Physical security keys, like those sold by Yubico, Thetis and Kensington, are a great way to lock down your digital lives. They also tend to be wicked fast compared to the wait you have to put on while you're waiting for a 2FA password to arrive via SMS or typing in a verification code from an app like Google Authenticator.
Unless of course said security key is deeply, deeply borked.
From Engadget:
Yubico is recalling a line of security keys used by the U.S. government due to a firmware flaw. The company issued a security advisory today that warned of an issue in YubiKey FIPS Series devices with firmware versions 4.4.2 and 4.4.4 that reduced the randomness of the cryptographic keys it generates. The security keys are used by thousands of federal employees on a daily basis, letting them securely log-on to their devices by issuing one-time passwords.
The problem in question occurs after the security key powers up. According to Yubico, a bug keeps "some predictable content" inside the device's data buffer that could impact the randomness of the keys generated. Security keys with ECDSA signatures are in particular danger. A total of 80 of the 256 bits generated by the key remain static, meaning an attacker who gains access to several signatures could recreate the private key.
If someone reading this can school me on why anyone working at Yubico would think that keeping 'predictable content' on a device meant to secure highly-sensitive governmental systems and information, I'd appreciate it. Read the rest
Unless you are a Nazi, you probably don't want a pillow with Hitler's face and a swastika on it.
From the Fresno Bee:
When the Very Rev. Ryan Newman bought the pillow on walmart.com in November, he could see it featured large images of a bicycle and the Eiffel Tower, and the word “Paris.” What he didn’t see were Nazi party seals with swastikas, along with Hitler’s face on postage stamps with the German word “Reich” – referring to the Third Reich, the Nazi regime from 1933 to 1945 – on the top near the pillow’s seams. The images cover several inches on each side.
Newman said he was dumbfounded, and then angry and upset.
“To me this is a symbol of hate,” he said. “This is a symbol of evil.”
But it really wasn't Walmart's fault.
A Walmart spokeswoman provided the following statement: “This pillow was listed by a third-party seller on our online marketplace and is in violation of our policy. We regularly scan our marketplace for these types of items, but, unfortunately, the offensive image wasn’t visible on the pillow’s photo and we were not aware of it until the customer reached out. We removed the item immediately and are reviewing the seller’s assortment.”
.mcclatchy-embed{position:relative;padding:40px 0 56.25%;height:0;overflow:hidden;max-width:100%}.mcclatchy-embed iframe{position:absolute;top:0;left:0;width:100%;height:100%}
Image: Screengrab from Fresno Bee video Read the rest
"After Gerry’s death, Quadriga’s inventory of cryptocurrency has become unavailable and some of it may be lost," said his widow.
Beto O'Rourke was always a long shot running against incumbent Ted Cruz for Senate in the blood red state of Texas. But with a narrow loss of 51-48, O'Rourke kept it real and went out with a bang during his concession speech, telling his fans, “I want to thank this amazing campaign of people. Not a dime from a single PAC. All of you showing the country how to do this. I am so fucking proud of you guys.”
MSNBC later apologized for the not being quick enough with the censor button. "Sorry for the F-bomb. We have no control of what’s in the concession speeches,” anchor Brian Williams said.
Via Uproxx Read the rest
Fendi is taking a beating online after creating a pink scarf that resembles female genitalia, bush and all. Read the rest
OK fine, maybe it's a napkin. Still, somebody could have told the man. But they didn't. They didn't. Video evidence below.
(Washington Post)
Read the rest
You would think this driver who missed his exit would have stopped after causing a truck to flip over.
But even being the cause of two trucks crashing is not enough to make this sociopath think twice about the disastrous consequences of his actions. I have a feeling that, no matter how many trucks crashed, he'd doggedly pursue his goal of driving his car onto the exit ramp. Read the rest
That crunching sound you hear is hundreds of thousands of dollars in repair bills. The person who shot the video says: "The larger ship, which had a prom on it, first rammed into the second cruise ship, then backed up, then struck it again with full force pushing it into the street knocking down a street lamp and causing damage to both ships." Read the rest
Or maybe Gary Busey. That's supposed to be Brandi Chastain, recently inducted into the Bay Area Sports Hall of Fame. Here's a side-by-side to see who this resembles more: Read the rest
Oops.
On Friday, a painting by Pablo Picasso was damaged by Christie's auction house and has been withdrawn from their May 15 sale.
The painting, Le Marin (The Sailor), was created by Picasso as a self-portrait in 1943. It was sent to auction by its owner, accused rapist Steve Wynn.
The New York Times reports:
The unnamed client of Christie’s had been identified by Bloomberg in April as the casino mogul Steve Wynn, who in February resigned as chairman and chief executive of Wynn Resorts as a result of sexual misconduct allegations. In 2006, Mr. Wynn, who suffers from the degenerative eye disease retinitis pigmentosa, accidentally put his elbow through the canvas of Picasso’s celebrated 1932 masterwork “Le Rêve,” which he had agreed to sell to the billionaire hedge fund collector Steven A. Cohen for $135 million. The painting was restored and was eventually sold to Mr. Cohen in 2013 for $155 million. It is currently on show in the exhibition “Picasso 1932: Love Fame Tragedy” at Tate Modern in London.
Christie’s has not divulged the precise nature of the damage to “Le Marin,” but following the mishap, the auction house said in an email that Picasso’s 1964 painting “Femme au chat assise dans un fauteuil” (“Woman With a Cat Seated in an Armchair”), estimated at $22 million to $28 million, has also been withdrawn from the sale. This second Picasso had also been identified as being offered by Mr. Wynn. Like “Le Marin,” it had been guaranteed to sell courtesy of a third party.
Read the rest
If you were to ask the Indian Space Research Organization, they'd tell you that space is hard: the IRSO has lost communications with one of its satellites mere days after launching it into orbit.
According to The Times of India, the IRSO launched the GSAT-6A communications satellite into orbit on March 29. Indian ground control was able to command the satellite to alter its orbit on two separate occasions. Smooth sailing! Then, on Saturday, things went south:
After remaining incommunicado the whole of Saturday, ISRO, on Sunday said: “The second orbit raising operation of GSAT-6A satellite has been successfully carried out by LAM Engine firing for about 53 minutes on March 31, 2018 in the morning. After the successful long duration firings, when the satellite was on course to normal operating configuration for the third and the final firing, scheduled for April 1, 2018, communication from the satellite was lost. Efforts are underway to establish the link with the satellite.”
That's got to be disappointing. It's worth mentioning that just because they've lost communications with the GSAT-6A doesn't mean that it's lost forever – yet. There have been plenty of instances where long-range communications have been lost by ground control and then restored. Given the satellite's mission, providing mobile communications for the people of India over the next decade, it'd be nice if the ISRO could get the thing back online.
If they fail, however, a permanent loss of communications with the satellite would mark the second mission failure for the space agency in less than a year. Read the rest
McDonald's accidentally tweeted this late Thursday night:
While the internet was having a field day deciding if the tweet was intentional or not, McDonald's copped up to the boo-boo with this tweet nine hours later:
(Mashable)
photo by Rusty Blazenhoff Read the rest
On Monday, the Weather Channel was live-streaming the planned implosion of the Georgia Dome for a full 40 minutes before a bus pulled up in front of their camera, completely blocking their shot at the exact wrong moment. Oops! Read the rest
Someone should get a large tattoo that says "Don't get tattoos of living celebrities unless you have the money for a cover-up." Behold, a gallery of suddenly recontextualized ink: Read the rest
A train trestle in Gregson St. in Durham, NC has a clearance of 11' 8". Despite the warning signs and flashing lights advertising the lower-than-normal clearance, trucks collide with the trestle often enough that an enterprising person has set up a video camera to catch every spectacular collision. The latest incident, which happened on 10/14/2017, is a doozy. Read the rest
