# data[].attributes.body
Biometric Face Recognition for ID System

# data[].attributes.attachment_link.readable_text
NEW DELHI: Aadhaar will now allow face recognition along with biometrics as a means of authentication of users, a move intended to offer major relief to older people whose fingerprints and irises are unclear.

The decision comes less than a week after the Unique Identification Authority of India ( UIDAI) sought to address privacy concerns by offering the option of creating virtual IDs that mask the actual unique identification number of an individual during an UID-authenticated transaction and just ahead of the Supreme Court hearing the challenge to the use of the Aadhaar system.

To be made available by July 1, the face authentication option will be allowed in combination with fingerprints, or iris scans, or an OTP to verify the details of Aadhaar users and is expected to go a long way in dealing with problems faced by older users with blurred biometrics. Interestingly, the authentication will require some facial movement, like blinking or smiling, to ensure live presence of the user.

Face authentication will not require any new reference data as photos of citizens are already on the Aadhaar database. The objective is to increase the inclusiveness of the system so that genuine beneficiaries of government benefits, like pensioners, are not denied their dues.

"This is a landmark development which will go a long way in helping people in authentication in a secured manner, particularly whose fingerprints have worn out because of old age or manual work," UIDAI CEO Ajay Bhusan Pandey told TOI. He said the "liveness" detection feature would provide additional security.

The new method will also be allowed "on need basis" for those who face problems in carrying out Aadhaar-related transactions. A recent Niti Aayog commissioned report had found that farmers found fingerprinting a problem while accessing fertiliser subsidies under the Aadhaar authenticated system.

A UIDAI statement said face authentication would be allowed "only in fusion mode", meaning only along with either fingerprint or iris scan or OTP, to verify the details of the Aadhaar holder.

Aadhaar numbers are being used for identity authentications across banks, telecom companies, the public distribution system, and for income tax, among others. Its use can be gauged from the fact that an average four crore authentications are done on a daily basis.

The move to allow face authentication came within a week of UIDAI allowing residents - in a bid to protect privacy - to use a 16-digit temporary virtual ID to avoid sharing their 12-digit UID numbers when accessing government benefits and other services.

"This facility is going to help in inclusive authentication of those who are not able to biometrically authenticate due to their worn-out fingerprints, old age or hard work conditions," the UIDAI statement said.

To facilitate the new authentication service, the Aadhaar issuing body will work with biometric device providers to integrate face modality into the registered devices.

It will also line up software development kits that will have the ability to capture face images, check liveness and create digitally signed and encrypted authentication inputs.

As many as 119 crore biometric identifiers have been issued so far, and Aadhaar is being used by various government and private agencies as proof of identity of a person and for verifying bank accounts and PANs to weed out black money and bring unaccounted wealth to book.

# data[].attributes.attachment_link.keywords[]
unique identification authority of india

# data[].attributes.attachment_link.title
Now, face recognition to authenticate Aadhaar, but with biometrics or OTP - Times of India

# data[].attributes.attachment_link.description
NEW DELHI: Aadhaar will now allow face recognition along with biometrics as a means of authentication of users, a move intended to offer major relief to older people whose fingerprints and irises are unclear.

# data[].attributes.body
Meltdown & Spectre: How this vulnerability affecting the Cloud

# data[].attributes.attachment_link.readable_text
Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs.

All versions of Cloud Foundry are potentially affected. More information will be added to this page as it is made available.

Mitigations for these issues are expected to be necessary at several levels, including infrastructure and operating systems. Information for major providers is available on the Meltdown/Spectre website [1].

The Cloud Foundry Project intends to provide new versions of stemcells as soon as updates are released upstream.

Update: As of January 24, BOSH stemcells for Ubuntu [11] have been released to mitigate Meltdown and Spectre. Further releases from Ubuntu are possible but none are currently expected. [6]

Windows stemcells v1200.13 available on bosh.io address Microsoft's guidance for protection against "speculative execution side-channel vulnerabilities"[9] . For vSphere, see instructions for building the stemcell [10].

See the following table for information related to specific infrastructures. We will update this table as more information is available.

# data[].attributes.attachment_link.title
Meltdown and Spectre Attacks - Cloud Foundry

# data[].attributes.attachment_link.description
Meltdown and Spectre Attacks Severity Advisory/Critical Description Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of ...

# data[].attributes.body
IPv6 Security & Privacy Improvement

# data[].attributes.attachment_link.readable_text
News Stay informed about the latest enterprise technology news and product updates.

The recent IPv6 update from the IETF introduces new security and privacy recommendations. Expert Fernando Gont explains these changes and what they mean for organizations.

Recently, the Internet Engineering Task Force, also known as IETF, published a new set of standards: RFC 8064 or...

"Recommendation on Stable IPv6 Interface Identifiers." The new standard formally updates 14 IETF standards, including the IPv6 Addressing Architecture. Essentially, RFC 8064 recommends the implementation and use of RFC 7217 for the generation of stable IPv6 addresses. The publication of this RFC is the result of previous work on the security and privacy properties of IPv6 addressing, notably RFC 7217 itself, but also RFC 7707 and RFC 7721.

Background on IPv6

The traditional algorithm to generate stable IPv6 addresses with stateless address auto configuration (SLAAC) was designed to generate them by employing the underlying link layer address as the Interface Identifier of the address.

Over time, awareness has been raised about performing host tracking by means of IPv6 addresses. Since the MAC addresses are typically globally unique, and they were embedded in the IPv6 addresses, host identity was leaked by IPv6 addresses. In response to these concerns, the IETF published a standard for temporary addresses that were meant to be employed along with the traditional (stable) IPv6 addresses. While temporary addresses have helped mitigate one specific vector for host tracking, other vectors for IPv6 host tracking, as well as the vulnerability of the traditional scheme to trivial address scans, remained unaddressed.

Ongoing work on the security and privacy properties of IPv6 addresses eventually led to the publication of a proposal to replace the traditional algorithm to generate stable IPv6 addresses with SLAAC with one with improved properties. However, the IPv6 update proposal got push-back at the relevant IETF Working Group, known as 6man. Thus, the 6man working group decided to publish the proposed algorithm as RFC 7217, without formally replacing the traditional SLAAC algorithm. This means that no IETF standards were formally updated.

While the publication of RFC 7217 was a step forward as an IPv6 update, its implementation and use was not recommended or mandated by any standard, and therefore the traditional SLAAC algorithm was still the recommended approach for generating stable IPv6 addresses.

Publication of two informational RFCs on the security and privacy implications of IPv6 addresses, namely RFC 7707 and RFC 7721, probably prepared the grounds for the IETF to take the final step and replace the traditional SLAAC algorithm with the one specified in RFC 7217.

This was finally achieved in February 2017 with the publication of RFC 8064, which recommends the implementation and use of RFC 7217 for the generation of stable addresses, and also recommends against using any address generation schemes that embed link-layer addresses in IPv6 addresses.

Semantically opaque interface identifiers

The RFC 7217 IPv6 update specifies an algorithm that can produce IPv6 Interface Identifiers (and, thus, IPv6 addresses) that are stable within the same network, but that vary as a node moves from one network to another. The algorithm can be summarized and simplified with the following expression:

IPv6_IID = Hash(Net_Prefix, Net_ID, Net_Iface_ID, Secret_Key)

where:

Hash(): A cryptographically secure hash function.

Net_Prefix: IPv6 Prefix being advertised by local routers.

Net_ID: An optional network identifier, such as the service set identifier of a Wi-Fi network.

Net_Iface_ID: An identifier for the underlying network interface (e.g., the network interface name).

Secret_Key: A secret value, typically initialized during system installation as a random value, and constant across reboots.

Essentially, the IPv6 Interface Identifier is obtained by computing a secure hash over the concatenation of a number of parameters, most notably the network prefix advertised by local routers (Net_Prefix) and a secret key (Secret_Key).

As long as the node remains in the same network, it will maintain and configure the same IPv6 addresses, since all of the parameters employed for the hash function remain constant. On the other hand, as soon as the node connects to a different network, the IPv6 Interface Identifier will change, since the network prefix will change. If the node moves back to a network to which it previously connected, it will configure the same IPv6 address as before, as all of the parameters originally employed to compute the IPv6 Interface Identifier will be the same as in the original case.

Implementing the IPv6 update

At the time of this writing, at least the following implementations of RFC 7217 are known to exist:

Linux kernel v4.0;

NetworkManager v1.2.0-0.3.20151112gitec4d653.fc24;

dhcpcd 6.4.0; and

macOS Sierra.

The Linux kernel implementation was the first implementation of RFC 7217, and thus, also served as a reference implementation. However, some of the most popular Linux distributions, such as Ubuntu and Fedora, employ the NetworkManager application package for network configuration rather than relying on the kernel. NetworkManager has implemented RFC 7217 since version 1.2.0-0.3.20151112gitec4d653.fc24. Thus, as new versions of popular Linux distributions are released, all major distributions should be supporting the new algorithm specified in RFC 7217. Some popular Linux distributions, such as Fedora, already ship with the new algorithm enabled by default.

The dhcpcd package is employed in a number of Linux distributions, such as Raspbian, for network configuration. Dhcpcd has implemented support for RFC 7217 since version 6.4.0. Current releases of Raspbian already ship with the algorithm specified by RFC 7217 enabled by default.

Finally, another popular operating system that has incorporated the RFC 7217 IPv6 update support is macOS Sierra, which ships with this new algorithm enabled by default.

The latest releases of some of the most popular operating systems already support RFC 7217. Android is expected to support RFC 7217, as most recent versions of the Linux kernel are supported.

On the other hand, at the time of this writing, Microsoft Windows does not support RFC 7217. However, based on a number of other security and privacy improvements incorporated into Windows (such as MAC address randomization), as well as the fact that one of the co-authors of RFC 8064 is affiliated with Microsoft, one should probably expect Microsoft to implement support for RFC 7217 at some point in the future.

Next Steps

Learn how to handle IPv6 vulnerabilities before deployment

Discover how to use IPv6 atomic fragments for a denial-of-service attack

Find out how to deal with automated IPv6 attacks

Fernando Gont asks:

What do you think about the updates to IPv6 addressing?

# data[].attributes.attachment_link.title
IPv6 update: A look at the security and privacy improvements

# data[].attributes.attachment_link.description
News Stay informed about the latest enterprise technology news and product updates. Recently, the Internet Engineering Task Force, also known as IETF, published a new set of standards: RFC 8064 or... "Recommendation on Stable IPv6 Interface Identifiers." The new standard formally updates 14 IETF standards, including the IPv6 Addressing Architecture.

# data[].attributes.attachment_link.provider_name
KitPloit - PenTest Tools for your Security Arsenal ☣

# data[].attributes.attachment_link.readable_text
Linux System Optimizer And Monitoring.

Required Packages

Debian x64

1. Download stacer_1.0.8_amd64.deb from the Stacer releases page.

2. Run sudo dpkg -i stacer*.deb on the downloaded package.

3. Launch Stacer using the installed stacer command.

Fedora x64

1. Download stacer_1.0.8_x64.rpm from the Stacer releases page.

2. Run sudo rpm --install stacer*.rpm on the downloaded package.

3. Launch Stacer using the installed stacer command.

Build from source with CMake (Qt Version Qt 5.9)

$ mkdir build && cd build $ cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH=/qt/path/bin -G Ninja .. $ ninja $ output/bin/stacer

# data[].attributes.attachment_link.title
Stacer - Linux System Optimizer and Monitoring

# data[].attributes.attachment_link.description
Linux System Optimizer And Monitoring. Required Packages Debian x64 Download stacer_1.0.8_amd64.deb from the Stacer releases page. Run sudo dpkg -i stacer*.deb on the downloaded package. Launch Stacer using the installed stacer command. Fedora x64 Download stacer_1.0.8_x64.rpm from the Stacer releases page. Run sudo rpm --install stacer*.rpm on the downloaded package.