Businesses

Shadow Acquires Android Emulation Startup Genymobile (techcrunch.com) 5

Shadow is making its first acquisition as it announced that it would snatch up Genymobile, the company behind Genymotion. From a report: Shadow is better known for its cloud computing service that works particularly well for cloud gaming. It also offers a cloud storage service based on Nextcloud. As for Genymobile, the French startup has been around for more than a decade. It has specialized in low-level Android development. And in particular, it has developed a popular Android emulator so that developers can test their apps on multiple configurations and following different scenarios. Terms of the deal are undisclosed. Genymobile's co-founder and CTO Arnaud Dupuis will stay at the company and act as the chief executive of Genymobile starting March 1st. Genymobile's existing CEO Tim Danford will step back from the company's day-to-day activities and move to an advisor role.
Businesses

Fake SSDs With Great Reviews Are Still Popping Up on Amazon (theverge.com) 93

An anonymous reader writes: If you've searched for external SSDs on Amazon.com recently, you may have noticed something weird: mixed in with the 1TB and 2TB drives from brands like Samsung and SanDisk are a bunch of listings for 16TB SSDs, mostly around $100, and with surprisingly high user ratings. Every single one is a scam, even if they're shipped by Amazon. Josh Hendrickson -- Editor-in-Chief of Review Geek -- bought one of the "16TB SSDs" and tore it down to reveal a generic 64GB microSD card on a USB 2.0 card reader. Adrian Kingsley-Huges, writing for ZDNet in May 2022, found the exact same thing. Different packaging and different case colors, but the same trick.

The Verge confirmed that several fake 16TB drives showed up on the first page of results for "external SSD," and over half the results for "16TB SSD" were fakes -- the rest were either 16TB enterprise hard drives, multi-drive enclosures, and one actual 16TB external drive, which costs $2,400 and contains two 8TB SSDs. While the top fake had a 3.6-star rating, the next two were 4.8 and 4.2, respectively. How are such obvious fakes getting such high ratings? It's the scam Hendrickson calls "review merging," and Consumer Reports calls "review hijacking." As Hendrickson explains, some third-party sellers take old listings and replace them with new items, leaving the reviews but changing everything else. A quick scan of one fake 16TB drive listing showed five-star reviews for laptop chargers, basketball backpacks, stickers, screen protectors, Mardi Gras beads, and mousepads. The sellers gather good reviews for cheap generic products, swap in a more expensive fake, and then take it down when bad reviews start piling up.

Desktops (Apple)

Apple Announces a Mac Mini With the M2 and M2 Pro (theverge.com) 73

The Mac Mini is Apple's next computer to get the bump up to the M2 chip -- and this time around, it's being offered with the Pro version of Apple's processor, too. From a report: The new model was announced this morning in a press release, with a starting price of $599, and is available to order today, with availability beginning Tuesday, January 24th. The Mac Mini's baseline configuration includes the M2 chip, 8GB of RAM, and 256GB of storage. It features an HDMI port, Gigabit Ethernet, and a standard headphone jack, alongside two USB-A ports and two Thunderbolt 4 (USB-C) ports -- an upgrade from the Thunderbolt 3 ports on the previous generation.

The M2 Pro configuration of the new Mac Mini features 16GB of RAM, 512GB of SSD storage, and an additional two Thunderbolt 4 ports alongside the ports already available on the standard M2 model. This configuration will set you back $1,299, more than double the price of the baseline model. This is the first time Apple has brought Pro-tier chips to the Mini. The Mini was previously only offered with the entry-level M1 chip -- the same one used in MacBook Air. This time, it's being offered with one of Apple's more powerful chip series. The M2 Max, however, is so far only being offered in the MacBook Pro.

Earth

Climate Startup Removes CO2 From the Air In Industry First 131

Swiss company Climeworks announced Thursday that it has successfully taken carbon dioxide out of the air and put it in the ground where it will eventually turn into rock in a process that has been verified by an independent third-party auditor. It the first time a company has successfully taken carbon dioxide out of the atmosphere, put it underground to be locked away permanently and delivered that permanent carbon removal to a paying customer. CNBC reports: The development has been a long time coming. Christoph Gebald and Jan Wurzbacher co-founded Climeworks in 2009 as a spinoff of ETH Zurich, the main technical university in Switzerland's largest city. They have been scaling the technology for direct carbon removal, wherein machines vacuum greenhouse gasses out of the air. have all bought future carbon removal services from Climeworks in a bid to help kick-start the nascent industry. Now Climeworks is actually removing the carbon dioxide and putting it underground in a process that has been certified by DNV, an independent auditor.

The cost of carbon dioxide removal and storage for these corporate clients is confidential and depends on what quantity of carbon dioxide the companies want to have removed and over what period of time. But the general price for carbon removal runs to several hundred dollars per ton. Individuals can also pay to Climeworks to remove carbon dioxide to offset their personal emissions.

Climeworks' largest carbon dioxide removal facility is located in Iceland, where it partners with CarbFix, which stores the gas underground. CarbFix dissolves carbon dioxide in water then intermingles that mixture with basalt rock formations. Natural processes convert the material to solid carbonate minerals in about two years. In June, Climeworks announced it had begun construction of its second commercial-sized plant in Iceland that will capture and store 36,000 metric tons per year of carbon dioxide.
Sony

New Sony Walkman Music Players Feature Stunning Good Looks, Android 12 (arstechnica.com) 48

Sony has a pair of new Android Walkmans out, the NW-A300 and NW-ZX700. Ars Technica reports: We'll start with the most consumer-friendly of the two, the NW-A300. This basic design debuted in 2019 with the NW-A105, but that shipped with Android 9. This is an upgraded version of that device with a less-ancient version of Android, a new SoC, and a scalloped back design. In Sony's home of Japan, the 32GB version is 46,000 yen (about $360), while in Europe, it's 399 euro (about $430). The NW-A300 is a tiny little device that measures 56.6x98.5x12 mm, so pretty close to a deck of playing cards. [...] The front is dominated by a 3.6-inch, 60 Hz, 1280x720 touchscreen LCD. There's 32GB of storage, and the device supports Wi-Fi 802.11AC and Bluetooth 5. That's about all Sony wants to talk about for official specs. It touts "longer battery life" but won't say how big the battery is, promising only "36 hours* of 44.1 KHz FLAC playback, up to 32 hours* of 96 KHz FLAC High-Resolution Audio playback." Presumably, that's all with the screen off. [...] This is a music player, so of course, there's a headphone jack on the bottom of the unit. You'll also find a spot for a lanyard, a speedy USB-C 3.2 Gen1 port for quick music transfers, and a MicroSD slot for storing all your music. Buttons along the side of the device also give you every music control you could want, like a hold switch, previous, play/pause, next, volume controls, and power.

There's another new Sony Walkman, the NW-ZX700. It's 104,500 yen ($818) in Japan, and while that sounds like a lot for a portable music player, it's actually a relative bargain compared to the "Signature Series" NW-WM1ZM2, which goes for an eye-popping $3,700 thanks to audiophile hocus-pocus like a "gold plated, oxygen-free, copper body." Anyway, back to this $800 model. Unlike regular phone equipment, this has a proper audio amplifier with big, beefy capacitors to power the analog audio output. That makes it much bigger than the A300, at 72.6x132 mm and a whopping 17 mm thick. It also has two audio outs: a standard 3.5 mm headphone jack and a 4.4 mm "balanced" audio jack, which is used by some high-end audio equipment. I'm sure Sony has a wonderful headphone collection to match. [...] Both this and the A300 use the S-Master HX digital amplifier chip, which supports Sony's high-resolution "NativeDSD" audio format, which is also used on Super Audio CDs. If you're some kind of heathen that is just streaming 128kb Spotify, Sony's "DSEE Ultimate" feature dubiously claims to be able to "upscale" your music with AI. There's also a "Vinyl Processor" that will add record player noises to your audio for an "authentic listening experience."

Microsoft

Microsoft 365 Basic is a New $1.99 a Month Subscription With 100GB of Storage (theverge.com) 63

Microsoft is introducing a new consumer tier to its Microsoft 365 subscription offerings. From a report: Priced at $1.99 per month, Microsoft 365 Basic is designed to replace the 100GB OneDrive storage option with some extra features that sit in between the free option and the $6.99 a month Personal subscription. Microsoft 365 Basic will be available worldwide on January 30th with 100GB of cloud storage, an ad-free Outlook web and mobile experience, and enhanced security features. The security features include data encryption for an Outlook mailbox, suspicious link checking, and virus / malware scanning for attachments. Existing OneDrive 100GB storage customers will be automatically upgraded to Microsoft 365 Basic at the same $1.99 monthly rate. [...] The main difference between the $6.99 Personal subscription and this new $1.99 Basic one (other than the amount of cloud storage) is that Microsoft 365 Basic doesn't include access to the desktop versions of Word, Excel, and PowerPoint apps. Basic subscribers will have to use the web or mobile versions instead.
The Courts

Seattle Schools Sue TikTok, Meta and Other Platforms Over Youth 'Mental Health Crisis' 46

Seattle public schools have sued the tech giants behind TikTok, Facebook, Instagram, YouTube and Snapchat, accusing them of creating a "mental health crisis among America's Youth." Engadget reports: The 91-page lawsuit (PDF) filed in a US district court states that tech giants exploit the addictive nature of social media, leading to rising anxiety, depression and thoughts of self-harm. "Defendants' growth is a product of choices they made to design and operate their platforms in ways that exploit the psychology and neurophysiology of their users into spending more and more time on their platforms," the complaint states. "[They] have successfully exploited the vulnerable brains of youth, hooking tens of millions of students across the country into positive feedback loops of excessive use and abuse of Defendants' social media platforms."

Harmful content pushed to users includes extreme diet plants, encouragement of self-harm and more, according to the complaint. That has led to a 30 percent increase between 2009 and 2019 of students who report feeling "so sad or hopeless... for two weeks or more in a row that [they] stopped doing some usual activities." That in turn leads to a drop in performance in their studies, making them "less likely to attend school, more likely to engage in substance use, and to act out, all of which directly affects Seattle Public Schools' ability to fulfill its educational mission." Section 230 of the US Communications Decency Act means that online platforms aren't responsible for content posted by third parties. However, the lawsuit claims that the provision doesn't protect social media companies for recommending, distributing and promoting content "in a way that causes harm."
Medicine

Cryonics Company Charges a Monthly Subscription Fee (Plus Your Life Insurance Payout) (deccanherald.com) 192

"To date, about 500 people have been put in cryogenic stasis after legal death," writes a Bloomberg Opinion technology columnist, "with the majority of them in the U.S.

"But a few thousand more, including Emil Kendziorra, are on waiting lists, wearing bracelets or necklaces with instructions for emergency responders. " Kendziorra, 36, runs Berlin-based Tomorrow Biostasis GmbH, one of the first cryonics businesses in Europe to join a market dominated by American firms organizations like The Alcor Life Extension Foundation and The Cryonics Institute. The former cancer doctor has several hundred people on his firm's waiting list. They skew to their late 30s, male and tend to work in technology. Patients can choose to have their entire body preserved and held upside down in a four-person dewars, a thermos-like aluminum vat filled with liquid nitrogen, or just preserve their brain, which is cheaper.

Kendziorra says cryopreservation overall has become less expensive over the past few decades on an inflation-adjusted basis, a claim that he bases on historic prices published by his peers, who he says are making a collective effort to bring down costs. That could be critical to shifting cryonics from a fringe pursuit to something a little more mainstream, especially since it is no longer just for billionaires like PayPal Inc. co-founder Peter Thiel (who has reportedly signed up with Alcor). Kendziorra, for instance, has made cryonics just another monthly subscription by capitalizing on insurance, he told me during a Twitter Spaces discussion on cryonics last month. His customers pay a 25-euro ($26.54) monthly fee to Tomorrow Biostasis, and they also make the company the beneficiary of a minimum 100,000-euro life insurance payout upon their legal death. Kendziorra says that covers the full cost of cryonics including the biggest outlay: maintenance over the next century or so.

All told, most of his customers are paying about 50 euros a month for both the company's subscription fee and the life insurance policy for the option of a long sleep at death. Of course, most companies don't survive for more than a century, so Tomorrow Biostasis also partners with a non-profit group in Switzerland to carry out the storage of customers on its behalf.... The domain itself is largely funded by wealthy individuals including CEOs of tech companies, angel investors and scientists, Kendziorra says, adding that for them to invest in his own firm, their primary motivation shouldn't be "monetary" but rather to help further the field.

The mechanics all sound sensible, but that still leaves the question of whether cryonics will work, medically speaking. Doctors and scientists have used words like quackery, pseudoscience and outright fraud to describe the field. Clive Cohen, a neuroscientist from Kings College London, has called it a "hopeless aspiration that reveals an appalling ignorance of biology." The Association of Cryobiology has compared it to turning a hamburger back into a cow.

Encryption

Amazon S3 Will Now Encrypt All New Data With AES-256 By Default 27

Amazon Simple Storage Service (S3) will now automatically encrypt all new objects added on buckets on the server side, using AES-256 by default. BleepingComputer reports: While the server-side encryption system has been available on AWS for over a decade, the tech giant has enabled it by default to bolster security. Administrators will not have to take any actions for the new encryption system to affect their buckets, and Amazon promises it won't have any negative performance impact. Administrators may leave the system to encrypt at the default 256-bit AES or choose one of the alternative methods, namely SSE-C or SSE-KMS.

The first option (SSE-C) gives bucket owners control of the keys, while the second (SSE-KMS) lets Amazon do the key management. However, bucket owners can set different permissions for each KMS key to maintain more granular control over the asset access system. To confirm that the changes have been applied to your buckets, admins can configure CloudTrail to log data events at no extra cost. Then perform a test object upload, and look in the event logs for the "SSEApplied": "Default_SSE_S3." field in the log for the uploaded file. To retroactively encrypt objects already in S3 buckets, follow this official guide.
"This change puts another security best practice into effect automatically -- with no impact on performance and no action required on your side," reads Amazon's announcement.

"S3 buckets that do not use default encryption will now automatically apply SSE-S3 as the default setting. Existing buckets currently using S3 default encryption will not change."
Transportation

Mercedes-Benz Will Build a $1 Billion EV Fast-Charging Network In the US (arstechnica.com) 88

An anonymous reader quotes a report from Ars Technica: On Thursday, Mercedes-Benz announced that it is entering the DC fast-charging arena for electric vehicles. The German automaker is in the midst of an electrification push and a plan to be carbon-neutral by 2039, and it evidently doesn't believe that the current charging infrastructure is as good as its new EVs, so it's doing something about the situation. Mercedes says it plans to deploy more than 10,000 fast chargers around the world, starting in North America. The new network is separate from and independent of Ionity, the European fast-charging network backed by Mercedes, BMW, Ford, and Volkswagen. Here in the US, Mercedes is partnering with the charging company ChargePoint and MN8 Energy, a solar and battery-storage company. Together, they will deploy more than 2,500 DC fast chargers at more than 400 sites around the US by 2027.

The chargers will feature plug-and-charge compatibility and won't be restricted to Mercedes' EVs. Mercedes also says the locations and surroundings will be carefully chosen -- all too often, banks of DC chargers are located in desolate and lonely corners of mall parking lots that can make charging at night a stressful experience for some drivers. So the OEM plans to build the chargers "with food outlets and restrooms situated nearby." It also says there will be surveillance cameras and other security in place to provide "a safe and secure charging environment." Expect a minimum of four DC chargers at each hub, similar to an Electrify America charging location. But some hubs will have as many as 12 chargers, and there are plans for as many as 30 in some locations. The hubs will use ChargePoint's modular Express Plus system, which is capable of up to 500 kW per charging port, although Mercedes says that chargers will be "up to 350 kW" in power. And load management will ensure that if multiple EVs are charging at the same time, one charger doesn't end up throttling the rest.

In keeping with the company's 2039 sustainability goals, the electricity it uses will come from green energy suppliers or come with renewable energy certificates. Some hubs will use solar to power the lighting and security cameras. None of this will be particularly cheap. In fact, the initiative will cost more than $1.1 billion (1 billion euro) over the next six or seven years, with the costs split evenly between Mercedes and MN8 Energy. And this is just the start -- plans for more charger deployment in Europe and China will be announced in the future.

AMD

AMD Claims New Laptop Chip Is 30% Faster Than M1 Pro, Promises Up To 30 Hours of Battery Life (macrumors.com) 74

At CES this week, AMD announced a suite of new chips for notebooks and desktop computers, with one notable announcement being the company's new AMD Ryzen 7040 series of processors for ultrathin notebooks that will compete with Apple's M1 Pro and M2 chips. MacRumors reports: The AMD Ryzen 7040 series of chips are "ultrathin" processors based on the 4nm process, and the highest-end chip part of the family is the Ryzen 9 7940HS. The Ryzen 9 7940HS has eight cores, 16 threads, and 5.2GHz boost speeds. Announcing the new chip, AMD CEO Lisa Su made bold claims about its performance, saying it's up to 30% faster than Apple's M1 Pro chip. In specific tasks, AMD claims the chip is 34% faster in multiprocessing workloads than the M1 Pro and 20% faster than the M2 in AI tasks.

One cornerstone of Apple silicon is energy efficiency, and in that area, AMD claims the new AMD Ryzen 7040 series will offer 30+ hours of video playback in ultrathin notebooks. Built directly into the series of chips is Ryzen AI, a dedicated AI engine embedded in the processor. AMD chips configured with Ryzen AI are 20% faster in AI tasks than Apple's M2 chip while being 50% more energy efficient, according to the company.

To showcase the new chip's performance, AMD compared the performance of a high-end Intel chip, the M1 Pro, and its new Ryzen 9 7940HS processor rendering an object in the popular application Blender. In the time-lapsed video shown on stage, the M1 Pro lags behind the Ryzen 9 7940HS in rendering the object. AMD says it made its performance claims against a MacBook Pro with M1 Pro, 32GB of unified memory, and 1TB of SSD storage running macOS Monterey. The M1 Pro is not Apple's highest-end and most powerful chip for laptops, which is the M1 Max, and AMD did not compare its chip to the M1 Max.
After roasting the M1 Pro, Ian Zelbo from FrontPageTech noticed AMD running their CES keynote on multiple 14-inch MacBook Pros. "Obviously these are contracted employees, and it means nothing," he tweeted. "I just always find stuff like this hilarious."

We do too... It's akin to the "Twitter for iPhone" line on tweets that have gotten Android promoters in hot water multiple times over the past several years.
Bitcoin

Key Bitcoin Developer Calls on FBI To Recover $3.6M in Digital Coin (arstechnica.com) 119

One of the prominent developers behind the bitcoin blockchain said he has asked the FBI to assist him in recovering $3.6 million worth of the digital coin that was stolen from his storage wallets on New Year's Eve. From a report: Luke Dashjr is a developer of the Bitcoin Core, an app that runs 97 percent of the nodes making up the bitcoin blockchain. Bitcoin Core derives from the software developed by the anonymous bitcoin inventor who uses the pseudonym Satoshi Nakamoto. That software was called simply Bitcoin but was later changed to Bitcoin Core to distinguish it from the coin. Dashjr has been contributing to the Bitcoin Core since 2011 and has long championed the concept of decentralization that the cryptocurrency was founded on.

On New Year's Day, Dashjr took to Twitter to report that his entire bitcoin holdings -- worth roughly $3.6 million -- were "basically all gone." He said the hack stemmed from the compromise of a PGP (Pretty Good Privacy) key that he used to ensure that his downloads of Bitcoin Core and a smaller app known as Bitcoin Knots weren't laced with malware. He said all his computers were compromised and urged people to hold off downloading new versions for the time being. "So to be clear: DO NOT DOWNLOAD BITCOIN KNOTS AND TRUST IT UNTIL THIS IS RESOLVED," he wrote. "If you already did in the last few months, consider shutting that system down for now." In the same thread, the developer said he had contacted the FBI and police but hadn't received a response. "What the heck @FBI @ic3. Why can't I reach anyone???" he wrote. "I paid those taxes and the police don't care. What a scam."

Games

EA Says It Can't Recover 60% of Players' Corrupted Madden Franchise Save Files 63

An anonymous reader shares a report: EA says that a temporary "data storage issue" led to the corruption of many Madden NFL 23 players' Connected Franchise Mode (CFM) save files last week. What's worse, the company now estimates it can recover fewer than half of those corrupted files from a backup. The issue started last Monday, December 26, when EA tweeted that it was "aware of players experiencing connection issues when trying to connect to CFM." That problem lasted until Wednesday, December 28, when EA announced that subsequent server maintenance meant that "users should now be able to play CFM without issue."

But users who attempted to log in to play online franchise games during a 22-hour period ranging from Wednesday afternoon to Thursday morning saw their franchise save data corrupted by the aforementioned "data storage issue," as EA confirmed over the weekend. And while EA says some of those corrupted save files can be recovered from a backup, it adds that the development team is "currently projecting around 40% of leagues to be recovered." Players that didn't log in during the outage period last week should be unaffected, EA says, adding that CFM is now "up and running" and is "safe to log in and play." But the company offered a similar message on Wednesday afternoon, just before the period that led players who logged in to lose their save files in the first place.
Hardware

Alienware Goes Bigger and Taller With the X16 and M18 Gaming Laptops (theverge.com) 17

Alienware is unveiling a refreshed lineup of its M- and X-series gaming laptops at CES 2023. Like some other laptop companies, including Razer and Acer, Alienware is shifting focus away from 15- and 17-inch laptops toward thin, powerful 16- and 18-inch models. From a report: The brand is going big with the new M18, an 18-inch model that's being pitched as a desktop replacement. This is actually a resurrection following the M18's previous spec update way back in 2015. The 2023 model will feature Intel's 13th Generation HX CPUs and Nvidia's RTX 4090 mobile graphics card. The latest processors and graphics options from AMD will be available in the M18 later in 2023. Not only is the M18 massive and powerful -- it's a big deal in other ways. It can be configured with an 18-inch QHD Plus screen in the taller 16:10 aspect ratio and set up to include a ton of ports, including two Thunderbolt 4 ports, HDMI 2.1, Ethernet, an SD card reader, and many others. It supports user-upgradeable dual DDR5 RAM slots, and you can also cram up to 9TB of NVMe M.2 storage in it. This model starts at $2,099, but the first configuration it's releasing will cost $2,899.
Japan

In the Pacific, Outcry Over Japan's Plan To Release Fukushima Wastewater (nytimes.com) 141

The proposal has angered many of Japan's neighbors, particularly those with the most direct experience of unexpected exposure to dangerous levels of radiation. From a report: Every day at the Fukushima Daiichi nuclear plant in Japan, officials flush over a hundred tons of water through its corroded reactors to keep them cool after the calamitous meltdown of 2011. Then the highly radioactive water is pumped into hundreds of white and blue storage tanks that form a mazelike array around the plant. For the last decade, that's where the water has stayed. But with more than 1.3 million tons in the tanks, Japan is running out of room. So next year in spring, it plans to begin releasing the water into the Pacific after treatment for most radioactive particles, as has been done elsewhere. The Japanese government, saying there is no feasible alternative, has pledged to carry out the release with close attention to safety standards. The plan has been endorsed by the United Nations' nuclear watchdog.

But the approach is increasingly alarming Japan's neighbors. Those in the South Pacific, who have suffered for decades from the fallout of a U.S. nuclear test in the Marshall Islands, are particularly skeptical of the promises of safety. Last month, a group representing more than a dozen countries in the Pacific, including Australia and the Marshall Islands, urged Tokyo to defer the wastewater releases. Now, Japan is poised to forge ahead even as it risks alienating a region it has tried in recent years to cultivate. Nuclear testing in the Pacific "was shrouded in this veil of lies," said Bedi Racule, an antinuclear activist from the Marshall Islands. "The trust is really not there."

Security

The LastPass Disclosure of Leaked Password Vaults Is Being Torn Apart By Security Experts (theverge.com) 78

Last week, LastPass announced that attackers stole customer vault data after breaching its cloud storage earlier this year using information stolen during an August 2022 incident. "While the company insists that your login information is still secure, some cybersecurity experts are heavily criticizing its post, saying that it could make people feel more secure than they actually are and pointing out that this is just the latest in a series of incidents that make it hard to trust the password manager," reports The Verge. Here's an excerpt from the report: LastPass' December 22nd statement was "full of omissions, half-truths and outright lies," reads a blog post from Wladimir Palant, a security researcher known for helping originally develop AdBlock Pro, among other things. Some of his criticisms deal with how the company has framed the incident and how transparent it's being; he accuses the company of trying to portray the August incident where LastPass says "some source code and technical information were stolen" as a separate breach when he says that in reality the company "failed to contain" the breach. He also highlights LastPass' admission that the leaked data included "the IP addresses from which customers were accessing the LastPass service," saying that could let the threat actor "create a complete movement profile" of customers if LastPass was logging every IP address you used with its service.

Another security researcher, Jeremi Gosney, wrote a long post on Mastodon explaining his recommendation to move to another password manager. "LastPass's claim of 'zero knowledge' is a bald-faced lie," he says, alleging that the company has "about as much knowledge as a password manager can possibly get away with." LastPass claims its "zero knowledge" architecture keeps users safe because the company never has access to your master password, which is the thing that hackers would need to unlock the stolen vaults. While Gosney doesn't dispute that particular point, he does say that the phrase is misleading. "I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted."

Palant also notes that the encryption only does you any good if the hackers can't crack your master password, which is LastPass' main defense in its post: if you use its defaults for password length and strengthening and haven't reused it on another site, "it would take millions of years to guess your master password using generally-available password-cracking technology" wrote Karim Toubba, the company's CEO. "This prepares the ground for blaming the customers," writes Palant, saying that "LastPass should be aware that passwords will be decrypted for at least some of their customers. And they have a convenient explanation already: these customers clearly didn't follow their best practices." However, he also points out that LastPass hasn't necessarily enforced those standards. Despite the fact that it made 12-character passwords the default in 2018, Palant says, "I can log in with my eight-character password without any warnings or prompts to change it."

Bitcoin

FTX's Sam Bankman-Fried Borrowed From Alameda To Buy Robinhood Shares (coindesk.com) 71

Former FTX chief Sam Bankman-Fried borrowed hundreds of millions of dollars from Alameda Research to purchase his stake in trading app Robinhood Markets (HOOD), according to court documents (PDF). CoinDesk reports: In an affidavit provided to a Caribbean court before his arrest, Bankman-Fried said he and FTX co-founder Gary Wang together borrowed over $546 million from Alameda via promissory notes in April and May. They used that money to capitalize Emergent Fidelity Technologies Ltd., the shell corporation that in May bought a 7.6% stake of Robinhood. The affidavit provides a new curveball in the three-way race to lay claim to the 56 million Robinhood shares. Crypto lender BlockFi, FTX Group and Bankman-Fried himself have all attempted to lay claim to the shares, which could be worth over $440 million.

Crypto lender BlockFi, which like FTX has filed for bankruptcy, alleged in a court document (PDF) that it was owed the rights to the Robinhood shares due to a deal Bankman-Fried made in early November. The shares were pledged as collateral against a loan taken out by Alameda Research -- the same firm whose funds were used to purchase the shares to begin with, according to Tuesday's filing.

Software

Ask Slashdot: What Note-Taking App Do You Use? 187

An anonymous reader writes: This column about a writer's struggle to find the perfect note-taking app resonated a lot with me. "A singular productivity tool that works for everyone is a unicorn -- beautiful, perfect, and completely fictional. Still, there has to be some sort of middle ground between an unachievable fantasy and the current landscape. I would happily settle for two, maybe three apps. Honestly, less than 10 is all I'm asking for. Until then, my phone and laptop will be a cluttered mess of productivity apps that only do half their jobs," writes Victoria Song.

Over the years, I have tried Notion, Apple Notes, the good old Windows' Notepad, Roam Research, Obsidian, Google Keep, Google Docs, and OneNote among possibly many more that I am unable to recall anymore. Some support Apple Pencil, which is one of the usecases I find useful. Roam Research did not even have a native app for mobile devices for the longest time. Some applications are good, but they don't support online syncing, or support syncing with only a particular storage service. And have you noticed just how expensive some of these apps could get? As much as $15-$30 a month! Out of curiosity, and forget my usecases -- as I admit I have not mentioned many -- how do you maintain your notes for work and personal life. (I have been using physical notepads a lot more in recent months but would like an app for digital notes.)
Microsoft

CNET Touts 'Massive' Microsoft Office Deal: 91% Discount on a Lifetime License (cnet.com) 80

Meanwhile, over in the Microsoft ecosystem, CNET reports: You can ditch the subscription (with recurring charges) and snag a lifetime license of access to Microsoft's Word, Excel, PowerPoint, Outlook, Teams, OneNote, Publisher and Access for just $30...

That's back at the lowest price we've ever seen, and a whopping 91% off the usual price of $349.

However, this deal expires in just a few days, so be sure to get your order in soon.The offer, from StackSocial, applies to both the Windows and Mac version of the software.

Now, you can always opt to use the free online version of Microsoft Office (which has far fewer features). But compared to the online Microsoft 365 subscription suite that costs $10 per month or $100 per year, this downloadable version is a phenomenal bargain.

The Mac deal ends today, but the Windows deal extends through December 28th, according to CNET's article. "The two big caveats: You get a single key — which only works on a single computer — and there's no Microsoft OneDrive Cloud Storage included."
Cloud

LastPass: Hackers Stole Customer Vault Data In Cloud Storage Breach (bleepingcomputer.com) 38

LastPass revealed today that attackers stole customer vault data after breaching its cloud storage earlier this year using information stolen during an August 2022 incident. BleepingComputer reports: This follows a previous update issued last month when the company's CEO, Karim Toubba, only said that the threat actor gained access to "certain elements" of customer information. Today, Toubba added that the cloud storage service is used by LastPass to store archived backups of production data. The attacker gained access to Lastpass' cloud storage using "cloud storage access key and dual storage container decryption keys" stolen from its developer environment.

"The threat actor copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service," Toubba said today. "The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data."

Fortunately, the encrypted data is secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user's master password. According to Toubba, the master password is never known to LastPass, it is not stored on Lastpass' systems, and LastPass does not maintain it. Customers were also warned that the attackers might try to brute force their master passwords to gain access to the stolen encrypted vault data. However, this would be very difficult and time-consuming if you've been following password best practices recommended by LastPass. If you do, "it would take millions of years to guess your master password using generally-available password-cracking technology," Toubba added. "Your sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass' Zero Knowledge architecture."

Slashdot Top Deals