Is oneself the greatest threat to LastPass security?

I wrote this letter as a Q&A submission for the Security Now! podcast. It didn't make it into the show, but I thought about sharing it here. I think there's a valid point to my argument, but who knows? Am I right? Overly exaggerating? You tell us!

Dear Steve,

I'm currently moving away from a algorithm based password system. I have been testing out LastPass with some sites and have been more or less liking it. I'm already convinced that its technology can keep me safe from threats from without. However, I still have a cause for concern. As I see it, and as it currently stands, the greatest threat to a LastPass based security scheme is: *myself*.

Although I use good habits and have not had a problem for the last decade, I cannot completely trust myself not to bring malware to my system: I can be served a malicious banner on a trusted site, open a file from a contact that has been previously compromised, or click a link in an e-mail message while distracted ("so-and-so sent you a message!").

So, if I happen to get malware in my system, what is there to stop it from taking advantage from my LastPass sessions? As I see it, there are at least two ways in which it could harm me. The first one, taking advantage of an open LastPass session to look into my vault and grab whatever it can in one fell swoop; and secondly,  passively detecting the presence of LastPass and recording the unencrypted passwords on their way from LastPass to each webpage; key logging is surely not the only tool available for hackers. And, still a third one, if one wants to go over the top, what's to stop the malware from interacting concurrently with me on an open webpage? No doubt it can beat me on speed ("look! A banking site! Let's attempt a quick transaction").

The PPP option doesn't look as if it could help me here, because it would only protect the LastPass data when closed or from without, not when open and in use.

By the looks of it, LastPass is great with holding my passwords and populating fields quickly, but not much else. I still need some sort of second factor authentication for each site, preferably a global one.

Are these cause for concern or have the LastPass people have come with a solution for this too?

Columbine by Dave Cullen book review

I believe that it was when the Red Lake school massacre happened that I first learned about Valeen Schnurr and her experience at Columbine. She was interviewed on TV as part of the coverage of the latest incident and her story both inspired me and made me want to know more about the Columbine shooting. Over the next days I dove into the net and among all sites I found Dave Cullen's the most informative. At some point, if he had not already, he announced an upcoming book and I waited probably years for it.  When it finally came out, I immediately snatched it.

Columbine, is the result of research based on interviews with the survivors, news reports, the official Columbine documents and more. As one can immediately tell it is well-researched and thought out. Although it is a five-parter I felt it more like it had just two distinct parts: a first one describing the eve of and the attack proper; and a second where we get set of alternating chapters in which Cullen contrasts the shooters' path to the attack with the unfolding aftermath of the massacre. The shooters' path draws heavily from their recovered journals and schoolwork to gain insight into their motivations, preparations leading to the shooting and mindsets.

The survivors path describes their way to healing . These chapters in a way have the survivor community, rise up to the tragedy and negate the harm done by the shooters. Case in point, the rallying of survivor Patrick Ireland.

For what appears to be a 'first' we get the inside story from the assailants, as the killers wanted us to know and took pains to leave a trail. In part, this scheme would later be followed by the perpetrator of the Virgina Tech shooting. Of all the major documents known to exist what we still have missing are the infamous basement tapes. Since these have officially not been released, we only get the snippets  that Time magazine managed to get access to years ago.

During his reconstruction of the events Cullen, takes his time to put to rest many, if not all, of the most pervasive  conspiracy theories and myths surrounding the shooting, such as the third shooter, the Trenchcoat Mafia and the bullied outsiders. The Bernall/Schnurr library incident is also thoroughly examined. Although there are a few inescapable blanks, Columbine results in a solid coherent account.

When I finally got my hands on this book, I finished in about a week and it answered all my questions and more. Totally recommended.

5 stars

A Metal Evening

As I write this I'm listening to Yngwie Malmsteen's 2009 album Angels of Love. I find it a bit unusual, since metal music is supposed to be loud and powerful. Then again, I'm not really one to talk since my experience with the genre is small and to say the truth, it is mostly limited to this man and his music. I like what I hear.

My intro to him was through the music of Castlevania, back in 2008, when listening to some mp3s. Someone at the Castlevania Dungeon posted that Dwelling of Doom sounded just like YM's Music Far Beyond the Sun. I immediately checked that out and saw that it was true to the point of almost identity. I was hooked. Through eMusic I began to gather some of his tracks and not long after, some six or eight months,  I was delighted to find on his site he was coming to town.

The very day tickets went on sale I was first on line at my local Ticketmaster booth and I believe I bought the first couple of tickets, for me and a friend, townwide. I had to see this man in action. Wouldn't I go see Paganini play if I had the chance? Oh, and this is not a flippant remark. Both are virtuous on their instruments, compose and stretch the possibilities of each to 'impossible' reaches and have a loyal following. The Swede openly admires the Italian and it doesn't feel like a stretch imagining the Italian giving at least a knowing nod and wink to the Swede's play.

When the day came and I got to the venue I began to have some second thoughts as a row of imposing Marshall amps lined at back of the stage greeted the fans. Maybe I should've brought some earplugs. The people there were expectant and well-behaved. When the man finally appeared on stage there was a surge forward from the crowd and the tall fan behind me used me as a battering ram to open his closer to the stage. For a while I felt as lifted off my feet and feared that I might suffocate. In the end the push forward had the positive effect of placing me in the seventh to fifth row with a great view. I got separated from my friend for the rest of the evening.

I had prepared beforehand by going to the online forums and had found out by a poster who had listened to Yngwie in Argentina, that he positioned himself to the left (his) of the stage. I aimed for that and... success!

In regards to the performance, the venue's acoustics  were subpar. The first thing I noticed was an unpleasant after-screech for the highs. Got over it quick, but these never quite left. For a while I got fixated on the bass player and thought how lucky he was to be on stage as part of a great band. As for Yngwie, the thought that struck me other than his playing was: he's pompous! But in a good way. The leather pants that quite don't fit, the hair, the mid-kick, the guitar back roll, the teeth and backward shred... more than anything, I believe this is a kind of fanservice and that he has fun doing it. He could just stand there and riff, but he obliges and we love him for it. During the concert he went through a fair amount of picks which he threw to the crowd as they were spent. Sad to say I did not get any. The selection was good, including all the mainstay suspects. I was hoping for the 7th Sign, which is one of my top three, but it was not included this time around. When he pulled a cover on Mozart or someone, the audience cheered in recognition.

In regards to the rest of the fans, a great many of them watched all right, but through the filter of their (then) crappy phones. It was frankly surprised by the number of glowing screens, but I guess that this is here to stay. Well, why not?

There are times when one feels as being a part of a larger whole. This was one of those times as one could feel the energy sweep over all of us and while it lasted, a sense of oneness. Cheesy? Perhaps. But I'm sure you've felt it before.

When it was over there was a noticeable number of parents waiting outside the venue for their underaged kids. I guess they did catch some of the music as it was loud enough for them to listen. Now,  loud it was. My ears, especially the right one, were ringing and felt as if clogged. I was begining to wish that I should've stayed with my mp3s. Volume control! Next day the after effects were worryingly still there, but began to lessen as time went on. Flash forward to present day, on a checkup with the ears & throat doctor, he told me I was none the worse for the experience.

An evening  to remember.

War Without Mercy book review

At high school  my classmates and I were given QBVII by Leon Uris as reading assignment some reason. It was about war crimes and was good and all. The question it raised for some however was: how come American/Allied WWII war crimes were not pursued? Were they that few? Just recently I got part of the answer to these questions in War Without Mercy.

This book is about the Pacific Theatre. One can think of it several related books bound in one: a) War crimes from both sides laid bare; b) the way the Americans viewed and portrayed the Japanese before Pearl Harbor; b2) before Midway and; b3) up to surrender; and c)  the perspective from the Japanese viewpoint.

The Japanese were called everything in the spectrum from vermin to supermen according  to the various stages, apes being the most popular. Everything but human beings. And not only by the sensationalist and uneducated but from what we generally believe respectable sources as Time and Winston Churchill.

In regard to war crimes, the American troops misbehaved as bad as the Japanese with the complicit assent of their superiors. Justifications were easy to come by.  The racial slur is appalling in hindsight but it served its purpose at the time. Not only did it inflame the passions, but made the business of killing easier, all while upholding support at home.

On the Japanese side, the optics where more complex resulting in their exaltation of their purity as rallying point at home and their Asian background for greater Asia. For the Anglo-Saxons they reserved the worst they could conceive, demons, which further fueled  their self-righteousness and the justice of their cause. Of particular interest is the next to last chapter where, largely based on recovered wartime documents, the Japanese postwar aims, within the Greater East Asia Co-Prosperity Sphere, are explained.

All these build into the crucial point of passing from hate and war to cooperation and peace. The final chapter reveals the mechanisms from which this was attained pointing out the seeds  that were already present in the view of each other. In the end, despite the momentum of the war years, the right decision was taken by the Americans, that of maintaining the Imperial Throne as a symbol, when it was needed the most.

It is a bit surprising is how in these last 60 years all this multi-century misunderstanding/hate/fear has evaporated to our present low state. Mr. Dower stops near the cusp of Japan's economic might at the end of 80's and he shows how, once again, distrust and fear flared up within some sectors drawing even on the war experience. He doesn't get to show us how these once again have receded, but receded they have. Looking to what has preceded, is it really true that the (white) West has overcome it's biases and that an era of sustainable peace & harmony with the East is here to stay? Do we understand each other now?

4 stars

Beethoven's Shadow book review

Music is one of the greatest pleasures of humanity and sometimes a bit of information or background knowledge can enhance the experience. Not only composers and listeners are relevant in the music communication, but performers frequently have a say.

In his book, Beethoven's Shadow, American pianist Jonathan Biss shares his performer's view on music in general and on Beethoven in particular. Not long ago he agreed to record the whole of Beethoven's piano sonatas and this book is a companion of sorts to the project.

It is a short book. It also has no obvious structure. Rather, Biss writes something closer to an extended essay. In it he explores, the project at hand,  recorded vs live music, virtuosity Fleisher, Schnabel and Serkin, with emphasis on the latter's philosophy, his (Biss') relationship with the sonatas and the quest of the 'ultimate' performance. The result is that more than listening/reading a lecture one feels he has him on one's living room having tea.

He has too much respect for the sonatas. From the start one can feel even something close to fear from his part seep here and there until he finally admits to it, defuses it and lays it to rest; all without losing admiring wonder.

The only thing that's missing are clips of the pieces he talks about.  I guess that those really interested can find them, but it would have been nice to have had them on the spot.

Now a short ramble on my impressions.  What I liked most was how he, being one of the most overexposed persons to the pieces, still find new aspects and secrets in them. My trepidation with music I like is listening too much to it and getting too familiar with it. Should that happen I fear getting some sort of diminishing returns by liking the piece less, not more. Biss sets my mind at ease. In other matters his impression on what ultimately is music echoes what Gleick describes in The Information when early theorists were trying to define the same question. Is it the scoresheet? A certain recording? The sum of all performances?

Both the audio and kindle editions are under $2, so, if you play an instrument or really listen to music, why not?

Dreaming in Code book review

It amazes me how seldom the death struggles and victories of programmers are ever sung. Behind every program and script there are intractable problems that had to be solved,  impossible deadlines, kludges and clever elegant solutions, wild goose chases, tears and triumphs; some of these worthy of epic poetry or of Agatha Christie. Few of these stories ever surface into public consciousness.

After a fashion, Dreaming in Code opens this world to the larger audiences.

Starts fine, comparing software coding to bridge building and pointing out the ways in which wholesome projects break down. Somewhere around here the author refers Britcher's The Limits of Software  as " a disjointed, but impassioned book". Ironically, the same description applies to Dreaming more and more as it progresses: it jumps from here to there making the reader only catch glimpses of what the author tries to show, but not in an ordered fashion. This is not an altogether a bad thing: this is one of those books where you can open it at any page, begin reading and find something interesting to be delighted with.

There is central thread though, Mitch Kapor's Chandler project. We get the inside scoop of its development, decisions and travails. This is where in one way or another the anecdotes sprout and return to. There are also about half a dozen previous books on programming projects that the author frequently refers to, being The Mythical Man-Month the most cited. These mentions in a way feel quite similar to how the characters of the Hitchhiker's Guide to The Galaxy refer to the Guide as a beacon. With these books Rosenberg also shows that despite the better tools there is nothing new under the sun.

Tribulations are one thing. There is also a large component of programming philosophy which waxes towards the end. Programming, not being an exact science, has several schools of thought on how it should be done. Dreaming presents some of these, many relating to the work at hand, others, historical.

Notwithstanding its externally disordered nature, an overall nice book that warrants a reread here and there. Recommended if you have any interest in programming.

(If you want more on team projects try Code Name Ginger for a story on hardware. For a biology one, try the Billion Dollar Molecule) 

Lapsang Souchong tea review

We have seen now different kinds of teas, some pure, some flavored. The pure ones derive their taste from their very own qualities plus some processing while the flavored ones generally get theirs from added elements such as fruits, petals or essential oils. One can still find a midway category between these two and here are those teas whose flavors are brought up by a moderate alteration of their nature. One example is the hoji-cha which was born when someone, either by insight or accident, roasted green tea leaves. Another, arguably, is the Puerh which is left to ferment. And another yet is the Lapsang Souchong of which will be talking today.

The Lapsang Souchong is a black tea from China that has the peculiarity of being smoked. It's discovery, no less, has been a boon to many.

This tea is probably the oldest member of my tea shelf and I inherited it, so to speak, from my dad who had tasted it once and bought some in London. The original batch was a Fortnum & Mason tin of whole leaf. It had stood there for over 20 years and when I finally began brewing some of it, I found that it had weathered the intervening years very well. When this ran out, we bought some more from the same company, these time in tea bags, and found that, well sure, the flavor was more pronounced, but it still was essentially the same.

The Lapsang Souchong teas are smoked by drying the larger Lapsang tea leaves over pinewood fire. The resulting smoky flavor is not quite like those found in hams or salmon. It rather has its own distinctive taste. Nowadays, having run out of all Fortnum leaf, I brew from that of my local provider and with this even the taste of sap is clearly present.

The Lapsang flavor is intense and can even be too powerful for some. Thus, brewing time is an important aspect to watch for.  Unless you really, really love smokiness, an overbrewed Lapsang can be unpleasant, even undrinkable. I'd say experimenting with shorter infusion times is the right way start for newcomers. It can also be an interesting ingredient for those who prepare their own household blends as a relatively small amount of leaf can lend a touch of smokiness to a base mix or even add piquancy to otherwise flat brews.

On a few occasions I've prepared some as iced tea and, though good, it generates some  dissonance as one's mind tries to harmonize the flavor with the drink's temperature.

I also think that it can be a very agreeable companion to those who have or like to stay up late. For the way ahead preparing a cup or pot in early evening can provide a warm feeling for a prolonged time. In regards to food, it pairs well with spicy cuisines, sausages, meats and more, and can even be accompanied with regular meals, but it will very likely overpower blander dishes.

In closing, Lapsang may not be for everyone, but for a great many it can bring joy and comfort and it is a fine example of what of what can be achieved tastewise with tea with just one step.