The big news this time around is the release of NVDA 2023.1! But there’s plenty more exclusive news below so let’s get into it: NVDA 2023.1 It’s new release time! NVDA 2023.1 is n…
Security is the major reason why software updates are important. The LastPass breach demonstrates this dramatically.
If you search the web for why software updates are important, you will get loads of results that say there are "3 or 5 reasons why software updates are important". While this may be correct, there is only one major reason why you must keep your software up to date: Security.
Security researchers have shared technical details for exploiting a critical Microsoft Outlook vulnerability for Windows (CVE-2023-23397) that allows hackers to remotely steal hashed passwords by simply receiving an email.
Microsoft Authenticator prompts the user to accept sharing analytics during the first launch. The prompt only dismisses when the user taps on "Accept." In fact, the app starts sending analytics even before accepting the privacy statement.🤦♂️
In this video, we downloaded the authenticator app from the App Store and we opened it as we monitored the iPhone network traffic. While the app was showing the permission prompt, we captured at least 3 calls made by the app sending diagnostics to Microsoft. The app sent 14 KB of analytics even before accepting the prompt.
The message on the prompt actually says that Microsoft needs to collect diagnostic data in order to keep Authenticator secure and up to date. 😵💫
When opening Microsoft Authenticator for the first time after downloading it from the App Store, it prompts the user to accept sharing diagnostics with Micro...
Der Werbe- und Trackingblocker #Blokada entwickelt sich immer mehr zu einer kommerziellen Lösung. Von einer weiteren Verwendung ist abzuraten. Nutzt besser die Alternative #AdAway. 👇
Today I learned that when you "edit" or "correct" a message in #XMPP, the original message is still technically stored on the server or device. It's the client side that understands that the new message is an edit of the previous message, and "displays" it as such. But, if you send a password or something sensitive, "editing" the message after it has been sent might not remove the actual contents of the original version of the message, so make sure you use #encryption too.
Portmaster, eine Art Firewall zur Kontrolle des ausgehenden Datenverkehrs, ist nicht mehr Alpha, sondern in der Version 1.0.7 für Windows, Debian/Ubuntu und Fedora verfügbar. Gerade für Windows-Nutzer interessant, die Microsofts Schnüffelei eindämmen wollen.
Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.
Have you heard about #ReproducibleBuilds? This is one of the biggest #security benefits of #FOSS. On #Android, this technique ensures that the #FDroid version of an app exactly matches the developer's version.
A common criticism directed at F-Droid is that F-Droid signs published APKswith its own keys. Using our own keys doesn’t mean insecure — we have a goodtrack ...
Update 1/31/2020: The grade change is now live on www.ssllabs.com. Servers that support TLS 1.0 or TLS 1.1 are capped to B grade. Update 1/16/2020: The grade change is now live on the development…
Do you like security? Do you like privacy? Cryptography? Do you like working for a public benefit non-profit instead of an investor-beholden corporation?
Let's Encrypt is hiring for someone to join our SRE team and help run the largest Certificate Authority in the world! Come work with me and some of the most wonderful folks in tech, to make the web a better place.
Posted: September 29, 2022
Start Date: January 2023
Position Status: Open
Location: Remote within US
Compensation: $140k USD, 100% 401k Match, Excellent Insurance We’re making HTTPS easier for developers to use, we’re doing it at scale, and we need y…
What do you value the most in your devices? Privacy, Security and/or Freedom?
At #CES2023, the biggest #tech event, we are asking people their thoughts about where they stand when it comes to #privacy, #security and #freedom when it comes to their #laptops, #phones, IoT devices
🔓 Like good neocolonizers, #humanitarian organizations & #nonprofits, like militaries, also collect vast amounts of #biometric & other private information about people with reckless disregard for basic #privacy and #security concepts.
✊🏽 We must hold them accountable for the risks and damages their actions cause: it's unacceptable to allow society to continue this way.
Thanks to #CCC for helping expose the dangerous truth.
I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)
So, here are my responses to all of these concerns!
Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.
But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:
- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...
- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...
- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...
- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...
- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...
- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...
- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.
You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.
So, why do I recommend Bitwarden and 1Password? It's quite simple:
- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable.
- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.
Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.
I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!
Doc Searls and Katherine Druckman talk to Kyle Rankin about hardware supply chains, building the only USA-made mobile phone, trust, open standards, and much more.
"Virenschutz: Rechteausweitung durch Schwachstelle in AVG und Avast"
[1]Nein? Doch! Ohh! 😉
Schmeißt dieses unnütze Schlangenöl endlich von euren Rechnern. Einzig den Microsoft Defender würde ich noch (mit leichten Schmerzen) eingeschaltet lassen. Mehr Infos unter [2].
Die Virenscanner von AVG und Avast hätten Angreifern ermöglichen können, ihre Rechte im System auszuweiten. Updates zum Beheben des Fehlers sind verfügbar.
Repository dedicated to an enthusiast for technology, games, new software features and GNU/Linux. - GitHub - raven2cz/geek-room: Repository dedicated to an enthusiast for technology, games, new sof...
According to research conducted by @zerforschung, the #Twitter alternative Hive Social has got a number of dangerous #security vulnerabilies.
They allow attackers to completely access and even to partly edit anyone's data, including private posts, deleted direct messages, e-mail addresses and phone numbers signed up with etc.
Once again this demonstrates that you should not rely on closed-source software to guard sensitive data.
Dieser Artikel ist auch auf deutsch erschienen.
Following the Twitter takeover, a number of services promising to be an alternative gained traction. One of those is “Hive Social”, which reached more than a million users in the last weeks.
Internet Security Research Group (ISRG), the nonprofit behind Let's Encrypt, says the open certificate authority (CA) has issued its three billionth certificate this year.
🎁 Score $100 off this holiday season on your order for Librem 5 USA. With the holiday season in full swing, this is a great gift for any one in your family concerned about secure supply chain or online privacy. Offer valid till 5 Dec 2022, so hurry!
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
Google publishes the source code for their TalkBack screen reader. GrapheneOS maintains a fork of it and includes it in GrapheneOS with the help of a blind GrapheneOS user who works on their own more elaborate fork. Eventually, we'd like to include more or all of their changes.
TalkBack depends on a text-to-speech (TTS) implementation installed/configured/activated. It needs to have Direct Boot support to function before the first unlock of a profile. Google's TTS implementation supports this and can be used on GrapheneOS, but it's not open source.
We requested Direct Boot support from both prominent open source implementations:
eSpeak NG recently added it but it's not yet included in a stable release and their licensing (GPLv3) is too restrictive for us.
RHVoice itself has acceptable licensing for inclusion in GrapheneOS (LGPL v2.1), but has dependencies with restrictive licensing. Both these software projects also have non-free licensing issues for the voices. Neither provides close to a working out-of-the-box experience either.
Google's Speech Services app providing text-to-speech and speech-to-text works perfectly. Their proprietary accessibility services app with extended TalkBack and other services also works fine. However, many of our users don't want to use them and we need something we can bundle.
There aren't currently any usable open source speech-to-text apps. There are experimental open source speech-to-text implementations but they lack Android integration.
We also really need to make a brand new setup wizard with both accessibility and enterprise deployment support.
GrapheneOS still has too little funding and too few developers to take on these projects. These would be standalone projects able to be developed largely independently. There are similar standalone projects which we need to have developed in order to replace some existing apps.
AOSP provides a set of barebones sample apps with outdated user interfaces / features. These are intended to be replaced by OEMs, but we lack the resources of a typical OEM. We replaced AOSP Camera with our own app, but we still need to do the same with Gallery and other apps.
Google has started the process of updating the open source TalkBack, which only happens rarely. We've identified a major issue: a major component has no source code published.
Google has been very hostile towards feedback / contributions for TalkBack...
This is one example of something seemingly on the right track significantly regressing. Another example is the takeover of the Seedvault project initially developed for GrapheneOS. It has deviated substantially from the original plans and lacks usability, robustness and security.
In the case of Seedvault, GrapheneOS designed the concept for it and one of our community members created it. It was taken over by a group highly hostile towards us and run into the ground. It doesn't have the intended design/features and lacks usability, security and robustness.
All of these are important standalone app projects for making GrapheneOS highly usable and accessible. What we need is not being developed by others and therefore we need to the resources including funding and developers to make our own implementations meeting our requirements.
More information: https://developer.android.com/training/articles/direct-boot https://github.com/GrapheneOS/platform_packages_apps_Updater is a trivial example of using this. You need to mark a sub...
See our good friend and frequent guest, @kyle, discuss supply chain security in this CNBC piece on manufacturing consumer electronics in the USA. We're excited to see @purism in the news!
Made in China. It’s a common phrase known by many. Cell phones, TV screens and game consoles are just some of the millions of electronics manufactured and im...
I was interviewed about supply chain security (around 15 min mark) in a longer CNBC feature about manufacturing phones in the USA. In short, it's less about trust concerns with any particular country/govt., and more about reducing the links in the supply chain to reduce the opportunities to tamper with hardware.
Our Made-in-USA-electronics Librem 5 USA phone also got a number of shout-outs. Pretty neat!
Made in China. It’s a common phrase known by many. Cell phones, TV screens and game consoles are just some of the millions of electronics manufactured and im...
To learn more about #MLS and why this protocol exists in the first place when we already have Signal's, here is a great podcast on the topic: https://www.cryptography.fm/7.
Content warning: meta Some useful tips and tricks for Mastodon
The official Mastodon app seems to have a bug when posting an image. Sometimes it will let you compose the post but when you add the image, the Publish button is greyed out. There are other apps that are good, for example, Metatext and Toot! on iOS, and Tusky on Android. ----------------------------------------------------- There is an Advanced web interface that looks like Tweetdeck. You can enable it in Settings, Appearance. ----------------------------------------------------- Putting plain text into the 'Search or paste URL' box at the top left of the web interface shows results from your own posts or posts that you have boosted, favourited, or been mentioned in. You can also search for user names, display names, and hashtags located in the body of posts. Putting a hashtag into a Content Warning doesn't work. It won't be clickable and might not be searchable unless someone else has used it in the body of a post. ----------------------------------------------------- If you find a post on another Mastodon instance and want to boost it on your own instance, click the … menu and then Copy Link. Go back to your own instance, paste the link into the Search box and press Enter. The post will appear below the Search box, and you can boost it from there. ----------------------------------------------------- You can create Filters to block posts containing certain pieces of text from being displayed in your Home feed. If you want, the filter can hide the post behind a Content Warning so that you can decide whether to view it or not. ----------------------------------------------------- In the Advanced web interface, you can search for a hashtag, click the result and it will appear in its own column. You can then click the column settings icon at the top right and Pin the column. You can add more tags to the same column, if you like. ----------------------------------------------------- If you boost a post and the author edits it, you will get a notification so that you know that it has been edited. ----------------------------------------------------- It's the custom on Mastodon that if you're posting about Mastodon itself, you put a context warning (CW) of "Meta" so that people's timelines aren't flooded with things they don't want or need to see. Likewise, posts about Twitter can be hidden behind a CW: Twitter (or birdsite, birbsite, hellsite, tw). "CW: meta, bird" should be an obvious one. ----------------------------------------------------- When you're writing hashtags that are a combination of several words, please use "camel case" (#CamelCase) so that screenreaders used by people with impaired vision can pronounce them properly. ----------------------------------------------------- Mastodon has its own thread unroller: https://mastodon.social/@threadunroller ----------------------------------------------------- If you go into Settings in Mastodon's web interface and click on Other, you'll see a list of languages at the bottom which you can use to control which posts you'll see. This works well if you select which language your own posts are in. If you make a post in a different language from your default, select that language using the button at the bottom of the edit box before you post. This way, it can be filtered out on other people's feeds if they choose not to see posts in that language. ----------------------------------------------------- When posting images, please add Alt Text. This allows sight-impaired people using screenreaders to know what is in the pictures. Let's keep the Fediverse friendly to everyone. ----------------------------------------------------- Please use a strong password to log in to your server. If you haven't already done so, make sure you have activated 2-Factor Authentication (2FA) in your Settings. This will keep you and everyone else safe. There are a number of good 2FA apps available in the Apple and Google app stores. In fact, iCloud Keychain on an Apple device can be used to generate 2FA keys. See this article for details: https://appleinsider.com/inside/icloud/tips/how-to-set-up-two-factor-authentication-in-icloud-keychain -----------------------------------------------------
You can balance both account security with the convenience of autofill when you set up two-factor authentication in iCloud Keychain. Here's how to do it.
PASS ZX2C4 - The Standard Unix Password Manager* Password Storage* Simple and follow Unix philosophy * Each password lives inside of a GPG encrypted file * T...
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
Time for an #introduction. I've been involved in #FOSS and #Linux since the late `90s. My career started as a sysadmin, pivoting to security. I'm the President of @purism and work on hardware and software to protect #privacy, #security and freedom.
Linux really needs to remove the “privileged ports” security theater bullshit.
We’re no longer living in the mainframe era. The security properties of the Internet are different to mainframes. This is actually an anti-feature that either complicates life or actually compromises security (when folks run servers as root and forget to drop privileges , etc.).
If anyone has any sway within the kernel team, etc., please do your thing.
Summary Currently, we’re using setcap to grant the CAP_NET_BIND_SERVICE privilege to allow Node.js (during development and testing) and the Site.js binary...
Thanks to #CCC for helping expose the dangerous truth.
