John L. Taylor @johnnylogic@qoto.org
- Home
- Portland, OR
- Website
- http://www.johnnylogic.org/
Data scientist, fraud researcher, bibliophile, humanist.
Joined Nov 2022
Riprap by Gary Snyder
Lay down these words
Before your mind like rocks.
placed solid, by hands
In choice of place, set
Before the body of the mind
in space and time:
Solidity of bark, leaf, or wall
riprap of things:
Cobble of milky way,
straying planets,
These poems, people,
lost ponies with
Dragging saddles—
and rocky sure-foot trails.
The worlds like an endless
four-dimensional
Game of Go.
ants and pebbles
In the thin loam, each rock a word
a creek-washed stone
Granite: ingrained
with torment of fire and weight
Crystal and sediment linked hot
all change, in thoughts,
As well as things.
- From “Riprap and Cold Mountain Poems”
“Invitation” by Mary Oliver
Oh do you have time
to linger
for just a little while
out of your busy
and very important day
for the goldfinches
that have gathered
in a field of thistles
for a musical battle,
to see who can sing
the highest note,
or the lowest,
or the most expressive of mirth,
or the most tender?
Their strong, blunt beaks
drink the air
as they strive
melodiously
not for your sake
and not for mine
and not for the sake of winning
but for sheer delight and gratitude –
believe us, they say,
it is a serious thing
just to be alive
on this fresh morning
in the broken world.
I beg of you,
do not walk by
without pausing
to attend to this
rather ridiculous performance.
It could mean something.
It could mean everything.
It could be what Rilke meant, when he wrote:
You must change your life.
-- Mary Oliver, “Invitation,” A Thousand Mornings (New York: Penguin Books, 2013).
A video from the paper “Shape oscillation of a levitated drop in an acoustic field,” by W. Ran & S. Fredericks (Clemson University, Department of Mechanical Engineering). #cymatics #science #video
John L. Taylor
boosted
I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)
So, here are my responses to all of these concerns!
Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.
But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:
- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...
- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...
- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...
- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...
- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...
- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...
- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.
You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.
So, why do I recommend Bitwarden and 1Password? It's quite simple:
- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security.
- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.
Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.
I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!
John L. Taylor
boosted
This is not the dystopia we were expecting https://www.nytimes.com/2022/12/19/opinion/columnists/elon-musk-twitter-oligarchs.html
Chag Sameach to my friends celebrating Hanukkah!
John L. Taylor
boosted
"The moment is not properly an atom of time but an atom of eternity. It is the first reflection of eternity in time, its first attempt, as it were, at stopping time."
200 years of beautiful reflections on the nature and mystery of time https://www.themarginalian.org/2022/12/13/time/
John L. Taylor
boosted
'Twitter is a mess, so former employees are creating Spill as an alternative' via TechCrunch
https://techcrunch.com/2022/12/16/spill-twitter-alternative/
John L. Taylor
boosted
From #Logic to Technology and Back. A great talk by @vardi !
https://youtu.be/dajmA4ff-Uc
John L. Taylor
boosted
This is a good video on a topic that I've long been interested in: people often take the wrong lesson from the Copernican revolution.
We now know that from a math perspective, any point can be used as the center of the solar system for visualization purposes. The key idea is that placing the sun at the center simplifies some things and facilitates better physical understanding. And in any case, the sun moves too.
John L. Taylor
boosted
My piece putting tomorrow's #fusion announcement in context has just come out:
(Paywalled, but 12ft.io works as a bypass.)
Quick summary: if this is really is 2.1 MJ laser light in to 2.5 MJ fusion energy out, then it really is achieving a decades-old definition of ignition in this type of fusion reaction (ICF, as opposed to magnetic fusion.) It'll be the first defensible claim of producing net fusion energy in the lab. BUT....
(more)
John L. Taylor
boosted
"Overall, this recurring pattern of lackadaisical approaches to model release—and the defensive responses to critical feedback—is deeply concerning."
Under no circumstances should we genuflect to the nihilistic disruptors of Silicon Valley.
Morning Routine by Bianca Stone
Some days I get up to run but then
just sit in spandex and write poems.
Is the fog lifting or the trees rising? Who cares.
Nature transfers blood into the air. We are
its lung cancer. Its trans fat. Its addiction.
Some days I get up to write but instead, clean
the horrible beans from the night before,
beer cans on the coffee table. At the window
the insects are bigger and scarier
than the month before.
They are giving their last Hurrah.
I creep around like Nancy Drew
with my hunch and no real proof.
All things feel preordained, repeated.
My body is numb. Without anticipation.
I sit in the lobby of someone else’s potential,
thinking it is my own. I go about my day
convinced I am immortal.
(Source)
John L. Taylor
boosted
Here's the video of a virtual talk I gave yesterday on dynamical systems theory in neuroscience. I suggest that the language of attractor basins can be used to discuss high level behavioral phenomena, including some symptoms of psychiatric disorders.
'Cognitive and behavioral attractors: dynamical systems theory as a lens for systems neuroscience'
John L. Taylor
boosted
May God grant me the confidence of a large language model.
MLOps - Definitions, Tools and Challenges
“This paper is an overview of the Machine Learning Operations (MLOps) area. Our aim is to define the operation and the components of such systems by highlighting the current problems and trends. In this context we present the different tools and their usefulness in order to provide the corresponding guidelines. Moreover, the connection between MLOps and AutoML (Automated Machine Learning) is identified and how this combination could work is proposed.”
John L. Taylor
boosted
A stunning example of a Kelvin-Helmholtz instability over Wyoming
John L. Taylor
boosted
It's that time of the year where I teach our 1st year #DataScience students about data *in the wild*
John L. Taylor
boosted
Can you spot the circles?
It took me a long time. Once you see them, they'll seem obvious.
This is the Coffer Illusion, by Anthony Norcia
John L. Taylor
boosted
'Noise in Cognition: Bug or Feature?' https://psyarxiv.com/438nd/
"First, both perceptual and preferential judgments show that sensory and motor noise may only play minor roles, with most noise arising in the cognitive computations."
"...we propose that the brain approximates probabilistic inference with a local sampling algorithm, one that uses randomness to drive its exploration of alternative hypotheses."
Sort of obvious? But good to see it out there.
- Home
- Portland, OR
- Website
- http://www.johnnylogic.org/
Data scientist, fraud researcher, bibliophile, humanist.
Joined Nov 2022
