Archive

Category Archives for "Networking"

Missing good old ‘wr’ command on N9K? let’s bring it back!

Doing a lot on Nexus 9000 series datacenter boxes (N9K) lately? Sure you’re missing the good old ‘wr’ command to save your last startup-config into running-config. NXOS architecture guys decided that you should be really well concentrated when deciding to save your nice new configuration to survive device reboot and type: N9K_1(config)# copy running-config startup-config. Just typing ‘wr’ into the console would be too nice right? Let’s use the alias configuration and bring that command back to the box. N9K_1(config)# copy running-config startup-config 100% Copy complete, now saving to disk (please wait)... Copy complete. N9K_1(config)# If you try ‘wr’:

The post Missing good old ‘wr’ command on N9K? let’s bring it back! appeared first on How Does Internet Work.

Calico Cloud: What’s new in October

Calico Cloud is an industry-first security and observability SaaS platform for Kubernetes, containers, and cloud. Since its launch, we have seen customers use Calico Cloud to address a range of security and observability problems for regulatory and compliance requirements in a matter of days and weeks. In addition, they only paid for the services used, instead of an upfront investment commitment, thus aligning their budgets with their business needs.

New in October

We are excited to announce recent Calico Cloud enhancements. Highlights include:

  • Managing your security and observability shouldn’t require you to manage a separate credential, authentication, and authorization access workflow. With Calico Cloud, you can bring your identity provider to manage user access to your security and observability platform. Simple sign in now requires login with the same credentials aligned to organizational roles. User management is simplified by leveraging in-house knowledge of identity management for many popular platforms. Calico Cloud supports Microsoft Azure Active Directory, Google IDP, and Open ID.
  • Pre-built use case workflows are available in Calico Cloud for workload access control and enterprise security and controls. After signup:
    • Users can start monitoring and observing their application and microservices communication to external resources within minutes.
    • Users can prevent Continue reading

How to Protect Your Cell Phone from Malicious Wi-Fi

One of the most common vulnerabilities that many people face is the malicious Wi-Fi, which can be accessed without entering a password. Wi-Fi networks with no password are especially prone to cyber-attacks and data theft. A malicious Wi-Fi hotspot can be a nightmare for your cell phone. These hotspots are often used by hackers to intercept data exchanged between your phone and the internet.

Update Your OS and apps

It is important to update your operating system because it can make you vulnerable to threats and attacks. The OS will have all the latest updates that are released, so updating your OS will keep it secure in many ways. Some of the ways updating your OS keeps you safe are by having a better built-in firewall and antivirus software. Updating your OS is also important because it can improve the performance of your computer.

Avoid Public Wi-Fi

Public Wi-Fi is not secure and can lead to serious consequences. Public Wi-Fi networks are often unsecured. Unsecured networks can give cybercriminals access to your device and your personal data. If you use public Wi-Fi then you may be putting yourself at risk for identity theft because hackers can access your personal information Continue reading

Flexible Automation For A Complex Enterprise: Gluware LiveStream Video [4/8]

Angelo Rossi, GNS LAN-WAN Architect at WSP joins Drew Conry-Murray of the Packet Pushers to explain how WSP automated their brownfield network with Gluware. If Gluware might be a fit for your network automation needs, visit here. Thanks! You can subscribe to the Packet Pushers’ YouTube channel for more videos as they are published. It’s […]

The post Flexible Automation For A Complex Enterprise: Gluware LiveStream Video [4/8] appeared first on Packet Pushers.

Privacy-Preserving Compromised Credential Checking

Privacy-Preserving Compromised Credential Checking
Privacy-Preserving Compromised Credential Checking

Today we’re announcing a public demo and an open-sourced Go implementation of a next-generation, privacy-preserving compromised credential checking protocol called MIGP (“Might I Get Pwned”, a nod to Troy Hunt’s “Have I Been Pwned”). Compromised credential checking services are used to alert users when their credentials might have been exposed in data breaches. Critically, the ‘privacy-preserving’ property of the MIGP protocol means that clients can check for leaked credentials without leaking any information to the service about the queried password, and only a small amount of information about the queried username. Thus, not only can the service inform you when one of your usernames and passwords may have become compromised, but it does so without exposing any unnecessary information, keeping credential checking from becoming a vulnerability itself. The ‘next-generation’ property comes from the fact that MIGP advances upon the current state of the art in credential checking services by allowing clients to not only check if their exact password is present in a data breach, but to check if similar passwords have been exposed as well.

For example, suppose your password last year was amazon20\$, and you change your password each year (so your current password is amazon21\$). Continue reading

Unbuckling the narrow waist of IP: Addressing Agility for Names and Web Services

Unbuckling the narrow waist of IP: Addressing Agility for Names and Web Services
Unbuckling the narrow waist of IP: Addressing Agility for Names and Web Services

At large operational scales, IP addressing stifles innovation in network- and web-oriented services. For every architectural change, and certainly when starting to design new systems, the first set of questions we are forced to ask are:

  • Which block of IP addresses do or can we use?
  • Do we have enough in IPv4? If not, where or how can we get them?
  • How do we use IPv6 addresses, and does this affect other uses of IPv6?
  • Oh, and what careful plan, checks, time, and people do we need for migration?

Having to stop and worry about IP addresses costs time, money, resources. This may sound surprising, given the visionary and resilient advent of IP, 40+ years ago. By their very design, IP addresses should be the last thing that any network has to think about. However, if the Internet has laid anything bare, it’s that small or seemingly unimportant weaknesses — often invisible or impossible to see at design time — always show up at sufficient scale.

One thing we do know: “more addresses” should never be the answer. In IPv4 that type of thinking only contributes to their scarcity, driving up further their market prices. IPv6 is absolutely necessary, Continue reading

Research Directions in Password Security

Research Directions in Password Security
Research Directions in Password Security

As Internet users, we all deal with passwords every day. With so many different services, each with their own login systems, we have to somehow keep track of the credentials we use with each of these services. This situation leads some users to delegate credential storage to password managers like LastPass or a browser-based password manager, but this is far from universal. Instead, many people still rely on old-fashioned human memory, which has its limitations — leading to reused passwords and to security problems. This blog post discusses how Cloudflare Research is exploring how to minimize password exposure and thwart password attacks.

The Problem of Password Reuse

Because it’s too difficult to remember many distinct passwords, people often reuse them across different online services. When breached password datasets are leaked online, attackers can take advantage of these to conduct “credential stuffing attacks”. In a credential stuffing attack, an attacker tests breached credentials against multiple online login systems in an attempt to hijack user accounts. These attacks are highly effective because users tend to reuse the same credentials across different websites, and they have quickly become one of the most prevalent types of online guessing attacks. Automated attacks can be run Continue reading

Hedge 104: Automation with David Gee

Automation is often put forward as the answer to all our problems—but without a map, how can we be certain we are moving in the right direction? David Gee joins Tom Ammon and Russ White on this episode of the Hedge to talk about automata without a map. Where did we come from, what are we doing with automation right now, and what do we need to do to map out a truly better future?

download

Marvell announces some very smart SmartNIC processors

Marvell has begun to sample the Octeon 10, a server microprocessor aimed at intelligent network management that has up to 24 Arm-compatible cores, making it as powerful as any server processor.Marvell refers to the Octeon processor line as data processing units (DPUs). They are designed to run high-throughput data in the cloud and on-premises. The DPU is more commonly called the SmartNIC because it can offload non-computational tasks from the CPU like network packet processing, data encryption and compression. That frees up CPU cores to run general-purpose applications.The Octeon 10 has a few firsts. It's the first processor made by TSMCs 5nm manufacturing process and the first processor to feature Arm’s Neoverse N2 core. The N2 core uses the new Armv9 architecture that the company claims can deliver 40% more single-threaded performance for a variety of workloads vs. the N1, but still retains the same level of power and area efficiency as N1.To read this article in full, please click here

Day Two Cloud 119: Unifying Multi-Cloud Security With Valtix (Sponsored)

Ethan Banks & Ned Bellavance have a tech discussion with CEO Doug Murray and CTO Vishal Jain about multi-cloud security startup Valtix. Along the way, we find out that Valtix is a cloud-delivered security control-plane paired with a data-plane of enforcement points (sort of firewalls, but not exactly) delivered between any two points in the cloud you need them. Engineers should walk away from this chat with a solid idea of Valtix architecture and how it fits into their cloud design.

The post Day Two Cloud 119: Unifying Multi-Cloud Security With Valtix (Sponsored) appeared first on Packet Pushers.

Day Two Cloud 119: Unifying Multi-Cloud Security With Valtix (Sponsored)

Ethan Banks & Ned Bellavance have a tech discussion with CEO Doug Murray and CTO Vishal Jain about multi-cloud security startup Valtix. Along the way, we find out that Valtix is a cloud-delivered security control-plane paired with a data-plane of enforcement points (sort of firewalls, but not exactly) delivered between any two points in the cloud you need them. Engineers should walk away from this chat with a solid idea of Valtix architecture and how it fits into their cloud design.

Cloudflare and the IETF

Cloudflare and the IETF
Cloudflare and the IETF

The Internet, far from being just a series of tubes, is a huge, incredibly complex, decentralized system. Every action and interaction in the system is enabled by a complicated mass of protocols woven together to accomplish their task, each handing off to the next like trapeze artists high above a virtual circus ring. Stop to think about details, and it is a marvel.

Consider one of the simplest tasks enabled by the Internet: Sending a message from sender to receiver.

Cloudflare and the IETF

The location (address) of a receiver is discovered using DNS, a connection between sender and receiver is established using a transport protocol like TCP, and (hopefully!) secured with a protocol like TLS. The sender's message is encoded in a format that the receiver can recognize and parse, like HTTP, because the two disparate parties need a common language to communicate. Then, ultimately, the message is sent and carried in an IP datagram that is forwarded from sender to receiver based on routes established with BGP.

Cloudflare and the IETF

Even an explanation this dense is laughably oversimplified. For example, the four protocols listed are just the start, and ignore many others with acronyms of their own. The truth is that things are complicated. Continue reading

Pairings in CIRCL

Pairings in CIRCL
Pairings in CIRCL

In 2019, we announced the release of CIRCL, an open-source cryptographic library written in Go that provides optimized implementations of several primitives for key exchange and digital signatures. We are pleased to announce a major update of our library: we have included more packages for elliptic curve-based cryptography (ECC), pairing-based cryptography, and quantum-resistant algorithms.

All of these packages are the foundation of work we’re doing on bringing the benefits of cutting edge research to Cloudflare. In the past we’ve experimented with post-quantum algorithms, used pairings to keep keys safe around the world, and implemented advanced elliptic curves. Now we’re continuing that work, and sharing the foundation with everyone.

In this blog post we’re going to focus on pairing-based cryptography and give you a brief overview of some properties that make this topic so pleasant. If you are not so familiar with elliptic curves, we recommend this primer on ECC.

Otherwise, let’s get ready, pairings have arrived!

What are pairings?

Elliptic curve cryptography enables an efficient instantiation of several cryptographic applications: public-key encryption, signatures, zero-knowledge proofs, and many other more exotic applications like oblivious transfer and OPRFs. With all of those applications you might wonder what is Continue reading

Exported Authenticators: The long road to RFC

Exported Authenticators: The long road to RFC
Exported Authenticators: The long road to RFC

Our earlier blog post talked in general terms about how we work with the IETF. In this post we’re going to talk about a particular IETF project we’ve been working on, Exported Authenticators (EAs). Exported Authenticators is a new extension to TLS that we think will prove really exciting. It unlocks all sorts of fancy new authentication possibilities, from TLS connections with multiple certificates attached, to logging in to a website without ever revealing your password.

Now, you might have thought that given the innumerable hours that went into the design of TLS 1.3 that it couldn’t possibly be improved, but it turns out that there are a number of places where the design falls a little short. TLS allows us to establish a secure connection between a client and a server. The TLS connection presents a certificate to the browser, which proves the server is authorised to use the name written on the certificate, for example blog.cloudflare.com. One of the most common things we use that ability for is delivering webpages. In fact, if you’re reading this, your browser has already done this for you. The Cloudflare Blog is delivered over TLS, and by presenting a Continue reading