bbbbb5

It's a conspiracy theory because Nacchio was actually guilty of insider trading regardless of what the NSA may have done.

From the court decision which you didn't bother to read:

>Even if the classified information were presented and established what he said it would, it could not exonerate Mr. Nacchio as he claims. Essentially, Mr. Nacchio argued that undisclosed positive information can be used as a defense to a charge of trading on undisclosed negative information. We disagree. … If an insider trades on the basis of his perception of the net effect of two bits of material undisclosed information, he has violated the law in two respects, not none.

The government proved insider trading.

>I'm not going to claim to be an american law expert, but when the agencies can just say "nope" to evidence against them in said court of law, it becomes hard to claim strong legal protections. I may be wrong and misunderstanding the law, but it does seem like that. And as a shot in the dark here I doubt it got any better after the patriot act.

This is nonsense. In your example the court said "nope" to the defendant trying to push a conspiracy theory which could not possibly have exonerated him.

Here's a decent read on the Nacchio case without weird conspiracy theory bullshit https://truthonthemarket.com/2008/03/31/some-thoughts-on-the...

>I could see a world where ‘see if it violates your own policies’ is a code for extortion with plausible deniability.

That's not the world we live in. If you reply with "Blow me", the FBI will do nothing.

> A single developer associated

Laslo is the first chair of the board, not just "a single developer".

> It's not nothing, and it's weird to be strident about it

To an outsider, hearing people talk about how LastPass used Very Bad ECB mode makes it sound like a fuckup with immediate and dramatic effect on the security of their passwords, that isn't exactly true.

Nobody should have been using LastPass, but we can still be realistic about the threats facing those who did.

> but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about.

Of course not, but that's a completely separate issue from their choice of AES mode.

That's exactly what I'm saying :)

If the attacker doesn't have the valid password, the knowledge that two different sites share the same password isn't exactly game-changing. And if the attacker does have the password, they'll figure out where it works regardless of access to LastPass db.

I don't think this is a significant advantage, the cost of an incorrect password attempt is essentially zero. Trying "every password they have on every website" for an individual will still be a very small set of passwords to try.

>Am I misunderstanding something here?

No, not at all. The point is that while ECB is a silly choice, it does not make it easier for the attacker to crack your vault. It does allow the attacker to see if you're reusing passwords, but does not reveal to the attacker what those passwords are.

On the other hand, If the attacker were to discover one of your passwords from another source, they'd be able to confirm reuse anyway by simply attempting to use that password on other websites.

Attacker doesn't need to control the login form to use it as an oracle to confirm password reuse.

No paywall https://www.vwvortex.com/threads/my-ride-series-japanese-v12...

These vaults conveniently come with unencrypted URLs of the login forms associated with each password. An attacker who discovers the plaintext of one password can trivially attempt to reuse that against all of the forms.

Incorrect password attempts are essentially free, so ECB revealing reuse does not meaningfully help the attacker.

Given that any login form can be used to rapidly confirm password reuse it's hard to see how ECB introduces new issues here.

>This allows an attacker to detect repeating plain text segments, e.g. reused passwords.

This is hardly a problem, any login form will also allow an attacker to do this.

>Wtf wtf wtf. This would be considered wildly insecure even by the standards of the 80s

For this particular use-case? Hardly.

Since an attacker can easily use any login form of their choice as an oracle for password reuse, ECB mode can't really introduce significant issues here.

>I have to wear fingerless gloves so that I can use my smartphone to receive orders from DoorDash, Uber, and Grubhub

Hasn't this been a solved problem since like ... 2007? https://www.nytimes.com/wirecutter/reviews/best-touchscreen-...

Yes, but how exactly is the LastPass implementation faulty? In your other comment you claim to know that it is.

Do you actually know anything about this subject, or are you just speculating?

You came looking for a fight, don't act so surprised when you get one.

Go verbally attack random people on the street, see if you don't come home with a bloody nose.

If your comment hadn't been so obviously in bad faith, you'd have received a different response. A 7 months old account that has only mentioned LastPass within the past 24 hours was obviously not created to systematically defend LastPass.

In fact, the account you were replying to hadn't even been "knocking down any criticisms of LastPass" as you accuse. There's not a single comment made by "rosnd" you could reasonably describe as defending LastPass.

Pretty sure most people with block heaters have these, they run off the same power source https://pic.beely.crasman.cloud/BVC-228/BVC228_11.jpg

Almost all ICE cars I've seen sold in Nordic countries during the past 30 years have an outlet on the passenger side to power these. I think these have been a thing since the 70s though.

>Wow. That would be "nearly every modern gas vehicle in north America".

>Seriously. Running a cold petrol engine under low load in freezing conditions only for heating i just simply a bad idea. Never understood how this is even remotely OK in the US. This is illegal in most of Europe. And for good reason.

My German BMW 7 series definitely had remote start (and an auxiliary heater too). Maybach GLS has an auxiliary heater.

These are hardly uncommon features in vastly cheaper cars either. Various Webasto systems have been around for ages, often installed by OEMs.

Cryptocurrency can easily be exchanged for a whole lot of goods and services.

Average Londoner earns something like 40k GBP/yr. If they have to pay the congestion charge every day, that'll eat up 12.5% of their annual income.

But I agree, it'd be nice if the charge was 100GBP per day and I was the only person on the roads.

Those signs exist in the US, not in the UK.

Mercedes sells a S-class with a 2L i4 engine, I don't think this is really going to be an issue.