Lastpass is a great piece of software when it comes to convenience, but a recent simple hack shows just how insecure software like it can be. [Mathias Karlsson] nabbed a nice $1000 bounty for its discovery.
The discussion in the HackerNews comment section more-or-less unilaterally agreed that most systems like this have their glaring flaws, but that the overall benefits of having secure passwords generated and managed by software was still worth the risk when compared to having a few commonly reused passwords over multiple sites.
One could get a more secure key manager by using software like KeePass, but it’s missing some of the convenience factor of remote-based services and relies on a user protecting their key files adequately.
Still, as scary as they are, openly discussing hacks like this after responsible disclosure is good because they force companies like Lastpass, who have some very big name clients, to take their code review and transparency more seriously.
If we had a dime for every 555-based noisemaker circuit we see… But this one’s got a twist.
[Tristan] does two things that elevate his sawtooth-wave noisemaker above the norm. First, he gets a clean sawtooth wave out of it so that it sounds about right. Then he manages to make it more or less playable. It’s a refined version of a classic hack.
The first trick is a matter of putting a constant current supply upstream of the timing capacitor. The usual 555-timer circuit just charges the capacitor up from the power rails through a resistor. This is fine if all you care about is timing. But because the current is proportional to the constantly dropping voltage difference, the voltage on the capacitor is an exponential function over time.
We’ve always wanted to implement LED-to-LDR control while writing the Logic Noise series, but never found a reliable way to make it work. It’s cool to see [Tristan]’s efforts. Maybe we’ll pull a 555 out of the junk box in his honor.
What’s to be gained from reverse engineering a four-decade-old video game? As it turns out, quite a lot, and as you’ll learn from [Norbert]’s recent talk at the ViennaJS meetup, it’s not just about bringing a classic back to life.
Continue reading “Forty-Year-Old Arcade Game Reveals Secrets of Robot Path Planning”
In this article, I’ll take you on a trip through the math of randomness, through to pseudo-randomness, and then loop back around and cover the history of the bad PRNG and its replacements. If you’ve been waiting for an excuse to get into PRNGs, you can use this bizarre fail and its fix as your excuse.
But first, some words of wisdom:
Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin. For, as has been pointed out several times, there is no such thing as a random number — there are only methods to produce random numbers, and a strict arithmetic procedure of course is not such a method.
John von Neumann
John von Neumann was a very smart man — that goes without saying. But in two sentences, he conveys something tremendously deep and tremendously important about random variables and their mathematical definition. Indeed, when you really understand these two sentences, you’ll understand more about randomness than most everyone you’ll meet.
A lot of great schematics wind up on the back of bar napkins or diner place mats. When inspiration strikes, you have to capture it, after all. Today, you are as likely to draw schematics on a computer and there are plenty of options for that; if you can install software your options are almost limitless. And if you have a modern Web browser, there are lots of good options that don’t even require an install.
Continue reading “The Worst CAD Package Ever is Still Handy”
The ESP8266 is a popular WiFi chip that provides a relatively transparent connection between the TX and RX pins of a microcontroller and a WiFi network. It was released a little more than a year ago, and since then developers and hardware hackers have turned the ESP into much more than a serial to WiFi bridge. It’s a microcontroller platform unto itself, with a real development environment and support for the scripting language Lua.
A lot of people find scripting languages very productive and we’ve seen quite a few chips now supporting what you normally think of as a scripting language. These high-level abstraction languages are great, until they aren’t. When you need to go under the abstraction and do something complex or you need every cycle of performance, you might have to break your normal tools.