LastPass XSS vulnerability found, website and browser add-ons affected (updated)

Mike Cardwell, the Stallmanite who recently discovered a fantastically covert way of working out which Web services you're currently logged in to, has found a nasty XSS vulnerability in the LastPass password manager. The cross-site scripting (XSS) vulnerability not only allows nefarious types to see which sites you've recently logged in to, but it also provides access your email address and password reminder.

First off: don't worry. Cardwell reported the vulnerability to LastPass before writing it up, and it has since been fixed. We're not sure if the fix has propagated out to the Chrome and Firefox add-ons -- but we have to assume that Cardwell wouldn't have written his blog post if the vulnerability still existed.

With that said, you should still be more than a little concerned about the fundamental architecture of LastPass as an in-the-cloud password manager. While this cross-site scripting attack was fixed quickly, Cardwell thinks a similar attack "could easily happen again in future."

Beyond being susceptible to XSS attacks, LastPass doesn't even use HSTS, which means that man-in-the-middle (MITM) attacks are also rather easy to pull off.

It's very hard for us to recommend LastPass as a password manager when further vulnerabilities will almost certainly be found. For the time being, you should check out KeePass, an offline password manager that, for now, is a lot more secure than LastPass.

Update: LastPass has now implemented HSTS and a few other features to make their website and browser add-ons a lot harder to attack in the future. Hooray!

[Thanks to Brad for the tip!]

LastPass XSS vulnerability found, website and browser add-ons affected (updated) originally appeared on Download Squad on Sun, 27 Feb 2011 10:30:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

Source: http://downloadsquad.switched.com/2011/02/27/lastpass-xss-vulnerability-found-website-and-browser-add-ons-af/

KINGSTON TECHNOLOGY COMPANY KEY JDS UNIPHASE JDA SOFTWARE GROUP JACK HENRY and ASSOCIATES IXYS ITRON IRON MOUNTAIN INORATED IOMEGA INTUIT

OpenFeint announces OpenFeint Connect cross-platform gaming API

OpenFeint announces OpenFeint Connect cross-platform gaming API

Before Apple introduced Game Center, iOS gamers got their scores and rankings fix from OpenFeint. Don't count OpenFeint out, though: the company now boasts 65 million users, and it's about to launch a cross-platform service called OpenFeint Connect that will let gamers on iOS, Android, Windows Phone 7, OS X and Windows compare scores. Even Facebook games could potentially connect to OpenFeint. This move makes a ton of sense, considering the way successful iOS games like Angry Birds have been ported to Android, Mac and Windows.

OpenFeint Connect is in private beta now, allowing developers on any platform to tap into OpenFeint's APIs for social gaming. Unfortunately, that doesn't mean cross-platform simultaneous play, but does mean that game devs will be able to push news and updates to all their players at once, and players will be able to compete for high scores against their friends on other platforms.

OpenFeint announces OpenFeint Connect cross-platform gaming API originally appeared on Download Squad on Thu, 17 Feb 2011 13:30:00 EST. Please see our terms for use of feeds.

Permalink�|�Email this�|�Comments

The Samsung Gem lives! Dummy units heading to Verizon stores

The Samsung Gem lives! Dummy units heading to Verizon stores

We broke the good/bad/indifferent news earlier today in our rumored devices forum -- the Samsung Gem has been resurrected, and dummy units are hitting Verizon stores as we speak. The Gem is a pretty basic 3.2-inch Android smartphone with a 3.2MP camera and an 800MHz processor. Not all that much to write home about, but it did see release on Alltel just a few weeks ago.

So, yeah, dummy units are arriving. We've got one more pic after the break, and that's probably as close as we're going to get to this thing. Thanks to you know who!

The Samsung Gem lives! Dummy units heading to Verizon stores posted originally by Android Central

Sponsored by Android Cases and Accessories

Daily Crunch: Worm Projection Edition

Audi Carbon Skis Get Their Close-Up Pico Projectors Aren?t Far Off From Next-gen Smartphones Duke Nukem Forever ?Balls Of Steel Edition? Is Swag-Excessive Free! Super Mega Worm For iOS New Tech Reduces Production Costs Of Solar Cells By Up To 70% People, Not Things, Are The Tools Of Revolution

Source: http://www.crunchgear.com/2011/02/12/daily-crunch-worm-projection/

IBASIS HYPERCOM HEWLETT PACKARD CO HEARTLAND PAYMENT SYSTEMS GOOGLE GOOGLE FORMFACTOR FISERV FIRST SOLAR FINISAR

The Story of the Lonely Whale Will Break Your Heart [Video]

Once upon a time, there was a whale called June. Or maybe her name is Margaret. Or Kate. We don't really know. A few nitrogen-hearted scientists call her 52 Hertz just because she sings at a 51.75Hz frequency, but I will call her Alice. More »

Source: http://feeds.gawker.com/~r/gizmodo/full/~3/WNRO67sU9o4/the-story-of-the-lonely-whale-will-break-your-heart

HEARTLAND PAYMENT SYSTEMS GOOGLE GOOGLE FORMFACTOR FISERV FIRST SOLAR FINISAR FEI COMPANY FAIRCHILD SEMICONDUCTOR INTERNATIONAL FAIR ISAAC

Mac OS X requires a helper program to connect to Android 3.0 tablets

Android 3.0 Honeycomb, the OS that runs on the recently-released Motorola Xoom, will not bond with Mac OS X unless you install a helper program on your PC first.

The program, which is aptly named Android File Transfer, provides third-party Media Transfer Protcol (MTP) support, which Mac OS X doesn't natively provide. MTP started off as a Windows Media Player technology, which is probably why Apple doesn't support it, but today it's represented by a standard USB device class and an extension of its precursor, PTP.

MTP support is definitely a step up as far as Android is concerned. Rather than 'turn on mass storage mode,' which locks local apps out of your SD card, MTP allows both the phone and the PC to access your phone's filesystem at the same time. Hopefully Medial Transfer Protocol will find its way to the smartphone version of Android in due course

Incidentally, it's possible that the upcoming version of OS X, Lion, could support MTP. If anyone has Lion, and a Motorola Xoom, we'd love to know if you've had any luck connecting them.

Mac OS X requires a helper program to connect to Android 3.0 tablets originally appeared on Download Squad on Mon, 28 Feb 2011 08:15:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

Source: http://downloadsquad.switched.com/2011/02/28/mac-os-x-requires-a-helper-program-to-connect-to-android-3-0-tab/

HEWLETT PACKARD CO HEARTLAND PAYMENT SYSTEMS GOOGLE GOOGLE FORMFACTOR FISERV FIRST SOLAR FINISAR FEI COMPANY FAIRCHILD SEMICONDUCTOR INTERNATIONAL

AdvanceTC's 4.8-inch tabletphone runs Windows 7 on a 1.6GHz Atom CPU

It may not sound like the most practical combination, but we've got to hand it to AdvanceTC -- it's shoehorned telephony into a Windows 7 tablet, fulfilling our dark desire for a spiritual successor to the xpPhone. Yes, that's not Windows Phone 7 you're looking at above, but rather full desktop Windows running on a sizable quad-band GSM brick, whose insides hold a 1.6GHz Intel Atom Z530 CPU, 1GB of RAM, a 32GB SSD, a 4.8-inch 800 x 480 touchscreen, a 1.3 megapixel webcam and a chunky 3200mAh battery to power the whole thing. Calls are handled via AdvanceTC's custom UI layer and there's some software trickery to keep that battery in check, as the device can automatically wake from sleep when it detects an incoming call or text message. We doubt we'd much enjoy navigating Windows 7 on a screen that small, but AdvanceTC also gives the Atrix a nod, claiming that the device can act like a full nettop PC when connected to an HDMI dock. We'll let you know if the company gives us a price, release date, or any indication that it will actually hit retail at all.

Gallery: AdvanceTC Magic W3 press shots

AdvanceTC's 4.8-inch tabletphone runs Windows 7 on a 1.6GHz Atom CPU originally appeared on Engadget on Mon, 28 Feb 2011 02:01:00 EDT. Please see our terms for use of feeds.

Permalink   |  AdvanceTC  | Email this | Comments

Source: http://feeds.engadget.com/~r/weblogsinc/engadget/~3/DvJooIaBGzE/

SKYWORKS SOLUTIONS SILICON LABORATORIES SI INTERNATIONAL SEAGATE TECHNOLOGY SCIENTIFIC GAMES SANDISK SALESFORCE COM SAIC ROCKWELL AUTOMATION RF MICRO DEVICES

Natale 2010: prime idee regalo geek

Natale 2010: prime idee regalo geek
Secondo le ultime sconcertanti notizie pubblicate da Wikileaks, oggi è cominciato il mese di dicembre. Fa freddo, qualcuno comincia ad andare in letargo e sì, molti di noi stanno già pensando a cosa regalare o farsi regalare a Natale. Potevamo mai scegliere giorno diverso per inaugurare il nostro Natale geek e proporvi qualche bella idea [...]

Secondo le ultime sconcertanti notizie pubblicate da Wikileaks, oggi è cominciato il mese di dicembre. Fa freddo, qualcuno comincia ad andare in letargo e sì, molti di noi stanno già pensando a cosa regalare o farsi regalare a Natale.

Potevamo mai scegliere giorno diverso per inaugurare il nostro Natale geek e proporvi qualche bella idea regalo per voi e i vostri cari? Certo che no, quindi mettiamo al bando le ciance e cominciamo subito il nostro viaggio nel mondo dei gadget geek più intriganti e simpatici del 2010!

Microsoft Kinect – Il controller di Microsoft che permette di interagire con la Xbox 360 senza usare alcun joypad, ma riconoscendo i movimenti dei giocatori e le loro voci, è un regalo perfetto per tutti i videogiocatori… e chi si accinge a diventarlo. Prezzo di vendita al pubblico: 149 euro (senza console).

Ritorno al futuro, trilogia in Blu Ray – una delle saghe cinematografiche più amate dai geek di tutto il mondo festeggia il suo 25° anniversario con una straordinaria collezione contenente la trilogia completa in blu-ray e un modellino della DeLorean. Prezzo: circa 60 euro.

(...)
Continua a leggere Natale 2010: prime idee regalo geek, su Geekissimo

Natale 2010: prime idee regalo geek, pubblicato su Geekissimo il 01/12/2010

---

© naqern per Geekissimo, 2010. | Permalink | 15 commenti | Aggiungi su del.icio.us
Hai trovato interessante questo articolo? Leggi altri articoli correlati nelle categorie Curiosità, Gadget Geek.
Post tags: natale, natale 2010, natale geek

SendGenie offers simple drag and drop file sharing for Windows and Mac

SendGenie offers simple drag and drop file sharing for Windows and Mac

SendGenie is a slick new app (currently in open beta testing) which makes sharing files and photos as easy as dragging and dropping. Once installed, SendGenie adds a dropzone widget to your desktop which you can hide and unhide via the system tray icon. When you want to zap a file to a friend, just drag it onto the dropzone (yes, the wizard hat that you see above). Your file will be added to a send queue, and you can then choose the people you want to send the file (or files) to.

SendGenie also supports contact groups, so you can build a list for your department at work, your family, or your clan mates for easy mass sharing. You can also send clipboard contents -- like screenshots -- by tapping the Paste button in the main window and naming your clip. Once uploaded, your contacts will receive an email with a link to a page from where they can download your files. Friends running SendGenie on their desktop can choose to automatically receive files you send -- they'll appear in Documents\Me SendGenie\Your Email Address\Inbox\.

The app can optionally auto-resize photos you share, but there are no settings you can tweak. We'd like to see that option added before the final release, but SendGenie is still a very slick, easy-to-use desktop app for sharing files with your contacts.

SendGenie offers simple drag and drop file sharing for Windows and Mac originally appeared on Download Squad on Mon, 21 Feb 2011 16:30:00 EST. Please see our terms for use of feeds.

Permalink�|�Email this�|�Comments

Mac OS X Lion to include updated version of Safari with WebKit2

After originally reporting on the introduction of WebKit2 back in April 2010, it looks like it will finally be rolled out with OS X Lion, in a new version of the Safari Web browser.

WebKit2, rather than being a whole new rendering engine, is a layer around WebKit that adds more stability, security and speed -- not entirely unlike the Google Chrome sandbox, which is also strapped onto a version of WebKit. The most exciting feature of WebKit2 is that it splits the browser UI and the rendered content into separate processes. It's possible that each tab will have its own process, too, like Chrome.

This is the first solid news of a Safari update since the minor revisions of desktop and iOS versions back in November. It also represents a major change for the browser, so we wouldn't be surprised if it is Safari 6, rather than 5, that ships with OS X Lion.

We're also hoping to see some benchmarks from the Lion version of Safari. Split processes is definitely a huge step forward, but its JavaScript performance is the thing that really needs to improve. Presumably WebKit2 isn't the only change that Apple plans to make to a new version of Safari, so here's hoping!

Mac OS X Lion to include updated version of Safari with WebKit2 originally appeared on Download Squad on Mon, 28 Feb 2011 06:15:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

Source: http://downloadsquad.switched.com/2011/02/28/mac-os-x-lion-to-include-updated-version-of-safari-with-webkit2/

INFOCUS ZORAN ZIONS BAN YAHOO YAHOO XILINX WESTERN DIGITAL VOLT INFORMATION SCIENCES VISHAY INTERTECHNOLOGY VIRGIN MEDIA

Groupon launches Gaopeng.com coupon site in China

With a population of more than 1.3 billion people, getting your app launched inside China's borders could be a very good thing for business. That's what Groupon thinks, too, and its new China spin-off Gaopeng.com aims to bring local deals to connected Chinese users.

Estimates peg the number of Internet users in China at around half a billion. Groupon will be fighting for market share with other group buying services, and it has apparently partenered with Tencent -- which develops China's most popular instant messaging app QQ -- to get Gaopeng off and running.

Competitors aren't totally thrilled with Groupon's arrival, and not just because there's another deal site in China. Groupon has been accused of poaching staff -- and competitors have firmly stated that employees who leave for Grouon will not be welcomed back.

Groupon launches Gaopeng.com coupon site in China originally appeared on Download Squad on Mon, 28 Feb 2011 12:00:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

Source: http://downloadsquad.switched.com/2011/02/28/groupon-launches-gaopeng-com-coupon-site-in-china/

RF MICRO DEVICES RED HAT RADISYS RACKABLE SYSTEMS QUEST SOFTWARE QUANTUM QLOGIC PROGRESS SOFTWARE PLANAR SYSTEMS PEROT SYSTEMS

Yahoo shuts down MyBlogLog, a $10 mil purchase you never heard of

In the grand scheme of things, $10 million isn't a ton of money for a big company like Yahoo! to spend acquiring another company. Still, for an embattled Yahoo!, shutting down MyBlogLog is another sad trombone in its symphony of missteps.

MyBlogLog was a service which allowed bloggers to create a community for their sites. The shutdown was called out in the famous "sunsetting" slideshow in late 2010, where Yahoo! revealed that popular bookmarking site Delicious would also not be part of its future plans.

Despite all this, Yahoo! remains one of the most popular sites on the Internet -- it actually topped ComScore's U.S. traffic chart for January 2011.

Yahoo shuts down MyBlogLog, a $10 mil purchase you never heard of originally appeared on Download Squad on Thu, 24 Feb 2011 11:00:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

Source: http://downloadsquad.switched.com/2011/02/24/yahoo-shuts-down-mybloglog-a-10-mil-purchase-you-never-heard-of/

FACTSET RESEARCH SYSTEMS F5 NETWORKS EPICOR SOFTWARE EMULEX EMS TECHNOLOGIES EMC ELECTRONICS FOR IMAGING ELECTRONIC DATA SYSTEMS ELECTRONIC ARTS ECLIPSYS

Twilight Discovery [Image Cache]

Yesterday, ISS denizen Paolo Nespoli snapped this photo of the space shuttle Discovery on approach to the station. More »

Source: http://feeds.gawker.com/~r/gizmodo/full/~3/ZaXFCTUc4dg/twilight-discovery

MAXIMUS MANTECH INTERNATIONAL MANHATTAN ASSOCIATES LSI LINEAR TECHNOLOGY LEXMARK INTERNATIONAL LEVEL 3 COMMUNICATIONS LAWSON SOFTWARE LAND SOFTWARE LAM RESEARCH

CES 2010: i migliori gadget presenti (e assenti)

CES 2010: i migliori gadget presenti (e assenti)
Oggi, 7 gennaio, ha preso il via uno degli eventi geek più attesi dell’anno. Il Consumer Electronics Show (CES, per gli amici intimi) di Las Vegas ha finalmente spalancato le sue porte e per i prossimi tre giorni tutte le più grandi aziende operanti nel settore tecnologico – da Microsoft a Google, passando per Samsung [...]

Oggi, 7 gennaio, ha preso il via uno degli eventi geek più attesi dell’anno. Il Consumer Electronics Show (CES, per gli amici intimi) di Las Vegas ha finalmente spalancato le sue porte e per i prossimi tre giorni tutte le più grandi aziende operanti nel settore tecnologico – da Microsoft a Google, passando per Samsung e HP -saranno lì per presentare le loro novità più importanti.

Per l’occasione, abbiamo stilato per voi una lista con alcuni dei ‘gadget’ più interessanti della kermesse. Senza dimenticare talune assenze, che pesano più di tante presenze. Leggete e commentate numerosi.

Tablet Microsoft

A meno di clamorosi colpi di scena, il tanto atteso tablet iSlate non sarà della partita: gli ultimi rumor dicono che non verrà presentato prima dell’evento Apple fissato per il prossimo 26/27 gennaio. In compenso, il CES 2010 potrebbe ospitare un nuovo tablet di Microsoft. A riportare l’indiscrezione è l’autorevole New York Times, secondo cui il dispositivo sarà prodotto da HP e verrà commercializzato entro la metà dell’anno. Pensandoci bene, potrebbe trattarsi del modello finale del concept Courier (video sopra) presentato dal gruppo di Redmond a settembre 2009.

(...)
Continua a leggere CES 2010: i migliori gadget presenti (e assenti), su Geekissimo

CES 2010: i migliori gadget presenti (e assenti), pubblicato su Geekissimo il 07/01/2010

---

© naqern per Geekissimo, 2010. | Permalink | 11 commenti | Aggiungi su del.icio.us
Hai trovato interessante questo articolo? Leggi altri articoli correlati nelle categorie Gadget Geek.
Post tags: ces 2010, eventi, islate, nexus one, tablet