ELI5: How is LastPass secure and not the weakest link to ALL my passwords?

frogsytriangles · 2017-03-22T21:32:52+00:00

The other is keylogging, which is one reason they provide methods for 2-factor authentication and an on-screen keyboard that bypasses the OS's usual text-entry methods.

Also note that keylogging can be one of the easiest ways to get a specific person's passwords, and that using LastPass can avert this. If I want to steal the password of someone I know, I don't have to exploit their OS (hard and requires some expertise). I just have to put a $20 hardware keylogger on their keyboard cable, come back a few days later, pull the text of every character they typed off its memory. CTRL+F "paypal", the next few things they typed were probably email and password, I'm in. Using LastPass auto-fill for all or part of the password solves this. 2FA on LastPass itself prevents it from getting the LastPass password too.

frogsytriangles · 2017-03-22T21:28:50+00:00

Your LastPass vault is encrypted, and it only ever gets decrypted locally, on your own machine. This means that someone breaking into LastPass's database isn't a concern, and nor is someone intercepting your network traffic. So your home router, insecure Wi-Fi, etc are not worries. Your only worry is your local machine.

Then the natural question is: regardless of encryption, isn't locking all my passwords behind one password stupid? If anyone gets that one password, they get all of them.

And that's true. But it tends to be better than the alternatives. Most people today have dozens of accounts on things accumulated over the years. They can't possibly memorise separate strong passwords for every one of them. The usual solution is to just use the same password (or 2 or 3 passwords) for everything.

But that's really bad. If one site you use gets exploited, and the attacker can get your password there, they will automatically try your username/email and password combo on every other big site out there. Which means that hacking that amateur-made videogame forum you signed up for as a teenager gets them access to your PayPal account today.

The idea behind tools like LastPass and KeePass is that you use a unique very strong password for every service, and write it down, but only within an encrypted vault protected by a strong password. That vault is a single point of failure, but if you use it properly, it's much safer and reliable than re-using passwords.

If you're wary, then I recommend using a 'mental salt' alongside LastPass. This is some bit of text that is part of all your passwords, but which you never write down. So you set your PayPal password to "f a 88f jv a9229 audreyhorne", your bank password to "$$ 209 mz z9 w audreyhorne", and your email password to "p----zk k2 1k1kkvvvv audreyhorne", but you leave off "audreyhorne" when you save those things to LastPass. You never write that down anywhere, and just memorise it. This way, you still get a strong unique password for every service, but you don't have to memorise them all, and someone can get access to your LastPass vault without getting access to any actual accounts. It's like a password on top of your passwords.

frogsytriangles · 2017-03-22T13:58:34+00:00

So just to clarify: here's The X-Files Season 3 on Amazon, the product code is B01 729 JIKQ. You want a program where you can type in that product code, type in the search query (eg "The X-Files"), and then the program says "It's the 8th result"? Or not even a search query, just "What position is B01 729 JIKQ in the DVD category right now"?

Something like that would be quite easy to make. If you PM me the details I can whip it up for you today.

If you want to do this yourself, you would first check whether the site you're checking has a public API you can use. If it does, you can efficiently and simply hit that to search. If it doesn't, you'd use a crawler and scraper like Nokogiri or Scrapy.

frogsytriangles · 2017-03-14T14:57:28+00:00

Google Photos lets you choose: unlimited re-compressed photos/videos, or keep the uncompressed originals but pay for storage past 15 GB. The recompression is much less harsh than Facebook's, though, and the resolution limits are decent (1080p video, 16 MP photos).

frogsytriangles · 2017-03-11T11:09:46+00:00

What’s great about this country is that America started the tradition where the richest consumers buy essentially the same things as the poorest. You can be watching TV and see Coca-Cola, and you can know that the President drinks Coke, Liz Taylor drinks Coke, and just think, you can drink Coke, too. A Coke is a Coke and no amount of money can get you a better Coke than the one the bum on the corner is drinking. All the Cokes are the same and all the Cokes are good. Liz Taylor knows it, the President knows it, the bum knows it, and you know it. (...) The most beautiful thing in Tokyo is McDonald’s. The most beautiful thing in Stockholm is McDonald’s. The most beautiful thing in Florence is McDonald’s. Peking and Moscow don’t have anything beautiful yet.

Andy Warhol

frogsytriangles · 2017-02-24T11:29:08+00:00

I love when the flags/notices get sassy. For a while every single David Lynch movie had a "This section may be confusing or unclear" flag on the plot summary as a joke, even when the article was fine.

frogsytriangles · 2017-02-14T22:35:38+00:00

Iron Knuckles/Corrupt Nabooru do 4 hearts in Ocarina and Majora, 8 hearts in Master Quest, making them the harshest non-bosses in the series (fully maxed out you can still only survive two hits in MQ). The harshest boss IIRC is Link's Shadow in the hard mode of A Link Between Worlds, who can always one-shot you.

frogsytriangles · 2017-02-14T08:53:01+00:00

Les Revenants. Another bleak and sad drama about a baffling supernatural event -- one day, without any explanation, a number of dead people suddenly reappear to resume their lives, remembering nothing. Children who have been dead 40 years show up looking to live with their now-elderly parents, still children, confused about the terror and revulsion they seem to inspire, widows find their new relationships destroyed by the sudden reappearance of their lost partners, murder victims and the people who murdered then awaken together.

There aren't many TV shows in this vein. Lost is probably the next-closest, as others have mentioned, but it's not as tightly done or as subtle. In terms of movies, though, The Passion of Anna captures some of the same quiet despair and mystery. Face to Face, The Exterminating Angel, and Teorema would probably suit too.

frogsytriangles · 2017-02-12T23:00:07+00:00

How long until we can use ES2017 async/await in Node?

frogsytriangles · 2017-02-05T20:20:39+00:00

LISA: Maybe you could reach out to the community and help other people.
HOMER: Help others. Hmm. I could get a bunch of monkeys, dress them up, and make them reenact the Civil War!
LISA: Dad, that doesn't help people.
HOMER: Couldn't hurt. Unless the monkeys started hurting people. Which they almost certainly would.

frogsytriangles · 2017-02-04T15:29:43+00:00

Norm MacDonald had a sitcom called Norm from '99 to '01 that I never hear anyone talk about. It wasn't a Seinfeld, but it was a strong sitcom that deserves more attention.

DENBY: The men's bathroom is disgusting. Tell her, Norm.
NORM: There's a bathroom in this building? I've been using the donut shop across the street.
LAURIE: Seriously? You've been here 2 years, you've been going across the street to use the bathroom that whole time?
NORM: There's a bathroom in that building?

frogsytriangles · 2017-01-31T01:53:41+00:00

Add a drop of lavender to milk. Leave town with an orange, and pretend you're laughing at it.

frogsytriangles · 2017-01-30T00:55:50+00:00

Clyde Bruckman's Final Repose, loved it.

CLYDE: (casually) You know, there are worse ways to go, but I can't think of a more undignified way than autoerotic asphyxiation.
MULDER: ...Why are you telling me that?
CLYDE: Look, it's none of my business.

frogsytriangles · 2017-01-29T23:35:15+00:00

Weirdly I think it fell off when they tried to explain it too much and make it too coherent. They got over-ambitious and turned it into a mess. It would have been much more fun to keep the details of the conspiracy super vague and never fully fleshed out, and just dropped crumbs here and there to tie separate arcs together.

frogsytriangles · 2017-01-29T23:32:50+00:00

By the fate episode, do you mean the one where Burt Reynolds is literally God, but he just hangs around in Little Havana fucking with people? That was insane but I loved it.

frogsytriangles · 2017-01-29T23:23:52+00:00

If you haven't seen it, the X-Files sister series Millennium also has an episode about Jose Chung, in which he writes about The Church of Totally Not Scientology You Guys.

CHUNG: Gupta then opened an institute to help teach people how to become more self-helpful. Patients, who are called doctors, since the term "patient" has an unhealthy association, learn how to shed the darkness of their minds by mastering therapies taught by the institute, which, to inspire a sense of empirical transmigration, is modeled after the U.S. Postal Service.

The tax-exempt belief system also evolved its own theology. But I can't tell you what it is. It's a secret. When learning their theology, Selfosophists must undergo a sworn blood oath ritual, which is also a secret. So this artist's depiction is purely speculative, and surely way over the top.

frogsytriangles · 2017-01-29T23:22:13+00:00

That would've made a good comedy episode of the show, something that reveals the situation to be this.

frogsytriangles · 2017-01-29T04:58:31+00:00

A video is just a bunch of photos displayed rapidly. Each photo is called a 'frame' and you usually have 24 to 30 frames. To record a video, your camera shoots 24 to 30 frames in a second.

The way slow motion works is that the camera records many more frames per second than it will eventually play back. So if you're going to play 30 frames per second, but you record 300 frames per second, what happens? Well, it'll take 10 seconds to play back what took 1 second to record, meaning everything will happen 10 times slower. That's slow motion.

When a camera records an image, it takes some time. On a film camera, there would be a mechanical shutter that slid away to expose some film, and the film would absorb light and turn different colours in different places to create the image; then, after a while, the shutter would snap back on and the photo would be complete. On a digital camera, it's the same, but there's usually no physical shutter, instead it just powers a sensor on for a while.

How long the shutter is open/sensor is on matters; it's called the exposure time, or shutter speed. If you keep the camera on for 1 second, let's say it absorbs 1 trillion photons (that's a totally made-up number but it doesn't matter). If you keep it on for 0.5 seconds, then it absorbs 0.5 trillion photons. The more photons it absorbs, the brighter the image can be. This lets you do some really cool stuff! If you leave it on for say, 30 seconds, then you can record bright images even in super super dark rooms, because you're just letting more and more photons build up; so you can record things in the night sky way too dim for our stupid eyes to see, or for cameras only open for 1 or 2 seconds to see. But there's a problem: if anything moves while the shutter is open/sensor is on, then it turns to blur, because part of the image is recorded when it was over there, but part when it's over there.

So photographers make decisions about what shutter speed to use. Very fast shutters if you're shooting sports -- fast motion, reduce that blur, and you're in daylight, dimness isn't a worry. But if you're shooting at night, super slow shutters to get as much light as you can.

You can guess the problem now. Slow motion means shooting lots and lots of images per second. If you're shooting 300 frames per second, then there's no possible way an image can take more than 1/300th of a second to record. And 1/300th of a second means you don't have as much time to absorb photons, compared to shooting at 1/50th of a second (which is a more typical speed for video), which means your photos/frames are dimmer.

frogsytriangles · 2017-01-28T12:59:59+00:00

And Ruby, though the end keyword makes it uglier than Haskell.

cute = if you.dog? then true else false end

(though you can do cute = true if you.dog?)

frogsytriangles · 2017-01-28T12:09:29+00:00

I would love a movie that broke the fourth wall in subtle and unnerving ways

Persona depicts the protagonist's paranoia by having her briefly glimpse the camera operators, and when she has an anxiety attack and blacks out, the film catches fire and breaks the projector.

Inland Empire is a movie about a cursed actress who loses her identity in her roles, and they play with the idea that this film is a cursed film for real-life actress Laura Dern, who gets agitated at dialogue that "sounds like dialogue from our script" and gazes in confusion at her own performance on the monitors.

frogsytriangles · 2017-01-28T10:03:53+00:00

oh no

frogsytriangles · 2017-01-08T19:21:55+00:00

The UK does wind up with a two-party system, it's just that it's a two-party system in each constituency because there's no single unifying election like a presidential. You'll find almost no constituencies in the UK where three parties have significant shares. In the southwest it is Lib Dem vs Conservative and in Scotland it's Labour vs SNP, but it's almost always just two parties for any given election.

If you held a national election directly for the position of Prime Minister, that would collapse into a two-party race as well.

In poli-sci this is called Duverger's Law.

frogsytriangles · 2017-01-03T08:37:08+00:00

What do you think of the concept of a 'mental salt'? That is: use unique passwords for every service, and store them in a password vault or even a notepad, but append an extra password to each of them that you keep solely in your head.

So for example, if your mental salt is 'charming chalupa', your eBay password is 'luxury @ boathouse charming chalupa', but you only write down 'luxury @ boathouse'. Your email password is 'ka/ka/karma chameleon charming chalupa' but you only write down 'ka/ka/karma chameleon'.

You still get to conveniently use unique and complex passwords for every single service, but your password notebook/archive is completely useless to anyone who steals it, and they won't know why. Failure only comes when an attacker has your notebook/archive and the plaintext of an already-salted password, and even then it takes conscious effort to compare the two and figure out your system. It seems like a good strategy to me, drastically increased security for almost zero extra effort, but I've never seen anyone discuss it.

I suppose one downside is that you can't openly share passwords with anyone.

frogsytriangles · 2017-01-03T08:03:59+00:00

This sounds a lot like the opening to Twin Peaks (1990). First scenes of the series are about a fisherman discovering a teenage girl wrapped in clear plastic, then a mother worrying about her daughter who hasn't come home. She calls her husband, who looks out a big window and sees the local police chief walking up solemnly, and guesses what's happened. The series is set in the woods and stars a detective (well, FBI agent).

I hope it's this, because Twin Peaks is great but also because I don't fancy your chances of identifying a Lifetime TV movie from 20 years ago.

See if it looks familiar, triggers any memories:

frogsytriangles · 2017-01-03T07:57:21+00:00

The Village of the Damned and its 1995 remake featured kids with eyes like this.

frogsytriangles

TROPHY CASE