Xitoring was introduced in 2021 to revolutionize the server monitoring industry for those who are tired of cumbersome, traditional ways and are looking forward to automation in this vital part of their jobs.

Xitoring

This paper is under CC 4.0 license. available on arxiv Authors: (1) Joel Jang, CarperAI,University of Washington & Allen Institute for AI; (2) Seungone Kim, KAIST AI; (3) Yizhong Wang, University of Washington; (4) Jack Hessel, University of Washington; (5) Luke Zettlemoyer, Aleph Alpha; (6) Hannaneh Hajishirzi, University of Washington & Allen Institute for AI; (7) Yejin Choi, UC San Diego. 5 CONCLUSION Previous work has shown that adapting LLMs with RLHF helps them generate outputs that are preferred by humans over the supervised fine-tuned counterpart. However, recent work has also pointed out that simply training LLMs to abide by the preference of the general may result in ignoring individual preferences and values. In this work, we provide the first steps to tackle this issue by proposing Reinforcement Learning from Personalized Human Feedback as a multi-objective problem so that LLMs can be aligned to follow conflicting preferences. We propose a promising method called P-SOUPS that is able to composite models trained on single objectives on the fly during inference. We also highlight the scalability of P-SOUPS by showing that it scales linearly, instead of exponentially like the MORL baseline, with regards to the number of new preferences, which is required to provide true personalization to individual users. ACKNOWLEDGMENTS Thanks to Minyoung Hwang, Sungdong Kim, Tim Dettmers, Yoonjoo Lee, and Margaret Li for helpful feedback and discussion. REFERENCES Xiang Ao, Xiting Wang, Ling Luo, Ying Qiao, Qing He, and Xing Xie. PENS: A dataset and generic framework for personalized news headline generation. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 82–92, Online, August 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.acl-long.7. URL https: //aclanthology.org/2021.acl-long.7. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, T. J. Henighan, Nicholas Joseph, Saurav Kadavath, John Kernion, Tom Conerly, Sheer El-Showk, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Tristan Hume, Scott Johnston, Shauna Kravec, Liane Lovitt, Neel Nanda, Catherine Olsson, Dario Amodei, Tom B. Brown, Jack Clark, Sam McCandlish, Christopher Olah, Benjamin Mann, and Jared Kaplan. Training a helpful and harmless assistant with reinforcement learning from human feedback. ArXiv, abs/2204.05862, 2022a. URL https://api.semanticscholar.org/ CorpusID:248118878. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073, 2022b. Stephen Casper, Xander Davies, Claudia Shi, Thomas Krendl Gilbert, Jer´ emy Scheurer, Javier ´ Rando, Rachel Freedman, Tomasz Korbak, David Lindner, Pedro Freire, et al. Open problems and fundamental limitations of reinforcement learning from human feedback. arXiv preprint arXiv:2307.15217, 2023. Deborah Cohen, Moonkyung Ryu, Yinlam Chow, Orgad Keller, Ido Greenberg, Avinatan Hassidim, Michael Fink, Yossi Matias, Idan Szpektor, Craig Boutilier, et al. Dynamic planning in openended dialogue using reinforcement learning. arXiv preprint arXiv:2208.02294, 2022. Shachar Don-Yehiya, Elad Venezian, Colin Raffel, Noam Slonim, Yoav Katz, and Leshem Choshen. Cold fusion: Collaborative descent for distributed multitask finetuning. arXiv preprint arXiv:2212.01378, 2022. Yann Dubois, Xuechen Li, Rohan Taori, Tianyi Zhang, Ishaan Gulrajani, Jimmy Ba, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. Alpacafarm: A simulation framework for methods that learn from human feedback. arXiv preprint arXiv:2305.14387, 2023. Shangbin Feng, Chan Young Park, Yuhan Liu, and Yulia Tsvetkov. From pretraining data to language models to downstream tasks: Tracking the trails of political biases leading to unfair nlp models. arXiv preprint arXiv:2305.08283, 2023. Xinyang Geng, Arnav Gudibande, Hao Liu, Eric Wallace, Pieter Abbeel, Sergey Levine, and Dawn Song. Koala: A dialogue model for academic research. Blog post, April, 1, 2023. Conor F Hayes, Roxana Radulescu, Eugenio Bargiacchi, Johan K ˘ allstr ¨ om, Matthew Macfarlane, ¨ Mathieu Reymond, Timothy Verstraeten, Luisa M Zintgraf, Richard Dazeley, Fredrik Heintz, et al. A practical guide to multi-objective reinforcement learning and planning. Autonomous Agents and Multi-Agent Systems, 36(1):26, 2022. Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum? id=nZeVKeeFYf9. Chengsong Huang, Qian Liu, Bill Yuchen Lin, Tianyu Pang, Chao Du, and Min Lin. Lorahub: Efficient cross-task generalization via dynamic lora composition. ArXiv, abs/2307.13269, 2023. URL https://api.semanticscholar.org/CorpusID:260155012. Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. ICLR, 2022. Joel Jang, Seungone Kim, Seonghyeon Ye, Doyoung Kim, Lajanugen Logeswaran, Moontae Lee, Kyungjae Lee, and Minjoon Seo. Exploring the benefits of training expert language models over instruction tuning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 14702–14729. PMLR, 23–29 Jul 2023. URL https://proceedings.mlr.press/v202/jang23a. html. Sungdong Kim, Sanghwan Bae, Jamin Shin, Soyoung Kang, Donghyun Kwak, Kang Min Yoo, and Minjoon Seo. Aligning large language models through synthetic feedback. arXiv preprint arXiv:2305.13735, 2023. Hannah Rose Kirk, Bertie Vidgen, Paul Rottger, and Scott A Hale. Personalisation within bounds: A ¨ risk taxonomy and policy framework for the alignment of large language models with personalised feedback. arXiv preprint arXiv:2303.05453, 2023. Noriyuki Kojima, Alane Suhr, and Yoav Artzi. Continual learning for grounded instruction generation by observing human following behavior. Transactions of the Association for Computational Linguistics, 9:1303–1319, 2021. Margaret Li, Suchin Gururangan, Tim Dettmers, Mike Lewis, Tim Althoff, Noah A Smith, and Luke Zettlemoyer. Branch-train-merge: Embarrassingly parallel training of expert language models. arXiv preprint arXiv:2208.03306, 2022. Pan Li and Alexander Tuzhilin. Towards controllable and personalized review generation. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 3237–3245, Hong Kong, China, November 2019. Association for Computational Linguistics. doi: 10.18653/v1/D19-1319. URL https://aclanthology.org/D19-1319. Bodhisattwa Prasad Majumder, Shuyang Li, Jianmo Ni, and Julian McAuley. Generating personalized recipes from historical user preferences. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 5976–5982, Hong Kong, China, November 2019. Association for Computational Linguistics. doi: 10.18653/v1/D19-1613. URL https://aclanthology.org/D19-1613. Pierre-Emmanuel Mazare, Samuel Humeau, Martin Raison, and Antoine Bordes. Training mil- ´ lions of personalized dialogue agents. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pp. 2775–2779, Brussels, Belgium, OctoberNovember 2018. Association for Computational Linguistics. doi: 10.18653/v1/D18-1298. URL https://aclanthology.org/D18-1298. Jacob Menick, Maja Trebacz, Vladimir Mikulik, John Aslanides, Francis Song, Martin Chadwick, Mia Glaese, Susannah Young, Lucy Campbell-Gillingham, Geoffrey Irving, et al. Teaching language models to support answers with verified quotes. arXiv preprint arXiv:2203.11147, 2022. Reiichiro Nakano, Jacob Hilton, S. Arun Balaji, Jeff Wu, Ouyang Long, Christina Kim, Christopher Hesse, Shantanu Jain, Vineet Kosaraju, William Saunders, Xu Jiang, Karl Cobbe, Tyna Eloundou, Gretchen Krueger, Kevin Button, Matthew Knight, Benjamin Chess, and John Schulman. Webgpt: Browser-assisted question-answering with human feedback. ArXiv, abs/2112.09332, 2021a. URL https://api.semanticscholar.org/CorpusID:245329531. Reiichiro Nakano, Jacob Hilton, Suchir Balaji, Jeff Wu, Long Ouyang, Christina Kim, Christopher Hesse, Shantanu Jain, Vineet Kosaraju, William Saunders, et al. Webgpt: Browser-assisted question-answering with human feedback. arXiv preprint arXiv:2112.09332, 2021b. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke E. Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Francis Christiano, Jan Leike, and Ryan J. Lowe. Training language models to follow instructions with human feedback. ArXiv, abs/2203.02155, 2022a. URL https://api.semanticscholar.org/ CorpusID:246426909. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 35: 27730–27744, 2022b. Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. Instruction tuning with gpt-4. arXiv preprint arXiv:2304.03277, 2023. Jonas Pfeiffer, Naman Goyal, Xi Victoria Lin, Xian Li, James Cross, Sebastian Riedel, and Mikel Artetxe. Lifting the curse of multilinguality by pre-training modular transformers. arXiv preprint arXiv:2205.06266, 2022. Alexandre Rame, Guillaume Couairon, Mustafa Shukor, Corentin Dancette, Jean-Baptiste Gaya, Laure Soulier, and Matthieu Cord. Rewarded soups: towards pareto-optimal alignment by interpolating weights fine-tuned on diverse rewards. arXiv preprint arXiv:2306.04488, 2023. Alireza Salemi, Sheshera Mysore, Michael Bendersky, and Hamed Zamani. Lamp: When large language models meet personalization. arXiv preprint arXiv:2304.11406, 2023. Shibani Santurkar, Esin Durmus, Faisal Ladhak, Cinoo Lee, Percy Liang, and Tatsunori Hashimoto. Whose opinions do language models reflect? arXiv preprint arXiv:2303.17548, 2023. John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347, 2017. Umer Siddique, Paul Weng, and Matthieu Zimmer. Learning fair policies in multi-objective (deep) reinforcement learning with average and discounted rewards. In International Conference on Machine Learning, pp. 8905–8915. PMLR, 2020. David Silver, Satinder Singh, Doina Precup, and Richard S Sutton. Reward is enough. Artificial Intelligence, 299:103535, 2021. Prasann Singhal, Tanya Goyal, Jiacheng Xu, and Greg Durrett. A long way to go: Investigating length correlations in rlhf. arXiv preprint arXiv:2310.03716, 2023. Feifan Song, Bowen Yu, Minghao Li, Haiyang Yu, Fei Huang, Yongbin Li, and Houfeng Wang. Preference ranking optimization for human alignment. arXiv preprint arXiv:2306.17492, 2023. Nisan Stiennon, Long Ouyang, Jeffrey Wu, Daniel Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F Christiano. Learning to summarize with human feedback. Advances in Neural Information Processing Systems, 33:3008–3021, 2020. Alane Suhr and Yoav Artzi. Continual learning for instruction following from realtime feedback. arXiv preprint arXiv:2212.09710, 2022. Richard S Sutton and Andrew G Barto. Reinforcement learning: An introduction. MIT press, 2018. Romal Thoppilan, Daniel De Freitas, Jamie Hall, Noam Shazeer, Apoorv Kulshreshtha, Heng-Tze Cheng, Alicia Jin, Taylor Bos, Leslie Baker, Yu Du, et al. Lamda: Language models for dialog applications. arXiv preprint arXiv:2201.08239, 2022. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothee´ Lacroix, Baptiste Roziere, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and ` efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023. Peter Vamplew, Richard Dazeley, Cameron Foale, Sally Firmin, and Jane Mummery. Humanaligned artificial intelligence is a multiobjective problem. Ethics and Information Technology, 20:27–40, 2018. Kristof Van Moffaert and Ann Nowe. Multi-objective reinforcement learning using sets of pareto ´ dominating policies. The Journal of Machine Learning Research, 15(1):3483–3512, 2014. Kristof Van Moffaert, Madalina M Drugan, and Ann Nowe. Scalarized multi-objective reinforce- ´ ment learning: Novel design techniques. In 2013 IEEE symposium on adaptive dynamic programming and reinforcement learning (ADPRL), pp. 191–199. IEEE, 2013. Yizhong Wang, Hamish Ivison, Pradeep Dasigi, Jack Hessel, Tushar Khot, Khyathi Raghavi Chandu, David Wadden, Kelsey MacMillan, Noah A Smith, Iz Beltagy, et al. How far can camels go? exploring the state of instruction tuning on open resources. arXiv preprint arXiv:2306.04751, 2023. Mitchell Wortsman, Suchin Gururangan, Shen Li, Ali Farhadi, Ludwig Schmidt, Michael Rabbat, and Ari S Morcos. lo-fi: distributed fine-tuning without communication. arXiv preprint arXiv:2210.11948, 2022a. Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael Gontijo-Lopes, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International Conference on Machine Learning, pp. 23965–23998. PMLR, 2022b. Jeff Wu, Long Ouyang, Daniel M Ziegler, Nisan Stiennon, Ryan Lowe, Jan Leike, and Paul Christiano. Recursively summarizing books with human feedback. arXiv preprint arXiv:2109.10862, 2021a. Yuwei Wu, Xuezhe Ma, and Diyi Yang. Personalized response generation via generative split memory network. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 1956–1970, 2021b. Zeqiu Wu, Yushi Hu, Weijia Shi, Nouha Dziri, Alane Suhr, Prithviraj Ammanabrolu, Noah A Smith, Mari Ostendorf, and Hannaneh Hajishirzi. Fine-grained human feedback gives better rewards for language model training. arXiv preprint arXiv:2306.01693, 2023. Jie Xu, Yunsheng Tian, Pingchuan Ma, Daniela Rus, Shinjiro Sueda, and Wojciech Matusik. Prediction-guided multi-objective reinforcement learning for continuous robot control. In International conference on machine learning, pp. 10607–10616. PMLR, 2020. Jing Xu, Arthur Szlam, and Jason Weston. Beyond goldfish memory: Long-term open-domain conversation. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 5180–5197, Dublin, Ireland, May 2022. Association for Computational Linguistics. doi: 10.18653/v1/2022.acl-long.356. URL https: //aclanthology.org/2022.acl-long.356. Runzhe Yang, Xingyuan Sun, and Karthik Narasimhan. A generalized algorithm for multi-objective reinforcement learning and policy adaptation. Advances in neural information processing systems, 32, 2019. Saizheng Zhang, Emily Dinan, Jack Urbanek, Arthur Szlam, Douwe Kiela, and Jason Weston. Personalizing dialogue agents: I have a dog, do you have pets too? arXiv preprint arXiv:1801.07243, 2018. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging llm-as-a-judge with mt-bench and chatbot arena. arXiv preprint arXiv:2306.05685, 2023. Yinhe Zheng, Guanyi Chen, Minlie Huang, Song Liu, and Xuan Zhu. Personalized dialogue generation with diversified traits. arXiv preprint arXiv:1901.09672, 2019. Daniel M Ziegler, Nisan Stiennon, Jeffrey Wu, Tom B Brown, Alec Radford, Dario Amodei, Paul Christiano, and Geoffrey Irving. Fine-tuning language models from human preferences. arXiv preprint arXiv:1909.08593, 2019. A DETAILS OF EVALUATION SETUP We use a modified version of the GPT4 annotation prompt used by Dubois et al. (2023). We modify the criteria to perform the pairwise evaluation from general to a single preference dimension. We also provide 3 demonstrations: one scenario where there is a tie because both responses do not contain any notion of the preference (e.g. both responses do not show any signs of friendliness), one scenario where there is a clear winner, and one scenario where they are both good, but one is better than the other. Simulated pairwise evaluation We recruited 24 crowd workers for our human evaluation. Figure 5 shows the interface used for human evaluation. We consider both the ‘Tie’ and ‘Both are bad’ options to be Ties. B CRITERIA-WISE EVALUATION The criteria-wise win rate (%) across all the methods are shown in Figure 6. The criteria-wise win rate was calculated by getting the average win-rate of the preference combinations that contained the specific preference dimension. For example, when calculating the criteria-wise win rate of ‘Elementary’, we got the average win-rate of the preference combinations that contained the ‘Elementary’ preference, which includes AAA, AAB, ABA, and ABB. C THE FULL LIST OF EVALUATION PROMPTS The full list of evaluation prompts used in our experiments are provided in Table 5 D DETAILED RESULTS FOR HUMAN EVALUATION AND GPT-4 EVALUATION We provide detailed results (win / loss / tie for each of the preference combinations for our main experimental results. Table 6 shows the GPT4 evaluation and Table 7 shows the human evaluation results. E EXAMPLES OF P-SOUPS TEXT GENERATIONS Table 8 shows empirical examples of the text generated from each preference combination of the 16 preference combination experiments for the same prompt.

Personalized Soups: LLM Alignment Via Parameter Merging - Conclusion & References

This is the 13-year journey that resulted in , a different approach to password management. Here goes articles[0] of articles.length == 2. Neulock Part I It was back in 2011. was still movie material; people communicated using monochromatic doodle faces instead of Pepe the Frog and Shiba Inu doges, and Daenerys Targaryen was the little girl who made the barbaric Khal Drogo find love. Contagion It was then that Google Chrome first made that offer. Do you want Google Chrome to save your password for this site? Save this password? Is that a thing browsers do now? Wow, thanks, Chrome, that’s so convenient! Come to think of it, I type most passwords on a web browser, so this looks like a great place to save them. Besides, what’s the worst that can happen? Chrome is a program installed on my computer. computer! I’m a seasoned Debian Linux power user, and nowhere in the universe is there a safer place than my hard drive! MY Sure, Chrome, go ahead. Save this password, and the next one, and every password I type in your input fields. Deception Until I bought another computer. After ditching the pre-installed Windows for whatever Linux distro I fancied at the time, the next thing to do was install Chrome. Firefox Quantum was still six years away, so there wasn’t much choice. Sign in with your Google account? Sure, why not? Let’s go check Facebook or whatever, and… hey, do you remember my username, Chrome? All right, let’s sign in to Facebook. Wait, why is the password field already filled in with asterisks? No, dear Chrome, this must be a bug, I’ve just bought this computer, your local database is pristine. You’ll realize your mistake once I click the login button. And… I’m in? I went to check Chrome settings immediately. What I saw only increased my horror. All the websites and usernames I had been saving were there, on a list. Plaintext passwords were only a click away. Two expectations had been broken. The first and most important thing is that I never expected Chrome to upload my passwords to Google’s servers without asking for consent. They asked me to my passwords, not to share them! save The second expectation was wishful thinking on my part. Shame on me. Google is one of the coolest tech companies in the world, and its engineers are supposed to be geniuses doing the impossible between ping-pong matches at the Googleplex. I thought Chrome was storing my passwords in some super-secure fashion and only retrieving each password at the right time to inject it like a ninja in the precise input field where it belonged. I didn’t expect to see them all in plaintext. And I wasn’t the only one who was shocked. ”. In a further discussion, Justin Schuh, Chrome’s chief of security, in a rather arrogant manner. Sir Tim Berners-Lee took Kember’s side, calling Chrome’s password manager “ .” Elliott Kember called Chrome’s password security “insane just shrugged it off a way to get your big sister’s passwords After this experience, I never got myself to trust any password manager, even though I knew it was better than confabulating weird passwords in my stupid human head. But, as we say in Brazil, a dog who’s been bitten by a snake fears even sausages. It doesn’t make more sense in Portuguese. A better password manager I spent the next ten years wandering in the desert of password insecurity. I was longing for a better password manager, but all of them seemed to follow the same principle: bundle up all your passwords in a “vault,” encrypt it with your master key and upload this vault to their cloud servers. I could never trust this model. Are they implementing end-to-end encryption, right? Is there a “key recovery” backdoor waiting to be exploited? Or maybe Justin Schuh was right after all: your passwords are “trivially recovered” from any application that stores them, and attempts to make passwords harder to leak are “all just theater.” In this sense, trying to safeguard your passwords any further than trusting a password manager was a novice fool’s errand. In 2019, I landed in the IT Department at the Ministry of Foreign Affairs of Brazil. There, I shadowed the CTO and . I learned a great deal from him and took over after he left. Cybersecurity was always on the agenda since that Ministry produced about 80% of all classified information in the Brazilian Federal government, and its operations were spread over 240 locations in all habitable continents. We were constantly targeted by the world’s scariest acronyms, so we needed to keep our guard up at all times. Over those years, through constant exposure to problems in different domains of cybersecurity, I started to put together principles for a better password manager. tech guru Fabio Cereda Principle #0: all cryptography is broken or eventually will get broken There was a museum of diplomatic communications where I worked. It was full of code books, cast-iron cipher machines, suitcase-portable dish antennas, TELEX adapters, and a few specimens of . It was a showcase of one and a half-century of secret communications between the headquarters and Brazilian embassies and diplomatic missions abroad. All of them relied on some sort of crypto to hold the secrets. All of that crypto is now broken. the infamous Crypto AG C-52 machine If you think about a password manager, the fact that all crypto will eventually get broken isn’t scary. Let’s say it takes, on average, 15 years to break a cryptographic protocol. Just change your passwords every couple of years, and you’ll be fine. A decent password manager should upgrade its crypto every now and then so you’ll always stay ahead of the curve. The scary part is that it’s impossible to know if a protocol has been broken already. Or worse, if it was designed with an intentional, hidden vulnerability, as was the case with the Crypto AG machine. Intelligence agencies and cybercriminal organizations keep their zero-days under the radar for as long as they can. The more I saw last-gen, corporate-grade security systems leaking secret information, sometimes in catastrophically spectacular manners, the less I trusted the vault model employed by all cloud-based password managers. Until very recently, these concerns were merely theoretical. As , fellow hackernooner @hossam26644 wrote There is nothing wrong with using Google’s password manager, Microsoft, Apple, 1password, Bitwarden, or whatever. People have been using them for long, with zero problems till now. He was right on July 25th, 2022. He didn’t trust any of them, though, and he was right again. One year later, there was compelling evidence that and people losing money. Over 150 people, over $35 million in money. the notorious LastPass leaks were resulting in some high-value vaults getting cracked A common misconception is that for an encrypted vault to be cracked, the itself would need to be compromised. LastPass has reminded us how much easier it is to break encryption. AES stands strong, but LastPass made poor implementation decisions: too short master key requirements, too few iterations, and some users were left with vaults that were easily crackable by brute force. AES algorithm Principle #1: logistics are often the weakest security link Government cryptanalysts knew Principle #0 all too well. They are some of the most intelligent people I’ve ever met, and few of them would put money on something protected by cryptography alone. The most wary of them insisted on the use of a for critically secure communications. In fact, they put this requirement in the regulations for the transmission and storage of top-secret documents. One-Time Pad (OTP) In principle, an OTP cypher cannot be broken. It is a simple XOR operation of the plaintext (the data) and a buffer of random values of the same length as the data (the OTP key). By XOR’ing the cipher against the same key again, the plaintext is recovered. Although unbreakable from a cryptanalysis standpoint, the OTP has several inconveniences: Each OTP key can never be reused; An OTP key must be at least as long as the plaintext; The key is symmetrical and must be pre-shared between the sending and the receiving parties. For a worldwide organization, supplying every office with OTP keys is a large ongoing logistical operation. Even worse, it’s the Achilles’ heel of the whole security model! Because, for all of OTP’s crypto-awesomeness to hold true, you need logistics, both in-transit and at-rest. perfect Should Eve intercept your OTP keys while on the road to the destination? All your communications from that point on are compromised. Should Eve physically crack your safe room and steal your OTP key media? All your comms from that point on are compromised, and maybe even your previous ones, if used portions of the key had not been properly erased from the media. If you implement OTP keys as 1 GB chunks of random bytes that get consumed as you send information, it clearly lacks both and backward secrecy. forward In the end, the perfect crypto is a way to shift responsibility from the cybersecurity team to the physical security team. And a similar problem affects offline password managers: they trade-off availability for confidentiality, leaving you with a logistical mess to sort out. As anyone running a local copy of knows, you need to backup your vault. This backup had better be external in case your computer storage dies. You need to keep your backup up-to-date. And make sure nobody has access to it. And don’t keep them all in your house, lest they fall prey to flood and fire. And don’t upload them to Google Drive; otherwise, you’re not using an offline password manager anymore. And… KeePass Principle #2: when a user device is compromised, it’s game over One day, my boss called me. She wanted to share a PDF with ten people from the upper echelon. This information should remain in their eyes only for three days. She knew that they had incentives to share this document with their respective teams to get a head start. This sort of information should be presented in person, but covid. So, she asked me to make this PDF impossible to copy and share. — Can’t be done, I replied. My boss was an Ambassador. This is the diplomatic equivalent of a General. Ambassadors aren’t used to hearing “no” as an answer. I patiently explained that, in computer science, when you give someone read permission to a resource, you implicitly give them permission to copy and distribute. Information access rights don’t obey legal rights. Even if we somehow made it inconvenient to share the file, they could just take pictures of their screens with their phones and share them over WhatsApp. If they can see the document on the screen, so can their cameras. Justin Schuh was right. If someone gains full access to your computer (or phone), they have full access to the information that you, the user, can access through that device. He’s right, but that doesn’t excuse him for implementing such a lousy password manager on Chrome. For a password manager, it means that protecting the user's device is always critical. If the server leaks, the attackers still need to go through the challenge of cracking the vaults. But if a hacker gains complete ownership over the computer running the password manager client, there’s nothing stopping them from stealing all passwords. This happens quite often in the crypto community. User Alice has a few dozen BTC, which makes her a millionaire. She has been doxxed or never hid her identity in the first place. She keeps a copy of her seed phrase in a local password manager on her desktop. “This is not a cloud password manager; I’m safe from leaks,” she thinks. Hackers find a way to make her install a backdoor to her computer. If they’re really good, they can do this without user interaction. The next morning, she wakes up to an empty wallet. For all the doom and gloom about user device compromise, there’s a silver lining: protecting our own devices, as users, is something that’s within our control. A server leak is not. The 150+ people who lost millions to the LastPass server leak bore no responsibility for the leaks or for LastPass implementing inadequate encryption standards. If user device compromise is a catastrophic attack vector no matter the password manager security model, and if we, as users, must protect our devices anyway, wouldn’t it be nice if this were attack vector? If we could build an password manager where no secrets ever leave the user devices so that users don’t need to worry about things out of their control, like server security and AES implementation details? the only online The ingredients are on the table Fellow author @hossam26644 continued, : “maybe I am a security freak, but I don’t want to trust my passwords to an entity, regardless of their promises &/reputation”. He’s right again. Cybersecurity is supposed to be proven and auditable, not based on trust and reputation. on his article The three principles outlined above guided my development of . It took me three years of ideation and iterations to arrive at its current form: an auditable cloud-based password manager that achieves zero knowledge by design and not through encryption. Passwords are synced across user devices using the cloud, but no secrets ever leave these devices. Cloud server compromises cannot leak any secrets because secrets never reach the cloud. Neulock Password Manager The three years of the making of Neulock will be documented in Part II.

Chrome Password Manager Betrayed My Trust 13 Years Ago. I Never Forgot

13 বছর আগে Chrome পাসওয়ার্ড ম্যানেজার আমার বিশ্বাসের সাথে বিশ্বাসঘাতকতা করেছে। আমি কখনই ভুলিনি।

Der Chrome Password Manager hat mein Vertrauen vor 13 Jahren missbraucht. Ich habe es nie vergessen.

Chrome Password Manager traicionó mi confianza hace 13 años. Nunca olvidé.

Le gestionnaire de mots de passe Chrome a trahi ma confiance il y a 13 ans. Je n'ai jamais oublié.

क्रोम पासवर्ड मैनेजर ने 13 साल पहले मेरे भरोसे को धोखा दिया। मैं कभी नहीं भूला.

Chrome パスワード マネージャーは 13 年前に私の信頼を裏切りました。私は決して忘れませんでした。

Chrome 비밀번호 관리자가 13년 전에 내 신뢰를 배신했습니다. 나는 결코 잊지 않았다.

O gerenciador de senhas do Chrome traiu minha confiança há 13 anos. Eu nunca esqueci.

Менеджер паролей Chrome предал мое доверие 13 лет назад. Я никогда не забывал.

Chrome Şifre Yöneticisi 13 Yıl Önce Güvenime İhanet Etti. Hiç unutmadım.

Trình quản lý mật khẩu Chrome đã phản bội lòng tin của tôi 13 năm trước Tôi không bao giờ quên.

Chrome 密码管理器 13 年前背叛了我的信任。我从未忘记。

Sound Call Graph Construction for Java Object: Conclusions, Acknowledgment, & References

Gemini - A Family of Highly Capable Multimodal Models: Discussion and Conclusion, References

Vitiligo 

vitíligo

Vitiligo

सफेद दाग

白斑

bệnh bạch biến

白癜风

Comeback

Regresar

Revenir

वापस लौटें

戻ってくる

Volte

Sự trở lại

回来

Storing Passwords In A Database: A Better Way to Do So

Scientific American, Vol. XXXVII.—No. 2. [New Series.], July 14, 1877 by Various, is part of the HackerNoon Books Series. You can jump to any chapter in this book . A NEW APPARATUS FOR STORING AND UTILIZING SOLAR HEAT. here A NEW APPARATUS FOR STORING AND UTILIZING SOLAR HEAT. The apparatus herewith illustrated is devised to collect solar heat or other heat, store it up in a heat reservoir—a mass of iron or other suitable material—confine it in the reservoir until needed, keep it in such form that it can be transported from place to place, and utilize it for industrial or other purposes. A is a concave mirror for concentrating the solar rays upon the heat reservoir, B, which is a mass of iron. C is the heat box for confining the heat until needed, and also for serving as package for transporting the heat reservoir when hot. G is the heat reservoir chamber, in which the heat is communicated from the hot reservoir to the air. Under certain circumstances the heat reservoir may be heated in the heat reservoir chamber. H is a devaporizing chamber, for extracting the moisture from the air by means of a deliquescent substance or other material or treatment. A vertical stack or flue, I, communicates with the heat reservoir chamber, for conveying the heated air away for use. The device for concentrating the solar rays may be either stationary or movable, and, if movable, may be moved by hand, or automatically, to follow the sun. The various chambers mentioned will have valves, J, at the ends to regulate the passage of the air, and there will be a door, K, at the side or bottom. Patented through the Scientific American Patent Agency, March 20, 1877, by Messrs. John S. Hittell and Geo. W. Deitzler, of San Francisco, Cal. About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Various (2012). Scientific American, Vol. XXXVII. —No. 2. [New Series.], July 14, 1877. Urbana, Illinois: Project Gutenberg. Retrieved https://www.gutenberg.org/cache/epub/38481/pg38481-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

A NEW APPARATUS FOR STORING AND UTILIZING SOLAR HEAT

XITORING

xitoring.com

1-10 employees

Since 2021

COMPANY RANKING

XITORING

EVERGREEN INDEX #11562

Representing this company? Click here to claim and customize this page!

Xitoring WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

XITORING

xitoring.com

1-10 employees

Since 2021

COMPANY RANKING

XITORING

EVERGREEN INDEX #11562

RELATED COMPANIESRANK

STORIES ABOUT XITORING

Representing this company? Click here to claim and customize this page!

Xitoring WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!