Max Headroom @Joel@qoto.org

This lighthouse is SO UNIQUE! It's called Þrídrangar, which means "three rock pillars". It is located 4.5 miles (7.2 kilometres) off the southwest coast of Iceland, in the archipelago of Vestmannaeyjar, often described as the most isolated lighthouse in the world. The lighthouse was built there in 1939.

It's such a INCREDIBLE location for a lighthouse, perched on a rock in Iceland's wild surf. Originally constructed and accessible only by scaling the rock on which it is situated, it is now accessible by helicopter since the construction of a helipad.

#photography #photo #photos #landscape #lighthouse #engineering #amazing #travel #world #wonders

So George Santos—if his name really is George Santos—will be sworn in Tuesday as a Republican member of Congress. What an insult this fraud is to every voter.

#Introduction
Hi all, I'm finally introducing myself in this new year of 2023! I am a postdoctoral researcher doing #neuroscience, often with a theoretical angle. My own work tends to focus on neural network dynamics, network architecture and (pre)motor control, but my interests are broad and I am trying to use Mastodon to broaden them even more! I also have a special interest in sociology, especially the sociology of #academia. I'm looking forward to learning from the other users, and to communicating about my own research!

HAPPY NEW YEAR! 🎉

May you have clear skies and a low noise floor.

All the best in 2023!

No chance of keeping this resolution

In Defense of George Santos, a Guest Editorial by George Santos - WhoWhatWhy https://whowhatwhy.org/politics/in-defense-of-george-santos-a-guest-editorial-by-george-santos/

In grad school I worked as a bike messenger in NYC. Our dispatcher, a mean little guy, was down in the financial, but I ran packages all over the LES and midtown. I was always nice to the dispatcher. (So I could get the good runs.)

Most messaging companies didn't just have people on bikes. There were also "walking messengers" who'd take the subway and do long runs, like out to Queens. But I loved to bike!

The first week was hell! You see, in messaging you have to "earn your radio" 🧵 #thread

Some jobs are better than others.
#Humor #Funny

Mark Meadows & his wife won’t face any charges, despite registering to vote using a trailer home he NEVER even visited and spreading the Big Lie

Meanwhile, DeSantis arrests Black voters for no reason at all and jails them for “voter fraud”

Welcome to American justice, y’all!

For the record, it appears that after the FTC sued Financial Education Services/United Wealth Services this summer -- calling it a $213 million pyramid scheme -- a month later their preliminary injunction against this entity was denied. It's still not clear why.

https://behindmlm.com/companies/ftc-denied-financial-education-services-preliminary-injunction/

That might explain why the UWE site that comes up when one visits Mr. Dames' vanity domain is still going strong.

Sometimes, it helps to see things visually. I know it does in my case. That's usually the only way I see all the connections.

This part got me, from the NYT story on Dec. 19:

"His financial disclosure forms suggest a life of some wealth. He lent his campaign more than $700,000 during the midterm election, has donated thousands of dollars to other candidates in the last two years and reported a $750,000 salary and over $1 million in dividends from his company, the Devolder Organization.

Yet the firm, which has no public website or LinkedIn page, is something of a mystery. On a campaign website, Mr. Santos once described Devolder as his “family’s firm” that managed $80 million in assets. On his congressional financial disclosure, he described it as a capital introduction consulting company, a type of boutique firm that serves as a liaison between investment funds and deep-pocketed investors. But Mr. Santos’s disclosures did not reveal any clients, an omission three election law experts said could be problematic if such clients exist."

https://www.nytimes.com/2022/12/19/nyregion/george-santos-ny-republicans.html

Something tells me the SEC and/or the FTC know a lot about his, er..."clients."

So where were we? Ah yes, Mr. Dames, whose name and other info is attached to both of the addresses listed on Mr. Santos's Devolder entity.

Mr. Dames's linkedin page says he also was CFO at Harbor City Capital Management. Surprise! This one's an out-and-out scam as well. Per the SEC:

The Securities and Exchange Commission (“SEC”) announced on April 26, 2021, that it filed an emergency action and obtained an asset freeze to stop an alleged ongoing fraudulent Ponzi scheme. The SEC claims that from 2015 to 2021, Harbor City Capital Corp. (“Harbor City”) and its founder and CEO, Jonathan P. Maroney raised more than $17.1 million from over 100 investors through unregistered, fraudulent securities offerings.

The defendants originally sold the securities as promissory notes and agreements, offering investors 2%-6% in interest rates for 12-36 months. The investors were promised a full return on their investment principal. The defendants solicited money through Harbor City’s website and online marketing videos posted to YouTube and social media platforms like Facebook. The investors were told in the marketing videos that their money would be used to fund Harbor City’s lead generation business which the SEC claim describes as the process of capturing online interest in a service or product for the purpose of developing sales leads.

Do you know how many times I've heard over the past few days how much the media is failing to follow the money in this story about the newly elected Rep. George Santos? This story makes it clear that's exactly what happened.

https://www.washingtonpost.com/media/2022/12/29/north-shore-leader-santos-scoop/

So let's follow the money, shall we? Starting with Mr. Santos' latest filing for The Devolder Organization, which is apparently responsible for his sudden unexplained wealth.

http://search.sunbiz.org/Inquiry/CorporationSearch/ConvertTiffToPDF?storagePath=COR%5C2021%5C0601%5C00184778.Tif&documentNumber=L21000206150

The organization lists its address as 336 N. Babcock St. Ste 104, and says another organization at the same address but Ste 101 is there called D&D International Investment Services Inc.

Both are affiliated with an individual named Devaughn Dames, who appears to be both a physician and a CFO somehow. He's also very passionate about spreading his knowledge about how to handle your money wisely. His linkedin page mentions both companies. He also seems to be an IT expert; previous domains include https://web.archive.org/web/20160518071721/http://www.manageditsolutions.net/about.html

One of Mr. Dames' email addresses (dev.dames at gmail) was used to register the vanity domain devaughndames[.]com. Firefox didn't like what that site tried to do when I visited it, but it loaded an empty page that had the heading "Financial Educational Services." But the pop-up takes you to a domain called myuwe.net, which is for an entity called United Wealth Education.

Now, UWE is full of stock photos and videos, and there isn't much there about who runs it. And after spending a few minutes on this site, you'll probably come away with the conclusion that the site is tied to some type of scam.

Well, if you look up the name of what Myuwe.com used to be called -- Financial Educational Services -- you'll see they were shut down JUST THIS YEAR by the US Federal Trade Commission for being a giant pyramid scheme that bilked people out of more than $213 million.

How's that for following the money? :) Wait, I'm not done yet.

I love closing out the year with this. 😊

On December 31, 1995, exactly 27 years ago today, legendary cartoonist Bill Watterson published his final 'Calvin and Hobbes' comic strip.

How beautiful and appropriate it was, and a timeless reminder of what we have before us in 2023. ❤️

Happy New Year, ya'll!

Too much, too fast.

Can you understand 6502 assembly? Even if you don't, you might find this thoroughly commented and very readable disassembly of Super Mario Bros. on the NES enlighting:
🍄 https://gist.github.com/1wErt3r/4048722

#retro #gamedev #6502assembly #programming

I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)

So, here are my responses to all of these concerns!

Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.

But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:

- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...

- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...

- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...

- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...

- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...

- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...

- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.

You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.

So, why do I recommend Bitwarden and 1Password? It's quite simple:

- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable.

- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.

Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.

I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!

@jlbaker yeah we all know that one is totally serious and not something people just pretend for political reasons