Category: Uncategorised

(credit: Rainer Ebert)

The Dutch government has released a statement in which it says that "it is currently not desirable to take restricting legal measures concerning the development, availability and use of encryption within the Netherlands." It also notes that forcing companies to add backdoors to their products and services would have "undesirable consequences for the security of communicated and stored information," since "digital systems can become vulnerable to criminals, terrorists and foreign intelligence services."

The Dutch government's declaration, translated by Matthijs R. Koot, looks at both sides of encryption—the benefits it provides by allowing sensitive information to be protected, and the issues it raises for the police and security services. It recognises that crypto "enables everyone to ensure the confidentiality and integrity of communication, and defend against, for instance, espionage and cyber crime. Fundamental rights and freedoms as well as security interests and economic interests benefit from this."

But it also acknowledges that the use of encryption by criminals "complicates, delays, or makes it impossible to gain (timely) insight in communication for the purpose of protecting national security and the purpose of prosecuting criminal offenses. Furthermore, court hearings and the providing of evidence in court for a conviction can be severely hindered."

An actual product you can buy... or at least pre-order. (credit: Oculus Shop)

[Update: More details on ship date, Oculus Ready PCs, and exclusive games are now in the below story]

After dozens of trade-show demos, two publicly available development kits, a $2 billion buyout, and nearly four years of speculation, Oculus has finally locked down the release details for the first consumer version of the Rift virtual reality headset. The $599 VR unit is now available for preorder ahead of expected shipments starting in March (though the shop page had some major loading problems right after pre-orders went live). Oculus says the headset will be available at "limited retail locations" starting in April.

That price will get users the headset, a head-tracking camera, an Xbox One controller, the media-focused "Oculus remote," connection cables, a carrying case, and two included games: space shooter Eve Valkyrie and third-person platform game Lucky's Tale. It does not include tax, roughly $30 in shipping, or the promising Oculus Touch hand-tracking controllers, which were recently delayed to the second half of 2016. Oculus founder Palmer Luckey tweeted yesterday that those who preorder the Rift would also be first in line to preorder the Touch controllers later in the year.

(credit: Gerald Lau/Flickr)

A plague of drug violence in Mexico stands to undo gains in life expectancy from the last century, according to new research published in Health Affairs.

Life expectancy crept upward during most of the 20^th century, largely thanks to improved access to health care and quality of life. But from 2005 to 2010, the trend reversed for men and slowed for women as the number of homicides spiked.

In that time frame, the country’s homicide rate more than doubled, from 9.5 deaths in 100,000 people during 2005 to 22 in 100,000 by 2010. That cropped life expectancy of men in all 31 Mexican states and the Federal District. Across the country, average life spans dropped from 72.5 years to about 72 years in the time frame. But areas more hard-hit by drug violence saw larger drops in life expectancy. In the northern states of Chihuahua, Sinaloa, and Durango, for instance, life expectancy fell by up to three years. For women country-wide, the upward trend in life expectancy merely slowed from 2005 to 2010. But drug violence in the northern states stunted life expectancy for women by several months.

(credit: US DOE)

Coal-fired plants and other human activities release mercury into the environment, where some of it ends up converted into methyl mercury, a potent neurotoxin. Because of this toxicity, the Environmental Protection Agency is currently in the process of tightening emissions rules at US power plants.

Global estimates of how much mercury we're emitting indicates that humanity is putting more of the substance into the atmosphere. But various direct measurements of the amount in the environment have been declining slowly over the past few decades. So where's the missing mercury? A new study suggests that we've cleaned it up while getting different pollutants under control.

Mercury emissions actually come in two forms. Some of it is released as neutral atoms, which are able to circulate widely in the atmosphere before being oxidized and falling to the surface. Another portion of the emissions are already oxidized and result in local contamination.

Enlarge (credit: US Navy)

If you thought MD5 was banished from HTTPS encryption, you'd be wrong. It turns out the fatally weak cryptographic hash function, along with its only slightly stronger SHA1 cousin, are still widely used in the transport layer security protocol that underpins HTTPS. Now, researchers have devised a series of attacks that exploit the weaknesses to break or degrade key protections provided not only by HTTPS but also other encryption protocols, including Internet Protocol Security and secure shell.

The attacks have been dubbed SLOTH—short for security losses from obsolete and truncated transcript hashes. The name is also a not-so-subtle rebuke of the collective laziness of the community that maintains crucial security regimens forming a cornerstone of Internet security. And if the criticism seems harsh, consider this: MD5-based signatures weren't introduced in TLS until version 1.2, which was released in 2008. That was the same year researchers exploited cryptographic weaknesses in MD5 that allowed them to spoof valid HTTPS certificates for any domain they wanted. Although SHA1 is considerably more resistant to so-called cryptographic collision attacks, it too is considered to be at least theoretically broken. (MD5 signatures were subsequently banned in TLS certificates but not other key aspects of the protocol.)

"Notably, we have found a number of unsafe uses of MD5 in various Internet protocols, yielding exploitable chosen-prefix and generic collision attacks," the researchers wrote in a technical paper scheduled to be discussed Wednesday at the Real World Cryptography Conference 2016 in Stanford, California. "We also found several unsafe uses of SHA1 that will become dangerous when more efficient collision-finding algorithms for SHA1 are discovered."