Hans-Christoph Steiner @eighthave@librem.one
Joined Aug 2019
There seems to be a common mode of thinking about #software these days that is something like "updated software is always best". I agree there is some truth to that, but it is unfortunately not that simple. Most vulns were introduced in an update, they were not there from the beginning. "Security is a process, not a product", so how the software is developed changes the relationship between updates and #security, e.g. software that never issues stable updates vs. software with stable releases.
I guess I left out my personal motivation: as the father of two curious boys, I'd love for the #internet to be a place of free exploration again, like I first experienced it in 1994. It is far too easy for an 11 year to find things they can never unsee, or really even understand. And even worse, lots of it is coming from services that are literally trying to hook people and get them addicted.
The real power to control the problems related to porn comes from the payment. If sites can't accept credit cards or build substantial advertising businesses, there will be much less money going to middlemen. For me the open question is how much to be concerned about also making it harder for the performers to get money //
That could then mean that something like pornhub can't really exist, since they make money as middlemen or really they are a kind of pimp. Or what if copyright did not apply to porn, but only something like the part of French "droit d'auteur" copyright law where the "author" has certain inalienable rights over the material. That could be used to maintain control over the images of one's own body. I would like to see something like that since it would make the worst porn much less accessible 4/
My gut instinct is that porn is never really a good thing. But I don't have much knowledge on the subject to say conclusively. Seeing that there are unions for sex workers in the US makes me think that at least some sex workers think it is a good thing. Of course, being abused, forced, tricked, etc. is always bad. So I was wondering if the same general Austrian policies for prostitution might work for porn: considered a job in the eyes of the state, the workers get the money, no pimping, etc 3/
I wonder how effective porn bans in Asia and Africa are? Is it simply a question of making it illegal? Some country's free speech laws would prevent that, like the US 1st Amendment. I think economic regulation would be legal basically everywhere. In Austria, prostitution is legal and highly regulated, and it seems quite successful at harm reduction, at least compared to New York, where it is fully illegal. I'm guessing though, based on what I've seen on the streets, and read in the news. 2/
A strange confluence of recent events has me thinking about the #economics of #porn. Through legal research for porn/gambling/etc regulation for F-Droid, I saw that porn is illegal in most of the world. Then hearing about 11 year olds I know accessing pornhub scared me and made me hate the internet. It is far too easy to access porn these days. Now, a famous man was arrested for human trafficking, and I read about the "loverboy method", which requires the trafficker spend money up front. 1/
Hans-Christoph Steiner
boosted
@jeffalyanak the concept of accessibility advocacy groups. automatically externalizes the concept of accessibility into something that people who are not a part of the process advocate for rather than people who are central to the process are making a reality. That’s a giant no. Not acceptable.
Hans-Christoph Steiner
boosted
Really cool write up about a vulnerability in Google home devices that could have been exploited via war driving or targeted attacks https://downrightnifty.me/blog/2022/12/26/hacking-google-home.html #research #BugBounty #google
Hans-Christoph Steiner
boosted
I DON'T WANT SELF DRIVING CARS!!!!
✔️ I want boring things like public transit that comes so regularly I don't need to check a schedule.
✔️ I want fast passenger rail so accessible and easy it's preferable to suffering airports.
✔️ I want cities that aren't built around cars-as-default
✔️ I want the country to own it.
Hans-Christoph Steiner
boosted
I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)
So, here are my responses to all of these concerns!
Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.
But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:
- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...
- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...
- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...
- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...
- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...
- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...
- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.
You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.
So, why do I recommend Bitwarden and 1Password? It's quite simple:
- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security.
- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.
Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.
I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!
@Gargron is providing a shining example of the new breed of "startup" culture that is arising. We want impact in the public interest, and just to make a living doing it. Getting rich is besides the point, and it is certainly not a reason to compromise the goals of the project. I believe #FDroid is another example of this.
Hans-Christoph Steiner
boosted
I am grateful to @Gargron because he is committed to preserve #Mastodon and the #Fediverse as a public network of communities, creating free knowledge for everyone, and he's keeping this commitment also against powerful market forces that would like to transform this "digital common" into a private investment generating profit for someone. GAFAM moguls should understand that the era of private social networks where people's data are used as cash cows is coming to an end.
Hans-Christoph Steiner
boosted
Am Beginn ist sie breiter, die Schottengasse. Gelegenheit für 3 Parkspuren mitten im Zentrum Wiens, wo wirklich niemand überirdisch von der Allgemeinheit subventioniert parken müsste. Parken kostet für Wiener 10€ im Monat. Der Platz, im Besitz uns aller, ist das 20-fache wert.
Hans-Christoph Steiner
boosted
Night train from Brussels to Berlin via Amsterdam starting mid 2023! 22:30-06:48 is not long enough for a full restful sleep, although continuing on to Prague would be nice. https://www.europeansleeper.eu/nl/coming-soon
Hans-Christoph Steiner
boosted
Ich würde gerne eine (lange) Geschichte Wiens lesen. Hat jemand Tipps?
Hans-Christoph Steiner
boosted
When you do NOT publish your #android #app in the Play Store (e.g. #gadgetbridge, #fdroidapp , #imagepipe), is there a good reason to increase the #targetSdk ?
Does it matter at all?
The last sdk updates mainly impose restrictions without much benefit for developers and make development harder.
Why upgrade targetSdk when you can completely ignore G***le's rules about minimum targetSdk?
What are your thoughts?
Sandboxes have often been represented as a security feature, but it seems there are always ways out, e.g. there are always jailbreaks available for iOS. Sandboxes still make sense for restricting non-malware apps from accessing private info. For security, its more important to avoid targeted exploits, e.g. reducing identifiability, to force the use 0days into broader targets, which is then more likely to burn that 0day. Users of 0day exploits are rarely willing to burn one to target one person
Hans-Christoph Steiner
boosted
Elon gave me no warning.... plus he suspended all of my accounts, half of which track aircraft (NASA aircraft, experimental aircraft, weather, airforce etc). not people including my personal
Hans-Christoph Steiner
boosted
Today’s social media status quo isn’t cutting it, so Mozilla is exploring an alternative here on Mastodon. In early 2023, Mozilla will be testing a publicly accessible instance in the Fediverse at Mozilla.Social. We will keep you updated, but for now learn more here: mzl.la/3BNXQMQ
Joined Aug 2019
