ceoln @ceoln@social.cleverlibre.org

I have extensive professional experience in this area. Here's an article from 29 years ago, when I was engaged as an elf-wrangler/santabot master for the holidays. https://archive.org/details/RTFM-D-19931224-santa/mode/1up

After George Floyd was killed miles from my house, I quit my corporate law job to build @TurnSignl—an app to instantly connect drivers to a lawyer on a video call 24/7. TurnSignal:
✅ Auto records the stop
✅ Is voice activated
✅ Free for low-income folks

Download @ link in the about tab!

CyberSpace must not become just another power-oriented frontier fraught with struggle and violence. ↯92MAR

The seventh candle is We Are All Completely Beside Ourselves, by Karen Joy Fowler. It's hard to know what to say about this book, because I advise approaching it as fresh as possible. The story is told in a certain way ("start in the middle," the narrator's father tells her) for a reason. A story about a family coping with a rupture that won't heal.

#BookishHanukkah #Chanukkah #Hanukkah #bookstodon #seventhcandle @bookstodonmy #BookishAdvent

The #Sun is starting to win its fight with the darkness, but at the moment it still looks like it's failing. #Sunset

The @internetarchive is magic.

1. One-line command to download 449 items and specify --format="DjVuTXT". You get the OCR'd text for each book.
2. egrep "^ISBN" */*txt
3. Clean up the results (<30 minutes)
4. Modify metadata to add isbn:$value for each item.
5. Kick off a book_op for each, and it will go fetch a MARC record for each item.
6. Voila! All the metadata is now populated from the MARC record.

Librarian cataloging on steroids.

I cannot stress enough that organised media manipulators, harassers, & white supremacist orgs use flamebait, debate, flame wars, drama, arguments, outrage & tabloid gossip as part of their strategy.
Amplifying them and assembling an audience for them is exactly what they want. They will pivot on that to multiply harms - at the low end of the harm scale, they’ll goat se the audience. At the high end: hundreds of people see revenge porn of a secondary target. Or worse.
Squelch them, every time.

Pooch pic time! #dogs

Ice along the edge of the Arkansas River down below the deck

It's probably just me, but I get sad every time I lose a sock. This is my sketch of 8 years ago that tries to express it. #rnapper #MastoArt #watercolor

For #caturday, I offer thee my mom's tiny lady cat Freya.

She's about a year old was rescued this summer with her first litter of mini kitties, which have since been weaned and rehomed.

Two weeks ago, after 4 months being fostered, Freya got to meet my mother and got her forever home, where she already has taken to battling specs of dust, running after toys and bullying her human to go to bed for comfy cuddles.

#catsofmastodon #rescuecat

But there is kindness out there too. Heaps of it. Nestling quietly in those places where the brash and the hateful and the egocentric don't care to shout. I've been the recipient of so much kindness. Kindness as love. Kindness as meaningful citizenship. The one sovereignty worth holding. A flag raised over the best things we can be. x

Jesus: *holds up bread* this is my body
*holds up wine* this is my blood
*holds up hotdog* this is a sandwich lol
Judas: ok that does it

Tjornin, Reykjavik.

Hi Mastodon! Well I reached 100,000 followers! Thank you so much, I love you all!
As promised, I have brought the mighty Mastodon back from extinction, so watch out! They’re out there stomping around and tooting like crazy! 💨

Many of you have been asking for my thoughts on the #LastPass breach, and I apologize that I'm a couple days late delivering.

Apart from all of the other commentary out there, here's what you need to know from a #password cracker's perspective!

Your vault is encrypted with #AES256 using a key that is derived from your master password, which is hashed using a minimum of 100,100 rounds of PBKDF2-HMAC-SHA256 (can be configured to use more rounds, but most people don't). #PBKDF2 is the minimum acceptable standard in key derivation functions (KDFs); it is compute-hard only and fits entirely within registers, so it is highly amenable to acceleration. However, it is the only #KDF that is FIPS/NIST approved, so it's the best (or only) KDF available to many applications. So while there are LOTS of things wrong with LastPass, key derivation isn't necessarily one of them.

Using #Hashcat with the top-of-the-line RTX 4090, you can crack PBKDF2-HMAC-SHA256 with 100,100 rounds at about 88 KH/s. At this speed an attacker could test ~7.6 billion passwords per day, which may sound like a lot, but it really isn't. By comparison, the same GPU can test Windows NT hashes at a rate of 288.5 GH/s, or ~25 quadrillion passwords per day. So while LastPass's hashing is nearly two orders of magnitude faster than the < 10 KH/s that I recommend, it's still more than 3 million times slower than cracking Windows/Active Directory passwords. In practice, it would take you about 3.25 hours to run through rockyou.txt + best64.rule, and a little under two months to exhaust rockyou.txt + rockyou-30000.rule.

Keep in mind these are the speeds for cracking a single vault; for an attacker to achieve this speed, they would have to single out your vault and dedicate their resources to cracking only your vault. If they're trying 1,000 vaults simultaneously, the speed would drop to just 88 H/s. With 1 million vaults, the speed drops to an abysmal 0.088 H/s, or 11.4 seconds to test just one password. Practically speaking, what this means is the attackers will target four groups of users:

1. users for which they have previously-compromised passwords (password reuse, credential stuffing)
2. users with laughably weak master passwords (think top20k)
3. users they can phish
4. high value targets (celbs, .gov, .mil, fortune 100)

If you are not in this list / you don't get phished, then it is highly unlikely your vault will be targeted. And due to the fairly expensive KDF, even passwords of moderate complexity should be safe.

I've seen several people recommend changing your master password as a mitigation for this breach. While changing your master password will help mitigate future breaches should you continue to use LastPass (you shouldn't), it does literally nothing to mitigate this current breach. The attacker has your vault, which was encrypted using a key derived from your master password. That's done, that's in the past. Changing your password will re-encrypt your vault with the new password, but of course it won't re-encrypt the copy of the vault the attacker has with your new password. That would be impossible unless you somehow had access to the attacker's copy of the vault, which if you do, please let me know?

A proper mitigation would be to migrate to #Bitwarden or #1Password, change the passwords for each of your accounts as you migrate over, and also review the MFA status of each of your accounts as well. The perfect way to spend your holiday vacation! Start the new year fresh with proper password hygiene.

For more password insights like this, give me a follow!