub much more secure.

GitHub Gets Hacked

GitHub was hacked recently, but not because the encryption failed. Real-world security breaches are caused by problems in implementation, not in math.
In this case, the hacker was able to exploit a hole and add his public key to the Ruby on Rails repository. Once the key was added, GitHub used it to verify the hacker’s identity and granted him access. We’re lucky this hacker was friendly and told GitHub about the issue.
Once the problem was fixed, you could keep using your private key because GitHub never had it to lose; it stayed on your machine. Public keys saved GitHub from serious problems.
The weakest link in GitHub’s security was in the mechanism that allowed clever users to add public keys to other projects without being authorized. The math was perfect, but the implementation wasn’t.

Public Keys In The Wild

Knowing the fundamentals is essential (you might say the key) to writing secure applications. The math is complex, but the basics are simple:

• There are two main types of encryption: shared-key encryption, such as a one-time pad, and public-key encryption, which uses public and private keys.
• Shared-key encryption is faster, but sharing the keys is difficult.
• RSA is the most popular public-key encryption algorithm, but a few others are in general use, as well as some cool experimental systems.
• Public-key cryptography works best in combination with other technologies.
• Don’t ever share your private key with anyone.

When it comes time to implement public-key cryptography in your application, don’t. RSA and other algorithms are already implemented in all major languages. These libraries include extra security features such as padding and salts, and they have a lot of testing behind them.
Most security flaws come from poor implementations and misunderstanding about the libraries. You don’t have to write your own cryptography libraries, but you do have to know the fundamentals so that you can use the ones that are out there.
Illustrations in this article were provided by Robb Perry.
(al) (km)

---

© Zack Grossbart for Smashing Magazine, 2012.

Summary for Week of May 11th

Summary for Week of May 11th: The key stories for the week were the elections in France and Greece, and JPMorgan’s $2 billion trading loss on a synthetic credit position. JPMorgan CEO Jamie Dimon said the losses were due to “egregious mistakes”, “sloppiness" and that the "portfolio still has risk”. This doesn’t appear to be a systemic risk, just poor risk management at JPMorgan.



The Greek political situation is unsettled, and the Europeans have said they support Greece through the next election on June 17th. After that … who knows? There is a strong possibility that Greece will leave the euro not long after the next election.



This was a light week for US economic data. The trade deficit was a little higher than expected, but most of the data improved slightly. The 4-week average of initial weekly unemployment claims declined, small business confidence improved, and consumer sentiment improved, and there were more job openings in March.



In an under reported story, both Fannie and Freddie reported improved performance due to “stabilization of house prices” in certain areas. The sharp decline in "for sale" inventory appears to be supporting house prices, and inventory and house prices continue to be key stories for 2012.



Here is a summary in graphs:



• Trade Deficit increased in March to $51.8 Billion



The trade deficit was above the consensus forecast of $49.5 billion.



The first graph shows the monthly U.S. exports and imports in dollars through March 2012.



Exports increased in March, and are at record levels. Imports increased even more. Exports are 13% above the pre-recession peak and up 7% compared to March 2011; imports are 3% above the pre-recession peak, and up about 8% compared to March 2011.



The second graph shows the U.S. trade deficit, with and without petroleum, through March.



The blue line is the total deficit, and the black line is the petroleum deficit, and the red line is the trade deficit ex-petroleum products.



Oil averaged $107.95 per barrel in March, up from $103.63 in February. Import oil prices were probably a little higher in April too, but will probably decline in May. The increase in imports was a combination of more petroleum imports and more imports from China.



• BLS: Job Openings increased in March



This graph shows job openings (yellow line), hires (dark blue), Layoff, Discharges and other (red column), and Quits (light blue column) from the JOLTS.



Jobs openings increased in March to 3.737 million, up from 3.565 million in February. The number of job openings (yellow) has generally been trending up, and openings are up about 17% year-over-year compared to March 2011. This is the highest level for job openings since July 2008.



Quits increased in March, and quits are now up about 8.5% year-over-year and quits are now at the highest level since 2008. These are voluntary separations and more quits might indicate some improvement in the labor market. (see light blue columns at bottom of graph for trend for "quits").





All current employment graphs

• REO Inventory for Fannie, Freddie and the FHA



This graph shows the combined REO inventory for Fannie, Freddie and the FHA (FHA through Feb 2012).



The combined REO inventory is down to 203 thousand in Q1 2012, down about 18% from Q1 2011.



The pace of REO acquisitions will probably increase following the mortgage servicer settlement (signed off on April 5th); and dispositions will probably increase too.



• CoreLogic: House Price Index increases in March, Down 0.6% Year-over-year



From CoreLogic: CoreLogic® March Home Price Index Shows Slight Year-Over-Year Decrease of Less Than One Percent

[CoreLogic March Home Price Index (HPI®) report] shows that nationally home prices, including distressed sales, declined on a year-over-year basis by 0.6 percent in March 2012 compared to March 2011. On a month-over-month basis, home prices, including distressed sales, increased by 0.6 percent in March 2012 compared to February 2012, the first month-over-month increase since July 2011.

This graph shows the national CoreLogic HPI data since 1976. January 2000 = 100.



The index was up 0.6% in March, and is down 0.6% over the last year.



The index is off 34% from the peak - and is just above the post-bubble low set last month.



• Weekly Initial Unemployment Claims at 367,000



Here is a long term graph of weekly claims:



The dashed line on the graph is the current 4-week average. The four-week average of weekly unemployment claims decreased to 379,000.



This decline in the 4-week moving average followed for four consecutive increases.



This was close to the consensus of 366,000. This is two consecutive weeks with initial unemployment claims in the 360s, after averaging close to 390,000 over the previous 3 weeks.







All current Employment Graphs

• NFIB: Small Business Optimism Index increases in April



This graph shows the small business optimism index since 1986. The index increased to 94.5 in April from 92.5 in March. This ties February 2011 as the highest level since December 2007.



Another positive sign is that the "single most important problem" was not "poor sales" in April - for the first time in years. In the best of times, small business owners complain about taxes and regulations, and that is starting to happen again.



This index remains low, but as housing continues to recover, I expect this index to increase (there is a high concentration of real estate related companies in this index).



• Consumer Sentiment increases in May to 77.8



The preliminary Reuters / University of Michigan consumer sentiment index for May increased to 77.8, up from the April reading of 76.4.



This was above the consensus forecast of 76.2 and the highest level since January 2008. Overall sentiment is still fairly weak - probably due to a combination of the high unemployment rate, high gasoline prices and the sluggish economy.



• Other Economic Stories ...

• LPS: House Price Index increased 0.2% in February

• Lawler: Table of Short Sales and Foreclosures for Selected Cities

• Sacramento: Percentage of Distressed House Sales increases slightly in April

• Lawler: REO inventory of "the F's" and PLS

• Fannie Mae reports $2.7 billion in income, REO inventory declines in Q1 2012

• The economic impact of stabilizing house prices?

• The Declining Participation Rate

• Housing: Inventory declines 21% year-over-year in early May

How Tech Is Changing College Life [INFOGRAPHIC]

How Tech Is Changing College Life [INFOGRAPHIC]:
College students today are more tech savvy than ever before. Just how important is technology to their academic lives?
More than 90% use email to communicate with professors and 73% say they cannot study without technology. Seven in 10 take notes on keyboards instead of paper, virtually all students who own an ereader and most use digital tools when preparing a presentation.
All that tech has caused something of a dependency too — 38% of students can’t go more than 10 minutes without checking their smartphone or other device. All told, students spent $13 billion on electronics in 2009.
Community college students are less digitally connected than students at four-year schools, but more and more people are making the Internet their education gateway. Twelve million students take at least one class online today — in five years, that number is projected to exceed 22 million. By 2014, analysts say, more than 3.5 million students will take all of their classes online.
This is all according to research compiled by Presta Electronics. Presta used material from the Pew Research Center, Chronicle of Higher Education, Mashable and other sources to put together the infographic below. Check it out for the full picture of how technology is changing college students’ lives.
Do you think technology is changing college for the better — or are there downsides?

More About: education, infographics, Social Media, Tech

For more Tech coverage:

• Follow Mashable Tech on Twitter
• Become a Fan on Facebook
• Subscribe to the Tech channel
• Download our free apps for Android, Mac, iPhone and iPad

Hey... I love History!

Hey... I love History!:

Submitted by: nixynixy

Posted at: 2012-05-04 22:43:16

See full post and comment: http://9gag.com/gag/4078715

The Power of Running

The Power of Running:
Runner
I was thinking that with so many people burning calories by running, if only that energy could be harnessed it might put a dent in the energy crisis. So for fun, I compared the energy exerted by runners to other worldly things that consume energy.

Feel free to put the above infographic on your blog by pasting the embed code below into your blog:
<a href="http://www.runner.com/the-power-of-running" ><img title="power-of-running" src="http://www.runner.com/wp-content/uploads/2012/05/Power-of-running.jpg" alt="The Power of Running Infographic" width="568" height="2280" /></a>

<br /> <a href=http://www.runner.com>Runner.com - Information and Inspiration for the Runner</a>

• Total calories burned by core runners in one year equals 4,234,278,397,440
• That’s enough to power the electricity needs for 1,771,622 homes for a year.
• That is equivalent to all the homes in Los Angeles and San Francisco combined
• Total energy used by all core runners is equivalent to 177,162,208 gallons of gasoline
• That’s enough to power a Boeing 747 around the world 1,093 times
• That’s also equivalent to the energy expended by 177 atomic bombs the size of Little Boy, the bomb dropped on Hiroshima.
• Calories a man runner burns per year of running equals 175,386 which is enough to power an LCD TV for 107 days
• Calories a woman runner burns per year of running equals 119,574 enough to power a clothes washer for 6 months
• An average woman running a marathon will burn enough calories to power a 60 watt bulb for 8 days
• An average man running a marathon will burn enough calories to power a laptop computer for 8 days
• For a half marathon, a woman runner will burn enough calories to charge cell phone for more than 21 days
• For a half marathon, a man runner will burn enough calories to run a clock radio for over 3.5 days
• The total calories burned by all finishers of the New York City Marathon equals 145,154,457, that is enough to light up NYC for 7 .5 hours

The figures used are for the core runner, which is a person that runs fifty or more times per year. Many sources were used to derive this information. Since there are many variables involved, I used averages (i.e. for runners weight, miles per week, LCD TV size, etc) so the results are estimates. Primary sources include, General Electric, Running USA, Runners World, Popular Mechanics, msnbc and the University of Washington.
Runner - Information and Inspiration for the Runner

Google explains how it searches the internet in under half a second, if you can find the video

Google explains how it searches the internet in under half a second, if you can find the video:

Ever wonder how Google manages to search the entire web and return results in half a second? Well, RobertvH from Munich did, and Mountain View's head of web-spam, Matt Cutts, talks you through it in the above YouTube video. The short answer? Lots of backend firepower and, you know, a few years in the search game. If you remember the Google dance, Cutts explains what caused that, before going on to give a good idea about how today's version of the site does what it does. If you're thinking this all sounds a bit too much like SEO 101, you'd be half-way right, but as Matt's delivery is so engaging, we're def hoping there'll be a follow up.

Google explains how it searches the internet in under half a second, if you can find the video originally appeared on Engadget on Tue, 24 Apr 2012 17:06:00 EDT. Please see our terms for use of feeds.

Permalink   |  Google Webmaster Help (YouTube)  | Email this | Comments

Lemons? Melons?

Lemons? Melons?:

Submitted by: skirkmav

Posted at: 2012-04-20 03:48:00

See full post and comment: http://9gag.com/gag/3921016

Seems legit.

Seems legit.:

Submitted by: zawalidz

Posted at: 2012-04-14 10:02:32

See full post and comment: http://9gag.com/gag/3844659