Void Abyss @voidabyss@qoto.org

Again, the FDA is lying

I'll take just one point, needle aspiration, pulling back the plunger before injecting to make sure the needle tip is not in a vein.

FDA: “Aspiration before injection of vaccines or toxoids is not necessary because no large blood vessels are present at the recommended injection sites, and a process that includes aspiration might be more painful for infants.”

That is a lie.

Many countries around the world require aspiration of the needle, and videos prove that approximately 1 in 1,000 aspirations of the vaccine needle in the shoulder draw blood, showing the needle point WAS in a vein.

Injecting the vaccine into a vein is virtually guaranteed to cause serious side effects, even death.

https://www.thegatewaypundit.com/2023/01/covid-19-vaccines-not-associated-sudden-death-fda-response-americans-concerns-covid-vaccines/

#DiedSuddenly #VaccineInjury #VaccineDeath #MillionsDied #MillionsWillDie #StopTheShots #GeneTherapy #ExcessMortality #PopulationReduction

@ignas @matthew_d_green

Bruce Marshall (PasswordResearch) and Michal Spacek (PWTooStrong) have been tracking this stuff for years, you'll find tons of examples on birdchan and Reddit. I also remember someone maintaining a GitHub repo called "Dumb Password Rules" that similarly tracked this stuff.

Here's a few famous ones I know off the top of my head:

Microsoft silently truncated passwords at 16 chars for Live, Outlook.com, etc for years, all the way up until 2019.

PayPal still silently truncates at 20.
https://www.reddit.com/r/cybersecurity/comments/10g22mr/paypal_silently_truncates_passwords_to_20/

BofA also still truncate at 20 afaik.

Myspace truncated passwords at 12 characters (and also transformed them to uppercase making them case insensitive).

I think my favorite is Fidelity, who converts passwords to telephone keypad values (letters replaced with corresponding keypad number, special chars replaced with asterisks, numbers unchanged.) https://twitter.com/jmgosney/status/983814268545093632?t=PHh-6bZN2IKF6O2w8J6bqw&s=19

Bottom line, truncation is a super common practice. So is transformation, sanitization, etc. What you input may not be at all what gets hashed/stored.

CW Long post. Original content.

How parents of DS children are subtly directed toward abortion

There has been little reaction to the news that 95pc of babies diagnosed with Down Syndrome before birth at the Rotunda hospital are subsequently aborted in England.

The response to these horrendous figures has been silence or fatalism. For some, it is an individual “choice” to be respected. There is nothing to be worried about or, even when people find the figures regrettable, little can be done.

“I don’t have a view on whether that is the right thing. We don’t advocate for it, that is just the lived experience”, said prof Fergal Malone, master of the Rotunda.

Is it true? Is it really a purely personal choice, without outside influence or expectations from others? Two recent studies on the experience of parents of children with DS indicate otherwise.

Irish research published last year interviewed eight people following the birth of a child with DS. Some praised the doctors and nurses, but others said the information they received was too medically focused and too negative. It is very hard to believe the same does not happen to couples who are told their baby has DS before it is born.

“Don’t come in with a list of negatives, all the negatives that were put in your head initially we never expected her to be this good now”, said one of the interviewed mothers.

She recalls: “We received purely negative information that she could have this or that, …”

A father said, “Doctors should show compassion when they are delivering the news, have patience and don’t be rushing in and out”.

A Danish study spoke to parents who were told their babies had Down Syndrome before they were born. In Denmark, almost all children with DS are aborted.

The study notes: “Following the diagnosis, the couples were generally critical of the information provided by the hospital. Some felt that the health professionals had painted an unnecessarily grim picture of Down Syndrome based on what couples perceived as outdated information. … Some felt that there was an unnecessary focus on potential diseases and additional diagnoses when the couple was more interested in their potential for living a fulfilling life.”

Participants in the study report feeling pressure from health professionals they encountered to abort, or else that they were presented with overly negative information about their babies.

The research found that “couples felt that termination of pregnancy had been taken for granted following the diagnosis: ‘As the obstetrician sat down, she put those abortion application forms on the table in front of her’”, recalls a mother.

Even conveying apparently neutral information, such as presenting what other couples generally do, can condition parents. We tend to imitate others. Social expectations can be subtle and unconscious.

“Maybe there’s something wrong with me since I don’t just do what 98pc of all people would do”, said a Danish mother in the study, who decided to have the baby.

“The high percentage of terminations in Denmark was a source of doubt and uncertainty during the decision-making process. This left the couples feeling vulnerable”, it notes.

“Why is Down Syndrome the disability [considered] socially acceptable to terminate? And how do we come back from that?”, asks actress Sally Phillips in her documentary “Prenatal Genetic Testing” where she investigates how Non-Invasive Prenatal Tests have increased the number of babies with DS, and other genetic or chromosomal anomalies, who are being aborted. Phillips has a son with Down Syndrome.

These tests, which can take place in the first trimester of pregnancy, are becoming more affordable and available. They can be used to prepare families to welcome a child with medical anomalies, or they can be used to get rid of them, as almost always happens when a diagnosis of DS is given. A proper ethical debate about those prenatal tests has still to happen in Ireland.

In a society that has normalised abortion, the main way to fight the progressive elimination of children with DS is for doctors to portray life with the condition, and life for the parents of such a child, in far more positive terms than seems to be the case at the moment. The medical professionals claim to be neutral about their use, but being not directive isn’t enough when society goes in one direction only.

Certainly, a national debate is called for.

Open corruption, All day, Every where!

Slack suffered a security incident over the holidays affecting some of its private GitHub code repositories.

https://www.bleepingcomputer.com/news/security/slacks-private-github-code-repositories-stolen-over-holidays/

The Pedo Pete effect...

CW Long post. Original content

The deadly inaccuracy of many prenatal tests

Prenatal tests are a vital part of the thriving eugenics industry whereby unborn children with genetic defects are not considered fit for life and are aborted instead. But a report in The New York Times (not a pro-life paper) confirms that the tests for certain foetal abnormalities are often unreliable as they give too many false positive results.

Even if advertised as highly accurate, for some conditions positive test results were incorrect more than 90pc of the time.

We highlighted the problem of the inaccuracy of foetal tests in a previous blog three years ago.

Non-invasive prenatal testing (NIPT) is used to screen the probability that chromosomal abnormalities, such as Down Syndrome, are present. These tests are now offered for more and more conditions. A positive screening test should be followed by a diagnostic test, to confirm the presence of the abnormal condition. Unfortunately, many do not wait for the follow-up test and abort their babies, not knowing that those screening tests are often wrong, as the New York Times article showed. With rare conditions, the probability of mistakes grows.

In Ireland we saw the tragic case of a baby who was aborted in Holles Street National Maternity Hospital at 19 weeks after his parents were incorrectly told that he suffered from Edwards Syndrome, a condition that is usually fatal.

But this is not a one-off case. It is likely that many healthy babies are aborted on the false presumption that they are disabled or will not live long after birth.

Ten of the 17 brochures given to parents by prenatal tests services and reviewed by the New York Times never mention that a false positive can occur and only one mentioned how often positive results are wrong.

The newspaper looked at five conditions, namely DiGeorge Syndrome, 1p36 Deletion, Cri-du-chat Syndrome, Wolf Hirschhorn Syndrome and Prader-Willie and Angelman Syndromes, and found the prenatal tests are wrong almost all the time (81pc, 89pc, 80pc, 86pc and 93pc respectively). This is appalling.

In 2019, the UK Advertising Standard Authority ruled that the ads promoting prenatal screening tests were misleading. For instance, out of 100 tests indicating the presence of Edwards Syndrome, only 37 were correct. Still, the tests were presented as 99pc accurate because if the condition is present, it is detected 99pc of the times. Accurate does not mean correct because often the test mistakenly says it is present. (For a more detailed account see here: https://ionainstitute.ie/the-inaccurate-accurate-tests-for-foetal-abnormalities/ )
In simple words, those tests are oversensitive as they tend to err on the side of false positives.

Oversensitive NIPT would not be a problem in a society that does not kill those suffering of abnormal conditions. The tests should be used to prepare families and doctors to welcome the newborns and care for them according to their special needs. Moreover, decisions should be made once the diagnosis confirms the screening results.

But oversensitive tests are morally problematic in our society, where abortion is the default outcome of positive testing results. Many do not even wait for the follow-up diagnostic test.

In Ireland, there is no gestational time limit for abortions when the baby is not expected to live longer than 28 days and now campaigners want to extend this possibility also to non-fatal abnormalities. This would only increase the probability that healthy babies are aborted.

Even the most ardent pro-choice campaigners should want everyone told about the literally deadly inaccuracy of many of these tests.

[AGENDA 2030]

- The Great Reset
- Un gouvernement mondial
- Quatrième révolution industrielle
- Corporatocratie technocratique
- Dépendance totale au système de crédit social de l'État.
- Système de surveillance de l'empreinte carbone
- Revenu de base universel pour les citoyens conformes
- Monnaie numérique de banque centrale programmable
- Dépeuplement
- Vaccins obligatoires pour tous les âges
- Fertilité et reproduction contrôlées
- Lois radicales sur le suicide assisté et l'avortement
- Aliments et sols génétiquement modifiés à 100%
- Interdiction de tous les remèdes et traitements naturels
- Main-d'œuvre robotique
- Internet des objets et Internet des corps
- Micropuces et technologies d'interface cérébrale implantables
- Exposition constante aux CEM et RF non natifs (5G, 6G, 7G)
- Destruction des genres
- Destruction de la maternité et de la paternité
- Rationnement de l'énergie et de toutes les ressources naturelles
- Restrictions des voyages aériens "non essentiels"
- Villes intelligentes
- Drones, caméras de reconnaissance faciale, capteurs de mouvement
- Abolition de la propriété privée
- Contrôle et surveillance de la nature et de la faune
- Accès restreint à la nature sauvage (zones sans humains)
- "Développement durable" du Nouvel Ordre Mondial.

Allez !! Encore une plante qui guérit le petit Covid. Mais cela n'intéresse surtout personne. Un haut responsable du ministère de l'Union d'Ayush a révélé que parmi les 65 000 patients #covid là-bas qui ont été traités avec l'Ayurveda tout au long de la pandémie, pas un seul n'est mort !
https://www.naturalnews.com/2022-12-30-ayurveda-cures-65000-patients-indian-town-covid.html#

This is rich, the guy being targeted is the President of Stanford. Scandalous!

https://www.statnews.com/2022/11/30/stanford-president-altered-images/

Please sign and boost this petition to help support Extinction Rebellion Korea rebels facing staggering fines for their nonviolent climate activism.

https://bit.ly/nomoreairport_southkorea

#climate
#ClimateCrisis
#southkorea

@ScientistRebellion @elokapina @news_en @xrdresden @xrgermany @xrfrance @xrczech @xrlatam @xrlille @NRW_XR

I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)

So, here are my responses to all of these concerns!

Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.

But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:

- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...

- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...

- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...

- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...

- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...

- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...

- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.

You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.

So, why do I recommend Bitwarden and 1Password? It's quite simple:

- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable.

- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.

Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.

I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!