Page 4,140«..1020..4,1394,1404,1414,142..4,1504,160..»

Security and encryption | Documentation | Turtl

Turtl uses encryption to protect your data in such a way that only you, andthose you choose, are able to view your data. Keep reading for a high-leveloverview of Turts encryption and how it protects you.

Simply put, encryption is the process of scrambling data. Generally, this isdone using a key which is usually a passphrase. The only way to de-scramblethe data is using that passphrase.

Turtls encryption works by generating a key for you based on youremail and password. This key is used to lock and unlock (or encrypt anddecrypt) your data and keep it private. All of the encryption in Turtl happensbefore any data leaves the app, meaning that even if someone is snooping in onyour connection or someone hacks our database, everything youve put into Turtlis just gibberish to them.

Without the keys that only you hold, your data is useless.

As mentioned, Turtl creates a key for you when you log in based on your emailand password. It wouldnt be very useful if you had to give people this key whenyou shared data with them because it would give them access to all your data.Instead, Turtl generates a new, random key for each object. This key is whatis sent to people when sharing, allowing them to unlock the specific item yousend them and nothing else.

Keys are stored one of two ways:

If youre looking for a more comprehensive look at how Turtl does encryption,check out the encryption specifics page of the docswhich goes over the ciphers, block modes, and other methods Turtl uses whenhandling your data.

Encryption specifics

Turtl has a feature that keeps you logged in if the app is closed and reopened.This feature may have security implications. Read more about the Stay logged infeature.

Here are some possible scenarios where Turtls security measures will fail you.We try to provide an exhaustive list so youre aware of the dangers of relyingon Turtl.

More:
Security and encryption | Documentation | Turtl

Read More..

Bitcoin (BTC) Price, Chart, Info | CoinGecko

About

Bitcoin is the first successful internet money based on peer-to-peer technology; whereby no central bank or authority is involved in the transaction and production of the Bitcoin currency. It was created by an anonymous individual/group under the name, Satoshi Nakamoto. The source code is available publicly as an open source project, anybody can look at it and be part of the developmental process.

Bitcoin is changing the way we see money as we speak. The idea was to produce a means of exchange, independent of any central authority, that could be transferred electronically in a secure, verifiable and immutable way. It is a decentralized peer-to-peer internet currency making mobile payment easy, very low transaction fees, protects your identity, and it works anywhere all the time with no central authority or banks.

Bitcoin is design to have only 21 million BTC ever created, thus making it a deflationary currency. Bitcoin uses the SHA-256 hashing algorithm with an average transaction confirmation time of 10 minutes. Miners today are mining Bitcoin using ASIC chip dedicated to only mining Bitcoin, and the hash rate has shot up to peta hashes.

Being the first successful online cryptography currency, Bitcoin has inspired other alternative currencies such as Litecoin, Peercoin, Primecoin, and so on.

The cryptocurrency then took off with the innovation of the turing-complete smart contract by Ethereum which led to the development of other amazing projects such as EOS, Tron, and even crypto-collectibles such as CryptoKitties.

Read the original here:
Bitcoin (BTC) Price, Chart, Info | CoinGecko

Read More..

Bitcoinker – The Best Bitcoin Faucet, Claim Every 5 Minutes!

Getup to 100,000 Satoshis every 5 minutesTotal paid: 1,639,181,911 SatoshisHow to use Bitcoinker?

1. Enter your Bitcoin address2. Solve the captcha3. Click on Claim Bitcoin

To check your address balance click herePlease read our FAQ page and faucet rulesYou can claim up to 120 times per 24 hoursYou are not allowed to use VPS, VPN or Proxy to connect to BitcoinkerPayouts are made every 1st day of the month for addresses above 20,000 Satoshis

Check out other Bitcoin faucets similar to BitcoinkerYou can use our banners to get more referrals: 300250 46860Share this link with your friends to earn a rewarding10% referral commission from each of their claims:https://Bitcoinker.com/?r=Your_Bitcoin_Address

Up to 30 days of using Bitcoinker- no bonus

Between 31 days and 60 days of usingBitcoinker- 10% bonus on all direct payouts

Between 61days and 90days of usingBitcoinker- 15% bonus on all direct payouts

Between 91 days and 120days of usingBitcoinker- 20% bonus on all direct payouts

Between 121days and 150 days of usingBitcoinker- 25% bonus on all direct payouts

Over 151days of usingBitcoinker- 30% bonus on all direct payouts

For each visitor you bring in to Bitcoinker your address will be paid 10% of all their claims.You can refer people by using the following link and replacing Your_Bitcoin_Address with your actual Bitcoin address: https://bitcoinker.com/?r=Your_Bitcoin_Address

Unfortunately we have no control over the difficulty of captcha as Solve Media sets the difficulty differently for every individual user based on many aspects. If it keeps getting harder we would suggest trying refreshing the page / clearing the cookies and history / a different browser.

This error should be due to a problem on the ISP side.Try refreshing the page / clearing your cookies / a different browser / resetting your router.

Go here to read the rest:
Bitcoinker - The Best Bitcoin Faucet, Claim Every 5 Minutes!

Read More..

Bitcoin and Other Cryptocurrency Prices Are Crashing Again …

For months, the price of Bitcoin has been hovering around the mid-$6,000s mark. No longer. The most popular cryptocurrency has plummeted by 12% over the last day, hitting a value of little more than $5,500.

The total market capitalization for Bitcoin now stands at $96 billionthe first time the market cap has fallen below $100 billion since October last year. The total market cap for the entire cryptocurrency scene now stands at $181 billion.

Bitcoin is far from the only casualty, with cryptocurrency price charts all firmly in the red right now. XRP (Ripple), the second-biggest virtual coin, is down 9.2%, Ethereums Ether is down almost 13%, and Bitcoin Cash is down 8.7%.

So, volatility is back, butas is so often the caseits not entirely clear why that is.

One theory, touted by BKCM founder Brian Kelly on CNBC, is that the crash is being caused by disagreements over a hard fork in Bitcoin Cash.

Hard forks are where a major software upgrade takes place on a cryptocurrency, essentially creating a new cryptocurrency (with free coins for existing coin holders) while leaving the old one intactthats how Bitcoin Cash formed in the first place, and now its doing it again. There is no majority agreement in the Bitcoin Cash community over which version would be best, though.

IMF chief Christine Lagarde also hit the headlines on Wednesday by calling for more countries to explore the potential of digital currenciesbut central-bank-backed digital currencies, not Bitcoin-style cryptocurrencies.

A few countries such as Sweden, China and Canada are already exploring this idea, with a key driver being maintaining the safety of currency-using consumers. There is a possibility that, if such schemes come to fruition, they could encourage regulators to crack down on competing cryptocurrencies that offer no such protections.

See the original post here:
Bitcoin and Other Cryptocurrency Prices Are Crashing Again ...

Read More..

Encryption | General Data Protection Regulation (GDPR)

Companies can reduce the probability of a data breach and thus reduce the risk of fines in the future, if they chose to use encryption of personal data. The processing of personal data is naturally associated with a certain degree of risk. Especially nowadays, where cyber-attacks are nearly unavoidable for companies above a given size. Therefore, risk management plays an ever-larger role in IT security and data encryption is suited, among other means, for these companies.

In general, encryption refers to the procedure that converts clear text into a hashed code using a key, where the outgoing information only becomes readable again by using the correct key. This minimises the risk of an incident during data processing, as encrypted contents are basically unreadable for third parties who do not have the correct key. Encryption is the best way to protect data during transfer and one way to secure stored personal data. It also reduces the risk of abuse within a company, as access is limited only to authorised people with the right key.

The Regulation also recognizes these risks when processing personal data and places the responsibility on the controller and the processor in Art. 32(1) of the General Data Protection Regulation to implement appropriate technical and organisational measures to secure personal data. The GDPR deliberately does not define which specific technical and organisational measures are considered suitable in each case, in order to accommodate individual factors. However, it gives the controller a catalogue of criteria to be considered when choosing methods to secure personal data. Those are the state of the art, implementation costs and the nature, scope, context and purposes of the processing. In addition to these criteria, one always has to consider the severity of the risks to the rights and freedoms of the data subject and how likely those risks could manifest. This basically boils down to the following: The higher the risks involved in the data processing and the more likely these are to manifest, the stronger the taken security measures have to be and the more measures must be taken. Encryption as a concept is explicitly mentioned as one possible technical and organisational measure to secure data in the list of Art. 32(1) of the GDPR, which is not exhaustive. Again, the GDPR does not mention explicit encryption methods to accommodate for the fast-paced technological progress. When choosing a method one must also apply the criteria catalogue above. To answer the question of what is currently considered state of the art data protection officers usually rely on the definitions set out in information security standards like ISO/IEC 27001 or other national IT-security guidelines.

Encryption of personal data has additional benefits for controllers and/or order processors. For example, the loss of a state of the art encrypted mobile storage medium which holds personal data is not necessarily considered a data breach, which must be reported to the data protection authorities. In addition, if there is a data breach, the authorities must positively consider the use of encryption in their decision on whether and what amount a fine is imposed as per Art. 83(2)(c) of the GDPR.

Authorities

Expert contribution

Visit link:
Encryption | General Data Protection Regulation (GDPR)

Read More..

Homepage – Cryptocurrency Army

The world of cryptocurrencies is a quickly growing and expanding place. The value of cryptocurrencies such as Bitcoin have been going through the roof. The reality is that cryptocurrencies are becoming ever more important, valuable, and widely accepted as legitimate forms of money. With this great value comes a very real chance for people to make a serious income. Yes, the trading of Bitcoins, Ethereum, and other such cryptocurrencies is becoming much more common and profitable too. Just like with other forms of trading, Bitcoin and Crypto trading has a lot of merit in terms of its profit potential. That being said, there are also lots of threats out there that arise from this popularity of cryptocurrencies. This is why we here at the Cryptocurrency Army have come into existence, to help you fight off these threats and stay safe.

Source:huffingtonpost

The sad reality is that there are countless cryptocurrency scams out there looking to take advantage of you. Just like with other scams and scammers, crypto-scams looks to expose beginners and people with limited knowledge. These criminals promise huge profits and awesome returns if you just give them some money. Whether it is a trading scam, a scam application, or an HYIP scam, there are plenty out there looking to bite a chunk out of you. These people are fraudsters, criminals, and scammers of epic proportions looking to make your life miserable with a ridiculous array of crypto-scams. Here at the Cryptocurrency Army our main goal is to keep you safe from scams, let you know about the legitimate trading applications out there, and to teach you everything there is to know about cryptocurrencies.

Here at the Cryptocurrency Army our mission is to keep you safe from scammers, criminals, and fraudulent peoples of all sorts. Were here to evaluate trading programs, investment opportunities, and to review anything and everything to do with cryptocurrencies. Whether Bitcoin, Ethereum, Litecoin, or any other form of digital currency, our goal is to ensure that your money is right where it should be, in your own pocket and not in the hands of scammers. To learn about cryptocurrencies, check out our section titled Cryptocurrency Explained and for info about the latest crypto-scams, visit our section titled Scam Report.

Email Us:cryptocurrencyarmy@gmail.com

Visit link:
Homepage - Cryptocurrency Army

Read More..

Cryptocurrency – Simple English Wikipedia, the free …

A cryptocurrency is a medium of exchange, that is designed to work like a currency. Usually, cryptocurrencies use features found in strong cryptography, such as digital signatures to secure financial transactions, control the creation of additional units, and verify the transfer of assets.[1][2][3] The first of them were created to be independent of a government-issued currency.

Cryptocurrencies use decentralized control[4] as opposed to centralized electronic money and central banking systems.[5] The decentralized control of each cryptocurrency works through distributed ledger technology, typically a blockchain [6], that serves as a public financial transaction database.[7][8]Bitcoin, first released as open-source software in 2009, is generally considered the first decentralized cryptocurrency.[9] Since then, over 4,000 altcoin (alternative coin) variants of bitcoin have been created.

In many cases, cryptocurrencies cannot be converted to real currencies; it is only possible to convert them to other cryptocurrencies, or to use them to buy things. Some cryptocurrencies can be converted to real currrencies: They usually have a high volatility, and using them carries a high risk.[10] They are also a target for so-called Pump-and-Dump-Attacks.[11] They act like a big distributed economic system: As they are not issued or controlled by central banks, their value is difficult to influence: For this reason, they cannot really take the place of a stable currency.[12]

Cryptocurrencies are prone to speculation, which makes buliding a system of more or less stable exchange rates very difficult.[13] Another problem is the inequality of distribution: Many cryptocurrencires are held by only few people. As an example: about 1.000 people hold half of the total amount of bitcoins in the world. This means that if any of these persons starts using their cryptocurrency, this has an effect on the exchange rate. It also means that these people have a great influence on the value of the currency, and are able to change its value easily.[14] The currency itself only documents ownership changes. Exchange rates of cryptocurrencies are established outside the system. Exchange rates are issued by brokers and traders; their indication is no guarantee that the currency is traded at the value proposed. In itself, the unit of cryptocurrency has no value.

In contrast to cyptocurrencies, real currencies are issued and controlled by central banks. Certain econnomic phenomena such as inflation or deflation may change the value (and exchange rate) of a currency. The people who own units of the currency have no direct influence on its value.

According to Jan Lansky, a cryptocurrency is a system that meets six conditions:[15]

In March 2018, the word "cryptocurrency" was added to the Merriam-Webster Dictionary.[16]

More here:
Cryptocurrency - Simple English Wikipedia, the free ...

Read More..

How To Create Your Own Cryptocurrency – fastcompany.com

When you look at the complexities that go into making a physical dollar bill its plain to see why most people dont start trying to print a new form of currency every day, but making a new digital currency is surprisingly easy for someone with even basic coding skills. But coding isnt the only step to getting your digital currency off the ground. Here are the five steps you should follow according to the makers of three cryptocurrencies.

When you think about creating a new digital currency its easy to assume the first step would be to begin coding your coin, but thats the wrong place to start, according to Chris Ellis, a London entrepreneur and a community activist at Feathercoin.

The first step is to find a community and build a currency around them rather than building a currency and expecting everyone to show up, Ellis says. It has to be sensitive to their needs and be relevant to their cultural heritage and background.

Feathercoin was created by Peter Bushnell in April 2013. Bushnell left his job as head of IT at Oxford Universitys Brasenose College because he wanted to start his own currency that put people at the center. This was in response to what he saw as a lack of community involvement and inclusiveness by the existing cryptocurrencies, such as Bitcoin, on the popular cryptocurrency site bitcointalk.org.

Though he had not met Bushnell at the time, Ellis, who had been actively promoting and educating people on cryptocurrencies since last March, shared the sense of alienation and seclusion found on Bitcoin forums.

These forums were very tech focused and not very welcoming to newcomers or minority groups which are often served better by smaller teams, Ellis says. The forums did not make it easy for people to get involved in the development of the coin. Many people on these forums take a backseat and speculate on the price rather than actively getting involved.

Ellis found the cryptocurrency community activism he was looking for in Feathercoin, whose technical development he says benefits greatly from its community activism approach.

For Feathercoin we were a group of crypto enthusiasts, some of whom were new to the scene but who felt shut out from the rest of the space, Ellis says. Everyone at Feathercoin feels its important to demonstrate how a devoted group of people can establish a stable currency, he says. By working together a community of dedicated crypto enthusiasts are much better able to find and address vulnerabilities and security threats, like the 51% attack, which the community of coders at Feathercoin have successfully built protections against.

Building such protections and nurturing the development of your currency give your coin legitimacy and trust in the eyes of the public, something that is hard to do if those involved in the currency are passive spectators looking out for their own interests.

Surprisingly, every single currency developer I spoke with said the same thing: Coding your cryptocurrency is usually the least time-intensive part of the process. Thats because virtually every cryptocurrency on the market today is based on the open source code of Bitcoin or Litecoin that is available on GitHub.

The creation itself does not take long. It is maybe only a day, says Peter Otterbach, one of the creators of Coino, which bills itself as the fastest cryptocurrency on the market with a maximum transaction time of only 50 seconds. To start coding you just need to know about C++ to build your own features in it.

The length of time could be a little longer than a day, however, according to Kolin Evans, developer of the Quark cryptocurrency. In coding the most complex steps may be related to how complex you plan to have the individual parameters of the blockchain, Evans says. For example, many currencies just use the Litecoin code and copy it, but with Quark there was a whole new Hash algorithmthat is to say, its separate from both Bitcoin and Litecoinso this aspect if you were to change it would certainly be the most difficult. And time consuming. In this case coding a cryptocurrency could take months. However, Evans notes that if a developer is just reusing code from GitHub and changing some simple parameters, thats something a competent coder could do in literally 30 minutes.

But just because anyone with some C++ skills can make their own cryptocurrency doesnt mean that there will be as many currencies as, say, iOS apps one day. Feathercoin is in fact a fork of Litecoin, says Ellis. It began with the minimum number of parameter changes because we felt the most important feature of a currency was survivability.

However, the Feathcoin team noticed that a few of the currencies that came before didnt last very long because they included a novel feature set which would gain short-term speculative hype but then the team often werent able to follow through on the stewardship of the project longer term and the project would fail. In other words, the developers of those coins that failed probably wanted to make some cheddar on some quick coin creation and didnt want to work at developing the currency for the long runsomething which doomed them from the start.

You have a duty of care at the development end in terms of bug fixing and ensuring the promise made at launch but you also have a duty to educate people of the risks and give them what they need to secure their wealth, Ellis says. If you cant do that, no one is going to stick around to use your coin, and the mining of it will drop off as quickly as downloads did of the first Doodle Jump knockoffs.

Once youve developed your coin you need to spread the word so people start mining it, which raises awareness of its existence and hopefully begins to gain some value in the eyes of its miners and users. This is where makers of cryptocurrencies need to stop thinking like coders and instead look into how human beings put trust (and value) in things.

A good start is half the way there and so this involves building trust, expressing your vision and intentions to miners, who have the hardware you need, and getting them on board with the opportunity ahead, Feathercoins Ellis explains. You have to be honest and respect peoples expectations and their tolerance of risk, which many people overestimate.

Overselling your coin will backfire. Including novel feature sets just to try and stand out will not work either. The market is there to test your grit and determination. You need a group of loyal miners committed to the cause who will process your payments even during slumps in price because they believe in the eventual outcome. Its about good communication and team building.

Many coins have failed because they undervalue the soft stuff. They think that throwing technology at a problem will make it disappear. Central banks think throwing money at problems does the same; the world has never worked this way. You have to be good at knowing what work needs to be done and be prepared to do the jobs nobody else wants to do.

Lets says youve made it this far. Youve conceptualized a good cryptocurrency and brought the right team together to code and nurture it along its way. Youve spread the news around the cryptocurrency forums and theres a healthy dose of miners actively working to grow your currency. The next step is marketing your currency so all the people mining it have a place to spend it. This is no small feat. After all, you need to convince individuals and merchants that these digital bits youve created hold value and can be traded for things, just like traditional, trusted money.

Its a process of confidence building, Ellis says. It takes good stewardship and time to work out what you really believe and stand for. People will buy in to your motives more than your actions, so once you feel confident you then have to start talking about your currency to friends, merchants, on Internet forums and on social media.

The people behind Coino agree. To start the marketing you need to find the exact target group, Peter Otterbach says. At first you can just start at the cryptocurrency market itself because the people there know about coins and you see the first reactions. After that it gets more difficult. You need to convince people who mostly dont even know what a cryptocurrency is, so you have to get the currency accepted as a payment solution in online shops to get their attention.

I would add its not just about educating them with facts, Ellis notes, its about inspiring them to learn and discover the advantages for themselves. Money is a ledger, it is a tool that people will use as a way of achieving their goals and satisfying their needs. Understanding that will take you a long way in your marketing efforts.

Ellis says that merchant adoption is similar to miner adoption, its just a matter of understanding their different outlooks. Different stakeholder, same rules. The difference is that miners have a speculative sentiment and merchants are conservative. He notes that merchants have three principal aims: to make money, to save money, and to increase their awareness. If you can bring them customers and increase their sales while reducing their payment fees, the rest is a matter of persistence and making it as easy as possible to get them started.

The last step in your cryptocurrency journey is, according to pundits and conventional wisdom, world domination by your coin. But given that in over 5,000 years no single currency has dominated the globe, its very unlikelyno matter what Silicon Valley Bitcoin enthusiasts saythat any one cryptocurrency ever will.

Besides, global cryptocurrency domination doesnt have to be the goal, Ellis says. Currencies can be local, indeed we think of Feathercoin as a local currency that can serve a global market.

And therein may lie the true market for the burgeoning field of cryptocurrency: hyper-local currencies for certain neighborhoods, cities, events, venues, and groups of people that are built around a community of like-minded consumers allowing them to trade freely, quickly, and securely for goods and services that are important in their lives instead of having to rely on the central banks and larger markets to tell them what arbitrary item, be it a copper coin or a plastic dollar, holds value.

Indeed, in a market where cryptocurrency use is defined by neighborhood boundaries or group memberships there is no need for any one cryptocurrency to win. Theres room for them allexcept maybe the ones with memes.

Read this article:
How To Create Your Own Cryptocurrency - fastcompany.com

Read More..

Using Encryption and Authentication Correctly (for PHP …

"Encryption is not authentication" is common wisdom among cryptography experts, but it is only rarely whispered among developers whom aren't also cryptography experts. This is unfortunate; a lot of design mistakes could be avoided if this information were more widely known and deeply understood. (These mistakes are painfully common in home-grown PHP cryptography classes and functions, as many of the posts on Crypto Fails demonstrates.)

The concept itself is not difficult, but there is a rich supply of detail and nuance to be found beneath the surface.

Encryption is the process of rendering a message such that it becomes unreadable without possessing the correct key. In the simple case of symmetric cryptography, the same key is used for encryption as is used for decryption. In asymmetric cryptography, it is possible to encrypt a message with a user's public key such that only possessing their private key can read it. Our white paper on PHP cryptography covers anonymous public-key encryption.

Authentication is the process of rendering a message tamper-resistant (typically within a certain very low probability, typically less than 1 divided by the number of particles in the known universe) while also proving it originated from the expected sender.

Note: When we say authenticity, we mean specifically message authenticity, not identity authenticity. That is a PKI and key management problem, which we may address in a future blog post.

In respect to the CIA triad: Encryption provides confidentiality. Authentication provides integrity.

Encryption does not provide integrity; a tampered message can (usually) still decrypt, but the result will usually be garbage. Encryption alone also does not inhibit malicious third parties from sending encrypted messages.

Authentication does not provide confidentiality; it is possible to provide tamper-resistance to a plaintext message.

A common mistake among programmers is to confuse the two. It is not uncommon to find a PHP library or framework that encrypts cookie data and then trusts it wholesale after merely decrypting it.

Message encryption without message authentication is a bad idea. Cryptography expert Moxie Marlinspike wrote about why message authentication matters (as well as the correct order of operations) in what he dubbed, The Cryptographic Doom Principle.

We previously defined encryption and specified that it provides confidentiality but not integrity or authenticity. You can tamper with an encrypted message and give the recipient garbage. But what if you could use this garbage-generating mechanism to bypass a security control? Consider the case of encrypted cookies.

The above code provides AES encryption in Cipher-Block-Chaining mode. If you pass a 32-byte string for $key, you can even claim to provide 256-bit AES encryption for your cookies and people might be misled into believing it's secure.

Let's say that, after logging into this application, you see that you receive a session cookie that looks like kHv9PAlStPZaZJHIYXzyCnuAhWdRRK7H0cNVUCwzCZ4M8fxH79xIIIbznxmiOxGQ7td8LwTzHFgwBmbqWuB+sQ==.

Let's change a byte in the first block (the initialization vector) and iteratively sending our new cookie until something changes. It should take a total of 4096 HTTP requests to attempt all possible one-byte changes to the IV. In our example above, after 2405 requests, we get a string that looks like this: kHv9PAlStPZaZZHIYXzyCnuAhWdRRK7H0cNVUCwzCZ4M8fxH79xIIIbznxmiOxGQ7td8LwTzHFgwBmbqWuB+sQ==

For comparison, only one character differs in the base64-encoded cookie (kHv9PAlStPZaZJ vs kHv9PAlStPZaZZ):

The original data we stored in this cookie was an array that looked like this:

But after merely altering a single byte in the initialization vector, we were able to rewrite our message to read:

Depending on how the underlying app is set up, you might be able to flip one bit and become and administrator. Even though your cookies are encrypted.

If you would like to reproduce our results, our encryption key was 000102030405060708090a0b0c0d0e0f (convert from hexadecimal to raw binary).

As stated above, authentication aims to provide both integrity (by which we mean significant tamper-resistance) to a message, while proving that it came from the expected source (authenticity). The typical way this is done is to calculate a keyed-Hash Message Authentication Code (HMAC for short) for the message and concatenate it with the message.

It is important that an appropriate cryptographic tool such as HMAC is used here and not just a simple hash function.

These two functions are prefixed with unsafe because they are vulnerable to a number of flaws:

To authenticate a message, you always want some sort of keyed Message Authentication Code rather than just a hash with a key.

Using a hash without a key is even worse. While a hash function can provide simple message integrity, any attacker can calculate a simple checksum or non-keyed hash of their forged message. Well-designed MACs require the attacker to know the authentication key to forge a message.

Simple integrity without authenticity (e.g. a checksum or a simple unkeyed hash) is insufficient for providing secure communications.

In cryptography, if a message is not authenticated, it offers no integrity guarantees either. Message Authentication gives you Message Integrity for free.

The only surefire way to prevent bit-rewriting attacks is to make sure that, after encrypting your information, you authenticate the encrypted message. This detail is very important! Encrypt then authenticate. Verify before decryption.

Let's revisit our encrypted cookie example, but make it a little safer. Let's also switch to CTR mode, in accordance with industry recommended best practices. Note that the encryption key and authentication key are different.

Now we're a little closer to our goal of robust symmetric authenticated encryption. There are still a few more questions left to answer, such as:

Fortunately, these questions are already answered in existing cryptography libraries. We highly recommend using an existing library instead of writing your own encryption features. For PHP developers, you should use defuse/php-encryption (or libsodium if it's available for you). If you still believe you should write your own, consider using openssl, not mcrypt.

Note: There is a narrow band of use-cases where authenticated encryption is either impractical (e.g. software-driven full disk encryption) or unnecessary (i.e. the data is never sent over the network, even by folder synchronization services such as Dropbox). If you suspect your problems or goals permit unauthenticated ciphertext, consult a professional cryptographer, because this is not a typical use-case.

If you wish to implement encrypted cookies in one of your projects, check out Halite. It has a cookie class dedicated to this use case.

If you want to reinvent this wheel yourself, you can always do something like this:

For developers without access to libsodium (i.e. you aren't allowed to install PHP extensions through PECL in production), one of our blog readers offered an example secure cookie implementation that uses defuse/php-encryption (the PHP library we recommend).

In our previous examples, we focused on building the encryption and authentication as separate components that must be used with care to avoid cryptographic doom. Specifically, we focused on AES in Cipher Block-Chaining mode (and more recently in Counter mode).

However, cryptographers have developed newer, more resilient modes of encryption that encrypt and authenticate a message in the same operation. These modes are called AEAD modes (Authenticated Encryption with Associated Data). Associated Data means whatever your application needs to authenticate, but not to encrypt.

AEAD modes are typically intended for stateful purposes, e.g. network communications where a nonce can be managed easily.

Two reliable implementations of AEAD are AES-GCM and ChaCha20-Poly1305.

In a few years, we anticipate the CAESAR competition will produce a next-generation authenticated encryption mode that we can recommend over these two.

And most importantly: Use a library with a proven record of resilience under the scrutiny of cryptography experts rather than hacking something together on your own. You'll be much better off for it.

Read the original here:
Using Encryption and Authentication Correctly (for PHP ...

Read More..

Africa Dominates P2P Bitcoin Exchange Paxful With $64 Million …

Paxful Inc., a peer-to-peer bitcoin exchange, is seeing significant growth in Africa. The U.S.-based company said Africans now accounted for the largest number of people buying and selling cryptocurrency on its platform, with average monthly transactions totaling $64.5 million.

Also Read:Brazilian Banks Ordered to Reopen Cryptocurrency Exchanges Frozen Accounts

Over the past year, users from the African continent of 1.2 billion people soared by 225 percent, Ray Youssef, chief executive officer of Paxful, told South African media. Transactions on the exchange climbed 60 percent in Nigeria, Africas biggest economy, 25 percent in South Africa, the continents most sophisticated economy, and by up to 100 percent in other parts of Africa.

The adoption of bitcoin across the globe re-affirms our belief that crypto will take its place as a mainstream financial system, Youssef was quoted as saying. As has been the case with other disruptive financial tech innovations like mobile money, Africa is leading the peer-to-peer financial revolution.

Each month, more people from Africa are opening new accounts with Paxful than from any other region of the world, he explained. The surge illustrates how Africas swelling population of millennials is quickly taking to cryptocurrencies, not only to circumvent the system (dominated by monopolistic institutions such as legacy banks and the state), but also to hedge against inflation and fiat currency volatility while enjoying lower transaction costs. On average, Africas young people spend $59 each on BTC via Paxful, Youssef said.

However, the increase in adoption is in sharp contrast to the often heavy-handedness with which some African governments have responded to digital assets. This is despite the continent being a region where virtual currency is viewed by many as key to mainstreaming the 350 million unbanked adults. Zimbabwe, Zambia, Namibia and Mozambique have all banned cryptocurrency, while Kenya, Nigeria, Senegal, Uganda and South Africa have adopted a somewhat pragmatic approach.

Other datafrom peer-to-peer exchange Localbitcoins reveals that Russia dominates bitcoin trading with over a quarter of all the platforms volume, followed by Venezuela at 12.2 percent and the U.S. at 11.8 percent. African countries trail, with transactions originating from Nigeria accounting for 7.6 percent of total volume, South Africa 1.3 percent and Kenya at 0.7 percent.

Artur Schaback, chief operating officer of Paxful, said African consumers tend to use cryptocurrency to buy goods, mostly from overseas, as well as investments in promising blockchain startups.

As a company, weve learned a lot from African consumers. For instance, weve improved our mobile capabilities to cater to the widespread use of smartphones on the continent. Our experience in Africa has strengthened our capability to serve consumers regardless of geographical location or origin, he explained.

What do you think about cryptocurrency adoption in Africa? Let us know in the comments section below.

Images courtesy of Shutterstock.

Verify and track bitcoin cash transactions on ourBCH Block Explorer, the best of its kind anywhere in the world. Also, keep up with your holdings, BCH and other coins, on our market charts atSatoshis Pulse, another original and free service from Bitcoin.com.

The rest is here:
Africa Dominates P2P Bitcoin Exchange Paxful With $64 Million ...

Read More..