Tuesday, March 1, 2011

LastPass XSS vulnerability found, website and browser add-ons affected (updated)

Mike Cardwell, the Stallmanite who recently discovered a fantastically covert way of working out which Web services you're currently logged in to, has found a nasty XSS vulnerability in the LastPass password manager. The cross-site scripting (XSS) vulnerability not only allows nefarious types to see which sites you've recently logged in to, but it also provides access your email address and password reminder.

First off: don't worry. Cardwell reported the vulnerability to LastPass before writing it up, and it has since been fixed. We're not sure if the fix has propagated out to the Chrome and Firefox add-ons -- but we have to assume that Cardwell wouldn't have written his blog post if the vulnerability still existed.

With that said, you should still be more than a little concerned about the fundamental architecture of LastPass as an in-the-cloud password manager. While this cross-site scripting attack was fixed quickly, Cardwell thinks a similar attack "could easily happen again in future."

Beyond being susceptible to XSS attacks, LastPass doesn't even use HSTS, which means that man-in-the-middle (MITM) attacks are also rather easy to pull off.

It's very hard for us to recommend LastPass as a password manager when further vulnerabilities will almost certainly be found. For the time being, you should check out KeePass, an offline password manager that, for now, is a lot more secure than LastPass.

Update: LastPass has now implemented HSTS and a few other features to make their website and browser add-ons a lot harder to attack in the future. Hooray!

[Thanks to Brad for the tip!]

Tags: apps, browsers, cross-site scripting, Cross-siteScripting, keepass, lastpass, password manager, PasswordManager, security, vulnerability, web, xss

nikon rumors orange fruit pear fruit remove windows installer

Torus is an impressive 3D Tetris game powered by HTML5

As far as Tetris goes, most variations look quite similar. You're usually looking at a "wall" of bricks directly from the front. Torus takes that notion and throws it away; as you might have guessed from the name (or screenshot), this Tetris clone is played on a ring-like 3D surface.

You rotate the ring itself with the arrow keys, while a Tetris-like piece slowly (excruciatingly slowly, in fact) descends from the top. As soon as you make a solid line, it disappears.

Not all pieces are Tetris-like; some of them wouldn't really work with a regular Tetris game but are a good fit for Torus' 3D format.

Torus is ideal for playing at the office, because it has absolutely no soundtrack. The game is dead-quiet. It's also very very slow (slow enough for me to mention it twice in one post) so you can safely look away for a moment and then keep playing. Also, as soon as the game loses focus, it automatically pauses.

Bottom line: It's an impressive demo of the power of HTML5; if it were a bit faster, it would have some serious addictive potential.

Tags: flash, fun, game, tetris, time waster, time-waster, time-wasters, TimeWaster, torus, web

windows vista ultimate windows xp windows xp download windows xp downloads

Tarzan Ball is a tricky hook-and-pull physics game

So, you're a ball. A Tarzan Ball, to be precise. You've earned the nickname thanks to your astonishing ability to shoot out a lengthy 'vine' (I hope it's a vine) at objects, and then pull yourself towards those objects.

That's a handy ability to have, especially since you've got no legs, no arms, and no other means of transportation. In Tarzan Ball, the rope is everything. But you don't just swing around the screen aimlessly ? that wouldn't be much of a game now, would it?

Instead, your goal in life is to collect "targets". Each level has one of these "targets" hidden away somewhere on the screen, usually behind some kind of barrier. Once you navigate close enough to the target, you can shoot your rope at it and just reel it in. That's when you pass the level.

You can't die in this game, but it can still be very frustrating. It's actually one of the tougher games I've posted recently. Still, if you enjoy physics games, this one is quite nicely made.

[This is actually the sequel to IQ Ball, which we covered last year! -Ed]

Tags: flash, fun, game, iq ball, IqBall, tarzan, tarzan ball, time waster, time-waster, time-wasters, TimeWaster, web

windows installer errors windows installer service windows installer vista windows installer xp

Jonathan Ive considering a move back to UK?

UK news paper, The Sunday Times is reporting that Jonathan Ive, the Senior Vice President�of�Industrial Design�at�Apple, wants to return to the UK to live! Ive is the principal designer of the�iMac,�MacBook,�unibody MacBook Pro,�iPod,�iPhone, and�iPad.

Ive supposedly wishes to commute to Cupertino from his home, which is based in Somerset, England, and the Apple board is not exactly thrilled by the idea. A friend of Ive?s family has allegedly confirmed the dispute and told The Sunday Times:

?Unfortunately he is just too valuable to�Apple�and they told him in no uncertain terms that if he headed back to England he would not be able to sustain his position with them.?

Ive?s has reportedly just received a $30 million payment from Apple on completion of his latest deal, which is now up for re-negotiation. The problem appears to be that his wife Heather would like their two children educated in their own country.

[Cult of Mac]

Related Posts:

Leave a Reply

Note: Comments must be civil, respectful, and on-topic. If a comment does not add to the conversation, if it contains spam advertising, or inappropriate language or content, it will be removed. Comments containing links may be held for moderation. Relax, enjoy, and share in the discussion.

apple store utc apple stores apple timeline apple trailers

Shot Shot Pirate is a fun, simple physics game

Shot Shot Pirate is very satisfying, because each level is short and to the point. You know what you have to do and you just do it.

As you may have gathered from the name, you're cast in the role of a pirate. Your goal is to shoot at a diamond and make it fall off a tower of bricks. The height of the tower changes as you progress through the levels. It's not enough to just make the diamond fall off the tower of bricks ? it has to fall below a certain line (drawn on the screen) for the level to be completed.

There are also different kinds of bricks, with some heavier than others, and different kinds of ammo. You only get a certain amount of ammo for each level, and when it's gone, you lose. But don't worry! If you don't make it on the first try, it's very easy to restart the level and just give it another shot (or three).

All in all it's a cute game. I've seen similar games with better graphics and music, but the game delivers on its main promise ? a few minutes of pure time wasting!

Tags: flash, fun, game, pirates, time waster, time-waster, time-wasters, TimeWaster, web

windows 7 windows 98 downloads windows defender windows downloads

Mac OS X Lion to include updated version of Safari with WebKit2

After originally reporting on the introduction of WebKit2 back in April 2010, it looks like it will finally be rolled out with OS X Lion, in a new version of the Safari Web browser.

WebKit2, rather than being a whole new rendering engine, is a layer around WebKit that adds more stability, security and speed -- not entirely unlike the Google Chrome sandbox, which is also strapped onto a version of WebKit. The most exciting feature of WebKit2 is that it splits the browser UI and the rendered content into separate processes. It's possible that each tab will have its own process, too, like Chrome.

This is the first solid news of a Safari update since the minor revisions of desktop and iOS versions back in November. It also represents a major change for the browser, so we wouldn't be surprised if it is Safari 6, rather than 5, that ships with OS X Lion.

We're also hoping to see some benchmarks from the Lion version of Safari. Split processes is definitely a huge step forward, but its JavaScript performance is the thing that really needs to improve. Presumably WebKit2 isn't the only change that Apple plans to make to a new version of Safari, so here's hoping!

Tags: API, apple, mac, mac os x, mac os x lion, MacOsX, MacOsXLion, os x lion, osx, OsXLion, process, safari, sandbox, webkit, webkit2

orange fruit pear fruit remove windows installer repair windows installer

Did Xoom Whiff It on WiFi?

Motorola's new Xoom Android tablet might be a tempting option for tablet buyers who want constant, on-the-go 3G data connectivity and don't mind paying for it. However, a large contingent of tablet buyers only want WiFi. Right now Motorola isn't offering a WiFi-only model and won't confirm such a version will ever arrive in the U.S. Is Motorola ignoring an important consumer desire?

Since it was unveiled at the Consumer Electronics Show last January, the Motorola (NYSE: MOT) Xoom tablet has been hailed as the strongest challenge yet to Apple's (Nasdaq: AAPL) iPad.

However, it faces two possible obstacles to widespread acceptance: Its price, and its lack of a WiFi-only version.

Motorola Xoom

Motorola Xoom

The Xoom has both 3G and WiFi capabilities, and it's offered at a price of US$800 without a carrier contract. It can be had for $600 if the buyer signs a two-year contract with Verizon Wireless for data services.

Apple, on the other hand, offers iPads with or without 3G capabilities. Prices for the latter range from $500 to $700, and for the former from $630 to $830.

So for buyers who want a WiFi-only model and don't want to incur the cost of 3G communications, the advantage is to Apple, at least for now. But more on that later.

The Unbearable Lightness of Lacking WiFi-Only Models

What about consumers who only want a tablet with WiFi and don't care to rack up charges for cellular data use? What proportion of tablet buyers want the WiFi feature only?

"About a third of iPad buyers got the 3G model, but only about one third of them turned 3G on," Rob Enderle, principal analyst at the Enderle Group, told TechNewsWorld. "They bought the 3G capability as insurance since you can't add it later."

Only about 10 percent of iPad buyers turn on the 3G service, Enderle said, adding that purchasers of the Samsung Galaxy Tablet were in line with this trend.

In other words, quite a few people buy the iPad only for its WiFi capabilities. Customers who desire the same thing from Xoom would have to choose between paying a monthly bill for something they don't really want or paying top dollar for hardware they don't need -- the embedded cellular data chip.

So what's Motorola going to do about this?

"We have not yet announced a WiFi-only Motorola Xoom for the U.S. market, but did announce that they would be coming to the Europe market in Q2," Motorola Mobility spokesperson Kira Golin told TechNewsWorld. She declined to discuss whether or not a WiFi-only version of the Xoom will be offered in the United States.

The 3G or Not to 3G?

On the other hand, perhaps a SKU with WiFi-only is overrated as a consumer draw.

"ABI Research estimates that only one in three U.S. homes have WiFi home networking," Jeff Orr, a senior practice director at ABI Research told TechNewsWorld. "This limits the opportunity for media tablets that rely upon WiFi or require a mobile broadband modem for basic connectivity to the Internet."

However, the majority of media tablets sold in 2010 only had WiFi support, although a few vendors, including Samsung, offered only models with 3G connectivity, Orr pointed out.

"Given the introduction of tens of new products in 2011, most manufacturers will differentiate by price, and value-add features that increase costs such as 3G, 4G, GPS and rugged enclosures, will be the first to go," Orr predicted. "In January, Samsung announced plans to introduce a WiFi-only version of its Galaxy Tab tablet, while even more companies are coming to market with only WiFi support."

That's the exact opposite of what Strategy Analytics Associate Director Martin Bradley sees.

"Our expectation is that the trend will be towards increasing adoption of cellular-capable devices, and consumer demand for wide-area usage will naturally increase," Bradley told TechNewsWorld. "We believe around 50 percent of users in developed markets are content with WiFi-only devices, but the trend is downwards."

MOT in the WiFi User's Eye

Perhaps Motorola's decision relates to its marketing Increase sales with VerticalResponse. Free trial. strategy. After all, the Xoom, as it's now designed, gives buyers the choice whether or not to use cellular data. If consumers are buying iPads with both 3G and WiFi capabilities to ensure they won't lose out on 3G, why shouldn't Motorola offer its Xoom to support both connectivity protocols?

"Motorola may be targeting an audience that expects mobility and isn't primarily using the tablet in and around the home," ABI Research's Orr speculated. "A mobile Internet tablet, designed to augment current usage habits for both laptops and smartphones, will include features and services tailored for on-the-go applications."

It's likely that Motorola is targeting mobile professionals and that a WiFi-only media tablet does not match this strategy, Orr pointed out. "The 3G-enabled Xoom is intended to address a specific market opportunity for prosumers and business professionals who want an Android-based tablet for applications that replace currently performing functions on a smartphone and/or a laptop today," he elaborated.

Money Talks -- but Listen Closely

The Xoom's price could prove to be a major issue for consumers. At $800 it's only $30 cheaper than the top-of-the-line 64GB iPad, which offers both 3G and WiFi.

"The Xoom's pricing is clearly at the high end of the range of current devices," Strategy Analytics' Bradley pointed out. "It's positioned as a market leader in the new wave of Android devices and runs the latest Android Honeycomb operating system."

"It's hard to price above Apple successfully, given folks think of them as a premium brand," Enderle said.

"Where are the $200 Android tablets everyone was talking about?" asked Andrew Eisner, director of community and content at Retrevo.

However, the high cost of the Motorola Xoom may be based more on perception than on reality.

The Xoom is more capable than the current iPad, Enderle contended. "With an Nvidia (Nasdaq: NVDA) Tegra2 dual-core processor and being upgradable to 4G LTE in a couple of months via a software patch, it has a much faster processor," he elaborated. "It's closer to what we think the iPad 2 will be."

On the other hand, the iPad 2 is expected to be announced March 2, and we'll then see whether Apple will price that device competitively with the Xoom.

Until then, it's not clear whether Motorola's holding off on offering a WiFi-only Xoom tablet in the United States is a canny marketing move -- or quite the opposite.

steve jobs toshiba laptops types of house windows used apple laptops