Daily Archives: November 4, 2019

Microsoft finds workers are more productive with a 4-day workweek

Posted on by

a recent experiment by Microsoft Japan suggests with a 4-day workweek we may be more productive if we work less.

In particular, it shows that a shorter workweek can actually impact productivity positively.

In August this year, Microsoft Japan ran an experiment where for one month they had a 3 day weekend, taken Friday off. This was paid leave and did not impact the worker’s usual vacation allocation.

Some results were predictable.

Workers were happier and took  25.4 percent fewer days off during the month.

There were also savings from spending less time at work.  23.1 percent less electricity was used and 58.7 percent fewer pages were printed.

More importantly from a bottom-line standpoint, however, productivity went up 39.9%, as fewer and shorter meetings were held, often virtually rather than in person.

In the end, the project had 92.1 percent employee approval, suggesting workers were happy with getting more done in less time.

The trial involved 2,300 employees, and Microsoft is looking to repeat it next summer.

Source: Microsoft finds workers are more productive with a 4-day workweek

Facebook, Mozilla, and Cloudflare announce new TLS Delegated Credentials standard

Posted on by

The new standard will work as an extension to TLS, a cryptographic protocol that underpins the more widely-known HTTPS protocol, used for loading websites inside browsers via an encrypted connection.

The TLS Delegate Credentials extension was specifically developed for large website setups, such as Facebook, or for website using content delivery networks (CDNs), such as Cloudflare.

How TLS Delegate Credentials works

For example, a big website like Facebook has thousands of servers spread all over the world. In order to support HTTPS traffic on all, Facebook has to place a copy of its TLS certificate private key on each one.

This is a dangerous setup. If an attacker hacks one server and steals the TLS private key, the attacker can impersonate Facebook servers and intercept user traffic until the stolen certificate expires.

The same thing is also valid with CDN services like Cloudflare. Anyone hosting an HTTPS website on Cloudflare’s infrastructure must upload their TLS private key to Cloudflare’s service, which then distributes it to thousands of servers across the world.

The TLS Delegate Credentials extension allows site owners to create short-lived TLS private keys (called delegated credentials) that they can deploy to these multi-server setups, instead of the real TLS private key.

The delegated credentials can live up to seven days and can be rotated automatically once they expire.

TLS Delegated Credentials shortens MitM attack window

The most important security improvement that comes with this new TLS extension is that if — in the worst-case scenarios — an attacker does manage to hack a server, the stolen private key (actually a delegated credential) won’t work for more than a few days, rather than weeks, months, or even a year, as it does now.

You can read more in-depth technical explanations about the new TLS Delegated Credentials extensions on the Facebook, Mozilla, and Cloudflare blogs.

The IETF draft specification is available here. TLS Delegated Credentials will be compatible with the TLS protocol v1.3 and later.

Source: Facebook, Mozilla, and Cloudflare announce new TLS Delegated Credentials standard | ZDNet

Car Blind Spots solved by 14  year old by projecting live camera feed onto pillars blocking view

Posted on by

Using some relatively inexpensive and readily available technology you can find at any well-stocked electronics store, Alaina Gassler, a 14-year-old inventor from West Grove, Pennsylvania, came up with a clever way to eliminate the blind spot created by the thick pillars on the side of a car’s windshield.

[…]

Her solution involves installing an outward-facing webcam on the outside of a vehicle’s windshield pillar, and then projecting a live feed from that camera onto the inside of that pillar. Custom 3D-printed parts allowed her to perfectly align the projected image so that it seamlessly blends with what a driver sees through the passenger window and the windshield, essentially making the pillar invisible.

Her invention was part of a project called “Improving Automobile Safety by Removing Blind Spots,” which Gassler presented at this year’s Society for Science and the Public’s Broadcom MASTERS (Math, Applied Science, Technology, and Engineering for Rising Stars) science and engineering competition.

Source: 14-Year-Old Genius Alaina Gassler Solves Car Blind Spots

NordVPN users’ passwords exposed in mass credential-stuffing attacks

Posted on by

As many as 2,000 users of NordVPN, the virtual private network service that recently disclosed a server hack that leaked crypto keys, have fallen victim to credential-stuffing attacks that allow unauthorized access to their accounts.

In recent weeks, credentials for NordVPN users have circulated on Pastebin and other online forums. They contain the email addresses, plain-text passwords, and expiration dates associated with NordVPN user accounts.

I received a list of 753 credentials on Thursday and polled a small sample of users. The passwords listed for all but one were still in use. The one user who had changed their password did so after receiving an unrequested password reset email. It would appear someone who gained unauthorized access was trying to take over the account. Several other people said their accounts had been accessed by unauthorized people.

Over the past week, breach notification service Have I Been Pwned has reported at least 10 lists of NordVPN credentials similar to the one I obtained.

Enlarge
Have I Been Pwned

While it’s likely that some accounts are listed in multiple lists, the number of user accounts easily tops 2,000. What’s more, a large number of the email addresses in the list I received weren’t indexed at all by Have I Been Pwned, indicating that some compromised credentials are still leaking into public view. Most of the Web pages that host these credentials have been taken down, but at the time this post was going live, at least one remained available on Pastebin, despite the fact Ars brought it to NordVPN’s attention more than 17 hours earlier.

Without exception, all of the plain-text passwords are weak. In some cases, they’re the string of characters to the left of the @ sign in the email address. In other cases, they’re words found in most dictionaries. Others appear to be surnames, sometimes with two or three numbers tacked onto the end. These common traits mean that the most likely way these passwords became public is through credential stuffing. That’s the term for attacks that take credentials divulged in one leak to break into other accounts that use the same username and password. Attackers typically use automated scripts to carry out these attacks.

Source: NordVPN users’ passwords exposed in mass credential-stuffing attacks | Ars Technica

13 year old thinks up New Hyperloop design, builds on existing rail infrastructure

Posted on by
Crouchley’s idea, which just won second place in the annual 3M Young Scientist Challenge, is to build pneumatic tubes next to existing train tracks.
Magnetic shuttles would travel through these vacuum tubes, connected via magnetic arm to trains traveling on the existing tracks.
This system would utilize current train tracks, thereby cutting infrastructure costs and, Crouchley says, eradicating the potential safety risk posed by propelling passengers in a vacuum.
There’d be no need for trains to use diesel or electric motors, making the trains lighter and more fuel-efficient.
This is important to Crouchley, who aims to devise active solutions to the climate crisis.
“I pinpointed transportation as something I wanted to work on because if we can make trains more efficient, then we can eliminate the amount of cars, trucks and buses on the road,” Crouchley tells CNN Travel.

Real world inspiration

Caroline-Crouchley-Hyperloop2
[…]
“Hyperloop is very high risk,” says Crouchley.
“My design can be less expensive and more efficient than current train technology that’s out there already. It’s also safer than Hyperloop.
My design can rely on 100% renewable energy, so it eliminates the need for a diesel engine or an electric motor, which makes the train lighter, so it can move faster.”

Source: New Hyperloop design comes from the mind of a 13-year-old scientist | CNN Travel