Esme Povirk @madewokherd@computerfairi.es

😂😂
---
RT @made_marian
Myers-Briggs personality types are SO 2004. Here's my proposal for a useful replacement in 2023:

T/B (Top / Bottom)
M/N (Morning / Night)
P/X (Phone Call / Text Message)
D/C (Dog / Cat)

This system is perfect and I will not elaborate further.
https://twitter.com/made_marian/status/1607004968984125442

I love that there's a word for this. It's from the Dictionary of Obscure Sorrows, which gets more incredible the more I explore it.

I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)

So, here are my responses to all of these concerns!

Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.

But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:

- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...

- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...

- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...

- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...

- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...

- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...

- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.

You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.

So, why do I recommend Bitwarden and 1Password? It's quite simple:

- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable.

- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.

Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.

I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!

Y'all duking it out over whether Mastodon should have the QTs are focusing on THE WRONG THING

What we NEED is markdown support up in this joint

FACTS ABOUT MASTODON

If you are curious about leaving the cooked turkey site and going to the elephant site, here are some important tips:

1. It sucks. But then, so does every site.

2. You can still shitpost. Take great glee.

3. Picking your server is super important.

Ideally you should start at a large instance, and leave because it's full of white suburban NIMBY shitheads who joined in November because they were promised 0 uncomfortable experiences in their lives and lash out when this turns out not to be the case.

Then you move to a smaller server where suddenly you can't talk to your friends because your admin is feuding with the admin of their instance. Then you wait a month before you can move again.

In this regard, the feudal structure of Mastodon instances is very like early 2000s message boards, whenever the admin got drunk and deleted the site.

4. You can work around the feudalism by running Mastodon yourself. It's the size of a mastodon and costs a fortune.

You can run Pleroma, which is smaller, and is also favoured by Nazis for unfortunate historical reasons. Pleroma is perfectly good software that fulfils a need for something smaller than Mastodon, but also the devs are definitely not Nazis but are the other ten guys at the table.

There was a hilarious moment where the guy behind Spinster was so obnoxious he got kicked out of Pleroma and did his own fork called Soapbox/Rebased. He is now known as Soapbox Terf.

The nice people went to Pleroma fork Akkoma, which Soapbox Terf calls the "tr***y server", a review I understand they were delighted by. Try that.

There's also Misskey, which is a bit weird and Japanese, and supports cat ears right there in the protocol.

5. Any bozo who makes assertions about the Fediverse that assume it all runs on the rules of mastodon.social is one of the suburban NIMBYs and invariably joined in November. Block and don't look back.

6. If anyone annoys you about your posting, you can improve their feed for them by blocking them from ever seeing your posts. The blocking tools are marvellous.

7. There are NO QUOTE TWEETS on Mastodon and anyone who wants QUOTE TWEETS is an invader, pollutant and corrupting influence despoiling the suburban vistas of Mastodon who only wants quote tweets to wreak EVIL.

So quote-tweeting is well supported in Akkoma and the Calckey fork of Misskey, is in live trials in the Treehouse fork of Mastodon, and will be coming to more Fediverse software soon.

8. In Mastodon, Eugen Rochko has achieved the creation of something greater than himself. And he will *never forgive it*.

9. The Fediverse interprets Website Boy as damage and routes around him.

10. Mastodon is yet another demonstration that worse is better. So come onto Mastodon, and *be* that worse.

Merry Christmas, everyone. Here’s a holiday #security tip for you. Actually, it’s an anti-tip.

You probably don’t need to be using a VPN. There’s an absolutely massive industry out there that’s aimed at trying to convince everyone and their mother that using a VPN will grant you additional privacy online, secure your personal data, and protect you from hackers. None of these things are true.

A VPN does one very specific thing: when you’re communicating with another computer, a VPN will stand in the middle and add a layer of encryption between you and the VPN itself. It then sends the communication on to the other computer, often using its own IP address to do so. Based on this, a VPN can be used to:

1. Add an additional layer of encryption to your communication in transit, but only between you and the VPN.
2. Mask your IP address and coarse location.

That’s it. Unless you’re sure that you’re on an extremely hostile network, or you need to get around streaming restrictions by changing your perceived location, a VPN is probably not what you need. Your communication is typically already encrypted once in transit (by way of TLS) and masking your IP address will not stop a website from forming a fingerprint to identify you if they want to.

Therefore, in all likelihood, you probably don’t need a VPN.

This is how it is.

I just really like most of you if i have you listen to 2 hour monologues ;)

Stolen from Discord:

doctor: you have synesthesia

me: I see what you’re saying

doctor: yes I know, you can stop telling me that

Was listening to a tech news podcast. One of the guests said they forgot on what Mastodon server they’d signed up and had to ask some folks out of band to dig up some old toots for a reminder. The other guests were like "hmm yes this is complicated"

And I'm like... Maybe you should give a shit and remember. Especially you, expert guest on a tech podcast. Like you know where your house or apartment is, you know where you parked your car (usually). You give a shit about those, give a shit about on whose server-couch you're crashing.

Maybe not giving a shit about where your eyeballs are harvested is a big reason we're in so many messes?

And then they talked about how fraught it is that these Mastodon servers are run by unpaid volunteers - and I'm like yeah so the fuckin least you can do is honor that work by remembering where you signed up and maybe toss a coin to your hosts sometime.

I know it’s a good thing to smooth over the rough edges of Mastodon and Fediverse UX, but these are basic things. And if remembering where you signed up is too steep a hill to climb, maybe the network shouldn’t work so hard to acquire or retain that particular participant