Author Archives: Michael Froomkin

Be Warned

Posted on June 17, 2015 by Michael Froomkin

EDRi, Microsoft’s new small print – how your personal data is (ab)used:

Summing up these 45 pages, one can say that Microsoft basically grants itself very broad rights to collect everything you do, say and write with and on your devices in order to sell more targeted advertising or to sell your data to third parties. The company appears to be granting itself the right to share your data either with your consent “or as necessary”.

This was particularly ominous:

Also, when device encryption is on, Windows automatically encrypts the drive Windows is installed on and generates a recovery key. The BitLocker recovery key for the user’s device is automatically backed up online in the Microsoft OneDrive account.

That said, there will be a few things you can turn off by deep diving into your computer’s settings and the Privacy Dashboard. And, I suspect, by not having a Microsoft Account or a OneDrive at all.

Microsoft’s new services agreement goes into effect on 1 August 2015, only a couple of days after the launch of the Windows 10 operating system on 29 July.

Posted in Law: Privacy, Software | Comments Off on Be Warned

Nutty, Even By Relaxed Modern Standards

Posted on June 16, 2015 by Michael Froomkin

TPM, With Eye on Fiscal Armageddon, Texas Set to ‘Repatriate’ Its Gold To New Texas Fort Knox.

On Friday, Gov. Greg Abbott signed legislation that will create a state-run gold depository in the Lone Star State – one that will attempt to rival those operated by the U.S. government inside Fort Knox and the Federal Reserve Bank of New York’s vault in lower Manhattan. “The Texas Bullion Depository,” Abbott said in a statement, “will become the first state-level facility of its kind in the nation, increasing the security and stability of our gold reserves and keeping taxpayer funds from leaving Texas to pay for fees to store gold in facilities outside our state.” Soon, Abbott’s office said, the state “will repatriate $1 billion of gold bullion ((As you will see if you read the article, this is malarky. There is no such $1 billion in gold from the Federal Reserve in New York to Texas.” In other words, when it comes preparing for the currency collapse and financial armeggedon, Abbott’s office really seems to think Texas is a whole ‘nother country

Just read it. And weep.

PS. Bonus crazy:

Indeed, Texas has no gold bars in the Federal Reserve’s New York vault. And what the state has is not worth a billion dollars. Instead some 4,200 gold bars bought in 2011 by the University of Texas’s endowment fund (the second largest in the country after Harvard’s) are stored in the basement vault of HSBC’s headquarters at 450 5th Avenue in New York City, just south of the New York Public Library. For the last four years, the endowment has paid an estimated $1 million per year to store their gold there. (If it had been at the New York Fed the cost would have totaled about $15,400 over that period). And the new depository law does not require the university’s endowment fund to relocate the gold to Texas.

How did UT end up holding actual gold?

In 2010 and 2011, … the University of Texas Investment Management Company’s board of directors … put nearly 5% of the then-$19 billion university and pension fund they manage into physical gold by converting options into bullion. …

When the endowment fund bought the gold, their basis for calculating a return – called their cost basis – was $1,150.17 per ounce. The fund eventually traded a third of their physical gold stake for gold futures and other equities, but never reduced their overall exposure to gold. That’s why they still own about 4,200 bars worth just under $500 million. After a significant run-up and subsequent fall in 2012, gold traded on Monday at $1,186. Over more than four years that just a 3% gain for the fund before you account for the cost of housing the gold in New York [which is $1 million / year] and the transaction costs that will be incurred if and when the endowment fund ships the bars back to Texas or sells them to a buyer. Over the same period, the S&P 500 index – a broad measure of owning stocks – gained 60%.

Posted in Econ & Money, Politics: The Party of Sleaze, Politics: Tinfoil | 3 Comments

Obamacare Decision Harbinger?

Posted on June 16, 2015 by Michael Froomkin

“Our job is to follow the text even if doing so will supposedly undercut a basic objective of the statute,” says a five-Justice majority in Baker Botts v. ASARCO, LLC, slip op. at 13 (quoting from the dissent!). Justice Sotomayor concurred in the opinion — except as to that section. Breyer, Ginsburg, and Kagan dissented.

Is this an indication of the likely result in King v. Burwell, the Obamacare decision due in the next few days? That case turns on whether to read one line out of context of the rest of the statute. (Non-jargony summary of the issues here.)

Justice Kennedy, the swing vote, signed on to the formalist view in yesterday’s bankruptcy decision. On the other hand, there was less evidence that Congress intended to let the Bankruptcy bar bill for defending fee petitions than there is about the intentions of Congress in the Affordable Care Act — if, that is, you are willing to read beyond the clause at issue.

Posted in Law: The Supremes | 16 Comments

Keep Guessing

Posted on June 15, 2015 by Michael Froomkin

Ruthann Robson runs through the options as to whether today’s immigration/marriage case allows us to predict much about the coming same-sex marriage case.

You’d think it might…but she’s persuasive that it doesn’t…necessarily…

In United States Supreme Court’s fragmented and closely divided decision in Kerry v. Din, the majority rejected the procedural due process argument of a naturalized American citizen to an explanation of the reasons supporting a denial of a visa to her noncitizen husband.  Justice Scalia, writing for the plurality and joined by Thomas and Chief Justice Roberts, concluded that she had no cognizable liberty interest attributable to her marriage.  Justice Kennedy, joined by Alito, would not reach the liberty interest issue because the process here was all that was due.  Justice Breyer, dissenting, and joined by Ginsburg, Sotomayor, and Kagan, would affirm the Ninth Circuit and find that she had a cognizable liberty interest and that more process was due in the form of a more precise and factual explanation.

So what might this mean for Obergefell?  Most obviously, the dissenting opinion by Breyer, and joined by Ginsburg, Sotomayor, and Kagan, articulates an expansive liberty interest in marriage under the Due Process Clause that could be easily imported into Obergefell.  On Justice Kennedy’s concurrence, joined by Alito, the clear signal is that Justice Scalia’s refusal to recognize a liberty interest in marriage is not one to which they are subscribing – – – in this case.  Given that Justice Kennedy, as author of the Court’s opinions Windsor, Lawrence, and Romer v. Evans, is being closely watched as potential author of an opinion in favor of Obergefell, there is nothing in Din that would mitigate that judgment. As for the plurality, Justice Scalia’s derogation of substantive due process has a familiar ring that might be echoed in his opinion in Obergefell, with an emphasis on history.  While Justice Thomas is widely expected to agree with Scalia’s position, does the Chief Justice’s joining of Scalia’s opinion in Kerry v. Din signal a disapproval of recognizing any liberty interest in marriage?  Perhaps.  But perhaps not. 

Lots of good explanation follows.

Posted in Law: Con Law: Marriage, Law: The Supremes | Comments Off on Keep Guessing

Change Your LastPass Master Password

Posted on June 15, 2015 by Michael Froomkin

We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.

We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed.

Nonetheless, we are taking additional measures to ensure that your data remains secure. We are requiring that all users who are logging in from a new device or IP address first verify their account by email, unless you have multifactor authentication enabled. As an added precaution, we will also be prompting users to update their master password.

An email is also being sent to all users regarding this security incident. We will also be prompting all users to change their master passwords. You do not need to update your master password until you see our prompt. However, if you have reused your master password on any other website, you should replace the passwords on those other websites.

Because encrypted user data was not taken, you do not need to change your passwords on sites stored in your LastPass vault. As always, we also recommend enabling multifactor authentication for added protection for your LastPass account.

Security and privacy are our top concerns here at LastPass. Over the years, we have been and continue to be dedicated to transparency and proactive measures to protect our users. In addition to the above steps, we’re working with the authorities and security forensic experts.

We apologize for the extra steps of verifying your account and updating your master password, but ultimately believe this will provide you better protection. Thank you for your understanding and support.

Joe Siegrist
& the LastPass Team

 

Frequently Asked Questions

Why haven’t I been notified by email? Emails are being sent to all users regarding the security incident. While this takes a bit longer than posting on the blog, we are working to notify users as fast as possible.

Do I need to change my master password right now? LastPass user accounts are locked down. You can only access your account from a trusted IP address or device – otherwise, verification is requested. We are confident that you are safe on your LastPass account regardless. If you’ve used a weak, dictionary-based master password (eg: robert1, mustang, 123456799, password1!), or if you used your master password as the password for other websites you need to update it.

via LastPass Security Notice | The LastPass Blog.

Posted in Cryptography, ID Cards and Identification | Comments Off on Change Your LastPass Master Password

The Style Trap

Posted on June 15, 2015 by Michael Froomkin

Robert Graham,

A lot of companies spend a great deal of time, and politically gnashing of teeth among developers, in order to draft style guidelines. This is garbage — it truly does not matter where you put braces, for example. Experienced coders have to be accustomed to reading various styles anyway. Here’s what you should do. Start a program asking anybody who is interested to come in after work in order to draft a new set of style guidelines. Fire everyone who shows up — they are political animals who are likely deadweight anyway. Then just pick a style guideline at random, like the Linux kernel style doc or the WebKit style.

— Errata Security, How to code: lesson 27

I don’t know if I’m persuaded by this, for all that it sounds good. I would expect that some coding styles impose some discipline on coders, making it hard to make careless errors — and easier for others to spot them. Plus shared expectations do make code easier to read and understand.

Then again, maybe modern coding languages have other tools that can notice when you leave out a ) or a }, or mis-specify a variable. It’s been a long time since I actually had to write code anyone else would see, much less work with.

Posted in Software | 3 Comments