John Rowe @JohnTheKea@nitech.online

Greta Thunberg's response to Andrew Tate's challenge will likely not go unnoticed

We’ve always needed safe infrastructures for people, but that need is even greater as vehicles have gotten bigger.

More cars, bigger cars, more and more space surrendered in cities to cars.

In 2000, a bike-rider next to a Toyota Camry had 18 inches on either side. Today a bike-rider next to a Ford F-150 has just 4 inches.

Stolen space.

Via #TransAlt

#cities #urbanism #cars #transportation #bike

Short rant.

Southwest Air has cancelled ~70% of its flights in an epic meltdown this holiday season.

Remember, Southwest took $3.7B in federal aid from 2020-21.

It’s CEO got a pay raise to a $9.1M package in 2022.

Yet Southwest employees are working 16 hour shifts & threatened w/termination if they refuse overtime or call in sick.

Socialism for the wealthy. Capitalism for workers.

Stop trusting billionaires. Start holding them accountable. And start protecting workers.

End Rant.

I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)

So, here are my responses to all of these concerns!

Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.

But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:

- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...

- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...

- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...

- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...

- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...

- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...

- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.

You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.

So, why do I recommend Bitwarden and 1Password? It's quite simple:

- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable.

- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.

Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.

I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!

The time for an easily self-hosted personal CMS, designed around the Fediverse and IndieWeb is now.

No, I don’t mean hacking it into a legacy CMS like WordPress. It needs to be modern, and completely focused.

(The CMS I use, Known, had the right idea, about 5 years too early).

Greetings. The amount of cynicism I see here about the Internet is really quite remarkable. Maybe it helps to have been engaged in this wonder of the world from the early ARPANET days (as I have) to fully appreciate what a fantastic tool the Internet is.

And yes, like any tool, the Internet can be used for good or evil. A hammer can help build a house for a needy family, or it can bash in someone's skull. The hammer doesn't make that decision -- the people using it are in control.

And so it is with the Internet as we stand on the cusp of 2023. Best, -L

And yes, Apple’s password manager syncs Verification Code generators. You don’t ever need to worry about losing a phone or getting a new phone and losing any of your codes.

Actual conversation I had…

Me: Billionaire philanthropy is nothing more than PR. Tax billionaires.
Troll: Lol you trust the Govt to spend our money?
Me: Yes, the Govt is elected by We the People, and therefore is accountable to us and can be voted out.
Troll: Govt is bought.
Me: Bought by who?
Troll: By billionai—...😳
Me: ...🤔
Troll: Ok, Tax billionaires.

I didn’t have enough room to mention: it’s on Windows! https://support.apple.com/guide/icloud-windows/set-up-icloud-passwords-icw2babf5e03/icloud

There’s a native Windows app for the password manager, and there are browser extensions available. :)

New TestFlight Build 🎉

Some highlights:
✨ In-app registrations
✨ Feature Tour
✨ Improved Onboarding
✨ Bug fixes

▶️ Join the beta: https://pixelfed.org/go/testflight-ios-beta

🤖 Android version soon!

Hey, everyone who follows me who is hacking on somethigna round ActivityPub/fediverse — please reply here and share a link to your app/GitHub/Glitch! Would love to show off all the creativity that's happening right now. (And please boost so your friends can share their projects too.)

A castle in Italy has braille etched in the railing that describes the view for blind people🤎

The USPS fleet is easily one of the best fits for EVs: Predictable routes, predictable miles, easy to schedule/coordinate charging, and constant stop and go with low speeds, which is perfect for regenerative braking (sends power back to the battery.)

This will have a positive impact on climate change, and reduce air pollution, noise pollution, and save money in the long run on fuel and maintenance.

Biden (and Podesta)- getting it done again. This is what a desire to govern and make things better can result in - progress. A willingness to cooperate and negotiate is crucial, of course.

Lots of people pushed back hard on the initial USPS plan keep things as they were. Thanks to everyone who pushed back.

US Postal Service fulfills top Biden climate goal with deployment of 66,000 electric delivery trucks |
https://www.cnn.com/2022/12/20/politics/usps-electric-vehicle-fleet/index.html

OK what’s next?

Again I reserve the right to do whatever I want.

Today’s social media status quo isn’t cutting it, so Mozilla is exploring an alternative here on Mastodon. In early 2023, Mozilla will be testing a publicly accessible instance in the Fediverse at Mozilla.Social. We will keep you updated, but for now learn more here: mzl.la/3BNXQMQ

Oh gee golly. The breach of my most sensitive data (most of which I never authorized Equifax to collect and store in the first place) was worth $5.21.

That sure makes up for it. This $5.21 makes me whole.

Rare photograph of #JoanMastodon and #JohnMastodon, early 1980s, testing the first virtual reality instance in their decentralized network: MastoTRON 0.1. They were far ahead of their time and fighting for the users.

Two excellent, in-depth guides to Mastodon, which should answer many of your questions, are here:

1. An Increasingly Less-Brief Guide to Mastodon by joyeusenoelle: https://github.com/joyeusenoelle/GuideToMastodon

2. Nikodemus' Guide to Mastodon: https://docs.google.com/document/d/1D9gfeKg_-hlsU66R-dLEvUeyMsqEfyIx2pnfUeX0t_E/edit#heading=h.j95atvlbfrn5

*PLEASE BOOST THIS POST* so more people can see this information in their timelines, thank you so much! ❤️

To boost, just click on the boost button below this post, as indicated by the red arrow in the attached image (the icon may vary a bit, by app):

this right here is why the Elon Jet account is important

this information about Elon Musk, the man whose entire career is made off the idea that he's going to save the world from climate catastrophe

and this is how he rolls so he can get to a World Cup game:

If, like me, you are on mastodon.social, consider becoming a monthly supporter. There are over 200,000 people on this instance, with fewer than 9000 currently supporting it on Patreon. The current fundraising goal is $50,000 per month, with about $32,000 raised. If enough of us kick in a buck a month we can hit that goal easily. Go here to contribute, if you can: https://www.patreon.com/mastodon