LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group - <AUTHOR> https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/ <comment><USER2> > Computrace/Lo Jack is a legitimate application that is factory installed > into the firmware of nearly every laptop in the world, of all varieties. The > idea is that if your laptop gets stolen, you can find it, and/or wipe it > remotely. This is obviously good, and useful.

How is this so? No one's ever mentioned this when talking about stolen laptops. They talk about high level software like Prey or whatever Apple uses. How would you use this to find your laptop? There's a central server that almost every laptop on earth talks to? Seems highly doubtful.

<comment><USER3> [https://en.m.wikipedia.org/wiki/LoJack_for_Laptops](https://en.m.wikipedia.org/wiki/LoJack_for_Laptops)

<comment><USER4> > The software agent behaves like rootkit (bootkit), reinstalling a small > installer agent into the Windows OS at boot time. This installer later > downloads the full agent from Absolute's servers via the internet. This > installer (small agent) is vulnerable to certain local attacks

And once again Linux is a solution.

<comment><USER5> I'm a full time Linux user so I'm all for fanboying, but the belief that Linux would be immune to this type of attack is naive at best.

<comment><USER6> > I'm all for fanboying

You probably shouldn't be. All this "fanboying" annoys the hell out of people because faboys are constantly trying to sell linux as the solution to all problems, and then when people give them reasons why linux isn't a solution to their problems they get really defensive and start using canned excuses like "well it works for me", "you didn't pick the right distro", "normal users don't need that", "you need to research your hardware", "you have the source so you could fix it yourself", or even "Windows/MacOS have problems too!".

The community alone is enough reason to avoid linux.

note: in this instance, "linux" is being used as shorthad for "the GNU/Linux Desktop".

<comment><USER7> > You probably shouldn't be. All this "fanboying" annoys the hell out of > people because faboys are constantly trying to sell linux as the solution to > all problems ...

This is true for nearly anything imaginable, not just Linux.

> The community alone is enough reason to avoid linux.

If you selectively pick the worst of any given (tech related) community, you'd probably be using nothing.

<comment><USER6> > This is true for nearly anything imaginable, not just Linux.

Yes, it is, but that doesn't mean you should be doing it if you actually care about linux.

> If you selectively pick the worst of any given (tech related) community, > you'd probably be using nothing.

I'm not selectively picking anything. This is the part of the community I am constantly exposed to because it is the part that evangelizes.

<comment><USER8> > I'm not selectively picking anything.

That's definitely why you're hanging out on a website built for armchair intellectuals. There's definitely no bias on the selection of people who visit and comment here. /s

<comment><USER6> You're making the assumption I was referring only to encounters on HN.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The Lo Jack stuff is a red herring. The main attack vector is SPI write protection bypass. I'm not sure what they used to get local root though. Once you can write to the SPI flash, you can write whatever you want, lojack or not. And this uses some old known vulnerabilities for SPI write bypass. There have been some of those over the years. I had to use one myself to bypass wifi whitelists in lenovo bioses. I don't think this would work on platforms with boot-guard though.

<comment><USER10> that's correct, something like SecureBoot would have prevented this as the signatures wouldn't have been able to be verified and therefore never proceeded.

<comment><USER9> No secure boot doesn't prevent this directly. Secure boot checks for the booting OS. Boot guard is what checks the booting BIOS.

</comment></comment></comment><comment><USER11> Using flashrom [1] you can dump the contents of your SPI flash for the inspection and open the image with UEFITool [2]. Both tools are opensource and developed for years. Some people recommend to use chipsec [3], but it can less in terms of dumping and unpacking. The state of security in UEFI firmware is horrible, thing is overengineered and poorly written (bad code practices). Not to mention Intel ME/AMT/etc that also provide the easy way for attacker to persist and hide itself once compromised. Projects like coreboot [4] and vendors like Purism [5] allow the tighter control of your own hardware, but thanks to Intel it still has a lot of blobs of a bad code. Apple realized they can't trust Intel and other "BIOS" writers, so working on improving the security and codebase. Thus the state of affairs is slightly better on Macbooks. I believe x86 firmware world is beyond any hope to get any better and everyone should focus on building better hardware/architectures from scratch. Hopefully companies like Raptor Engineering [6] can shift the mindset of consumers.

[1] [https://flashrom.org/Flashrom](https://flashrom.org/Flashrom)

[2] [https://github.com/LongSoft/UEFITool](https://github.com/LongSoft/UEFITool)

[3] [https://github.com/chipsec/chipsec](https://github.com/chipsec/chipsec)

[4] [http://coreboot.org/](http://coreboot.org/)

[5] [https://puri.sm/](https://puri.sm/)

[6] [https://www.raptorcs.com/content/base/products.html](https://www.raptorcs.com/content/base/products.html)

</comment><comment><USER12> > _Computrace /Lo Jack is a legitimate application that is factory installed > into the firmware of nearly every laptop in the world, of all varieties. The > idea is that if your laptop gets stolen, you can find it, and/or wipe it > remotely. This is obviously good, and useful._

This is useful, but not obviously good. It's good only if it's securely implemented, but as a user, I'm not sure. I've disabled Computrace on every laptop I own, and now stopped worrying about it after installing coreboot.

</comment><comment><USER13> Kind of a shame that security houses are doing legitimate research, but the products they release just don't have the same effectiveness they used to. If sales of antivirus is dropping, where will they get their funding from? Perhaps there needs to be some new approaches to anti-virus. The old fire and forget method doesn't work anymore, and lots of people/organisations don't realise that yet. But it won't be like that forever.

<comment><USER14> > the products they release just don't have the same effectiveness they used > to. If sales of antivirus is dropping, where will they get their funding > from?

Anti-virus software was very easy to circumvent in the past. Getting the kernel32 address from the PEB, having your own PE loader and having most code xored with the Mersenne twister output in the data segment for obfuscation, as well as some runtime is_sandbox() heuristics and no AV would detect anything malicious.

Don't know if it got better or worse, but AV software was not very good at finding malicious code explicitly written to not run in plain sight in the past.

<comment><USER15> AV isn't good at finding malicious code that hasn't been discovered and classified but it's also pretty unlikely that you'll encounter one unless you are a high value target which is being actively targeted.

Having Windows Defender on is sufficient for the casual threats most people would encounter.

<comment><USER8> > it's also pretty unlikely that you'll encounter [malicious code that hasn't > been discovered and classified] unless you are a high value target which is > being actively targeted.

This sounds much like survivorship bias to me.

<comment><USER15> No this is simply what they are good at it's like a vaccine it won't help you against mutations or something that was engineered but it's not a reason to not vaccinate when it's does cover a large number of other infectious diseases.

So unless you going to say that vaccination is survivorship bias because we don't have them against some diseases I really don't see your point.

Windows Defender will block virtually every common infection these are what most people get hit by, it will also block virtually all ransomware and you can see just how much the ransomware "market" got hit once they implemented it to see that it is effective.

Yes it won't protect you against NSA or some high end hacking group that writes completely custom malware to target single individuals but you are also not likely being the target of these.

But you are likely be target of the 1000's of known threats that are spread through driveby attacks, infected media and pretty old stuff you'll be surprised just how common 5 year old infections still are.

</comment></comment></comment></comment></comment><comment><USER16> Worth noting this important caveat mentioned in the article:

> "The tool described above is able to update the system's firmware only if > the SPI flash memory protections are vulnerable or misconfigured. Thus, you > should make sure that you are using the latest available UEFI/BIOS available > for your motherboard. Also, as the exploited vulnerability affects only > older chipsets, make sure that critical systems have modern chipsets with > the Platform Controller Hub (introduced with Intel Series 5 chipsets in > 2008)."

<comment><USER17> Is it a vulnerability in the SPI chip itself, or is the master allowing writes that it shouldn't ?

Does the SPI chip have a write protect line? Or could it be subbed with one that does?

<comment><USER18> FWIW, some BIOSes have a setting to disable "remote" firmware updates -- although I certainly cannot speak for how reliable that is (and, judging by past experiences, it isn't very reliable at all).

</comment></comment></comment><comment><USER19> I miss dearly bios write protect jumpers on motherboards.

<comment><USER11> The root of the problem that old BIOSes wrote their configuration into the CMOS memory, while all UEFI-based firmware storing configuration right in the SPI flash itself. Changing the values of variables every boot, sometimes performing "garbage collection" for compressing the size. Moreover, ME-like systems also write into the flash, sometimes even logging events. Every single boot, this is how it was designed.

</comment></comment><comment><USER20> The Register has more details:

[https://www.theregister.co.uk/2018/09/28/uefi_rootkit_apt28/](https://www.theregister.co.uk/2018/09/28/uefi_rootkit_apt28/)

</comment><comment><USER21> This is very interesting, to be sure, and I commend everyone involved for their work in exposing this stuff. But does anyone else get irked by the style of writing? He's alternating between implying complete assuredness and being excessively vague:

> _(2) The perps are probably a Russian hacking group (military, KGB, FSB, or > something similar), known by a bunch of names, but I call them Fancy Bear, > for no particular reason other than it was the first name I knew them by, > and it 's a neat name. These are the same guys that (probably) broke into a > factory in Taiwan in Feb 2018, and modified firmware in a bunch of > computers, headed for the German government._

How could he possibly be so sure (that he implies) that this is the same group? Sure, he adds a couple of "probably"s, but the style is completely undoubting.

Then, later:

> _(6) Interestingly, the modus operandi of the Lenovo rootkit and the > modified Lo Jacks, are _remarkably_ similar. This might be pure coincidence… > or … maybe something else._

Maybe _what_? Why is he being cagey about what it _could_ be? It looks like he wants the reader to feel like the "in"-group who knows what he means, but in reality nobody does.

<comment><USER22> I didn't get the impression that he was trying to imply anything beyond what he wrote... I think it was very clear that such speculation had no backing and was purely that- speculation.

</comment></comment><comment><USER23> I wish there was a reset button on the back of every computer that would reliably erase all memory and bring the computer back to its initial state.

<comment><USER24> You've never had to help a family member with their computer, have you? Maybe a switch on the motherboard, buried inside the case.

<comment><USER23> You are probably talking about data loss. That's what online backup is for. My recommendation to non-technical people is to do what I do: have one four-word password that unlocks the computer, their password manager, and the online backup. Typing the password every day to unlock the computer makes super sure they won't forget it.

But yes, not letting people reset their computer by accident is just good user interface.

</comment></comment></comment><comment><USER25> How can one determine if LoJack is present on their laptop (Linux user here)...

</comment><comment><USER26> Link to original blog post: [https://www.welivesecurity.com/2018/09/27/lojax- first-uefi-r...](https://www.welivesecurity.com/2018/09/27/lojax-first-uefi- rootkit-found-wild-courtesy-sednit-group/)

</comment><comment><USER27> These blogs are not very good. Here is the PDF about this vuln.

[https://www.welivesecurity.com/wp- content/uploads/2018/09/ES...](https://www.welivesecurity.com/wp- content/uploads/2018/09/ESET-LoJax.pdf)

I don't know why security-conscious people would willingly load a PDF but there you go.

<comment><USER28> Are you saying PDFs are a threat? More so than a web page?

<comment><USER29> Slightly OT, but you would be surprised at how much power PDFs have (especially when opened in Adobe Acrobat/Reader). I recently came across this monstrosity[1] on HN, and the author mentions this:

> Scripts can supposedly do things like make arbitrary database connections, > detect attached monitors, import external resources, and manipulate 3D > objects.

That's an unprecedented level of power for what is supposedly a simple document format.

That being said, PDFs are only a threat when opened in a with support for these obscure APIs, such as Adobe's own readers. You (probably) will be fine opening untrusted PDFs in Chrome's PDF reader (PDFium) and Preview.

[1]: [https://github.com/osnr/horrifying-pdf- experiments](https://github.com/osnr/horrifying-pdf-experiments)

<comment><USER30> You should totes makes this a top level HN post!!!! (I typed in my statutory copied one line NeWS program back in the day too. Never again)

<comment><USER31> [https://news.ycombinator.com/item?id=17915296](https://news.ycombinator.com/item?id=17915296)</comment></comment></comment></comment></comment>


Rebasing Is an Anti-Pattern - <AUTHOR> https://fossil-scm.org/home/doc/trunk/www/rebaseharm.md <comment><USER2> The elephant in the room with SVN was that merging two branches repeatedly was fraught with errors that just seemed to grow quadratically. It was part of why we were on the verge of assigning dedicated maintainers for each release branch so that people only had to recall how the code works now and on their release.

I think people see rebasing as a way to subtract from N. If you have another way that everyone can be trusted to handle 3+ way merges handily and unconfusingly, then it's a matter of retraining people.

If not, well...</comment>


Colour Without Colour: Apple II Computer Graphics - <AUTHOR> https://paleotronic.com/2018/10/03/apple-ii-colour-computer-graphics/ <comment><USER2> That is really cool how Wozniak was able to do that. Pure genius in my eyes.

</comment><comment><USER3> I had the Apple ][ europlus, which sadly didn't come with any color at all. Woz's tricks didn't work with the PAL color standard, if I understand it correctly.</comment>


Is 72K a good salary for software developer in Berlin? - <AUTHOR> I was offered a contract yesterday as a senior backend developer in Berlin for 72k/year. I graduated two years ago with a masters in CS and have two years of experience. I would like to know if this is a good salary or not. I honestly feel that I could have asked for more and they probably might have accepted. I had the feeling that I should have asked for 84k. What do you think? <comment><USER2> If you can blag a 72k salary and still not be able to Google 'German median salary' then I'd say you should shut up and shake their hand.

<comment><USER3> Googled salaries and advice from the people on the ground are very different.

Happens with Glassdoor salaries - they don't necessarily accurately reflect compensation (they're a good baseline I guess).

<comment><AUTHOR> exactly, i noticed that companies manipulate the salaries on Glassdoor. Also there is a HUGE difference between what's on the internet and reality when it comes to salaries. If you read the internet about the topic, the majority would tell you that 50k would be high-end for Berlin!</comment></comment></comment>


What We Need to Truly Thrive: Democracy and Unconditional Basic Income - <AUTHOR> https://medium.com/basic-income/what-we-need-to-truly-thrive-democracy-and-unconditional-basic-income-ccdbe72cefa5 <comment><USER2> Discussions of UBI need to bring back the basic principle -- Dismantling the bureaucracy that distributes current welfare state handouts and instead evenly applying the budgeted amounts would lead to better outcomes than having a bureaucratic mess siphoning off value w/o providing sufficient ROExpense.

As someone who is currently paying for a welfare state, and is likely to end up shouldering the cost of paying for everyone else to get a free lunch, I am on the verge of deciding I'd rather just be poorish with all my time back than to continue to work extremely hard only to have the "rules" consistently changed such that an increasing amount of my labor is claimed by those who had no part in the efforts.</comment>


Google accused of sabotaging Firefox, again - <AUTHOR> https://www.techspot.com/news/79672-google-accused-sabotaging-firefox-again.html <comment><USER2> Previously:

[https://news.ycombinator.com/item?id=19662852](https://news.ycombinator.com/item?id=19662852)

[https://news.ycombinator.com/item?id=19669586](https://news.ycombinator.com/item?id=19669586)

</comment><comment><USER3> Much less egregious behavior than this resulted in anti-trust action against Microsoft in the 90s. We are far past due to start working on breaking up these abusive giants.

</comment><comment><USER4> Are there ways to make chrome slow or not working, while firefox is work great? Ways that allow to hold that stance "oops, it was accident, sorry". Any resources on that?

</comment><comment><USER5> A lot of these "oopses" are the natural result of engineering only testing their work on Google Chrome. Are we accusing Google Chrome of being too successful?

The most shady practice I think is Google using it's dominant search engine position to promote Google Chrome heavily. This is pretty similar to Microsoft shipping with IE.

<comment><USER6> You'd think that but you'd be wrong. Having worked in engineering at Google, the impact of these design changes is well understood. Performance numbers are checked against all "major" browsers for every build. Some things just aren't as important...

</comment></comment><comment><USER7> Same about Gmail. For a long period, it was only performing well on Chrome.</comment>


Microsoft's default font is at the center of a government corruption case - <AUTHOR> https://thenextweb.com/world/2017/07/11/microsofts-default-font-is-at-the-center-of-a-government-corruption-case/#.tnw_dXuADIy5 <comment><USER2> In case you don't click on baity things:

Pakistan's Prime Minister is under investigation for corruption. His daughter defended him with documents from '06...but they use the MS Calibri font, which wasn't available until '07.

<comment><USER3> Thanks. Click-baity titles are the bane of our times.

</comment></comment><comment><USER4> This reminds me of a job posting I saw last year which said you should have at least 10 years of experience in NodeJS, considering NodeJS is from 2009 according to Wikipedia that would have been impossible

I wonder if there is a website that lists crazy tech experience requirements.

<comment><USER5> The posters don't really know that. They just want 10 years experience and they don't care what. It's like I want an experienced guy in whatever is the trend right now. Since NodeJS is the cool one right now, lets say 10 years experience in NodeJS. I just hope nobody got rejected because of it. (would be pretty unfair)

</comment></comment><comment><USER5> Just Wow. The devil is really in the details. (the small ones, the really small ones) which we never notice.</comment>


There's No Such Thing As 'Ethical A.I.' - <AUTHOR> https://onezero.medium.com/theres-no-such-thing-as-ethical-a-i-38891899261d <comment><USER2> There are a couple of different issues.

1) The author's point. That we don't agree on what's ethical so how can we program it?

2) But also, today's AIs aren't mechanism for understanding and balancing a multitude of interests and requirements. They are effectively pattern recognition machines, matching data with categories (or outcomes or etc). So even if you had some criteria formulated, an AI couldn't really do that. I mean, if you true, unlimited intelligence, you might just say "decide like the US supreme court would" and the might be able to do. But we don't even have something that could remotely be challenged that we.

</comment><comment><USER3> > And yet, when it comes to the ways in which A.I. codes of ethics are > discussed, a troubling tendency is at work even as the world wakes up to the > field's significance. This is the belief that A.I. codes are recipes for > automating ethics itself; and that once a broad consensus around such codes > has been achieved, the problem of determining an ethically positive future > direction for computer code will have begun to be solved.

Is anyone actually claiming that AI programs will "automate ethics"? The post seems rather pointless.

</comment><comment><USER4> Ethics for AI has roughly the same problems as ethics for corporations. That's not encouraging.

<comment><USER5> Not to mention fuzzy ownership interpretations. If it (the "AI") does something like incorrectly target a hospital instead of a bunker, who is responsible?

</comment></comment><comment><USER6> A univeraally useful question: What does it take to make it work?

In this case the AI will need to convince all of us to follow the ethical code it designs. It can do this by suppressing information or by making morally defensible decisions.

Having a good track-record of moral decisions key, so AIs need to be public persons and not subject to corporate secrecy.

<comment><USER7> I love how William Gibson reveals Eunice in _Agency_.

I'd for sure love to be her friend.

<comment><USER6> I will need to read that. :)

</comment></comment></comment><comment><USER8> [https://archive.fo/tbGNL](https://archive.fo/tbGNL)

But it quotes Evgeny Morozov as if he were something other than a notorious troll, so don't bother reading it.

<comment><USER9> Why? The article is fine.

> This is the fact that there is no such thing as ethical A.I, any more than > there's a single set of instructions spelling how to be good — and that our > current fascinated focus on the "inside" of automated processes only takes > us further away from the contested human contexts within which values and > consequences actually exist.

This rings true. A.I. is just another tool in the computational toolbox. We need expert practitioners just like we need expert statisticians, mathematicians, programmers, doctors, etc. Do all those other disciplines also have an ethics problem?

<comment><USER8> There are ways to interpret the statement you've quoted in which it's obvious (if by "AI" we just mean "deep learning" or something), and ways to interpret it in which it's just wrong (if by "AI" we mean what people usually mean by "AI", namely AGI). You seem to be interpreting it in the first sense, and additionally you have a considerably more jaundiced view of how widely applicable deep learning is likely to turn out to be than some of its prominent practitioners — Karpathy famously called it "Software 2.0," which to me seems perhaps a bit optimistic.

As far as I can tell, though, the article doesn't say anything both true and nonobvious, which to me is a necessary but not sufficient criterion for it being worth reading. Reliance on Morozov was just a particularly glaring sign of this.

</comment></comment></comment><comment><USER10> > Depending upon your priorities, your ethical views will inevitably be > incompatible with those of some other people in a manner no amount of > reasoning will resolve. Believers in a strong central state will find little > common ground with libertarians; advocates of radical redistribution will > never agree with defenders of private property; relativists won't suddenly > persuade religious fundamentalists that they're being silly. Who, then, gets > to say what an optimal balance between privacy and security looks like — or > what's meant by a socially beneficial purpose? And if we can't agree on this > among ourselves, how can we teach a machine to embody "human" values?

Those who build the machine will embody it "their" ethical values. Problem solved.

</comment><comment><USER11> There is no such thing as an "ethical hammer" either.

</comment><comment><USER12> If you need a refresher on the perils of ethical AI, Asimov's "Three laws of robotics" stories are as fresh as 60 years ago [1].

I'd like to remind that humans themselves are not that good at ethics, both in philosophy and in daily life; they are worse yet on agreeing what ethics to adhere to. You can imagine how well it could be automated then.

[1]: [https://en.wikipedia.org/wiki/Three_Laws_of_Robotics](https://en.wikipedia.org/wiki/Three_Laws_of_Robotics)

<comment><USER5> Good reference. I think "I Have No Mouth and Must Scream" is also standard material for futurist "AI" engineers.

Edit: on the contrary

<comment><USER7> That is an extremely disturbing story.

</comment></comment></comment><comment><USER13> >This is the belief that A.I. codes are recipes for automating ethics itself; and that once a broad consensus around such codes has been achieved, the problem of determining an ethically positive future direction for computer code will have begun to be solved.

I can think of literally nobody who believes this. I don't think anyone working in ethical AI would pretend that ethics can be "solved."

<comment><USER14> There always seems to be a disconnect between tech philosophers and the technology they write about. Maybe they should try to actually work on 'AI' before preaching about it.

To confirm your point a simple example is when working on an automated classifier for loan applications. One way to make the system more ethical, that is less descriminating based on certain features like race or gender, is to often lower the threshold of acceptance for the marginalized classes and raise it for the other ones. Anyone who had to do that sees how it poses a dilemma of equality vs fairness or even fairness vs cost. So indeed, ethics cannot be solved.

<comment><USER10> What if it turns out there is reason people discriminate using those features (for example that people of race X tend to fail repaying their loans), and the classifier just learned that reason from the data. Why should we be expected to "fix" the reality for the classifier?

<comment><USER15> Because now people start to get rejected for loans because of their race, and that's wrong for many obvious reasons.

<comment><USER10> I agree with you that it is _generally_ wrong, i.e. that other factors should come first. But what if the data suggests it? For example if is known that if you lend to someone from race X, there is 80% chance he would not pay back. Would you not incorporate that factor into your decision?

<comment><USER15> No. Find the other, non-racist data points that correlate.

<comment><USER16> Why should correlations with ethnicity be dismissed?

Epidemiological studies tell us some diseases disproportionally affect certain groups. Should doctors dismiss this knowledge as racist and refrain from screening patients in the affected groups because they might come off as racist?

<comment><USER17> Yes. We know, more specifically, that _genes_ are to blame for diseases like hemochromatosis [0], sickle cell anemia [1], or Tay-Sachs [2]. We also know, from pedigree collapse [3], that humans broadly form one single race.

Therefore we know that correlations with _any_ definition of ethnicity or race are spurious, because those definitions _must_ be socially constructed, because the gene pool simply does not have the shape that race realists claim that it does.

Think in terms of contraposition. Sure, _if_ race were real, then maybe it might make sense to talk about racial demographics. However, since race clearly is _not_ real, any demographic correlations must be bogus. There is a much simpler explanation for why some skin colors seem socioeconomically advantaged: Because our society itself has bigoted opinions about skin colors, and has practices like redlining [4] which systematically oppress folks.

[0] [https://en.wikipedia.org/wiki/Hereditary_haemochromatosis](https://en.wikipedia.org/wiki/Hereditary_haemochromatosis)

[1] [https://en.wikipedia.org/wiki/Sickle_cell_disease](https://en.wikipedia.org/wiki/Sickle_cell_disease)

[2] [https://en.wikipedia.org/wiki/Tay%E2%80%93Sachs_disease](https://en.wikipedia.org/wiki/Tay%E2%80%93Sachs_disease)

[3] [https://en.wikipedia.org/wiki/Pedigree_collapse](https://en.wikipedia.org/wiki/Pedigree_collapse)

[4] [https://en.wikipedia.org/wiki/Redlining](https://en.wikipedia.org/wiki/Redlining)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Whenever I hear this, I ask, "Whose ethics?"

When people say that we ought to or should or make some other pronouncement about how we _must_ make AI "ethical," I ask again, "Whose ethics?"

</comment><comment><USER19> At this point, each time I read "ethics" I think of someone proselytizing their political ideology in the most obnoxious way possible.

I do have ethics, they're the product of my own analysis and are consistent with my world view in other issues not related to my job. I don't go around telling everyone else how to conduct their lives. If they have their own ethics, good for them. If they don't, I don't care, it's their life.

</comment><comment><USER20> "Ethical AI" is just another buzzword. Companies are not ethical entities. They exist only to create profit and they will create the maximum amount of profit. Even laws and regulations only factor into it as numbers on a spreadsheet, and any profitable activity will continue as long as it generates maximum profit.

</comment><comment><USER21> I think the article can serve as a good opinion and an introduction to the subject. Certain ideas seem questionable enough - maybe the matter is inherently more complex than something which can be put in an article.

Does, for example, author argue that something which human can do the machine cannot?

<comment><USER22> Not really but he would be right if he did.

He argues that deep down the goal of the machine is to take decisions in humans contexts. Which by definition only can make sense for a human.

Ofc we can argue about a fictional theoretical human like machine to the point it is undifferentiated from a human... but then we created a human. Not a machine anymore.

<comment><USER21> > Not a machine anymore.

It's like failing to see the difference between human and machine. One can argue then there is no difference right now. So?

It's a time-honored discussion if machine can do all a human can. On the other hand, religion also has an associated long-living discussion. If we decide according to our beliefs, we should invent another mechanism - something other than reasoning, because it's not used here - to get to agreement.</comment></comment></comment>


Many teenagers report that they've never been so bored - <AUTHOR> https://www.thedailybeast.com/generation-z-is-already-bored-by-the-internet?ref=home <comment><USER3> They touch on something later in the article that sounds perfectly familiar to me from my teen years: eventually that unavoidable and universal boredom can lead to creativity.

Just as people my age saw TV go from 13 channels to 150+ channels and wondered how you could ever run out of things to entertain yourself, today's teens run into the same limited ability of "consumption" to keep their minds stimulated.

Eventually there's nothing on that you feel like watching, your mobile media feed runs out of new posts, and you get tired of playing the same video games. That period of boredom can be just what you need for ideas to start percolating in your head and occasionally lead you to make something or do something different.

Boredom is what got me screwing around with simple programming on my old Commodore computer or figuring out how to use a mix of cables, adapters, and stereo inputs on my boombox to experiment with rudimentary multi-track recording.

To this day I love having a good supply of parts, bits, pieces, craft supplies, and yes--boredom available on occasion because that's when I try out new ideas. When the alternative is just sitting around doing the same old things, the barriers to trying new ones tend to drop.

<comment><USER4> Boredom is a double-edged sword; it can lead to creativity, but it can also lead to drug and alcohol abuse. Small towns and counties are rife with substance abuse and everyone will tell you it's because "there's nothing better to do".

If boredom can be reasonably structured, then I think it's a good thing, but unfettered boredom is a bit risky in my opinion.

<comment><USER5> Idle hands are the devil's workshop.

<comment><USER4> Love that saying. I use a different version, "The devil makes work for idle hands".

</comment></comment></comment></comment><comment><USER6> As someone who falls into 'Generation Z' (at least technically. The line between generations is a special kind of confusing), I'd say on average that's the exact opposite of true - there's so much to do I'm almost never bored, but the result of that's been absolutely disappointing - it's made it infinitely harder to dedicate myself to learning new things, or reading books. There's simply so much to do that it feels almost neglectful not to try and get everything done.

Then again, I suppose that might just be a chronic lack of an attention span, which I've had years before I had internet access, so my experience is more than likely less common than average. There's simply too much to do and not enough hours in a day.

EDIT: I will say, though, that the internet's been incredibly beneficial to most, if not all, of those who've grown up with it - the world's never had a better comprehension of the English language.

<comment><USER7> The lines between generations are definitely blurry - if you stretch the unofficial start and end dates apart, my father and I are both parts of the same generation (how does that work)!

<comment><USER6> I'm in the same situation, actually! With the dates I've seen for Millennials, at least.

<comment><USER7> Youngin' ... my father and I could both be baby boomers.

</comment></comment></comment></comment><comment><USER8> I'm 32. I only see people on a few days of the week, some days I don't leave my house. I'm not axious, but I seem to think, "Why leave? My stuff is here, I can do all my work and socialize from the internet."

Part of the problem is I'm starting a company, and am on low finances until it launches. So, I'm car-less, in a city not really meant to be walked, and it's a small town, so not much happens anyway.

Part of me wants to take a cheap job washing dishes, so at least I see people regularly, but I know it would be a waste of my talent, and I would hate it and quit after a day ( seeing how futile it was ), but seriously.. yea, I get what they mean.

Sorry I'm not being extremely articulate, I'm trying to wrap my head around the utility and role of the internet in my life moving forward.

<comment><USER9> I find most people IRL are very boring. Out of all the people surround me there's one guy who I can talk to about life extension, robots, AI, etc. Everyone else is busy with meaningless everyday news and/or sports and/or generic entertainment shows, almost nobody has cool hobbies or even interests.

<comment><USER10> There are other interests besides what you might find on HN. Talk to someone about law or music or philosophy or art. Not everyone particularly cares about life extension, robots, or AI (I certainly don't). Maybe it's not that everyone is boring, but rather that they simply don't share your interests.

</comment></comment></comment><comment><USER11> I'm the most creative when I am bored. Being bored is important.

<comment><USER3> Yep! I've tried explaining this to my gf. I told her that I just _need_ days where I have the freedom to sit around and do nothing for a few hours because without feeling rested and bored, I don't have as much mental motivation to try new things or finally tackle projects that have been kicking around in my head for months.

When I'm never bored I feel like I'm too busy. Then when I get some small bit of downtime, I don't want to do anything because I never know when I'll get the next small bit.

<comment><USER12> I have a mentor who loves to define this any chance he gets. Recreation: re- creation. It's not what we do for fun, it's what we do to recreate ourselves. Arguably one of the most important activities we may be so fortunate to partake in. In my freelance circles we have an idiom "getting your _no_." It applies to when one learns to say no to things and has the courage to use it. As in "I finally got my _no_." Those two lessons have been invaluable for my wellbeing.

<comment><USER13> Wow, I never realized that. [Quick lookup]... indeed, the etymology is from Old English via Old French going back to Latin "recreare" and seems to have had that meaning all along.

This comes at the perfect time for me as I've been reflecting on my hobbies and how to make the most of them for my life.

</comment></comment></comment></comment><comment><USER14> We're all getting bored because microconsumption is inherently unsatisfying. You're waiting for others to produce a tiny bit of content for you to consume. Perhaps we will see a renaissance of long form consumption, dedication to work and study, and doing things for their own benefit rather than for social gain.

<comment><USER15> > We're all getting bored because microconsumption is inherently unsatisfying.

Well said.

> Perhaps we will see a renaissance of long form consumption...

The problem can perhaps be considered one of opportunity cost. In the time it takes to read that long form article, I could read a whole lot of "tiny bits of content". And in many ways, I have spent the last N years tuning myself for those tiny bits. So the long form article has to pay me back for the time I spend reading it, not just at the end of the article, but at least at the rate that the tiny bits of content do. Otherwise, I'll feel like the article is wasting my time, and I'll quit part way through, looking for something more stimulating.

Of course, the flip side is that all those tiny bits of content have their opportunity cost, too. The problem is that, for each one, it's just a tiny opportunity cost. But add them all together through a day (or worse, a year), and I lose a _huge_ amount of time and mental energy on tiny little searches for stimulation.

</comment></comment><comment><USER16> > "Sometimes I feel like I've seen everything there is to see on the internet"

That's very sad, and a direct result in my opinion of the gamification of digital attention. If it's not on ${social_network} and doesn't earn you Likes then it might as well not exist.

Even just pressing Random Article in Wikipedia would be a step up out of that abyss.

But first teenagers have to relearn the ability to self-discover, like previous generations did in libraries, instead of sitting staring at a feed waiting for something to be pushed to them.

And the second lesson might be that not everything has an immediate feeback. I still reach back to things that I learned about by chance on the Web and Usenet back in the 90s.

<comment><USER17> Eh... I'm not Gen Z and I get this quite often too. Sure there are a few dozen new articles on the front page of HN, but not all of them are interesting to me. Sure there are thousands of subreddits but good ones are hard to find and eventually you'll run out of interesting content there, too. Random Wiki pages are fun, but for every good one there's a hundred boring ones. I used to use StumbleUpon but again, the signal to noise ratio is just silly.

I don't think your assumption that these teens just don't know how to discover content is correct. The problem is that content isn't interesting. There's only so many times you can hit random on Wiki and stare at "List of famous dogs from Bollywood movies" before you want something more engaging.

Your comment, to my ears, sounds like "these kids need to put down their Nintendos and go play a nice game of kick-the-can!"

<comment><USER15> > Sure there are a few dozen new articles on the front page of HN, but not all > of them are interesting to me.

I think the problem is deeper than that. The problem is that even many of the interesting articles are only interesting in a certain way. I'm looking for something, and _what I 'm looking for isn't really here_. And after a few years on HN (or Facebook, or Reddit, or Twitter, or whatever), I start to realize that the next article isn't going to really supply what I'm looking for, just like the last thousand didn't. So I'm bored even while I'm looking at the next HN article, hoping it will do the trick, and at the same time knowing that it really won't.

</comment></comment></comment><comment><USER18> It's not just the kids. I've never been so bored with the internet.

<comment><USER19> It's the "commoditization" of the Internet.

The other day I started thinking about how amazing toilets are – how much time they save every day. Bare with me. I went on thinking about the history of toilets, musing back to an ancient one I visited in Ephesus, Turkey. There were no toilet stalls. Between 6-10 holes in a bench, with flowing water underneath. According to our guide, this is one of the first toilets of its kind (citation needed). It must've been so amazing when they got this toilet. They probably talked about it all the time, and wanted to go there to hang out. It was a place of communion. Today toilets are utilities. They aren't exciting at all. You barely stop to wonder about the marvel you sit on. How much time it has saved you, or how the mechanics actually work.

The Internet will sort of become like that one day too. Just a utility.

</comment></comment><comment><USER20> >"Sarah, a 14-year-old in New York, describes it this way: "I'll go on Insta and it's just people all talking about the same things. I'm like, I already heard that or I already saw that. It's like, when you've seen everything there is to see in your Insta feed or on the internet. We see the same lip gloss, the same eyebrow style, the same meme like 14 times. It all gets old and then you get bored.""

Incredibly sad that this is what the internet has been reduced to. It's not the internet that's boring; it's your vapid social circle!

<comment><USER21> Maybe the medium is partly at fault. How can you sustain any sensible discussion in the noisy mess of Insta etc? You can try but it reduces to catchphrases and catty remarks so easily. Even here on HN its a constant fight to keep folks on topic and contributing usefully. How much harder in the wild, wild internet!

<comment><USER22> YouTube is full of fascinating stuff for all hobbies. But it's hard to find because there's no quality filter, only popularity filters that promote clickbait.

<comment><AUTHOR> There's plenty of great content on YouTube. If you spend a day or two watching quality videos, YouTube will then start recommending other quality videos with a similar worldview. How do you find that first day or two worth of quality YouTube channels?

[https://www.reddit.com/r/AskReddit/comments/7xn6yv/what_yout...](https://www.reddit.com/r/AskReddit/comments/7xn6yv/what_youtube_channel_is_great_to_binge/)

</comment></comment></comment></comment><comment><USER7> "Sometimes I feel like I've reached the end of the internet"

Sometimes I've jokingly asked my family members if they've finished reading it (the Internet) yet. It's so sad that these limits are imposed - sometimes by ourselves but also often by the invisible walls of the corporate, private gardens. I guarantee there are enough educational (history/technology) and maker videos on youtube alone that I'd never get bored.

But if you're specifically looking for more to do where your friends are, you're going to be limited in the same way you would be in real life. When I started traveling extensively for business in the mid '90s, I made a point of being friendly to people in airports, restaurants, stores, etc. (Well ... those that wanted a conversation anyway). Expanding the pool of people that you talk to will inevitably lead to information pools that you weren't aware of.

As an analogy, it always amazes me to watch someone else using software - <USER2> git or even bash for example. I'll say "I didn't know you could do that" and when they ask how I accomplish a task, they generally learn something new too. I have (by far) more sites bookmarked that I've learned about here on HN than from any other source. I guess it's because we don't just repeat lip-gloss and fingernail polish styles here?

</comment><comment><USER23> I think part of it is that mainstream technology has become so homogenized and consolidated. Both hardware and software. Phones these days, for most people, are no longer empowering pocket-computers, but same-y glass rectangles that all hook you into the same handful of content streams. That's incredibly boring.

In 2018 you have to go out of your way to remember how novel and diverse both the internet and personal computing can be.

</comment><comment><USER24> It's great that our bodies have this mechanism to reject this artificial progress, the kind that is so fast we can't even get accustomed to it.

There is so much, SO MUCH, to do, to see outside our black mirrors, that we don't even realise. But it's much harder now than ever. Because our phones have made everything seem so easy, it cheapened many experiences (e.g. social interactions). Now that we have to go back we have to realise that the pace is much slower in real life.

reminds me of: [http://www.paulgraham.com/addiction.html](http://www.paulgraham.com/addiction.html)

</comment><comment><USER25> I'm a definitive millennial, I have access to multiple video streaming libraries, 3 game consoles, literally 100s of video games, all of the internet, and any book I could want. I still find myself looking at my copious amounts of entertainment and think "I don't want to do any of this right now." I may have a netflix queue in the hundreds and entire series I want to watch, but I experience the boredom that only comes when you have so many options you can't pick one. I don't think this is unique to teens.

<comment><USER26> I think it comes with changes in personality. I used to get into a new game every 3 months or so (and I still buy steam games on sale like that) but I find my way back into two games for months. I think it has to do with side work and hobbies. I definitely don't binge netflix or gaming like I used to.

</comment></comment><comment><USER27> That was... a lot of fluff.

A 15 year old kid who has "seen everything there is to see on the internet"? I mean, really.

This is the exact same 'restlessly disengaged' phenomenon humans have been experiencing since the dawn of the species. It's part of having a complex brain. Other animals probably even have it.

There is no end of stuff to do and see! Sometimes you just don't feel like doing anything. And that's okay. It might be better in my mind to consciously redirect, or to take a nap instead of zoning out on a screen, but to each their own.

<comment><USER28> >A 15 year old kid who has "seen everything there is to see on the internet"? I mean, really.

This isn't necessarily a literal statement. There's just so much noise and nonsense to wade through as to be demoralizing. Or the excess stimulus is enough to just turn you off everything, in part why I try to minimize aimless surfing. It may take a conscious effort to stumble upon something of interest.

</comment></comment><comment><USER29> >boredom is actually a crucial tool for making our lives happier, more productive, and more creative. -Gretchen Rubin

It reminds me of a book I read last year: Bored and Brilliant[1].

[1] [https://www.amazon.com/Bored-Brilliant-Spacing-Productive- Cr...](https://www.amazon.com/Bored-Brilliant-Spacing-Productive- Creative/dp/1250124956)

</comment><comment><USER30> I am shocked by the amount of people browsing the internet on mobile/tablets. If you are not going to make the effort to get yourself on a seating position so you can actually create stuff efficiently, you 're definitely going to be bored because feeds are just other people's ideas and you can only have so many before you lose yourself.they should try a desktop machine

<comment> yoz-y Well, you could also say that on a desktop machine one will just open 20 tabs with long-form articles to "read later" and then end up scrolling down a bite sized feed anyways. I know it happens to me.

<comment><USER30> the point is not to read more, but to try things real-time.

<comment> yoz-y Having a desktop computer may be useful if what you are making/trying has to be done on a computer. However, most of the things you read about on the internet can be done without it no? For example you could be looking up music sheets, or some tutorials on how to craft something.

I get your remark that the massive passive consumption leads to boredom, but I do not think that the format is the real culprit here.

</comment></comment></comment></comment><comment><USER31> Question.... is boredom felt differently by people in different eras?

I was terribly bored as a teenager. I didn't have the luxury of blaming the internet at the time. _I_ was boring.

</comment><comment><USER32> The teens are bored because 1) they are misusing the technology/resource that is the internet and 2) they never learned how to entertain themselves, probably because of the internet.

I'm a Millennial and had several friends complain regularly in high school and college that they were bored. They couldn't stand to be alone because they didn't know what to do with themselves. I never understood this. I was fine in groups and could be social and I was perfectly fine being alone for extended periods of time. I genuinely can't think of a time when I was bored when I was left alone. Sure, I've been bored in my life - but it has been when I was forced to do something or be somewhere I didn't want to be. Alone and in charge of my own time, though, there was always something I wanted to do, learn, etc. I think people like some of my friends and apparently Gen Z never learned to be alone or how to get lost in their own mind, whether that be through creativity or curiosity.

I've also noticed another troubling trend with Gen Z. Many of them have no passion, drive, or ambition. They don't really care about much of anything and simply want to be entertained all the time. I think that's the other side of this. I have younger siblings as part of this generation and nieces and nephews and they all seem to be aimless in life. Granted, they are still young and may not know for sure what they want to do, but for all but one of them they seem to have no interests or hobbies!

This wording might make me sound old and cranky but...when I was their age I was not like that. This isn't some romanticized hindsight bias from my childhood. I remember clearly. I had several interests that I was really, really into - science/math, computers/programming, tennis, and science fiction. I was fortunate enough to have parents who could afford to send me to places like tennis camp in the summer as well as computer camp (yes, that actually existed back in the 90's, believe it or not) so that I could further these areas of interest. My pure entertainment was through movies, music, and yes, gaming. But gaming wasn't done out of boredom. It was done for one of two reasons. First was the social aspect of multiplayer games like Counter-Strike and Goldeneye (which at the time had to have everyone in the same place). The second was for the fantasy aspect of gaming so that I could allow myself to get wrapped up into a well-told first person story with games like Myst, Half- Life, and System Shock.

Lastly, what truly astounds me is Gen Z's lack of curiosity. When Google and Wikipedia came around, I entered a whole new level of learning online. I could find and learn anything I wanted to, without having to hike to the library and try to figure out where to find the information I wanted (which I never did, because I hated going to the library). The internet became a massive educational resource to me. But Gen Z doesn't even use it for this purpose, as far as I can tell.

I don't think, as the article suggests, that the cause is that we have adapted. Instead, I think society has changed in a few other ways where instead of trying to curate children's curiosity and imagination, we have instead decided to follow stricter structures and schedules in a one-size- fits-all attempt at schooling, while decreasing funding for the arts and entirely getting rid of things like shop class. Combined with these structural changes, children have tablets from shortly after birth and they learn that entertainment (a.k.a. the eradication of boredom) is just a click away...until it suddenly isn't. And then when that hits, they don't know what to do, because they have never been in that situation ever before. Their mind literally can't function in the same way because it was never taught how to handle that scenario. So they click around through apps like zombies, accomplishing nothing, learning nothing, and remaining unfulfilled.

<comment><USER33> >I've also noticed another troubling trend with Gen Z. Many of them have no passion, drive, or ambition. They don't really care about much of anything ... they all seem to be aimless in life.

I think this is a symptom of a much bigger problem in society. I think there was a similar phenomenon during the collapse of the Roman Empire: people simply lost interest in maintaining the society and doing what was necessary to keep it going (such as specialization of labor), and it fell apart. People abandoned the cities to instead work for feudal lords, and the cities were sacked by invaders.

<comment><USER32> I agree with that general concept. The larger society becomes and the more densely populated an area is, combined with expanding government in nearly all areas of life, people seem to have this attitude that everything is someone else's problem to fix. Problem with poverty? Don't worry, government is on the case. Healthcare is too expensive? Government has a solution for that. Police are abusing their authority? Don't worry, the ACLU and other rights advocates are suing on your behalf. The list goes on. All of this takes away from the concept of being an involved, responsible citizen that knows what's going on in your community. It also absolves people of the moral obligation to do anything since the issue of the day is a clearly defined problem that someone else is supposed to tackle.

And of this, I have to admit, I am not guiltless. I don't feel connected to society in the same way I used to and I admit to having fallen into this mindset. I have actively tried a few times to offer something back (other than money) and no one seems to want it, despite their claims to the contrary. Case in point - I went on several forums offering completely free advice and support in helping people to lose weight as I have studied this topic extensively and made significant changes to my body through changing my eating habits. Only one single person even responded and then they didn't even follow through with a single communication. None of this was unsolicited, either. People directly asked for help and then wouldn't take it (despite being free). Others chastised me on the boards for what they thought was a scam ("it's not free, he'll hock products at you", despite my promise to not do so). I even put up fliers at my local grocery store and bus stops advertising the same. Not a single response. I tried to put up a flyer at my community center but they put up so many roadblocks just to let me put up a piece of paper advertising a free service, I couldn't get approval. So even when I try to pay it forward, so to speak, I can't even do that, so I just gave up and stopped trying entirely.

So now I'm more, "Fuck 'em, every man for himself. They're someone else's responsibility and they probably have a family anyway who should be helping. Not wasting my time." And that's really messed up and unfortunate.

<comment><USER34> Thanks for trying. There are still a few areas where good samaritans are valued, but they are drying up (mostly due to companies and scammers).

</comment></comment></comment></comment><comment><USER35> It's easy for me to think "first world problems", but that's the aim off such clickbait-ish articles after all.

Hopefully this boredom will lead to the end of the society of the spectacle and commodity fetishism (bringing with them consumerism i hope).

Maybe this will result in a new approach towards entertainment, how to socialize between peers, art; it would be amazing if boredom would lead to a renaissance driven by science and helping others - let's see

</comment><comment><USER36> Teenagers being bored? Is this a news report from the 50's? :)

</comment><comment><USER37> The Onion article almost writes itself.

</comment><comment><USER38> So, 57 channels and nothing on?

</comment><comment><USER39> Do they still even know how to entertain themselves IRL? Can we get Calvin and Hobbes in front of these kids?

<comment><USER40> Yes they do.

Whilst I also like a bit of C&H, it's a cultural artifact from another generation. "(T)hese kids" don't need our C&H, they have their own, or will make it themselves.

</comment></comment><comment><USER41> I'm bored by roads.

</comment><comment><USER42> _Never_</comment>


Passwords: Using 3 Random Words Is a Really Bad Idea (2017) - <AUTHOR> https://paul.reviews/passwords-why-using-3-random-words-is-a-really-bad-idea/ <comment><USER2> I guess this is a good primer for some folks, but there are two really spurious arguments:

(1) Your working vocabulary of 20k words is irrelevant. If you pick the words yourself, they aren't random and your random-word-vocabulary (the ones you'd actually pick) is waaaay less. If you use a randomizer, which you should, just give it the full dictionary (or say, top 100k for memorability).

(2) Faced with the suggestion of adding more words, they show that 4 is crackable. But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect. This article should be as simple as "use 5 random words, not 4".

Password managers have their own issues, both with usability and their tendency to provide centralized targets. And, they still require a secure passkey themselves -- for which a long random phrase is a perfectly reasonable approach.

<comment><USER3> Hi evrydayhustling

"If you use a randomizer, which you should"

That's a big IF. People should use a password manager, or create unique random passwords for every site... but they don't. Of course, if someone other than you chooses the words, you'd need to include the entire dictionary.

"But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect."

I haven't excluded this; I make reference to DiceWare at the bottom of the page. This covers both using more words chosen at random, which is the entire point.

Thanks

<comment><USER2> Oops - I didn't notice this part was related because I haven't used diceware! I still think it's weird to put something this fundamental to your argument in a footnote under one product above, but apologies for implying you if ignored it entirely.

</comment></comment></comment><comment><USER4> No, using 3 random words isn't "a really bad idea". That's complete nonsense.

The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online.

The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first place. Capitalize one random letter in all of that, throw a number between the second or third letter, add dashes, whatever and they're totally screwed. Game over, you win.

<comment><USER5> Even if they know it doesn't matter. Online password brute force attacks are extremely rare. If you don't reuse passwords then offline attacks don't really matter to you.

<comment><USER6> This very week you had the Quora users info leak ([https://blog.quora.com/Quora-Security-Update](https://blog.quora.com/Quora- Security-Update)) where users info, including and their encrypted passwords, were compromised.

Password reuse, or even following a simple pattern for having different password for each site (i.e. a seed+site name) is the main problem here. If one site falls, then it should not be trivial to deduce your password or how to attack it for other, maybe more important or secure, sites.

<comment><USER4> So they brute force an account (a not insignificant effort and the attacker now sees your password of "fuzzykittytoes". What are they going to do with that information?

Target a bank with it? They can't bruteforce a 14 character password for the bank over the internet. What trivial method would you use to get into your bank account, if you didn't reuse that password?

</comment></comment></comment></comment><comment><USER7> I'm not sure how this made it to the front page. It mashes up several things about passwords, some of which are dangerous, some of which are smart. It acknowledges the strength of a system like diceware. Then it concludes 'Don't use words in passwords. Ever.' while failing to distinguish between passphases based on words (like diceware generates) and having a password that is "benisgreat".

<comment><USER8> Here's 1Password's article on creating a master password (spoilers: it is _way_ better): [https://blog.1password.com/toward-better-master- passwords/](https://blog.1password.com/toward-better-master-passwords/)

<comment><USER9> > Change a weak Master Password, otherwise leave it be

I wish LastPass would take this advice. They ask me to change my master password every time I log in because I've had the same one for a long time.

</comment></comment></comment><comment><USER10> The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear?

Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?

<comment><USER11> Write it down on paper, put it in an envelope, and leave it in your home, preferably in a small fire resistant lockbox that you keep other important documents in.

If your home isn't secure enough for this purpose due to roommates or other issues, ask a trusted friend, parent or relative to hold onto it and your other important documents on your behalf. If your situation makes putting it in someone else's hands a problem, you can split the password or other key material between multiple locations as well. 1Password makes it easy with the "rescue kit", and KeepassXC can use a combination of a password and file-based key for this purpose.

Security conversations on this topic typically go down some rabbit hole about the government, police etc. Keep it simple and don't crawl into that hole. End of the day, in the United States, the most reliable and legally secure place is your home or in some cases an attorney's office.

<comment><USER12> Not a safety deposit box at the bank?

<comment><USER11> Safe deposit boxes are an option but are expensive, inconvenient and often less secure. A bank clerical error, fubar, or payment issue could result in loss of the contents at any time. (See: [https://sacramento.cbslocal.com/2018/07/26/safe-boxes- stolen...](https://sacramento.cbslocal.com/2018/07/26/safe-boxes-stolen- drilled) )

When you need your password at 4:30PM, the bank is closed.

Also, it's an awful place for important documents like a will, as the bank will require a court order for your family to open it upon your death.

</comment></comment></comment></comment><comment><USER13> i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.

<comment><USER3> I'm sorry, but that's nonsense if you actually think about it.

Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached.

My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is an exercise in futility. The people who follow the advice are still at considerable risk, the majority will ignore it and remain almost as vulnerable.

<comment><USER13> That's if they're encrypted in the first place. Avoiding re-use is far more important, as others have said in this thread. And humans are bad at remembering random combinations of letters and numbers, but ok at remembering words. If I could get my parents to use a password manager, I would.

But until then, three words is better than re-use, and your pedantry still isn't helping the people who need it most, i.e. people lacking technical literacy in the first place.

<comment><USER3> I'm guessing you mean hashed, or am I being pedantic? ;)

Anything is better than re-use, that's not really an argument. If I recommended using "1", "2", "3" for three different sites, that's technically better than reusing the same password... but still not safe.

Labelling it as pedantry really ignores the wider point. Having 3 unique passwords which take 40 seconds to break really isn't a great improvement, neither is it pedantic to point out that fact.

</comment></comment></comment></comment><comment><USER14> I feel like the real take-away from this article is that MD5 is broken, something we've all known for ages.

An application using a memory-hard algorithm like bcrypt would yield the same results, but without the hassle of retraining all users to use longer passwords.

<comment><USER15> Yup, also no mention of salting the passwords.

The 200 billion md5 hashes per second figure they use matches up nicely with this 8x GTX 1080 system: [https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...](https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40) which cracks bcrypt (at a weak security factor) two million times slower.

So, that same system would crack a 3 word password at this weak bcrypt setting in about 3 years, and a 4 word password in 50 thousand years.

<comment><USER3> Salts make no difference here. They do not harden passwords, but make an otherwise deterministic process random to ensure no two inputs result in the same output.

Of course, using a slower hash algorith will increase the time required to break it... but we know the majority of sites don't adequately protect passwords.

There are 331 breaches on HIBP. 108 used MD5, 43 used SHAx... meaning half of all firms used algorithms which we can break quickly & easily.

</comment></comment></comment><comment><USER16> I think this misses who the intended audience of this simple password advice is. Hint: it's not us.

Normal people's passwords are terrible! It's the site name, their name, "password123" or a single word with a number on the end.

A lot of advice about passwords is aimed at getting normal people to make easy steps to make their passwords better, not perfectly uncrackable.

Complex passwords don't work for lay users and most of them aren't going to switch to password managers. So getting people to make small steps, like not reusing the same password and making it more than one word and a number, does make a big difference to users' security.

</comment><comment><USER17> Outside of the Twitter-verse, who actually advocates to use a 3 word passphrase? Use 5 or 6 words and the problems listed here vanish. Also, use diceware or an equivalent generator.

If you're writing out a string of letters and characters, that's not going to be random either. The only way to generate a random password is to use a device that gives you random numbers. If you're relying on your working vocabulary and picking passphrases out of thin air, then your 12 character letters, numbers, and symbols isn't going to very good either, because you're not good at choosing things randomly and picking letters out of thin air won't be any better than words.

This entire article could be rewritten as one sentence: "Use a program or a dictionary/dice to generate your >4 word passphrase."

<comment><USER18> It doesn't even have to be truly random, just "random enough". If you were to use a passphrase like "Use 5 or 6 words and the problems listed here vanish", that wouldn't be random per se, but for an attacker it might as well be.

</comment></comment><comment><USER19> The simple answer here is to use non-word words. A sample might be:

eggscellent frantillion scrofulon

Ok. I'm skewing to the letter 'L' \- but they don't have to know that.

<comment><USER20> You can also, add irregular punctuation & capitalization, throw in some numbers within words, include words from other languages that you know or look up. Or use near words of other languages.

I have always thought of "3 random words" as a starting point for randomizing a password not literal advice to follow.

<comment><USER21> I wonder about that - given that a dictionary attack relies on known values (and can substitute out "l"'s for "1" and "!") - what happens if you write something like "Ger!bils"? Is the dictionary attack totally nullified, or is that possibly accounted for? That would seem to open up the potential space a ton.

<comment><USER22> Depends on the attacker, but it's probably accounted for at least partially. In some passwords where I don't care much about security I'll use this technique and some personal, site-specific mnemonic - if their logo reminded me of a gerbil, I might start with the name of a pet gerbil I once had and obfuscate it with character replacement or keyboard proximity replacement (same characters, one row up or down). These passwords are always unique to the site, which doesn't get any financial info.

When I need a secure password that's easy to remember I'll obfuscate the initials of a memorable passphrase from a joke, poem, song or book. My password manager is offline (remember the LastPass hack?) so I need to read from it once and type it in.

Update: I remembered this old article that describes some of the techniques that have been used to crack passwords, including 133t-character replacement: [https://arstechnica.com/information- technology/2013/05/how-c...](https://arstechnica.com/information- technology/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/)

</comment></comment></comment></comment><comment><USER23> This depends on the cracker knowing that you only use words in your password. If they don't know that, then they're back to cracking it based on length. Or at least, attempting all of the words _first_ , then brute force.

<comment><USER24> If you have _n_ schemes that you're targeting, that's only a slowdown by a factor of _n_ , because you share effort between the two schemes.

A cracker can try all the word combinations below a certain depth, then try all the passwords below a certain depth. Then increase the search space a bit for each, as long as they want.

<comment><USER23> That's fine if your only other scheme is "exact matching words". But once you break from that, even a little bit, the number of different possible schemes balloons quickly. For instance, 3 words + a symbol at the end. A cracker can try all the words, sure. But they're probably not going to try every different "all the words plus a little twist" schemes.

<comment><USER24> Most of those schemes fall into the category of:

sym,word,sym,word,sym,word,sym

Where sym is 0-1 symbols or numbers, and comma indicates concatenation.

If you use 5+symbols you're probably creating enough entropy, but you're veering into hard to type, might as well just use gibberish territory.

<comment><USER23> They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of:

* word sym

* sym word

* word word sym

* word sym word

* sym word word

* word word word sym

* word word sym word

* word sym word word

* sym word word word

And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?

<comment><USER24> Most of those are covered by what I wrote. I said they're ranges of 0-1 symbols.

<comment><USER23> Right, but my point is that since the cracker doesn't know which you're going to use, they'll need to stick to broad schemas that will take a long time. It doesn't matter if you only use 1 symbol, if the cracker needs to try every combination of up to 5 symbols. And even a broad schema like you suggest—which would take a long time to complete—will have holes that would be easy to squeak through, which means even those broad schemas have minimal value.

Ultimately, even a schema like "sym? word sym? word sym? word sym? word sym?" is useless. They'll have to use brute force, and that means the difficulty of cracking your password is back to being based on the length.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I really do hate that many websites/services put a max length on passwords that is really short like 16.I remember even outlook.com restricting it to 16 chars,really bad for people who would use long sentence like passwords.

</comment><comment><USER26> Niceware ships 65,536 unique words. 3 words chosen randomly is 1 "password" of 281,474,976,710,656 possibilities.

[https://diracdeltas.github.io/niceware](https://diracdeltas.github.io/niceware)

If that password was hashed with a single pass of vanilla MD5, the Jeremi Gonsey's cluster of 8 Nvidia GTX 1080i GPUs [2] would be running at 307,200,000,000 hashes per second.

[https://gist.github.com/epixoip/ace60d09981be09544fdd3500505...](https://gist.github.com/epixoip/ace60d09981be09544fdd35005051505)

In order to exhaust half of the keyspace, so odds would be in the favor of the password cracker finding the original hash, they would need to search only 140,737,488,355,328 hashes.

At 307.2 gigahashes per second, this would take approximately 458 seconds, or just under 8 hours using the Niceware list.

However, jumping to 4 random words grows that time by a factor of 65,536, which means reaching 50% exhaustion would take approximately 1 full year. Moving to 5 randomly generated Niceware words, and it's impractical to attempt cracking the MD5 hash.

Cherry-picking 3 words is a little dishonest for the discussion surrounding password security. The right "best answer" for password generation is to use a password manager, no argument there. And I don't know of any password generators that generate passphrases by default, Niceware, Diceware, or otherwise.

But if a user wants a passphrase instead, I don't know of a security expert who would recommend 3 words.

</comment><comment><USER27> Quickly just sharing:

I must have read online for 2 solid years about how much better/safer and secure Password Managers are before I finally switched to one.

After switching though, the CONVENIENCE of a password manager is the most undersold part of it.

Nothing seems to be perfect solution with security, but if you're reading this and haven't switched to a password manager for whatever reason, security benefits aside I would highly recommend finally doing it.

<comment><USER21> > CONVENIENCE of a password manager

Absolutely. The only issue I have is when I'm logging into something I log into every day, but other than that it's great to log into the manager and go "ah, here's the password I set up a decade ago".

</comment></comment><comment><USER28> What I don't understand is the math. Author makes the claim that using 3 words changes the combinatorics from 62^12 (62 characters, in 12 positions) to 20,000^3 (20k words, in 3 positions) but a hashing algorithm doesn't work with words, it works with characters, so if the words are 4 characters each, you've still got 12 characters to fill. Since an attacker doesn't know that you've not used symbols or numbers, they can't reduce the problem space to 26^12. Right?

Have I missed something in the article that would make the connection?

EDIT: Yes, hashing works with bytes, so technically, it can be even stronger if we include charsets from other scripts in the problem space.

<comment><USER29> Exactly. The attacker would have to _try_ a word-based attack to benefit from the ~7 hour time-to-crack.

So I disagree with the article's advice: "Don't use words in passwords. Ever." Yes, you should use caution when using words in a password, but even if you use a password manager, a 5- or 6-word diceware password is ideal. Even better if you stick on a 4-digit numeric "salt" to your diceware passwords.

But yes, I do agree that a 3-word password is too short (~33 bits of entropy[1]). It should be at least 5 words (~55 bits). And you really need at least 6 words (~66 bits, obviously) for a master password.

1\. Using EFF's user-friendly, ~1200 word list for diceware.

</comment></comment><comment><USER30> Novice in the area, so grain of salt (and if you can correct me where I'm wrong, that'd be great. All for learning):

1) I don't think the base changes nor the exponent deviates from the character approach (in reference to the 20,000, 40,000, and 171,000 base stated). If we're in a system that allows all uppercase letters, all lower case letters, all special characters, and all numbers, then the base is the sum of those: regardless if my password is purplepenguinparade because you don't know that I've artificially set parameters for my password within the existing parameters. It could be argued you could try all permutations of lowercase characters first (base 26) but then how do you know to go to 26^19 before adding more to the base?

1a) if the hashed passwords give away tells as to what the decoded password is like (in this case 3 words lowercase), that'd seem like a concern about the encryption moreso than the password.

2) The 20,000 and 40,000 part seems like a meaningless piece of trivia. What if one of the words I want to use doesn't fall in your 20,000-40,000 word store? You're never going to crack my password. Better go the full 171,000 or whatever it was and hope I don't slip an extra character of the numeric, special character, upper/lower case variety.

\</comment><comment></comment><comment>-

While I do personally use a password manager, it isn't perfect for me either (requires loading 1Password 2x on Windows 10 for me because the first attempt does nothing, but loads on second try). I do hope more OS creators do like Apple did to better tie in with password managers and that may help alleviate some of it). So I don't see my parents or grandparents, for example, using one.

That said, for the rank and file folks that are taking their security advice from the government and police departments, I think pushing for various words in sequence is much better advice than "8 characters in length because it takes longer to guess than 6 characters" or whatever it is that people predominantly operate under and usually ties back to something about themselves that someone with some familiarity about them could guess (if I recall, this is what happened to Sarah Palin when she was hacked shortly after being McCain's VP nominee).

<comment><USER31> To your first point, I think it's about priors about password choices. To take an extreme example, even if a site allows up to 32 alphanumeric characters, we don't just say passwords on this site are uniformly secure under metric (26+26+10)^32 because theoretically a brute-force approach would have to go through up that many permutations. (Such a number is an upper bound on your password security.)

In particular, short passwords with up to 8 characters are weaker because they form a small and common subset of passwords that people often draw from, and attackers exploit that by trying short passwords first.

Passwords that are 3 dictionary words, with possibly some small perturbations like punctuation inserts or replacements (which helps but only expands the space so much), also form a relatively small subset of passwords that people increasingly draw upon, and attackers aware of this will tailor their brute- force search accordingly.

<comment><USER30> I might be misunderstanding your first paragraph, but I'm not saying that the exponent is constant, just the base.

What I was saying is if the rules of the site allow for all lower, all upper, special characters, and numerals, the sum of that is your base. If your password is purplepenguinparade, the expectation is you've cracked it by the time you've completed combined_base^1 through combined_base^19. They could artificially limit it (most people use lowercase characters and this site allows just lowercase characters, so let's try 26^n), but they'd run the risk of never cracking it because characters could've been added that deviate from their parameters.

<comment><USER31> Oops, that was my misunderstanding in the first paragraph :)

Maybe a clearer example w.r.t. the base^exponent value would be another highly structured class of long passwords, instead of short passwords. For example, those that are just a 2-character sequence repeated 20 times (e.g. abab...ab). You can still say that it'll take maybe up to 26^40 tries for an attacker to guess this, but that number should be more obviously too charitable, since less entropic classes of passwords are more likely to be guessed first.

More generally, this kind of counting analysis depends on your choice of attacker, and it's plausible for attackers to be more sophisticated than just trying all the strings in lexicographical order. A more concrete but still practical attack sketch adapted to the frequency of password schemes today could be: guess dictionary word combinations first, starting with common/short words/phrase lengths, then repeat with small perturbations, then more perturbations, and so on until you search all the remaining strings.

Then, the number of tries for such an attacker to find a 3-word passphrase with a few changes would be much closer to (some small constant) * (# dictionary words)^3 than (# characters)^(string length). Of course, you can still say that such an attacker would take at most (# characters)^(string length) tries to get it, but such an upper bound isn't as useful when the password is much more structured and easy to guess with a slightly more sophisticated attacker.

(Yet another way to put it: one shouldn't expect a password that's 'slightly out of reach' to be significantly more secure than a password that follows a scheme exactly - a more sophisticated attacker would test neighbouring passwords as it brute-forces the combinations in the scheme)

</comment></comment></comment></comment><comment><USER32> I wrote a perl script a while back to create random passphrases based on a random mnemonic word

It seems like a good idea to me but I'm not knowledgeable enough about cryptography to know if that's really true and would be very interested to hear from anyone who does know

[https://github.com/jlmcgraw/mnemonic_passphrase](https://github.com/jlmcgraw/mnemonic_passphrase)

</comment><comment><USER33> This was posted here a few years back, and it's still a tool I use: [https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic- pass...](https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password- strength-estimation/)

Anyone else still using this?

</comment><comment><USER34> Yes, if you use 3 common words it's not a good idea.

But most people don't, and the attacker doesn't know that.

It's useless to use a strong password if it's going to be stored in plaintext on some service.

</comment><comment><USER24> While I use strong passwords (better safe than sorry), how important is it really to worry about this kind of offline attack if you don't reuse passwords?

</comment><comment><USER35> I believe it comes from a good place, but this post is bad.

Why?

Because it doesn't apply the same comparison standard to character-based passwords than to word-based passwords.

Sure, we only use a few common dictionary words. But by the same token, our character-based passwords aren't random strings either: they are variation based on random words.

This is the basis of the xkcd advice to use 4 random words: [https://xkcd.com/936/](https://xkcd.com/936/)

Notice Randall gives each word 11 bits of entropy, meaning he considers each word is chosen at random amongst a pool of ~2000 words. Yet that base is still much bigger than ~64 for characters.

If you take 3 common words, you get ~8 billion possibilities. 4 common words: 17,000 billion. That's much more than than ~400 billion for a perfectly random (again: that's not the case in practice) password of 12 characters. And four words is easy to remember, 12 random characters is HARD.

If anything bad can be said about the xkcd comic, it's that it doesn't hammer the point that it has to be FOUR words. As three is much less secure (but still probably more secure than the 12 characters password people are likely to use in practice).

<comment><USER36> This post also fails to take into account people's exposure to fiction. My vocabulary may be limited, but many of my passphrases use nouns/concepts/slang that are drawn from video games, novels, movies, etc. Some of these works (authored by family, friends, and myself) aren't even published. I reckon the chance of these "words" being included in some cracker's dictionary is quite close to zero.

Also as you point out their analysis of the entropy of random words is quite uncharitable. It fails to account for any sort of punctuation, capitalization, etc. Is my password "correct horse battery staple" or "correct Horse, battery staple!" or "CORRECT HORSE! Battery staple.", etc. There is a lot of entropy inherent in crafting a phrase.

<comment><USER35> The point being that even so it's already better while simultaneously being easier to remember (because indeed, what did I capitalize again?).

</comment></comment></comment><comment><USER37> what if you use a non-dictionary word as one of the three words?

</comment><comment><USER38> Here's a sample from my 4x dictionary-based generator. Let me know how quickly you can re-create it via brute force.

Pocahontas-ballot-balustrade-blackouts

[https://www.xkcd.com/936/](https://www.xkcd.com/936/)

</comment><comment><USER39> According to XKCD[0] you need a fourth random word.

[0][https://xkcd.com/936/](https://xkcd.com/936/)

<comment><USER33> Also this, which references the same comic: [https://github.com/dropbox/zxcvbn](https://github.com/dropbox/zxcvbn)</comment></comment>


Ask HN: Ning or WP based membership website? - <AUTHOR>

Hi,
I want to create paid membership based website, I have 2 options
1) Go with usual WP+Membership Plugin+Hosting Costs: Theme:$35, Membership plugin:$30 to $100, Hosting:$20 per month(Zippykid/page.ly) Pros: Customization, full control Cons: I hate WP (bcoz it gets hacked)
2) Ning paid membership addon
Costs: $25 per month Pros: Peace of mind(no upgrades, no hacking) Cons: bandwidth issue, lots of -ve reviews, they take 3-4% of ur membership earning :(
As usual I am confused what to do :)
It will be great to hear from you guys <comment><USER2> Wordpress if you want maximum flexibility later. Even though it gets hacked, keep it updated and use the right plugins to minimize the risk involved.

</comment><comment><USER3> I would definately go for WordPress because of it's flexibity.</comment>