New HTTP Shaming blog

Initially, I wasn't very impressed, but the new HTTP Shaming site is pretty impressive.

An unencrypted Terminal server?  Key server?  password service !?! 

Wow.  Get with the times, people.

P

Tor Servers crackable, according to ARS

Majority of Tor crypto keys could be broken, researcher says

 Rob Graham, CEO of penetration testing firm Errata Security, arrived at that conclusion by running his own "hostile" exit node on Tor and surveying the encryption algorithms established by incoming connections. About 76 percent of the 22,920 connections he polled used some form of 1024-bit Diffie-Hellman key.

...

He went on to cite official Tor statistics to observe that only 10 percent of Tor servers are using version 2.4 of the software. That's the only Tor release that implements elliptical curve Diffie-Hellman crypto, which cryptographers believe is much harder to break. The remaining versions use keys that are presumed to be weaker.

md5crypt() no longer suitable for production use?

A 25-GPU clustered password-cracking computer has passed a new threshold in brute-force guessing, apparently making weaker password algorithms (like LM and NTLM) obsolete.  This has prompted Poul-Henning Kamp, creator of md5crypt() to state that it's not suitable for production use.

What does this mean?  Unfortunately I don't know, but will keep my eyes out.

Perry