#also you know something isn't right because like ed had a really fashionable look

[fullmtal]

gonna prioritize my holiday asks (halloween / winter themed / etc!) and then just clearing my inbox ! i think setting tiny goals or just an ask or two at a time is doable and easier to manage in my head so thanks for the patience and you folks are welcome to keep sending in holiday themed asks, as i'm totally fine doing them way after the dates of all the winter holidays! i cleared some of my inbox for my sanity so most of it is still there just at an easy pace for me. since the writing bug is back i'll be iconing and lurking in the bg but working on stuff! again, thanks a ton for your patience i feel like i can actually engage again after having this year be a wild ride. hope everyone has a great day!

[rogueddie]

Eddie couldn't take his eyes off of the ugliest, evil looking polo top that he's ever had the misfortune to lay his eyes upon. It's everything he hates in one piece of clothing, so horrible that he'd gagged at it when he'd first seen it.

His friends had laughed, agreeing that the top is an abomination and crime against humanity.

But Eddie couldn't stop looking at it.

It's the exact type of thing that Steve would wear. It's the type of thing he would love and brag about.

Even though the party, with the help of Robin, have been trying to 'fix' Steve and his taste. They're currently targetting his wardrobe and they're almost wearing him down enough to get him to stop wearing so many polos.

It's making Eddie feel... conflicted.

He agrees that Steves taste is horrible. He listens to bad pop music most of the time, he has no sense of fashion and loves romance so much that he thinks awful rom-coms are the height of cinema.

But it's Steve. Those things are what make him so... Steve.

He sneaks back to the top when his friends aren't looking, crouching behind racks to get to the till and quickly buy it. He buries it in the bottom of his bag, ignoring the bored and judgemental look the staff are giving him.

"There you are," Gareth squints at him when he rejoins them. "Where did you go?"

"Fainted," he sneers, throwing an arm around Jeffs shoulders. "All these neons and pop are making me dizzy."

They laugh, quickly moving on.

After dropping them off, he goes straight to Steves house. He doesn't want the ugly shirt on his person longer than necessary and the last thing he needs is someone finding it in his closet.

He nearly cheers when he pulls up to Steves house and his parents car isn't parked out front.

They'd only caught him in their house once, when they'd come home early, and he's sure he only escaped with his life because the entire party was there too.

"Eddie?" Steve frowns when he opens the door. "What are you doing here? Are you ok?"

"Yeah, fine, just..." he huffs, rubbing his eyes. He digs through the bag, grabbing the offending shirt, and throwing it at Steve. "Got you that. I thought- whatever. There. Good night."

"Woah, woah," Steve quickly catches his arm. "It's ok, man. If the others ask then I'll say I got it. It's... this is really nice, Eds."

"It's ugly."

"Sure," Steve snorts, looking back to the shirt. "But it's definitely my style. This really means a lot to me. I think it looks cool."

"Uh, yeah, I guessed," Eddie shifts, squirming with how genuine Steve is being. "It's just a polo."

"No, it's not. It's special to me."

"Right, because you think that pattern is 'so-"

"You saw it and thought of me. Like, you hate it, but you knew I'd like it and... it just means a lot to me, that you're thinking of me."

"Alright, it's just a shirt, calm down."

"No, I don't think I will," Steve gently tugs him inside so he can shut the door. "I get it if this is difficult for you but I'm getting impatient."

"If- what?"

"Do you need me to make the first move? Or- is this a move? Is your love language gift giving or something?"

"You've lost me."

Steve huffs, putting his hands on his hips and giving Eddie a look that he can only describe as 'disappointed parent'.

"We've been flirting for months and you haven't done anything about it." Steve falters quickly when he sees the shock on Eddies face. "Or... am I missing something? Is it the whole, like... keeping it secret thing? Because I don't mind! It's not safe to be out in Hawkins, I know, and I'm not expecting a big date at-"

"You knew that I was flirting with you," Eddie interrupts. "This whole time?"

"Well, yeah, I was also flirting with you."

Eddie stares at him for a moment. "And you've been waiting for me to make a move on you?"

"Exactly. Was I not being obvious enough? I didn't want to out you or anything..."

"No... in retrospect you were being very clear. All of Robins cryptic advice makes so much sense now. Oh, God, even Wayne figured it out."

[yeetlegay]

The gremlin is back with new notes, I hope you don't mind. I'll put a read-more mark in case someone wants to skip them.

Santa Maria we're like 1 minute in and it's already going places

Pete didn't strike me as a tattoo person but it makes sense

I mean I know my man is getting slapped and all but that shirt is fire

"Who's a good boy?" sounded equally terrifying and awfully cute (9 minutes in and I'm already bananas)

TANKHUN YES HELLO OMG YOUR OUTFIT IS LIT LIKE ALWAYS

Tankhun has the best reactions, kicking Kinn with legs included

Porsche is the definition of "this all could've been done without a gun and yes, this all could've been an email"

JESUS that wrench is huge

what if the car accident was caused by Time? In one of the first episode Time mentioned Tay's dad covered up his car accident like nothing ever happened because it was his area. Just a thought.

omg Porchay and his Snoopy hoodie so cute I'll die

as someone who has terrible relationship with my siblings, I'd die for their bromance. Porsche and Porchay might get on some people's nerves in the fandom, but like... They literally only have each other. Of course they'd be super gentle and overprotective.

God that blow-dryer is loud

omg these two babies. Tay and Time are serving looks

OH MY GOD SHE IS SO PRETTY SHE IS INDEED SERVING LOOKS

Love how Tay is manspreading while Time is trying to occupy as little space as possible

Vegas is really reading Childhood's End, a story about literal aliens invading Earth while he has Pete locked up???

No, he isn't. Idk whether I should say God bless or not

I wish Vegas' father a happy burn in hell

Tankhun is such a fashion icon and no I will never stop saying it

I want Tankhun to be kindergarten teacher to my kids so he can teach them basic life rules such as be relaxed and kill everyone who is suspicious immediately and all that while looking so damn fabulous

Sir, uh, that is, um, really creative excuse to kiss someone...

Pete is so good at asking the right questions at the right time

"Have you ever loved me?" no, that's why he Superman-ed those kidnappers and proceeded to enter the warehouse guns blazing... (I getchu tho, Chay...)

Vegas, it's not as bad as before because prior to this you got free Pete therapy session

"If you hate me, you'll have energy to kill me later." or as I call it, positive thinking

Turbulence... noted.

Nope, I don't think my car accident theory was correct. Rest in peace theory, you did your best.

I started to respond to this bullet by bullet but half the bullets were just variations of “AKDHDJNSJSKAJSH SO TRUE” so here is a shortened version lol

THE WHO’S A GOOD BOY LINE REWROTE MY FUCKING DNA ISTG if I ever decide to proceed with my villain era I will be taking Vegas as my manipulate manslaughter malewhore inspo

“This could’ve been an email” LESTAT I WHEEZED

That wrench scared me more than the electric chair (taint edition) from ep 10, like for why is it so ENORMOUS

I live for sibling bonds too ugh. Oldest of 5 here so Porsche’s older sibling struggles resonate deeply. (Also that one post about how Kinn is a middle son but an eldest daughter…math was found dead from the accuracy)

The second I saw the Childhood’s End cover I had to pause and Google lol I’m obsessed with analyzing characters’ reading choices (the Kardashian Konfidential book led to a headcanon that Kinn started watching KUWTK with Tankhun just to feel something and now he’s lowkey a celebrity gossip encyclopedia)

Tankhun kindergarten teacher…WHO’S GONNA WRITE HIM STARTING A MAFIA DAYCARE FOR THE NEXT GENERATION OF THEERAPANYAKUL TOTS

No bc my first thought when Vegas did the pill kiss was “holy shit he’s ballin I could’ve been having my gf give me Tylenol kisses this whole time???” Like absolute legend behavior imo

Kinn walking like that had me thinking Something Else and I was like “surely…surely they wouldn’t have…..not-not on a-a helicopter” so glad we got confirmation of a sky bj to bring my brain back online (sort of)

[miraculous-trinity-leo]

Tᕼᗴ ᑕᕼᗩOTIᑕ ᗩᑎᘜᗴᒪ

(Part 1) (Part 2) (Part 3) (Part 4) (Part 5) (Part 6)

Chapter 3: Au Revoir Gotham My True Home

•—–—–·†·–—–—•

Marinette explained what happened and that she didn't mean to cause trouble, she didn't know why the bats were looking for her (author to audience... it's because she looks like one of his bat kids gone rouge.) When she asked how they knew the Bat was looking for her, she found out that Selina was actually dating the Bat... So Marinette was very surprised at that, her family talked about it and a few days after her birthday she'll be going to Paris, France with Selina to be with a family friend of hers. Marinette was now really thinking she was cursed, but she made sure to take it in stride and spend as much time with her friends and family as possible.

"Doan wawhry suguh, we'll make sure tuh visit as much as possible, yuh can even visit us durin' summuh and wintuh break." - Harley held back the tears as she hugged Marinette, Bud, Lou, Ivy, Selina, Ed and even Frank joined in on it.

……… ………

Marinette was out with her friends still not sure how to tell them, she started with the obvious.

"Sooo... tomorrow I turn 10... the double digits." - Marinette

"Soon you'll be one of us!" - Garfield gave Marinette a side hug with a big smile, god he made it harder to tell them

"So what do you want to do? We can celebrate, tomorrow and the day after that, and the day after that, heck we can celebrate for the whole week while we're at it!" - Garfield

Rachel noticed the sad smile Marinette had as Garfield continued talking.

"Is there something you need to tell us?" - Rachel's words stoped Garfield in his tracks, he then looked at a slightly teary Marinette, and he felt a slight tinge of pain in his chest.

"I- um, I'm moving this Saturday... I'm sorry I really don't want to, but- *hic* I-" - Marinette was cut off by Garfield giving her a hug, he rubbed small circles on her back as she let out a few sobs. Rachel patting her shoulder to try and comfort her.

After they were like that for a few minutes, they decided to get ice cream

……… ……… ………

"I'm sorry." - Marinette eating her chocolate chip ice cream

"It's not your fault Mari, besides, we can officially say we have a pen pal in Paris." - Garfield with his chocolate mint ice cream trying to lighten the mood, managed to get a chuckle out of Marinette.

"We can still video call, or text you. And your parents said you can visit on summer and winter break." - Rachel just starting her strawberry ice cream

"But what if I need a friend to talk to when I can't sleep? Or if I need a movie buddy? Or gaming buddy?" - Marinette

"There are online multiplayer games we can play you know." - Rachel

"Yeah, and I'm sure you'll make friends over there really quickly, I mean you already know a few other languages, including French, so there isn't any communication problems." - Garfield

"I wish you guys could come with me..." - Marinette almost done with her ice cream

"... Didn't you say you always wanted a hamster, maybe one that's unique, like a the rare Green Gotham Hamster?" - Garfield with a mischievous grin

"Selina's family friends own a bakery, so no pets allowed. Sorry Rare Green Gotham Hamster, I'm afraid you're staying native to Gotham." - Marinette said patting his shoulder.

"Wait they own a bakery?! As in you can be on a sugar high 24/7?! Take me with you!!" - Garfield

……… ……… ………

Soon it was time for them to go home, when Marinette got home, she continued packing what she would need, making sure that her Siren plushies where safely secure, and then went to eat dinner.

The next day she made sure to get up early, Garfield and Rachel knew where she lived, and wanted to make sure everything was ready for them, setting up the games they would play into the night, and the movies they would watch after that.

She then went to the Gardens to greet her Mom and the plants, doing the usual routine of checking all the plants, complimenting and watering them. During which a sleepy Harley walked over giving Ivy and Marinette a morning kiss before going to make her coffee.

At breakfast she didn't see her Aunt yet, she assumed she was robbing someone rich again.

……… Over to Catwoman ………

"Come ta mama." - Catwoman mumbled as she used her claws to cut the glass surrounding an old elegant purple sapphire that belonged to one of Gotham's founding fathers' wives.

……… Back to Marinette ………

About an hour after breakfast Garfield and Rachel came over, holding Marinettes' rapped presents, they started the day off with trivia games, which they called the MIQ (which can mean either Marinette Isley-Quinzel or in this case Memory Intelligence Quiz) which Marinette and Rachel came to a tie followed by Ivy, then Harley, and Garfield. They then moved on to board games, Marinette decided to play The Game of Life rather than Monopoly (because lets be honest, who has ever finished that game in the time of a signle day? An extreme speedrunner... maybe.) while the adults got the cake ready. Surprisingly Garfield won, he got the acting career, a sports car, a nice old fashioned mid modern house, a wife, and 3 kids... Marinette got the fashion designer career, got a motorcycle, and a small, but nice victorian house, a husband, and one kid... and Rachel got the scientist career (because science is just simplified mortal magic), a delorean car (and even said "Since science is magic I can make it fly, so technically, I don't need roads where I'm going."), a modern cabin in the woods, single (she didn't want a significant other to interrupt her magic science) and got a pet bird.

Once Selina and Ed came over, they began the party, playing games like DDR, Ultimate Mecha Strike 2, and Racing games.

When it came time for Marinette to blow out her candles, she wished that everything would be okay, and that she will be able to come back to Gotham permanently, and blew them out.

She then got to open her presents, she started with Harley's, and got a custom baseball bat that was a dark steel blue, with a light grey handle grip, and it had the words "Quinn For Da Win" on it, putting a smile on her face, when she opened Ivy's gift she got seeds of her favorite flowers to plant over in Paris. She then opened her Uncle Ed's gift, which was a small watch that had special A.I., it had a cover over the inside screen that would flip open to reveal another screen. The cover was silver with a blue question mark, and when it opened, it showed the time, and the location you where in, it could also act as a GPS, and a phone (it could even play music AND had an incredible battery life span). She then moved on to her Aunt Selina's gift, finding a small purple sapphire in the shape of a cat paw, surrounded in silver. She then opened Rachel's gift, it was a travel mug that said "Coffee lives in my veins." (Marinette started drinking coffee recently) which made Marinette laugh, and then she got to Garfield's gift. When she opened it, she found a handmade charm bracelet, it had animals that she really liked around it, and there was one that was a small tiger, with it's eyes and nose having a light green peridot stone, to represent the first day they met. She put the bracelet on her right rist and thanked Garfield for it, and gave everyone a big hug.

She spent the rest of the day playing with her friends, having a wonderful time, and getting a massive sugar rush from all the cake they had. When it came time for dinner they were running low on energy, but were back to normal after Harley snuck some coffee into their food... The only thoughts that went through Garfield and Rachel's minds where "That's why Mari drinks this stuff..."

After dinner they played all kinds of video games, and ended it by watching Back To The Future. They fell asleep some time after 2am.

……… ……… …….

The next morning they all had breakfast and then spent the day playing parkour tag over roofs and playing I spy games. And at the end of the day Marinette gave her friends a big hug, before heading back home. She spent her time with her moms, Uncle, and Frank, playing more boardgames and discussing what she should do to make friends...

"Just be yawhself, we love yuh fawh who yuh are, and I'm sure everyone in Paris will love yuh too... if dey doan, den dey most likely have a massive defective reject of a brain." - Was Harley's opinion

"Riddle the f-ck out of their brain, if they can solve all of them, and like you for you, then they are worthy." - Which was Ed's opinion

"Use a chemical based compound from the magnolia flower, combined with three tulip petals, one rose petal, and pollen from a lilac to create a befriending potion." - Ivy's words made everyone silent before Ed spoke up

"... Harley if you're being mind controlled blink." - Ed deadpaned, which had Marinette cackling

"I'm not bein' mind controlled, also yuh nawhmally say ‘blink once or twice’ not just ‘blink’ I could blink at any random interval and yuh woun't know what tuh tink, and here I thoughtcha were a genius." - Harley with her head on Ivy's lap as Marinette starts wheezing.

"I think y'all broke her." - Frank just pointed to Marinette as she was still cackling and wheezing while in the fetal position.

That's when Selina walked in...

"What the hell did you guys do to Kitten?!" - Selina dropping the bags she got from some high end shop, and after they made sure Marinette was still alive they continued their game... and Marinette may have actually written the list of ingredients for that position, but only as a last resort. When it was time for them to sleep Marinette spent the night with her moms, like she use to when she was 4.

She got up early to make sure everything was ready, she had her sketch book in her backpack, as well as some pencils, ear buds, snacks and a picture of her with her family and friends. She decided to wear her new watch and charm bracelet as she finished checking her bag, she then went into the garden to say goodbye to all the plants, and to give Bud, Lou and Frank one last goodbye. She had about 3 hours before her and her Aunt were to head to the airport, and she spent that time with her moms, almost never leaving their side.

……… ……… …….

As the plane took off she looked out the airplane window, saying goodbye to Gotham, until her next visit home....

•—–·★·–—•

Chapter 3 complete, also just in case I didn't describe her B-day gifts good enough, here's what they look like (꒪꒳꒪)

Hope you're all having an amazing day, staying safe and rockin' all positive vibes,!BUG-OUT! 💮🐞💮

〜(꒪꒳꒪)〜Tag List〜(꒪꒳꒪)〜

1st Place★: @jumpingjoy82

2nd Place★: @myazael

3rd Place★: @solangelo252

@fandom-trapped-03, @zorua-adorable, @blueblossombliss, @thefangirlwholiterallydies, @woe-is-me0, @lady-bee-fechin, @jayjayspixiepop, @kashlyn, @toodaloo-kangaroo, @buginetye, @our-preciousss , @vroomtaka, @alessialeone6997

[happymetalgirl]

Bring Me the Horizon - amo

For better and for worse, this one has been a long time coming. If Sempiternal was the irritated throat fans brushed off as nothing, then That's the Spirit was their first terrifying handful of blood coughed up after ignoring diagnostics, and amo is the progression of the untreated pop infection in Bring Me the Horizon's lungs that has progressed beyond treatment. For fans uneasy about the band's trajectory in 2015, this album is no easy pill to swallow.

I've been rather critical of a lot of bands aping Bring Me the Horizon's more try-hard anthemic metalcore style since the success of 2013's Sempiternal, but for Bring Me the Horizon themselves, I've actually had at least a little bit of appreciation for the boldness and ambition with which they have seemed to try to push their brand of metalcore since their 2010 album There Is a Hell, Believe Me I've Seen It. There Is a Heaven, Let's Keep It a Secret. But with that appreciation of what they are trying to do to bolster their sound has also come with a lot of frustration when it comes to the execution, whether it be the repetitive formula on Sempiternal yielding some seriously irritating tunes whose energy only magnified their obnoxiousness, or the horrendous watering down that neutered any idea of ambition on That's the Spirit.

It has been about four years since the band's aggravating previous album, and for myself, the metal community outside the band's fanbase, and even within, those four years have been spent nervously gritting teeth in anticipation of what the band would progress toward next. And now it's here. Given the sour turn the band took with That's the Spirit, my hopes for amo were not high at all. In fact after a series of lackluster maimstream-ish releases so far this year, I was ready for the cherry to top the shit sundae with this album. That being said, amo is definitely bolder and a much more thoughtful continuation of Bring Me the Horizon's quest for pop glory, and one that is at least more determined and more comprehensive than That's the Spirit. The band finally commit to the sound they clearly wanted to make their way to, and in some ways it's good that they're not trying to cover their bases as thinly as possible like they were with their previous album. Indeed, there are a few tracks on here I enjoy quite a lot.

The band fully commit to the sounds and writing styles of Top 40 pop these days, and this album would definitely blend right in with the likes of Ed Sheeran and Shawn Mendes. I feel like I have to address my distaste for Top 40 music in general and clarify that it's not based in a simplistic, tribalistic feud I see lots of metalheads take part in, where it's the principle of pop vs. rock or mainstream music vs. outsider music that's being fought over. No, I definitely enjoy me some thoughtfully done pop music and even some indulgently tasty pop as well. What I don't like is the sterility of the music from the likes of Halsey, Macklemore, Camila Cabello, or whoever made that shit song "The Middle" selected to be the goal for pop artists to strive for to reach radio/playlist success. And then there's the despised Imagine Dragons, the only pop rock band in existence apparently, based on how much time they suck up on the radio. I know this is a sidetrack and I know that radio is not the prime outlet it used to be, but it still represents a lot of what pop trends towards these days, and it continues to set a precedent for vapid, lazy songwriting, and corporately calculated pandering. That being said, there's the occasional song I'm surprised, not so much by my enjoyment of, but of the presence of something enjoyable coming from a mainstream pop outlet, and that's what amo seems to be going for.

I gave this album quite a few listens, both to really get to know it as per usual, and because this kind of pop isn't my usual forte, and it was interesting to see how the album transformed in my eyes with each successive listen. My first time hearing it, I knew I was going into a straight-up pop album, and with the ilk of Top 40 stations as my barometer, I was actually pretty relieved and pleasantly surprised to not be slamming my head against the nearest wall for the 51 minutes it lasts. But then I remembered, "wait a minute, this is a pop album, it loves to ride a good first impression, see how it is after 4, 5, 6 listens." And sure enough, it waned on me the more I listened.

The parts that I really enjoy did rise to the top as the rest sank, but with a better understanding of this album's content and what it's trying to achieve, I end up with a lot of the same frustrations I had with the band on Sempiternal and its predecessor, just in a less heavy format/context this time. Like the band's first metalcore-departing albums, amo has some good stylistic ideas and it works well with them, but the band's inconsistent results with the repetitive formulas they emply continues to be the limiting factor for them. On the vocal front, Oli Sykes clearly channels Minutes to Midnight-era Chester Bennington all over the project, from the raspy borderline shouted melodies and overwhelmingly polished cleans, while also making a very pop-influenced use of his falsettos as well, and as much as it often teems over with blatant imitation, at least I can't complain about his execution; he's on point pretty much the entire time, which could be thanks to some production crutches, but Sykes' performances sound watertight nonetheless. The rest of the band are much more present than I thought they would be, not as drowned out in gaudy pop production (which does still become a bit too much at some points, but for the most part it's pretty tasteful and balanced throughout the album).

Songs like "nihilist blues" do well to set futuristically melancholic moods through modern electro pop instrumentals, while on songs like "MANTRA" and "sugar honey ice & tea" (a cheesy roundabout way to title the song "shit"), the band try to keep the guitar-driven energy high while blending more pop-oriented elements and performance/production techniques, and the blend is at least a refreshingly alive spin on the egg-shell-treading stlyes of this era of pop music. But the band still don't really manage to make what sounds good on paper actually sound as good as it should through speakers, churning out some annoying melodies through the overly repetitive structures that take bad pop songs from displeasing to disgusting. And these songs have some potential and some parts of them that I wish weren't wrecked by overproduction or cheesy choruses, "sugar honey ice & tea" especially has some invigorating building rock instrumentation in its verses, but the band don't really follow through on the hollow, high-pitched electro vocal-laden chorus. But then there are the songs that (I think) don't really have any redeeming qualities.

The songs where Bring Me the Horizon really just lean all the way into this new role as a prospective pop act are the ones where they of course fall into the styles' predictable pitfalls. Straightforward pop numbers like "mother tongue" and "medicine" channel kiddish lyrics about love and embodying vindictiveness respectively through bland, unimaginative instrumentation. Another track, "in the dark", runs in kind of the same vein of unadultered pop with Oli Sykes doing his best Shawn Mendes impersonation, but is at least a little bit more soulful and less robotic.

Back in the gray area is the song "heavy metal", which takes aim at the attitudes of discontented fans being mad at the band for continuing to shift styles. I understand that there are definitely a lot of stubborn people willing to let that be sufficient justification for their reasons for lampooning the band's change in style, but there are plenty of reasons to be apprehensive about this new direction that lots of other people are articulating that the band could have addressed instead of minimizing the criticism surrounding them to the reductive basement-dweller strawman. Instrumentally though, it is one of the heavier songs on the album, ending with the album's only screamed breakdown, as short as it is.

As far as highlights go, the song "why you gotta kick me when i'm down?" is a convincing electronic banger that finds low-register synths mimicking the crunch of the guitar the band usually uses, and doing so well. Lyrically it oozes of the same kind of inability to accept criticism as "heavy metal", but at least this song's fierce potency makes a good case for the band's being above the type of simplistic criticism they lament. The song "wonderful life" is by far the best song on the album with its gritty electro-nu metal guitar groove and its anthemic vocal melody in the chorus raising a defeatist toast to growing old and burning out. The pop influences are still easily palpable, but taking a support role rather than the lead, with the band driving the song with the down-tuned metal riffage they do well that made Suicide Season and the best parts of Sempiternal.

For what could have been the definitive nail in the coffin for a lot of people like me who hated That's the Spirit, amo is definitely a mixed bag in classic Bring Me the Horizon fashion, but that sure is a lot better than the torturous train wreck I was expecting (especially after hearing "mother tongue" and "medicine" as preliminary singles), and it at least shows that this band does indeed have the potential to do well in this metal-flavored pop niche they're trying to carve out, and by all means I would love for them to do well with it. I think it is important for metal to continue to make good entry-level material for the new generations, and entry-level material that immersed fans can bond with new fans over as well and for younger generations to be able to look back at fondly after diving deep into the wonderful world of metal music. I definitely don't think amo is quite that album, but it is a gateway, and it does suggest that somewhere in Bring Me the Horizon's collective creative potential exists that album, which only tenacity and further perfection of this style they've arrived at can uncover.

better than Halsey/10

[cmst138]

Face ID has upsides and downsides on both security and usability and isn't less secure than a PIN or Touch ID in practice (Troy Hunt)

I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is subsequently set. I went out looking for figures and found the following on Dropbox:

"less than 1% of the Dropbox user base is taking advantage of the company’s two-factor authentication feature": https://t.co/AdbYwWGb7t

— Troy Hunt (@troyhunt) June 3, 2016

Less than 1%. That's alarming. It's alarming not just because the number is so low, but because Dropbox holds such valuable information for so many people. Not only that, but their multi-step implementation is very low-friction - you generally only ever see it when setting up a new machine for the first time.

But here's the problem with multi-step verification: it's a perfect example of where security is friction. No matter how easy you make it, it's something you have to do in addition to the thing you normally do, namely entering a username and password. That's precisely the same problem with getting people to put PINs on their phone and as a result, there's a huge number of devices out there left wide open. How many? It's hard to tell because there's no easy way of collecting those stats. I found one survey from 2014 which said 52% of people have absolutely nothing protecting their phone. Another in 2016 said the number is more like 34%. Keep searching and you'll find more stats of wildly varying values but the simple fact remains that there are a huge number of people out there with no protection on the device at all.

And this brings us to Face ID. I'm writing this the day after the iPhone X launch and obviously this pattern of biometric login is now going to be a major part of the Apple security strategy:

Of course, this now brings with it the whole biometrics discussion and to some extent, it's similar to the one we had when Touch ID launched in 2013 with the iPhone 5S. Obviously there are differences, but many of the issues are also the same. Either way, in my mind both pose fantastic upsides for 99.x% of people and I shared that thought accordingly:

Face ID: for 99.x% of people, their "threat actors" are people who steal their phone at a bar. For everyone else, don't use biometrics.

— Troy Hunt (@troyhunt) September 12, 2017

Not everyone agreed though and there were some responses I honestly didn't see coming. I want to outline some of the issues with each and why per the title of this post, "pragmatic security" is really important here.

No ID

Let's start here because it's the obvious one. Missing PINs on phones provides zero protection from any adversary that gets their hands on it; the kids, a pickpocket or law enforcement - it's free rein for all. Free reign over photos and videos, free reign over messages and email and free reign to communicate with anyone else under the identity of the device owner. I'm stating things here that may seem obvious to you, but clearly the risks haven't yet hit home for many people.

A lack of PIN has also proved very useful for remote attackers. Back in 2014 I wrote about the "Oleg Pliss" situation where unprotected devices were being remotely locked and ransomed. This was only possible when the device didn't have a PIN, a fact the attacker abused by then placing their own on it after gaining access to the victim's online Apple account.

But we can't talk about devices not having any authentication without talking about why and that almost always comes down to friction. The Dropbox multi-step verification situation described above where an additional security control is imposed. So let's move on and start talking about that friction, let's talk about PINs.

PIN

The first point I'll make here as I begin talking about the 3 main security constructs available is that they're all differently secure. This is not a case of one is "secure" and another is "insecure" in any sort of absolute way and anyone referring to them in this fashion is missing a very important part of the narrative. With that said, let's look at the pros and cons involved here.

Obviously, the big pro of a PIN is familiarity (that and not having the problems mentioned above, of course). If you can remember a number, you can set a PIN and hey, we're all good at remembering numbers, right? Like that same one that people use everywhere... which is obviously a con. And this is a perfect example of the human element we so frequently neglect when having this discussion: people take shortcuts with PINs. They reuse them. They follow basic patterns. They disclose them to other people - how many people's kids know the PIN that unlocks their phone? And before you answer "not mine", you're (probably) not normal people by virtue of being interested enough in your security to be here reading this post in the first place!

But PINs are enormously popular and even when you do use the biometric options we're about to get into, you're still going to need one on your phone anyway. For example, every time you hard-reboot an iPhone with Touch ID you need to enter the PIN. When you do, depending on the environment you're in you may be a bit inclined to do so like this:

This is Edward Snowden typing his password in whilst under a blanket in the Citizenfour documentary. He's doing everything he can to ensure there's no way his password can be observed by others because this is precisely the problem with passwords - anyone who has yours can use it (again, this is why multi-step verification is so important). Now you may argue that Snowden's threat profile is such that he needs to take such measures and you're right - I can see exactly why he'd do this. But this also means recognising that different people have different threat profiles and whilst Ed was worried about the likes of the NSA specifically targeting him as a high-value individual, you are (almost certainly) not.

We've all been warned about the risk of shoulder surfing at one time or another and it's pretty common to find it represented in corporate training programs in a similar fashion to this:

Except as it relates to PINs on phones, the problem is much worse. Firstly, it's worse because it's a PIN that's a mere 4 or 6 digits (you could always go alphanumeric on an iPhone but that'll be a near-zero percentage of people) and there's only 10 characters to choose from so observing and remembering them isn't hard. Secondly, mobile devices are obviously used in, well, mobile locations so you're unlocking them on the train, in the shops and in a whole raft of locations where people can directly observe you. When using Apple Pay is a perfect example: you're standing in a queue with people in front of you and people behind you waiting for you to pay for your shopping and that's not a great environment to be entering a secret by pressing a small number of big buttons on a publicly observable screen.

And then there's all the really niche attacks against PINS, for example using thermal imaging to detect the locations the screen was tapped. Now that's by no means trivial, but some of criticisms being levelled at biometrics are also by no means trivial so let's keep it an even playing field. Even entering your PIN in an open space away from people presents a risk in the presence of the burgeoning number of surveillance cameras that are present.

But there's one thing in particular PINs are resilient to which biometrics are not: the police in the US can force you to unlock your phone using your fingerprint. I'm not sure how this differs in the rest of the world, but it was regularly highlighted to me during yesterday's discussions. Now there are obvious privacy issues with this - big ones - but getting back to the personal threat actors issue, this is something the individual needs to think about and consider whether it's a significant enough risk to them to rule out biometrics. If you're an activist or political dissident or indeed an outright criminal, this may pose a problem. For everyone else, you're starting to approach infinitely small likelihoods. I heard an argument yesterday that, for example, a lady who was filming a bloke being shot by the police could have then been forced to unlock her phone by fingerprint so the cops can erase the evidence. But think this through for a moment...

So the risk here is being shot while recording it to local storage then cops unlocking phone with biometrics and illegally erasing evidence?

— Troy Hunt (@troyhunt) September 12, 2017

There will always be attack vectors like this. Always. The question someone has to ask when choosing between biometrics or PIN is how threatened they personally feel by these situations. And then they make their own security decision of their own free volition.

Let's move onto the biometric alternatives.

Touch ID

Given we've now had 4 years of Touch ID (and of course many more years of fingerprint auth in general), we've got a pretty good sense the threat landscape. Even 15 years ago, researchers were circumventing biometric logins. In that particular case, the guy simply lifted a fingerprint from a glass then enhanced it with a cyanoacrylate adhesive, photographed it, took it into Photoshop and cleaned up the picture, printed it onto a transparency sheet, grabbed a photo-sensitive printed circuit board then etched the printed fingerprint from the transparency sheet into the copper on the board before moulding a gelatine finger onto it hence inheriting the fingerprint. Easy!

There have many other examples of auth bypass since that time, including against Apple's Touch ID and indeed some of them have been simpler too. Like PINs, it's not foolproof and what people are doing is trading various security and usability attributes between the PIN and biometric options. A PIN has to be known to unlock the device whilst a fingerprint could be forged, but then a PIN may have been observed or readily guessed (and certainly there are brute force protections to limit this) whilst biometric login can be used in plain sight. They're differently secure and they protect from different threat actors. It's extremely unlikely that the guy who steals your phone off a bar is going to be able to do this, much more likely that a nation state actor that sees a high value in a target's phone will.

One of the arguments I heard against Touch ID yesterday is that an "attacker" could cause a sleeping or unconscious person to unlock their device by placing the owner's finger on the home button. I've quoted the word "attacker" because one such situation occurred last year when a six year old used her sleeping mother's fingerprint to buy $250 worth of Pokemon. Now I've got a 5-year-old and a 7-year-old so I reckon I'm qualified enough to make a few comments on the matter (plus the whole thing about me thinking a lot about security!)

Firstly, whilst the hacker inside of me is thinking "that kid is pretty smart", the parent inside of me is thinking "that kids needs a proverbial kick up the arse". There's nothing unusual about kids using parent's phones for all manner of things and we've probably all given an unlocked phone to one of our own children for them to play a game, watch a video or even just talk on the phone. Touch ID, PIN or nothing at all, if a kid abuses their parent's trust in this way then there's a very different discussion to be had than the one about how sophisticated a threat actor needs to be in order to circumvent it.

Be that as it may, there are certainly circumstances where biometric login poses a risk that PINs don't and the unconscious one is a perfect example. Now in my own personal threat model, being unconscious whilst someone steals my phone and forces me to unlock it is not exactly high up on the list of things that keep me awake at night. But if I was a binge drinker and prone to the odd bender, Touch ID may simply not be a good model for me. Then again, if the victim is getting paralytic drunk and the attacker wants access to an unlocked phone then there are many other simple social engineering tricks to make that happen. In fact, in the attacker's world, the victim having a PIN may well be preferable because it could be observed on unlock and then used to modify security settings that are otherwise unavailable with mere access to fingerprints.

One of the neat features coming in iOS 11 when it hits next week is the ability to rapidly disable Touch ID:

Tap the phone's home button five times, and it will launch a new lockscreen with options to make an emergency call or offer up the owner's emergency medical information. But that S.O.S. mode also silently disables TouchID, requiring a passcode to unlock the phone. That feature could be used to prevent someone from using the owner's finger to unlock their phone while they're sleeping or otherwise incapacitated, for instance.

What this means is that were you find yourself in a higher risk situation with only Touch ID enabled (i.e. you've been pulled over by the police and are concerned about them compelling you to biometrically unlock your phone), there's a speedy option to disable it. But that's obviously no good if you don't have time to enable it so if you're going to hold up a liquor store and it's possible the cops may come bursting in at any time, it could be tough luck (also, don't hold up liquor stores!)

Another new feature helps further strengthen the security model:

in iOS 11, iPhones will not only require a tap to trust a new computer, but the phone's passcode, too. That means even if forensic analysts do seize a phone while it's unlocked or use its owner's finger to unlock it, they still need a passcode to offload its data to a program where it can be analyzed wholesale.

I particularly like this because it adds protection to all unlocked devices where the PIN is not known. If you're compelled to biometrically unlock the device, that won't allow the data to be siphoned off via tethering it. Yes, it could still be accessed directly on the device, but that's a damn sight better then unfettered direct access to storage.

So pros and cons and indeed that's the whole theme of this post. Let's move onto the new thing.

Face ID

I watched the keynote today and was obviously particularly interested in how Face ID was positioned so let me share the key bits here. Keep in mind that I obviously haven't played with this and will purely be going by Apple's own info here.

Firstly, this is not a case of "if the camera sees something that looks like the owner's face the device unlocks". Here's why:

Infrared camera + flood illuminator + proximity sensor + ambient light sensor + camera + dot projector = Face ID. Each of these plays a different role and you can see how, for example, something like infrared could be used to discern the difference between a human head and a photo.

In Apple's demo, they talk about the flood illuminator being used to detect the face (including in the dark):

This is followed up by the infrared camera taking an image:

The dot projector then pumps out 30k invisible dots:

The IR image and the dot pattern then get "pushed though neural networks to create a mathematical model of your face" which is then compared to the stored one created at setup. Now of course we don't know how much of this is fancy Apple speak versus reality and I'm very keen to see the phone get into the hands of creative security people, but you can't help but think that the breadth of sensors available for visual verification trumps those required for touch alone.

Apple is obviously conscious of comparisons between the two biometric implementations and they shared some stats on the likelihood of each returning a false positive. Firstly, Touch ID:

So what they're saying here is that you've got a 1 in 50k chance of someone else's print unlocking your phone. From a pure chance perspective, those are pretty good odds but I'm not sure that's the best metric to use (more on that in a moment).

Here's how Face ID compares:

One in a million. There's literally a saying that's "one in a million" which symbolises the extremely remote likelihood of something happening! The 20x figure over Touch ID is significant but it doesn't seem like the right number to be focusing on. The right number would be the one that illustrates not the likelihood of random people gaining access, but rather the likelihood of an adversary tricking the biometrics via artificial means such as the gummi bears and PCBs. But that's not the sort of thing we're going to know until people start attempting just that.

Be that as it may, Apple claim that Face ID is resilient to both photos and masks:

And with all those sensors, it's certainly believable that there's enough inputs to discern with a high degree of confidence what is a legitimate face versus a fake one. Having said that, even Apple themselves acknowledged that certain threats remain:

Laughs were had, jokes were made but the underlying message was that Face ID isn't foolproof. Just like Touch ID. And PINs.

Thinking back to Touch ID for a moment, one of the risk flagged there was a kid holding a sleeping adult's finger on the sensor or indeed someone doing the same with an unconscious iPhone owner. Face ID seems to solve this problem:

If your eyes are closed or you're looking away, it's not going to unlock

Which makes a lot of sense - given the processing power to actually observe and interpret eye movements in the split second within which you expect this to work, this would be a really neat failsafe. Apple highlights this as "attention awareness" when they wrap up the Face ID portion of the presentation:

Moving on to something different, when I shared 99.x% tweet earlier on, a thread emerged about abusive spouses. Now if I'm honest, I didn't see that angle coming and it made me curious - what is the angle? I mean how does Face ID pose a greater threat to victims of domestic violence than the previous auth models? There's the risk of being physically compelled to unlock the phone, but of course Touch ID poses the same risk. One would also imagine that in such a situation, an abusive husband may demand a PIN in the same intimidating fashion in which they demand a finger is placed on the sensor or the front facing camera is pointed at the face (and appropriate eye movement is made). It's hard to imagine there are many legitimate scenarios where an iPhone X is present, is only using Face ID, the owner is an abused woman and the man is able to compel her to unlock the device in a way that wasn't previously possible. The only tangible thing I could take away from that conversation is that many people won't understand the respective strengths and weaknesses of each authentication method which, of course, is true for anyone regardless of their relationship status. (Folks who understand both domestic violence and the role of technology in that environment, do please comment if I'm missing something.)

The broader issue here is trusting those you surround yourself with in the home. In the same way that I trust my kids and my wife not to hold my finger to my phone while I'm sleeping, I trust them not to abuse my PC if I walk away from it whilst unlocked and yes, one would reasonably expect to be able to do that in their own home. The PC sits there next to my wallet with cash in it and the keys to the cars parked out the front. When you can no longer trust those in your immediate vicinity within the sanctity of your own home, you have a much bigger set of problems:

My ex broke into my phone by holding it against me while asleep She also broke a table over my head so I'm not sure I'm disproving Troy https://t.co/RELrlLozhN

— Alexander Payne (@myrrlyn) September 12, 2017

Having absorbed all the info and given Face ID some deeper thought, I stand by that 99.x% tweet until proven wrong. I just can't make good, rational arguments against it without letting go of the pragmatism which acknowledges all the factors I've mentioned above.

Summary

What we have to keep in mind here is just how low the security bar is still set for so many people. Probably not for you being someone interested in reading this sort of material in the first place, but for the billions of "normals" out there now using mobile devices. Touch ID and Face ID as so frictionless that they remove the usability barrier PINs post. There's a good reason Apple consistently shows biometric authentication in all their demos - because it's just such a slick experience.

The majority of negative commentary I'm seeing about Face ID in particular amounts to "facial recognition is bad" and that's it. Some of those responses seem to be based on the assumption that it introduces a privacy risk in the same way as facial tracking in, say, the local supermarket would. But that's not the case here; the data is stored in the iPhone's secure enclave and never leaves the device:

More than anything though, we need to remember that Face ID introduces another security model with its own upsides and downsides on both security and usability. It's not "less secure than a PIN", it's differently secure and the trick now is in individuals choosing the auth model that's right for them.

I'll order an iPhone X when they hit the store next month and I'll be giving Face ID a red hot go. I'll also be watching closely as smart security folks around the world try to break it :)

Edit: TechCrunch has published a great interview with Craig Federighi that answers many of the questions that have been raised in this blog post and in the subsequent comments. Highly recommended reading!

from Techmeme http://ift.tt/2wlv0DJ