You don't need a double-blind study to determine if acoustic emissions are the culprit. You just need to measure specifically for infrasound (and ultrasound, for that matter). It's an unusual form of pollution but very much measurable if you know to look for it.

Unlike the things you mentioned, infrasound is understood to be a thing these days and is sometimes considered in construction. It's not exactly witchcraft; most equipment (including decibel meters) just isn't built to account for very low frequencies.

If the data center does put out noise at very low frequencies that's probably some kind of unintended resonance that they'll have to stop. It might be as simple as slightly changing the RPMs of some cooling fans or installing sound proofing in specific places.

Yes, infrasound is a fairly well understood phenomenon. Loud noise at frequencies below 10 Hz isn't commonly picked up by recording equipment but can induce things like anxiety, nausea, and sleep problems. While recently wind power plants have sometimes been accused of generating it, it's also been caused by industrial fans and even resonance in a building's ductwork.

It wouldn't surprise me if a data center's AC caused enough noise at frequencies not normally monitored to become an issue.

Files containing login credentials should be encrypted, yes. You will also find that password managers tend to relock their database after a period of time in order to limit the opportunity for an attack. That's not the controversial action you think it is.

Besides, I find it interesting how Microsoft disabling a protection mechanism Chromium ships with has turned into a debate about the applicability of layered defense to cybersecurity in general.

Nothing beyond shipping laptops with NPUs, which isn't unusual since that's what Intel's and AMD's laptop CPUs come with these days.

As does Arch AFAIK. It's still very niche, though.

The difference in speed between MD5 and something like bcrypt or Argon2 is massive. We're talking orders of magnitude. That adds a layer of security – if hashing takes e.g. 1000 times longer than with md5, the 20 minutes to crack the least secure passwords suddenly turns into 14 days. Still not astronomical but a lot slower. The more secure algorithms also require more memory to run, leading to less effective parallelization.

Besides, MD5 is prone to collisions, which reduce the number of attacks needed. The attacker doesn't need the real password, just one that hashes to the correct value.

While they did do a more sophisticated dictionary attack, they also talk about rainbow tables, which only work if the hashes are unsalted. A more modern approach with salted passwords is immune to rainbow table attacks. An actually modern approach with salted and peppered Argon2 hashes makes the kind of offline attack Kaspersky did unfeasible in the first place.

For some reason Kaspersky never bothered to point this out. I'd expect a reputable cybersecurity company like them to at least include one line that urges developers to make use of a modern approach and gives pointers as to what that might be. But I suppose "we recommend passwords to be salted, peppered, and hashed with Argon2i or Argon2id with a sufficiently high work factor" wouldn't fit their narrative.

(I also just noticed that the advice part of Kaspersky's article is littered with references to the password manager they sell. Yep, it's an underhanded ad that just happens to contain some good security advice.)

You see, that's just inaccurate. GNU/Linux is not equivalent to GNU+Linux. That would be addition; this is division. The bigger Linux gets, the smaller GNU/Linux becomes.

That's why they've developed GNU/Hurd. Hurd is unlikely to ever amount to much, meaning that GNU/Hurd will never evaluate to a small value. And that is cold, hard mathematical fact.

I'd use at least one more: The one that unlocks your device shouldn't be the one that unlocks your password manager. Other than that, yes. Use a password manager, let it generate per-service passwords for you, and make sure you have a backup plan.

For example, I use a KeePass database shared across my devices via a self-hosted NextCloud. Each of my devices plus the server effectively holds a backup copy so I'd have to lose all of my devices plus the server before my password database becomes inaccessible. Since the server lives in a datacenter it also serves as a remote backup.

If your password manager is SaaS, you might want to investigate how to protect yourself from scenarios like the service being down or you losing access to the account.

I think Gunner means a biometrically unlocked second factor like a Yubikey or a smartphone's user attestation. Given how badly written the entire article is, I wouldn't be confused if that's what he originally said before they condensed his statement beyond comprehension.

So Kaspersky found out that MD5 passwords are unsafe. That's literally 20 year old news. Actually, Kaspersky found out that brute-forcing MD5 on consumer-grade hardware has become slightly faster than two years ago, which makes me wonder if Captain Obvious's secret identity is that of a Kaspersky cybersecurity expert.

El Reg concludes from this that we should ditch passwords, which they back up with the opinion of a second expert. This expert immediately tells them they're wrong, that passwords are perfectly fine if used with MFA, and that a lack of public knowledge about basic cybersecurity is the real issue. They somehow treat this as him agreeing with them.

Actual technological alternatives to traditional password use (such as passkeys or password managers with per-site passwords) are mentioned only as an aside or not at all. It never occurred to El Reg or Kaspersky to mention that MD5 has been considered obsolete since the days of Internet Explorer 7 and that more secure hashes like bcrypt have been around since the late 90s. For that matter, the Kaspersky source talks about rainbow tables without using the word "salt" even once.

Finally they conclude with a call to action to "improve that user security stack", arguing that passwords are inherently unsafe due to their "complex requirements and hashed storage". That's so deep into la-la land that I'm not even sure what it is they're trying to say or who they're even talking to.

That's an amazingly badly written article.

What impresses me the most is that the Kaspersky article they're talking about is just as asinine as El Reg's confused stammering. The most sense I can make out of it is that they're making a bad faith argument ("we can brute-force MD5'd passwords with a 5090 so you should use MFA") because they're trying to get nontechnical people to do the right thing and hope they can scare them into compliance if they bullshit hard enough.

Edit: I just noticed how often Kaspersky's article refers to the own password manager they sell. So their bad faith argument is really just in service of an ad that happens to contain some decent security advice.

Rektor: "Gemäß Vorgabe des Landeskultusministeriums werden jetzt ein Lobgesang und die Bayernhymne gespielt. Ihr dürft mitsingen, wenn ihr wollt, aber wenn ihr das tut, weist das Kultusministerium darauf hin, dass jede Abweichung vom euch ausgehändigten Liedtext eine Straftat gemäß §90a StGB ist. Schweigen ist natürlich legal."

CSU. "Warum singen die Schüler nicht mit? Wir haben ausdrücklich darum gebeten."

This makes it easier. The less sophisticated an attack is needed (reading from memory whenever you want vs. extracting the key during decryption), the more of an attack surface there is.

That's especially a problem since Edge is based on Chromium, which has more careful handling of passwords by default. Microsoft had to actively change that to get the current behavior.