A group of researchers in France and Japan say RequestPolicyContinued and NoScript have the toughest policies, while Ghostery and uBlock Origin offer good blocking performance and a better user experience.

The study also gave a nod to the EFF’s Privacy Badger, which uses heuristics rather than block lists, but once trained is nearly as good as Ghostery or uBlock, demonstrating that its heuristics are reliable.

Source: Ghostery, uBlock lead the anti-track pack

Using only data that can be legally collected by an app developer without the consent of a cellphone’s owner, researchers have been able to produce a privacy attack that can accurately pinpoint a user’s location and trajectory without accessing the device’s Global Position System—GPS. And while the ramifications of this ability falling into the wrong hands are distressing, the way in which they pulled it off is nothing short of genius.
[…]
In fact, all you really need is your phone’s internal compass, an air pressure reading, a few free-to-download maps, and a weather report.

Your cellphone comes equipped with an amazing array of compact sensors that are more or less collecting information about your environment at all time. An accelerometer can tell how fast you’re moving; a magnetometer can detect your orientation in relation to true north; and a barometer can measure the air pressure in your surrounding environment. You phone also freely offers up a slew of non-sensory data such as your device’s IP address, timezone, and network status (whether you’re connected to Wi-Fi or a cellular network.)

All of this data can be accessed by any app you download without the type of permissions required to access your contact lists, photos, or GPS. Combined with publicly available information, such as weather reports, airport specification databases, and transport timetables, this data is enough to accurately pinpoint your location—regardless of whether you’re walking, traveling by plane, train, or automobile.
[…]
To track a user, you first need to determine what kind of activity they’re performing. It’s easy enough to tell if a person is walking versus riding in a car, speed being the discriminant factor; but also, when you’re walking you tend to move in one direction, while your phone is held in a variety of different positions. In a car, you make sudden stops (when you brake) and specific types of turns—around 90 degrees—that can be detected using your phone’s magnetometer. People who travel by plane will rapidly change time zones; the air pressure on a plane also changes erratically, which can be detected by a cellphone’s barometer. When you ride a train, you tend to accelerate in a direction that doesn’t significantly change. In other words, determining your mode of travel is relatively simple.

The fact that your cellphone offers up your time zone as well as the last IP address you were connected to really narrows things down—geolocating IP addresses is very easy to do and can at least reveal the last city you were in—but to determine your exact location, with GPS-like precision, a wealth of publicly-available data is needed. To estimate your elevation—i.e., how far you are above sea level—PinMe gathers air pressure data provided freely by the Weather Channel and compares it to the reading on your cellphone’s barometer. Google Maps and open-source data offered by US Geological Survey Maps also provide comprehensive data regarding changes in elevation across the Earth’s surface. And we’re talking about minor differences in elevation from one street corner to the next.

Upon detecting a user’s activity (flying, walking, etc.) the PinMe app uses one of four algorithms to begin estimating a user’s location, narrowing down the possibilities until its error rate drops to zero, according to the peer-reviewed research. Let’s say, the app decides you’re traveling by car. It knows your elevation, it knows your timezone, and if you haven’t left the city you’re in since you last connected to Wi-Fi, you’re pretty much borked.

With access to publicly available maps and weather reports, and a phone’s barometer and magnetometer (which provides a heading), it’s only a matter of turns. When PinMe detected one of the researchers driving in Philadelphia during a test-run, for example, the researcher only had to make 12 turns before the app knew exactly where they were in the city. With each turn, the number of possible locations of the vehicles dwindles. “[A]s the number of turns increases, PinMe collects more information about the user’s environment, and as a result it is more likely to find a unique driving path on the map,” the researchers wrote.

Source: How to Track a Cellphone Without GPS—or Consent

According to OMC’s data, a full 19 percent of all “conversational” email is now tracked. That’s one in five of the emails you get from your friends. And you probably never noticed.“Surprisingly, while there is a vast literature on web tracking, email tracking has seen little research,” noted an October 2017 paper published by three Princeton computer scientists. All of this means that billions of emails are sent every day to millions of people who have never consented in any way to be tracked, but are being tracked nonetheless. And Seroussi believes that some, at least, are in serious danger as a result.

Source: You Give Up a Lot of Privacy Just Opening Emails. Here’s How to Stop It | WIRED

The Google Home Mini is a super-affordable way to get Google Assistant in your life, but Google was forced to hobble the device shortly after launch because a sticky touch sensor caused Artem’s Mini to record everything he said. Part of that functionality is now coming back with a small tweak. Instead of tapping the top of the device, you’ll be able to long-press the side.

Source: New Google Home Mini update 1.29 restores top tap functionality with long-press on the side

Let me make this point dreadfully clear, though: Your family members do not need an Amazon Echo or a Google Home or an Apple HomePod or whatever that one smart speaker that uses Cortana is called. And you don’t either. You only want one because every single gadget-slinger on the planet is marketing them to you as an all-new, life-changing device that could turn your kitchen into a futuristic voice-controlled paradise. You probably think that having an always-on microphone in your home is fine, and furthermore, tech companies only record and store snippets of your most intimate conversations. No big deal, you tell yourself.

Actually, it is a big deal. The newfound privacy conundrum presented by installing a device that can literally listen to everything you’re saying represents a chilling new development in the age of internet-connected things. By buying a smart speaker, you’re effectively paying money to let a huge tech company surveil you. And I don’t mean to sound overly cynical about this, either. Amazon, Google, Apple, and others say that their devices aren’t spying on unsuspecting families. The only problem is that these gadgets are both hackable and prone to bugs.

Before getting into the truly scary stuff, though, let’s talk a little bit about utility. Any internet-connected thing that you bring into your home should make your life easier. Philips Hue bulbs, for instance, let you dim the lights in an app. Easy! A Nest thermostat learns your habits so you don’t have to turn up the heat as often. Cool! An Amazon Echo or a Google Home, well, they talk to you, and if you’re lucky, you might be able to figure out how to talk back in the right way and do random things around the house. Huh?

Source: Don’t Buy Anyone an Echo

A good and concise explanation of why these useless devices are something to be very afraid of.

For the past few years, Gingerich has been laying the groundwork for Sopranica, an open source, DIY cell network that allows smartphone owners to make calls, send texts and eventually browse the internet with total anonymity.In January, Gingerich published the code for the first part of Sopranica called JMP. This is essentially a way of using a secure instant messaging protocol called XMPP, better known as Jabber, to communicate over voice and text from an anonymous phone number. JMP is the first phase of the Sopranica network.The next phase—called WOM—will create the physical infrastructure for the cell network with a community radio network. This will essentially involve people hosting small, inexpensive radio devices in their home that plug into their routers to provide internet access points to Sopranica users in the area.
[…]
Getting set up with JMP is easy. First, you need to create a free and anonymous Jabber ID, which is like an email address. I had already created a Jabber ID with the Chaos Computer Club (a German hacking group), but there are a lot of other servers you can register with as well. The only difference will be the web address in your Jabber ID will be different—for example, motherboard@jabber.ccc.de or motherboard@xmpp.jp.

Next, you need to install a Jabber app on your phone. I use Android and opted for Xabber, but again, there are plenty of options to choose from (Conversations is a good choice if you want to use Sopranica for picture messaging, for instance). You’ll also need to install a Session Initiation Protocol (SIP) app, which allows your phone to make calls and send texts over the internet instead of the regular cellular network. For Android users, the best choice is probably CSipSimple and for iPhones your best bet is Linphone.

Finally, it’s time to get your phone number. If you navigate to Sopranica’s JMP website, there is a list of numbers at the bottom. These phone numbers are generated by Sopranica’s Voice Over IP (VOIP) provider which provides talk and text services over the internet. Click whichever number you want to be your new number on the Sopranica network and enter your Jabber ID. A confirmation code should be sent to your phone and will appear in your Jabber app.

Once you’ve entered this code, you’re ready to use your new, anonymous number. To do this, use your SIP app and send a text or dial a number just like you would otherwise. This communication will be made through your new Sopranica number, rather than whichever cell carrier you normally use.

In many ways, JMP is kind of like getting a free VOIP number with Google Voice and then using that number to register for an account on the encrypted messaging platform Signal.
The downside of this, of course, is that the VOIP number you get from Google is registered under your name with Google, so even if the people who you communicate with using that number can’t trace it to you, Google can. On the other hand, all aspects of JMP are anonymous—neither the Jabber ID nor the JMP phone number require identifying information to register.

Source: This Interview Was Conducted on an Anonymous, DIY Cell Phone Network – Motherboard

A California federal court has ordered Coinbase to turn over identifying records for all users who have bought, sold, sent, or received more than $20,000 through their accounts in a single year between 2013 and 2015. Coinbase estimates that 14,355 users meet the government’s requirements. The full order is embedded below.

For each account, the company has been asked to provide the IRS with the user’s name, birth date, address, and taxpayer ID, along with records of all account activity and any associated account statements. The result is both a definitive link to the user’s identity and a comprehensive record of everything they’ve done with their Coinbase account, including other accounts to which they’ve sent money.

Source: Coinbase ordered to report 14,355 users to the IRS – The Verge

Last month, the European Consumer Organization (BEUC) warned that smartwatches marketed to kids were a serious threat to children’s privacy. A report published by the Norwegian Consumer Council in mid-October revealed serious flaws in several of the devices that could easily allow hackers to seize control.

Doing so could grant attackers access to both real-time and historical locational data, as well as a wealth of personal information.

You have to wonder who thought attaching a low-cost, internet-enabled microphone and a GPS tracker to a kid would be a good idea in the first place. Almost none of the companies offering these “toys” implement reasonable security standards, nor do they typically promise that the data they collect—from your children—won’t be used be used for marketing purposes.

Gizmodo

The companies asked by the consumer protection authority are

de ANWB, Nuon en Oxfam Novib. De Bijenkorf stopte hier al eerder mee. Essent heeft toegezegd binnenkort te stoppen en KLM en Transavia heroverwegen hun aanpak. De Bankgiroloterij, FBTO, KPN/Telfort, Postcodeloterij, Vakantieveilingen, Vriendenloterij en de Persgroep blijven gewoon doorgaan. Van Heerlijk.nl, HelloFresh en Hotels.nl

To be fair, some were giving the data away encrypted.

Many people worried that Google was scanning users’ documents in real time to determine if they’re being mean or somehow bad. You actually agree to such oversight in Google G Suite’s terms of service.

Those terms include include personal conduct stipulations and copyright protection, as well as adhering to “program policies.” Who knows what made the program that checks for abuse and other violations of the G Suite terms of service to go awry. But something did.

And it’s not just Google that has such terms. Chances are you or your employees have signed similar terms in the many agreements that people accept without reading.

The big concern from enterprises this week was not being locked out of Google Docs for a time but the fact that Google was scanning documents and other files. Even though this is spelled out in the terms of service, it’s uncomfortably Big Brother-ish, and raises anew questions about how confidential and secure corporate information really is in the cloud.  

This is part of a workshop I have given several times: many companies do this happily. Oddly enough you won’t find their invasions in the privacy policy, but in their terms of service is where you find the interesting maneuvering. It’s actually worse than above: you generally give away copyright to all your documents as well 🙂

An investigation by 24 data protection regulators from around the world – led by the UK’s Information Commissioner’s Office – concluded that ‘there is significant room for improvement in terms of specific details contained in privacy communications’.The privacy notices, communications and practices of 455 websites and apps in sectors including retail, finance and banking, travel, social media, gaming/gambling, education and health were assessed to consider whether it was clear from a user’s perspective exactly what information was collected, for what purpose, and how it would be processed, used and shared.Overall, the Global Privacy Enforcement Network (GPEN) came to the following conclusions: Privacy communications across the various sectors tended to be vague, lacked specific detail and often contained generic clauses. The majority of organisations failed to inform the user what would happen to their information once it had been provided. Organisations were generally quite clear on what information they would collect from the user. Organisations generally failed to specify with whom data would be shared. Many organisations failed to refer to the security of the data collected and held – it was often unclear in which country data was stored or whether any safeguards were in place. Just over half the organisations examined made reference to how users could access the personal data held about them.

Source: GPEN Sweep 2017 – International enforcement operation finds website privacy notices are too vague and generally inadequate | Global Privacy Enforcement Network

Google snuck a questionable feature into the operating system with a recent update. A new permission called “activity recognition” may be tracking your physical activity and sharing it with third-party apps, and there’s no easy way to stop it.
What Is Activity Recognition?

The “activity recognition” permission was shared on Reddit earlier this week. Basically, it allows Google to track your physical activity (biking, running, standing still) using your phone’s built-in sensors and then share that information with third-party apps.
Imgur

SoundHound and Shazam both appear to be using the permission, though it’s unclear why. Activity recognition is also categorized in the list of “other” permissions, so it won’t show up when an app updates on your phone. The only way to check is to go into each app on your device and look at all of its permissions.
How to Deal With It

There’s also no way to revoke this specific permission either across the board or on an app-by-app basis. If it’s an app you don’t use that often you could always delete it off your phone to avoid sharing your personal information. One Reddit user also suggested preventing those apps from running in the background.

Unfortunately, there’s no easy way to deal with activity recognition for now. Hopefully Google will offer a fix eventually, but until then you may just have to accept that owning a smartphone means giving up a bit of your privacy.

Source: Android Is Quietly Sharing Your Physical Activity with Other Apps

Google is getting more and more invasive, with Google Maps tracking your location all the time and the Google play store, Inbox and Google Play services (among others) requiring microphone and body sensors permissions for proper operations. Why? Because privacy is dead to Google as well.

When you spit in a test tube in in hopes of finding out about your ancestry or health or that perfect, genetically optimized bottle of wine, you’re giving companies access to some very intimate details about what makes you, you. Your genes don’t determine everything about who you are, but they do contain revealing information about your health, relationships, personality, and family history that, like a social security number, could be easily abused. Not only that—your genes reveal all of that information about other people you’re related to, too.
[…]
Gizmodo slogged though every line of Ancestry.com, 23andMe, and Helix’s privacy, terms of service, and research policies with the help of experts in privacy, law and consumer protection. It wasn’t fun. We fell asleep at least once. And what we found wasn’t pretty.

“It’s basically like you have no privacy, they’re taking it all,” said Joel Winston, a consumer protection lawyer. “When it comes to DNA tests, don’t assume you have any rights.”
[…]
here’s what you need to know before giving away your genetic information.

Testing companies can claim ownership of your DNA

It’s unclear who has access to your DNA, or for what

Your anonymous genetic information could get leaked

If you sue and lose, you’re screwed

If companies get rich off your DNA, you get nothing

Source: What DNA Testing Companies’ Terrifying Privacy Policies Actually Mean

A very good article examining the privacy clauses of some genetic testing companies followed up by an analysis of what this means for the consumer. Be scared.

The idea is straightforward: Associate a series of ads with a specific individual as well as predetermined GPS coordinates. When those ads are served to a smartphone app, you know where that individual has been… It’s a surprisingly simple technique, and the researchers say you can pull it off for “$1,000 or less.” The relatively low cost means that digitally tracking a target in this manner isn’t just for corporations, governments, or criminal enterprises. Rather, the stalker next door can have a go at it as well… Refusing to click on the popups isn’t enough, as the person being surveilled doesn’t need to do so for this to work — simply being served the advertisements is all it takes.

Source: For Under $1,000, Mobile Ads Can Track Your Location – Slashdot

Cortana is a decent voice assistant. Hell, “she” is probably better than Apple’s woefully disappointing Siri, but that isn’t saying very much. Still, Microsoft’s assistant very much annoys me on Windows 10. I don’t necessarily want to use my desktop PC like my phone, and sometimes I feel like she is intruding on my computer. While some people like Cortana, I am sure others agree with me.

Depending on how you feel about Cortana, you will either hate or love Microsoft’s latest move to shoehorn the virtual woman into your life. You see, starting today, Cortana is coming to Skype on mobile for both Android and iOS. I don’t think anyone actually wanted her in Skype, but oh well, she is on the way. Unfortunately, there is one huge downside — Microsoft is using her to scan your private messages! Yup, the Windows-maker seems a lot like Google with this move.
[…]
In order for this magical “in-context” technology to work, Cortana is constantly reading your private conversations. If you use Skype on mobile to discuss private matters with your friends or family, Cortana is constantly analyzing what you type. Talking about secret business plans with a colleague? Yup, Microsoft’s assistant is reading those too.

Don’t misunderstand — I am not saying Microsoft has malicious intent by adding Cortana to Skype; the company could have good intentions. Still, there is the potential for abuse. Despite being opt-in, users won’t necessarily understand the privacy risks involved.

Microsoft could use Cortana’s analysis to spy on you for things like advertising or worse, and that stinks. Is it really worth the risk to have smart replies and suggested calendar entries? I don’t know about you, but I’d rather not have my Skype conversations read by Microsoft.

Source: Warning: Microsoft is using Cortana to read your private Skype conversations

Because yeah! why privacy!

Sonos’ policy change, outlined by chief legal officer Craig Shelburne, allows the gizmo manufacturer to slurp personal information about each owner, such as email addresses and locations, and system telemetry – collectively referred to as functional data – in order to implement third-party services, specifically voice control through Amazon’s Alexa software, and for its own internal use.

“If you choose not to provide the functional data, you won’t be able to receive software updates,” a Sonos spokesperson explained at the time. “It’s not like if you don’t accept it, we’d be shutting down your device or intentionally bricking it.”

A handful of customers, however, have managed to brick their Sonos speakers by refusing to accept the data harvesting terms accompanying version 7.4+ of the firmware and then subsequently updating their Sonos mobile app to a version out of sync with their legacy firmware.

In an email to The Register, a reader by the name of Dave wrote: “You should know that in the latest update it is now impossible to use the player without updating, effectively bricking my three devices. Numerous attempts to contact Sonos have met with silence on the issue, and the phone number in the app for support is no longer valid.”

Source: Rejecting Sonos’ private data slurp basically bricks bloke’s boombox

Incredible that a company can change the terms of their product so one-sidedly without you having any recourse. And it’s not like these players are cheap!

The lack of clear information about what Microsoft does with the data that Windows 10 collects prevents consumers from giving their informed consent, says the Dutch Data Protection Authority (DPA). As such, the regulator says that the operating system is breaking the law.

To comply with the law, the DPA says that Microsoft needs to get valid user consent: this means the company must be clearer about what data is collected and how that data is processed. The regulator also complains that the Windows 10 Creators Update doesn’t always respect previously chosen settings about data collection. In the Creators Update, Microsoft introduced new, clearer wording about the data collection—though this language still wasn’t explicit about what was collected and why—and it forced everyone to re-assert their privacy choices through a new settings page. In some situations, though, that page defaulted to the standard Windows options rather than defaulting to the settings previously chosen.

In the Creators Update, Microsoft also explicitly enumerated all the data collected in Windows 10’s “Basic” telemetry setting. However, the company has not done so for the “Full” option, and the Full option remains the default.

The Windows 10 privacy options continue to be a work in progress for Microsoft. The Fall Creators Update, due for release on October 17, makes further changes to the way the operating system and applications collect data and the consent required to do so. Microsoft says that it will work with the DPA to “find appropriate solutions” to ensure that Windows 10 complies with the law. However, in its detailed response to the DPA’s findings, Microsoft disagrees with some of the DPA’s objections. In particular, the company claims that its disclosure surrounding the Full telemetry setting—both in terms of what it collects and why—is sufficient and that users are capable of making informed decisions.

The DPA’s complaint doesn’t call for Microsoft to offer a complete opt out of the telemetry and data collection, instead focusing on ensuring that Windows 10 users know what the operating system and Microsoft are doing with their data. The regulator says that Microsoft wants to “end all violations,” but if the software company fails to do so, it faces sanctions.

Source: Dutch privacy regulator says Windows 10 breaks the law

Note: the DPA is fine with MS collecting your data, as long as you know what data it is you are collecting. For a product you buy, this seems insane to me, which is why I am running Linux Mint on a day to day basis nowadays.

Earlier this month, software engineer Christopher Moore discovered that Shenzen, China-based phone manufacturer OnePlus was secretly collecting a trove of data about users without their consent and communicating it to company servers. Moore had routed his OnePlus 2’s internet traffic through security tool OWASP ZAP for a holiday hack challenge, but noticed his device was regularly transmitting large amounts of data to a server at open.oneplus.net.

According to Moore’s analysis, captured information included his phone’s IMEI and serial number, phone numbers, MAC addresses, mobile network names and IMSI prefixes, and wireless network data. OnePlus was also collecting data on when its users were opening applications and what they were doing in those apps, including Outlook and Slack. With the cat out of the bag, OnePlus admitted to the non-consensual snooping in a post to its customer service forum on Friday, but said the intent of the program was improving user experience on its OxygenOS software.

“The reason we collect some device information is to better provide after-sales support,” OnePlus wrote. “If you opt out of the user experience program, your usage analytics will not be tied to your device information.”

“We’d like to emphasize that at no point have we shared this information with outside parties,” the company added. “The analytics we’re discussing in this post, which we only look at in aggregate, are collected with the intention of improving our product and service offerings.”

According to OnePlus, it will also stop collecting “telephone numbers, MAC Addresses and WiFi information,” and by the end of October, the company will clearly prompt all users on how and why it collects data and provide users with an option to not participate in its “user experience program.”

Multiple users responded by saying their concerns were not resolved, as some of the data collected—like telephone numbers and wireless network information—was of limited use from a support perspective and instead could have been mined for its value to marketers.

As TechCrunch noted, the opt-out provision also does not appear to actually stop the data collection, but simply removes tags linking the data to a specific device. So no matter which way you slice it, this is not a very good situation for OnePlus users to find themselves in. As Moore noted, there are few good options to stop the data collection entirely:

Source: OnePlus Admits It Was Snooping on OxygenOS Users, Says It Will Tweak Data Collection Program

Encrypted messaging app Telegram must pay 800,000 roubles for resisting Russia’s FSB’s demand that it help decrypt user messages.

The fine translates to just under US$14,000, making it less of a serious punishment and more a shot across the bows.
[…]
Telegram founder Pavel Durov has posted to Russian social site VK.com that it’s not possible to comply.

“In addition to the fact that the requirements of the FSB are not technically feasible, they contradict Article 23 of the Constitution of the Russian Federation: ‘Everyone has the right to privacy of correspondence, telephone conversations, postal, telegraphic and other communications,’” he wrote.

He indicated his intention to appeal, and keep doing so “until the claim of the FSB is considered by a judge familiar with the basic law of Russia – its Constitution”

Source: Russia tweaks Telegram with tiny fine for decryption denial

However, does this mean that Telegram is being seen to speak up for privacy whilst in reality it’s not?