Show more

> "This is because the 13th
Amendment to the United States Constitution, which
generally protects against slavery and involuntary
servitude, explicitly excludes from its reach those
held in confinement due to a criminal conviction." - ACLU report on prison labor in the US

From this thread:

mastodon.social/@mhoye/1096488

Are you a fan of #Jewish #ScienceFiction?

If so, we are still looking for submissions for the SHJ blog (www.shj.org/blog) on the intersection of #SciFi and #Judaism. These posts will be published between now and March as part of #HumanisticJudaism magazine's celebration of SciFi in our upcoming issue.

Email me at HumanisticJudaismMagazine(at)gmail(dot)com for more details.

#Mazeldon @mazeldon @scifi

We normally promote the conference Tech Intersections: Women of Color in Computing on #Twitter but won't this year for obvious reasons.

Please help us spread the word about this #bipoc conference in #Oakland #California.

We're offering 20% off with promo code MASTODON. #BlackMastodon #BlackFriday

We are giving free tickets to people who have been laid off with promo code LAIDOFF.
techintersections.org

The event includes an #ally skills workshop for supporters of #woc.

Protip:

When designing a user interface, imagine some old woman using it, say Margaret Hamilton, and she's clicking your app's buttons and saying to you, as old people do,

"Young whippersnapper, when I was your age, I sent 24 people to the ACTUAL MOON with my software in 4K of RAM and here I am clicking your button and it takes ten seconds to load a 50 megabyte video ad and then it crashes

I'm not even ANGRY with you, I'm just disappointed."

I'm still sitting through catvalente.substack.com/p/stop but it's... poignant, emotional, and reminds me of how long the history of the Internet has become.

If you care about the future of social media, spend some time and read it.

Normalizing prison rape is rape apology.

Rape is wrong, and shouldn't be normalized, even if it happens to the worst posible person.

Rape joke are a normalization of rape.

the 4 types of national anthems:

- Gosh, This Sure is an Attractive Piece of Land We've Got Here

- That One War in Particular was a Doozy

- We Only Sing Parts of This Song Now Because the Other Verses are Racist

- We Speak French and We Will Fucking Kill You

This is a great story of how Barnes & Noble’s new CEO who was hired in 2019 has turned around the company. Sales are up, it opened 16 stores this year and plans to open more next year.

The secret is the CEO really likes books and readers. So he stopped doing deals with publishers to promote their latest books & NYT best sellers and encouraged individual stores to promote books they found most interesting.

So simple yet…

tedgioia.substack.com/p/what-c

@Cassandra @MJ @Karoli

Ronald Reagan hagiography sends me right up a wall.

On top of my earlier list, he traded arms for hostages in Iran-Contra to fund a genocidal war in Central America, created bogus supply-side economics that exploded the deficit with tax cuts for the rich, making budget cuts “necessary” but only for lower income people, Black people, people living with a disability, and older people, and cut funding for mental health, making millions unhoused. He also had the gall to tax Social Security to pay for the hole he blew in the budget. Ignored AIDS until Rock Hudson got it. The list goes on and on.

People who are need to stop venerating Reagan and pretending he was anything but a disaster for this country.

I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)

So, here are my responses to all of these concerns!

Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.

But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:

- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...

- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...

- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...

- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...

- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...

- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...

- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.

You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.

So, why do I recommend Bitwarden and 1Password? It's quite simple:

- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security.

- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.

Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.

I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!

$TSLA crashing because the company is on autopilot is the most fitting end to 2022 possible

@preeya I’m reading Anne Appelbaum’s depressingly-titled “Twilight of Democracy: The Seductive Lure of Authoritarianism” right now and the fascist hatred for complexity is a core theme in the second half of the book. Honestly blowing my mind, I hadn’t previously picked up on that angle to it all

it is not lost on me one bit that the stories people deem to be less serious and less important are the ones that women enjoy

Show thread

Why the heck are we trying to peer pressure people into stopping precautions for a disease that is a top 3 killer in the US?

#BringBackMasks #COVID #COVID19 #PublicHealth

moderation notice:

we have issued a limit/silence for mastodon.se.

the recent blog post by the admin of the instance refuses to action and moderate accounts including anti-abortionists, known harassers, neo-Nazi adjacent accounts, and more because they don't want to be the 'thought police'. this is directly in violation of our policies and furthermore endanger and directly threaten the safety of our users. #FediBlock

This wonderful Christmas tree was set up in the main hall of the University of Warmia and Mazury Library, Olsztyn, Poland, 2022. It consisted of 21 wire hoops, 150 m of fishing line, 1600 clips, and 1600 catalog cards that were intended for disposal.

📷 University of Warmia

@bookstodon #bookstodon #books #photography #library #christmas #ChristmasTree

Disinformation is a weapon of mass destruction
Racism is a weapon of mass destruction
Fear is a weapon of mass destruction
Greed is a weapon of mass destruction
We need to find the courage, overcome
Inaction is a weapon of mass destruction
Inaction is a weapon of mass destruction
Inaction is a weapon of mass destruction

🎶🥁

Although the 'No Roots' album will be 19 years old next year. 'Mass Destruction' by Faithless is still as current as ever ❤️

youtube.com/watch?v=uzgBD2wysu

Show more
Librem Social

Librem Social is an opt-in public network. Messages are shared under Creative Commons BY-SA 4.0 license terms. Policy.

Stay safe. Please abide by our code of conduct.

(Source code)

image/svg+xml Librem Chat image/svg+xml