📋 Cut, copy, and paste anything, anywhere, all from the terminal. - GitHub - Slackadays/Clipboard: 📋 Cut, copy, and paste anything, anywhere, all from the terminal.
🔓 Like good neocolonizers, #humanitarian organizations & #nonprofits, like militaries, also collect vast amounts of #biometric & other private information about people with reckless disregard for basic #privacy and #security concepts.
✊🏽 We must hold them accountable for the risks and damages their actions cause: it's unacceptable to allow society to continue this way.
Thanks to #CCC for helping expose the dangerous truth.
Angel of Greenwood is a retelling of the 1921 Tulsa Massacre. It follows two young Black teenagers: Isaiah and Angel, as they enjoy their last few weeks on Black Wallstreet. It was written for a younger audience and manages to capture the horror of one of the most horrific attacks on Black America without the graphic details many comparable books offer. 5/5 ⭐️. #bookstodon #blackbookstodon #bipocauthors #writewithmichael#writingcommunity Grab a copy: bookshop.org/a/87137/978125082…
I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)
So, here are my responses to all of these concerns!
Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.
But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:
- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...
- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...
- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...
- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...
- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...
- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...
- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.
You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.
So, why do I recommend Bitwarden and 1Password? It's quite simple:
- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable.
- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.
Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.
I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!
Don't forget about #KeeperSecurity, the only FedRAMP Authorized password manager with the longest-standing SOC 2 and ISO 27001 certifications in the industry. We stand by our extremely strict security standards. Here's a side-by-side comparison of how we stack up against LastPass: keepersecurity.com/blog/2022/0…. Our blog also features comparisons against other password managers on the market.
From price to product offerings, this comprehensive guide takes you through the key differences between the password managers Keeper Security and LastPass.
They have a bug bounty now (bugcrowd.com/keepersecurity ) but it does not allow researchers to disclose bugs (see “Disclosure” section) which to me represents a failure to engage with the security community. No amount of acronym certifications will make that ok for such a critical piece of security infrastructure.
@pvagner These are actually two tracks divided by slash, perhaps I should make it more obvious. :) As for the E-Type resemblance, Clocks perhaps, but Melancholy Angel is more of a Nightwish clone.
Taky jsem si zkoušel žádat o voličský průkaz přes datovou schránku. Dostal jsem se do posledního kroku, a tam mi datovka úplně zamítla poslat tu zprávu na úřad.
Volal jsem na podporu, kde mi řekli, že mám na úřad zajít osobně. Super systém
@archos Kupuju husy od Moni @vareckou, domácí z farmy 😍 peču při 90°C obvykle 12-16 hodin, podle velikosti, dokud nejde maso samo snadno od kosti. Výpečky slévám a používám pod míchaná vajíčka 😋
Když zbyde, pokrájím maso, knedlíky na kostky, v pekáči smíchám s medovým zelím, naplním sklenice a zavařím - je to geniální rychlá večeře 😍😋
@archos Vyzkoušej, je to žráááádlo 😍😋 už nekupuju jiné maso než od Moni, telecí, vepřové, kuřata, husy, cenově srovnatelné a stoprocentní bio kvalita z farmy 😋
Wow, the ethics of this seem dubious to me… but also kind of fascinating as an outsider looking in - How Kindle novelists are using ChatGPT / An interview with an AI early adopter theverge.com/23520625/chatgpt-… #AI #writing
@blindscribe thanks so much for sending this over and I’ll look out for your blog post. If I was still an illustrator I’d be very worried about the visual art side of AI so I imagine this is not a positive development for a lot of writers
I don't think this is getting the coverage it needs. Scottish government to require passivhaus standard for all new build homes. This is big. Really big. Growing out of lessons from the 70's oil crisis. Passivhaus buildings use very little energy to heat, or to cool. We've known how to do this for decades. It's gross negligence from all western governments that the same is not true of all new builds in the developed world.
@archos Dobré ráno, naprosto rozumím, už druhý den spím na gauči a sem rozlámaný jak tedsetonesmirikat hračky. Hraju už 3h na mobilu Krycí jména a už mi z těch slov hrabe.
Wayback Machine is useful to journalists. Very. But we need to archive. Very.
"Past statements of Mr. Santos are relatively clear however: An archived version of Mr. Santos’s former campaign website preserved by the Wayback Machine says that he “began working at Citigroup as an associate and quickly advanced to become an associate asset manager in the real asset division of the firm.”"
The congressman-elect confirmed The New York Times’s findings that he had not graduated from college or worked at two major Wall Street companies, as he had claimed.
Python with braces. Because python is awesome, but whitespace is awful. - GitHub - mathialo/bython: Python with braces. Because python is awesome, but whitespace is awful.
Could reporters stop both-siding COVID and focus on why political leaders are failing us? Politicians aren’t reinstating mandates because masks remind us we are in a pandemic, and they are afraid that people will consume less if they see more people wearing masks. They are prioritizing corporate profits over public health.
This is a really cheap and easy way to burn a design into wood without actually having a branding iron.Ammoniumcloride is not a dangerous chemicals but i wou...
What's Changed
Tooltips by @nvdaes in #2322
Translation into Spanish by @nvdaes in #2281
Improve notifications page readability by @NickColley in #2302
fix: handle status edit events by @nolanlaws...
So as this year draws to a close, and in the context of my returning to the fedi back in April, I realize how much I want to build tools for this space.
I like the convos about the future of how we all internet together, and I think we're so close to finding a good sweet spot that is not dependent on anything but us to make and support what we need. It's so close.
This is why I will work on getting funding for my projects to the point where I can work on them full-time. So much meaningful work in the fedi can result in a complete shift in how we think about social media. That's what I want to contribute.
Of course, until then, I have to make ends meet, so I'll still be looking for work. Ideally, I'm looking for a part-time web and graphic design or web development to split my time with Fipamo and The Bad Space.
I'm not opposed to full-time work in the product management area as long as it is remote and there's an understanding I'm putting time into my projects as well.
For an overview of all of the stuff I do, go here -> roiskinda.cool/profile.html 2023 is the year I want to make a big push to get better tools out there and explore ways we can interact safely with each other. It will take some work to get there, but now is the time.
This next year can be an even bigger leap forward.
@archos @pavel Ono je to se správci hesel dost problematické, když chce člověk ukládání do cloudu a synchronizaci. Já mám rád a pocit větší jistoty, když mám sám soubor s databází, který si sám někam nahraju. Vím, jak je šifrovaný, kde se nachází, kde jsou zálohy a tak. Není to však už tak pohodlné, jako Bitwarden nebo Lastpass.
@infoek @pavel Však i keepass používá stejné šifrovací klíče. Zálohovat jde i Bitwarden. A nemyslím, že je bezpečnostní riziko mít správce hesel na malé serveru.
@archos @pavel Ono je riziko vystavit i tu databázi na jakýkoliv server. Hesla je nejlepší mít pouze zašifrované offline. Bohužel to je dnes hodně nepohodlné. Především, když někdo střídá často mobily jako já 😀
@infoek @pavel To je mi jasný, ale musí člověk brát i komfort. Už vidím jak si běžný uživatel přenáší hesla na USB z PC do PC a a dělá tři zálohy a jednu posílá mimo domov. Navíc Bitwarden lze zabezpečit i yubikey klíčem. A hlavně nemyslím, že by šla jen tak rozšifrovat databáze hesel v Bitwardenu, nebo Keepass.
@archos @pavel Jasné ani já nedokážu mít hesla kompletně offline. 😀 Bitwarden se mi líbí. Hlavně ta appka funguje všude spolehlivě, což se o kombinaci Authpass a Linux říci nedá...
@archos @infoek @pavel Nějaké riziko tam je. Někdo může upravit image vaultwardenu a krást master hesla přes web. Nebo se může objevit zero day zranitelnost a díky službám, které mapují co kde běží, dojde k rychlým vykrádačkám vaultů i na malých serverech. Ale největší riziko vidím stejně v tom browser addonu, který má k dispozici celý vault. Chtělo by to plnotučného bezpečného klienta a toho se ptát z browseru jen na zrovna potřebná data (viz KeepassXY).
Fission is in the news, but few recognize that a woman physicist was behind the discovery.
Lise Meitner’s brilliance led to the discovery of nuclear fission. But her long time collaborator Otto Hahn, was awarded the Nobel Prize in Chemistry w/o her in 1944, even though she had given the first theoretical explanation.
Overnight, the world agreed to a "Paris Agreement" for biodiversity! It's the Kunming-Montreal Global Biodiversity Framework and its goals aren't expressed in degrees of warming but rather in land and water protected: 30% by 2030 globally. Read more: bbc.com/news/science-environme…
Thanks to #CCC for helping expose the dangerous truth.
The Black Book Guy
Unknown parent • • •