Mpeg-2 now patentfree!

This is the list of patents (Attachm​​ent 1) covered by the MPEG-2 Patent Portfolio License as of January 1, 2018. Under the MPEG-2 Patent Portfolio License, royalties are payable for products manufactured or sold in countries with an active MPEG-2 Patent Portfolio Patent at the time of manufacture or sale. Please note that the last US patent expired February 13, 2018, and patents remain active in Philippines and Malaysia after that date. ​

Source: PatentList

Do Not, I Repeat, Do Not Download Onavo, Facebook’s Vampiric VPN Service

There’s a new menu item in the Facebook app, first reported by TechCrunch on Monday, labeled “Protect.” Clicking it will send you to the App Store and prompt you to download a Virtual Private Network (VPN) service called Onavo. (“Protect” shows up in the iOS app. Gizmodo looked for it on an Android device and didn’t see it—though, presumably it is only a matter of time.)
[…]
Facebook, however, purchased Onavo from an Israeli firm in 2013 for an entirely different reason, as described in a Wall Street Journal report last summer. The company is actually collecting and analyzing the data of Onavo users. Doing so allows Facebook to monitor the online habits of people outside their use of the Facebook app itself. For instance, this gave the company insight into Snapchat’s dwindling user base, even before the company announced a period of diminished growth last year.

To put it another way, Onavo is corporate spyware.

If you’re someone who can’t live without Facebook or simply can’t find the courage to delete it, the Onavo appears under the “Explore” list just above the “Settings” menu. I’d recommend you never click it. Facebook is already vacuuming up enough your data without you giving them permission to monitor every website you visit.

Source: Do Not, I Repeat, Do Not Download Onavo, Facebook’s Vampiric VPN Service

If you want a VPN, buy a good one!

Danish man convicted of promoting illegal film service

A Danish man has become the first European to be convicted of taking part in the promotion of an illegal online film site.The 39-year-old man was handed a six-month suspended sentence by an Odense court for promoting the illegal online film streaming service Popcorn Time via his website popcorntime.dk.
[…]
More specifically, the man was convicted of offering a guideline about how Danish users could download the Popcorn Time app, how to install and use it, and how to avoid being discovered by the authorities.

Aside from his suspended sentence, the court also ruled to confiscate 500,000 kroner the man had earned in advertising income via his website. He also faces 120 hours of community service. He has two weeks to appeal to the higher courts.

Source: Historic case: Danish man convicted of promoting illegal film service – The Post

The case was brought by the movie mafia trying to sustain their outdated business model. Now I wonder how worried Google and Bing and other search engines should be, as they link to quite a few illegal places on the web.

UK.gov mass data slurping ruled illegal – AGAIN

In a judgment handed down this morning, judges backed a challenge brought by deputy Labour leader Tom Watson in a long-running battle against state surveillance rules.These laws allow for ISPs and telcos to retain communications data for up to a year and for public authorities to get access to this information. But campaigners have argued it fails to properly restrict this retention and access.Today’s ruling refers to the Data Retention and Investigatory Powers Act, which expired at the end of 2016, but will have significant implications for its successor, the Investigatory Powers Act.The so-called Snoopers’ Charter was already under pressure following a landmark 2016 ruling from the Court of Justice of the European Union, and today’s judgment adds weight to this.In the document, the judges also note: “As [Ben] Jaffey QC, on behalf of the first respondent, pointed out in the course of his oral submissions, that the fact that DRIPA has been repealed does not make this a pointless exercise”.Their ruling was that DRIPA “was inconsistent with EU law” because it did not limit access to retained communications data solely to the purpose of fighting serious crime.It also broke the law because police forces and public authorities could themselves grant access to retained data – rather than access being subject to prior review by a court or an independent administrative authority.

Source: UK.gov mass data slurping ruled illegal – AGAIN • The Register

Especially the last bit: rather than access being subject to prior review by a court or an independent administrative authority.

Come on! How hard is it to ask a judge after proving some sort of probable cause? It’s investigation that gets the bad guys. Not being a police state.

Thanks to “consent” buried deep in sales agreements, car manufacturers are tracking tens of millions of US and EU cars

Millions of new cars sold in the US and Europe are “connected,” having some mechanism for exchanging data with their manufacturers after the cars are sold; these cars stream or batch-upload location data and other telemetry to their manufacturers, who argue that they are allowed to do virtually anything they want with this data, thanks to the “explicit consent” of the car owners — who signed a lengthy contract at purchase time that contained a vague and misleading clause deep in its fine-print.

Car manufacturers are mostly warehousing this data (leaving it vulnerable to leaks and breaches, search-warrants, government hacking and unethical employee snooping), and can’t articulate why they’re saving it or how they use it.

Much of this data ends up in “marketplaces” where data-sets from multiple auto-makers are merged, made uniform, and given identifiers that allow them to be cross-referenced with the massive corporate data-sets that already exist, and then offered on the open market to any bidder.

Source: Thanks to “consent” buried deep in sales agreements, car manufacturers are tracking tens of millions of US cars / Boing Boing

Microsoft whips out tool so you can measure Windows 10’s data-slurping creepiness

The software giant has produced a tool that’s claimed to show users how much personal information its Windows 10 operating system collects and sends back to Redmond for diagnostics.The application is dubbed Diagnostic Data Viewer, and is free from the Windows Store. It reveals that stuff like the computer’s device name, OS version, and serial number, as well as more detailed records such as installed apps, preference settings, and details on each application’s usage, are beamed back to Microsoft.
[…]
Microsoft says the Diagnostic Data Viewer will run separately from the Windows Privacy Dashboard that is bundled with Windows 10. That app will also be upgraded to provide users with more information on data collection, including activity history for the user’s Microsoft account.

Microsoft is also planning an update to the app to allow users to export dashboard reports, view media consumption information, and delete reported data (for some reason this isn’t already allowed).

The Dashboard and Data Viewer apps arrive after Microsoft was taken to task by governments for what many saw as overly intrusive data collection by Windows 10.

Source: Microsoft whips out tool so you can measure Windows 10’s data-slurping creepiness • The Register

YouTube’s Support for Musicians Comes With a non-disparagement contract. Wait, what? It’s legal to agree to this before you know what they will do to you?!

YouTube has asked musicians to agree not to disparage the streaming-video service in exchange for promotional support, according to people familiar with the matter, a way to quell persistent criticism by artists.

In recent months, YouTube has given a handful of musicians a couple hundred thousand dollars to produce videos and promoted their work on billboards, part of a larger campaign to improve the site’s relationship with the music industry.

Yet such support comes with a catch, with some musicians required to promise the won’t say negative things about YouTube, said the people, who asked not to be identified discussing private business transactions. Non-disparagement agreements are common in business, but YouTube’s biggest direct competitors in music don’t require them, the people said.

YouTube’s non-disparagement agreements go beyond a requirement not to criticize the video site, one of the people said, without going into detail. YouTube requires many partners to agree to such conditions, including creators who make original series for its paid service, the person said.

YouTube has taken extra precautions in recent deals due to an incident with director Morgan Spurlock. Spurlock caught YouTube off-guard when he admitted in December to sexual misconduct just three months after the company acquired the rights to release his latest film, a sequel to the Oscar-nominated documentary “Super Size Me.”

YouTube has more reason to worry about artists’ public comments than most companies. Songwriters and artists have assailed the site for what they view as meager revenue-sharing and poor protections against piracy. Dozens of musicians signed a petition in 2016 rebuking free music services and pushing for Congress to make YouTube more responsible for policing copyright violations.

Source: YouTube’s Support for Musicians Comes With a Catch – Bloomberg

Surely non-disparagement contracts can’t be considederd at all legal?

American Reich restarts dodgy spying program – just as classified surveillance abuse memo emerges

The US Senate reauthorized a controversial NSA spying program on Thursday – and then, because it’s 2018 and nothing matters any more, embarked on a partisan battle over a confidential memo that outlines Uncle Sam’s alleged abuse of surveillance powers.

Despite numerous appeals, press conferences, competing legislation and speeches outlining abuse of the program, on Thursday a majority of senators ignored pleas for a proper warrant requirement to be added to the program – that would require the Feds to always go to a judge before searching the communications of a US citizen – and voted to continue the surveillance for a further six years.
[…]

However, the agents won’t need a warrant if they are looking into…

Death, kidnapping, serious bodily injury, offense against a minor, destruction of critical infrastructure, cybersecurity, transnational crime, and human trafficking

…which are basically the crimes the FBI investigates. Ergo, it’s unlikely the Feds will seek warrants to search the NSA’s section 702 data stores for stuff on American citizens.

Just hours after the section 702 program was given the final green light before the president can sign on the dotted line, the Senate’s intelligence committee approved the release of a confidential four-page memo alleging previous abuse of the FISA spying program to the rest of Congress. The public is unable to see it.

The mysterious missive was drafted by House intelligence committee chairman Devin Nunes (R-CA), and of course it could be looney-tunes nonsense. Regardless, a number of lawmakers who only now just read the memo have said that had they been aware of the misconduct detailed in the memo, they would not having voted for the reauthorization of section 702 of the FISA Amendments Act.

Republican lawmakers in particular, having seen the report, embarked on a fiercely partisan campaign accusing the Obama administration of snooping on the Trump presidential campaign using the foreigner-targeting FISA laws.
[…]
The hypocrisy is stunning, even for Congress. One moment, Republicans insist a Big Brother program is needed to foil terrorists abroad, ignoring its ability to pry into the lives of Americans. The next moment, Republicans are upset the same set of laws were indeed used to pry into the lives of Americans – some of the folks working for Team Trump.
[…]
Congresscriters who now claim to be shocked – shocked! – about FISA’s sweeping capabilities – have been willfully ignoring determined efforts in both the House and the Senate in recent weeks to have a full debate about the extent of spying powers that the US government possesses
[…]

In one part of that speech, he even went into great detail over how the Director of National Intelligence had publicly denied that Uncle Sam was able to intercept communications between US citizens on US soil – and then, when challenged subsequently, claimed to have heard a different question.

When Wyden asked the same question again, the director refused to answer, claiming that it was classified. “How can a topic in which the director of national intelligence has already given an answer in public suddenly become classified?” asked Wyden in his speech.

But if all that wasn’t enough, we will all likely be subject to one more head-holding display of hypocrisy when President Trump signs the reauthorization bill into law – despite the fact congressfolk are railing against the same set of FISA laws being used to spy on his campaign.

Source: America restarts dodgy spying program – just as classified surveillance abuse memo emerges • The Register

The Man from Earth Sequel ‘Pirated’ on The Pirate Bay – By Its Creators

More than a decade ago, Hollywood was struggling to get to grips with the file-sharing phenomenon. Sharing via BitTorrent was painted as a disease that could kill the movie industry, if it was allowed to take hold. Tough action was the only way to defeat it, the suits concluded.

In 2007, however, a most unusual turn of events showed that piracy could have a magical effect on the success of a movie.

After being produced on a tiny budget, a then little-known independent sci-fi film called “The Man from Earth” turned up on pirate sites, to the surprise of its creators.
[…]
“A week or two before the DVD’s ‘street date’, we jumped 11,000% on the IMDb ‘Moviemeter’ and we were shocked.”

With pirates fueling interest in the movie, a member of the team took an unusual step. Producer Eric Wilkinson wrote to RLSlog, a popular piracy links site – not to berate pirates – but to thank them for catapulting the movie to fame.

“Our independent movie had next to no advertising budget and very little going for it until somebody ripped one of the DVD screeners and put the movie online for all to download. Most of the feedback from everyone who has downloaded ‘The Man From Earth’ has been overwhelmingly positive. People like our movie and are talking about it, all thanks to piracy on the net!” he wrote.
[…]
“Once we realized what was going on, we asked people to make donations to our PayPal page if they saw the movie for free and liked it, because we had all worked for nothing for two years to bring it to the screen, and the only chance we had of surviving financially was to ask people to support us and the project,” Schenkman explains.

“And, happily, many people around the world did donate, although of course only a tiny fraction of the millions and millions of people who downloaded pirated copies.”

Following this early boost The Man from Earth went on to win multiple awards. And, a decade on, it boasts a hugely commendable 8/10 score on IMDb from more than 147,000 voters, with Netflix users leaving over 650,000 ratings, which reportedly translates to well over a million views.
[…]
Yesterday the team behind the movie took matters into their own hands, uploading the movie to The Pirate Bay and other sites so that fans can help themselves.

“It was going to get uploaded regardless of what we did or didn’t do, and we figured that as long as this was inevitable, we would do the uploading ourselves and explain why we were doing it,” Schenkman informs TF.

“And, we would once again reach out to the filesharing community and remind them that while movies may be free to watch, they are not free to make, and we need their support.”

The release, listed here on The Pirate Bay, comes with detailed notes and a few friendly pointers on how the release can be further shared. It also informs people how they can show their appreciation if they like it.

Source: The Man from Earth Sequel ‘Pirated’ on The Pirate Bay – By Its Creators – TorrentFreak

And this is how you make money in the digital age!

US House reps green-light Fourth Amendment busting spy program

The US House of Representatives has passed a six-year extension to the controversial Section 702 spying program, rejecting an amendment that would have required the authorities to get a warrant before searching for information on US citizens.

The 256-164 vote effectively retains the status quo and undermines a multi-year effort to bring accountability to a program that critics argue breaks the Constitution. A bipartisan substitute amendment put forward by House reps Justin Amash (R-MI) and Zoe Lofgren (D-CA) and supported by both ends of the political spectrum was defeated 233-183.< [...] The already tense atmosphere in Washington DC over the issue was heightened when President Trump tweeted his apparent support of critics of the program just moments after the Amash-Lofgren amendment was discussed on Fox News./blockquote>

Source: US House reps green-light Fourth Amendment busting spy program • The Register

OnePlus Android mobes’ clipboard app caught phoning home to China

OnePlus has admitted that the clipboard app in a beta build of its Android OS was beaming back mystery data to a cloud service in China.

Someone running the latest test version of OnePlus’s Oreo-based operating system revealed in its support forums that unusual activity from the builtin clipboard manager had been detected by a firewall tool.

Upon closer inspection, the punter found that the app had been transmitting information to a block of IP addresses registered to Alibaba, the Chinese e-commerce and cloud hosting giant.
[…]
This should not come as much of a shock to those who follow the China-based OnePlus. In October last year, researchers discovered that OnePlus handsets were collecting unusually detailed reports on user activities, although the manufacturer said at the time it was only hoarding the data for its internal analytics. One month later, it was discovered that some phones had apparently been shipped with a developer kit left active, resulting in the phones sporting a hidden backdoor.

And lest we forget, today’s desktop and mobile operating systems are pretty gung-ho in phoning home information about their users, with Microsoft catching flak for Windows 10 telemetry in particular. ®

Source: OnePlus Android mobes’ clipboard app caught phoning home to China

What’s Slack Doing With Your Data?

More than six million people use Slack daily, spending on average more than two hours each day inside the chat app. For many employees, work life is contingent on Slack, and surely plenty of us use it for more than just, say, work talk. You probably have a #CATS and a women-only channel, and you’ve probably said something privately that you wouldn’t want shared with your boss. But that’s not really up to you.

When you want to have an intimate or contentious chat, you might send a direct message. Or perhaps you and a few others have started a private channel, ensuring that whatever you say is only seen by a handful of people. This may feel like a closed circuit between you and another person—or small group of people—but that space and the little lock symbol aren’t actually emblematic of complete privacy.

Do Slack employees have access to your chats? The short answer is: sort of. The long answer is… below. Can your company peek at your private DMs? It’s entirely possible. Slack’s FAQ pages help elucidate some of these concerns, but at times the answers are frustratingly vague and difficult to navigate. So we dug into it for you. Read more to find out what Slack—and your company—is actually doing with your data.

Source: What’s Slack Doing With Your Data?

The short is:
Yes, there are slack employees that can view your data. Channel owners can see everything in a channel, also direct messages. Slack gives your data to law enforcement upon request and won’t inform you. They don’t (and say won’t) sell it to third parties. Deletion is deletion. Slack, like any other company, can be hacked. Caveat emptor.

Violating a Website’s Terms of Service Is Not a Crime, Federal Court Rules

the federal court of appeals heeded EFF’s advice and rejected an attempt by Oracle to hold a company criminally liable for accessing Oracle’s website in a manner it didn’t like. The court ruled back in 2012 that merely violating a website’s terms of use is not a crime under the federal computer crime statute, the Computer Fraud and Abuse Act. But some companies, like Oracle, turned to state computer crime statutes — in this case, California and Nevada — to enforce their computer use preferences. This decision shores up the good precedent from 2012 and makes clear — if it wasn’t clear already — that violating a corporate computer use policy is not a crime.

Source: Violating a Website’s Terms of Service Is Not a Crime, Federal Court Rules – Slashdot

Man’s YouTube Video of White Noise Hit With Five Copyright Claims

On Thursday, Tomczak tweeted a screenshot of the complaints that have been lodged against his video, “10 Hours of Low Level White Noise.” The clip is exactly what its title advertises, and the absurdity of someone claiming ownership of a bunch of frequencies with equal intensity playing simultaneously—that’s all white noise is—clearly illustrates just how beyond broken YouTube’s automated copyright system really is.
[…]
What’s most egregious about the situation is that the claimants aren’t just disputing Tomczak’s right to upload the video—they’ve elected to monetize it and leave it up. Tomczak isn’t missing out on any big profits (the video only has 1,485 views), but running around YouTube monetizing white noise has plenty of opportunities to be a moneymaker. A simple search pulls up millions of white noise videos and many of them have millions of views. A lot of the offerings are relaxing sounds like rain or a fan, but there’s plenty of good, old-fashioned TV static that’s quite popular.

Source: Man’s YouTube Video of White Noise Hit With Five Copyright Claims

Gamers Want DMCA Exemption for ‘Abandoned’ Online Games

Several organizations and gaming fans are asking the Copyright Office to make a DMCA circumvention exemption for abandoned online games, to preserve them for future generations. The exemption would allow museums and libraries to offer copies of abandoned online servers, so these games won’t turn to dust.

The U.S. Copyright Office is considering whether or not to update the DMCA’s anti-circumvention provisions, which prevent the public from tinkering with DRM-protected content and devices.

These provisions are renewed every three years. To allow individuals and organizations to chime in, the Office traditionally launches a public consultation, before it makes any decisions.

This week a series of new responses were received and many of these focused on abandoned games. As is true for most software, games have a limited lifespan, so after a few years they are no longer supported by manufacturers.

To preserve these games for future generations and nostalgic gamers, the Copyright Office previously included game preservation exemptions. This means that libraries, archives and museums can use emulators and other circumvention tools to make old classics playable.

However, these exemptions are limited and do not apply to games that require a connection to an online server, which includes most recent games. When the online servers are taken down, the game simply disappears forever.

Source: Gamers Want DMCA Exemption for ‘Abandoned’ Online Games – TorrentFreak

Chrome Extension with 100,000 Users Caught Pushing Cryptocurrency Miner

A Chrome extension with over 105,000 users has been deploying an in-browser cryptocurrency miner to unsuspecting users for the past few weeks.The extension does not ask for user permission before hijacking their CPUs to mine Monero all the time the Chrome browser is open.Named “Archive Poster,” the extension is advertised as a mod for Tumblr that allows users an easier way to “reblog, queue, draft, and like posts right from another blog’s archive.”According to users reviews, around the start of December the extension has incorporated the infamous Coinhive in-browser miner in its source code.

Source: Chrome Extension with 100,000 Users Caught Pushing Cryptocurrency Miner

How to Stop Apps From Listening in on Your TV Habits (it turns out thousands are)

That innocent-looking mobile game you just downloaded might just have an ulterior motive. Behind the scenes, hundreds of different apps could be using your smartphone’s microphone to figure out what you watch on TV, a new report from The New York Times reveals.
[…]
All of these apps need to get your permission before they can record in the background. So the easiest way is just to deny that permission. However, it’s possible that you might approved the request without realizing it, or your kid might do it while playing with your phone. In that case, switching it off is pretty easy.

Just head into Settings on your device and check the permissions for the app in question. If the app has microphone access when it doesn’t need to (why would a bowling game need to use your microphone?), just toggle that permission off.

Source: How to Stop Apps From Listening in on Your TV Habits

Web trackers exploit browser login managers

First, a user fills out a login form on the page and asks the browser to save the login. The tracking script is not present on the login page [1]. Then, the user visits another page on the same website which includes the third-party tracking script. The tracking script inserts an invisible login form, which is automatically filled in by the browser’s login manager. The third-party script retrieves the user’s email address by reading the populated form and sends the email hashes to third-party servers.

We found two scripts using this technique to extract email addresses from login managers on the websites which embed them. These addresses are then hashed and sent to one or more third-party servers. These scripts were present on 1110 of the Alexa top 1 million sites. The process of detecting these scripts is described in our measurement methodology in the Appendix 1. We provide a brief analysis of each script in the sections below.

Source: No boundaries for user identities: Web trackers exploit browser login managers

Nvidia: bans using cheap GeForce, Titan GPUs in servers through EULA. Is that legal?!

The chip-design giant updated its GeForce and Titan software licensing in the past few days, adding a new clause that reads: “No Datacenter Deployment. The SOFTWARE is not licensed for datacenter deployment, except that blockchain processing in a datacenter is permitted.”

In other words, if you wanted to bung a bunch of GeForce GPUs into a server box and use them to accelerate math-heavy software – such as machine learning, simulations and analytics – then, well, you can’t without breaking your licensing agreement with Nvidia. Unless you’re doing trendy blockchain stuff.

A copy of the license in the Google cache, dated December 31, 2017, shows no mention of the data center ban. Open the page today, and, oh look, data center use is verboten.

Source: Nvidia: Using cheap GeForce, Titan GPUs in servers? Haha, nope! • The Register

I don’t really understand how a company hopes to defend being able to tell you where and for what purpose you are allowed to used hardware you bought from them. You bought it, you paid for it, it’s your hardware to do with whatever you want. Unless the government says you can’t. Such as for eg. weaponry. Which I am pretty sure they don’t specify for Nvidia graphics cards.

Dozens of Companies Are Using Facebook to Exclude Older Workers

Verizon is among dozens of the nation’s leading employers — including Amazon, Goldman Sachs, Target and Facebook itself — that placed recruitment ads limited to particular age groups, an investigation by ProPublica and The New York Times has found.

The ability of advertisers to deliver their message to the precise audience most likely to respond is the cornerstone of Facebook’s business model. But using the system to expose job opportunities only to certain age groups has raised concerns about fairness to older workers.

Several experts questioned whether the practice is in keeping with the federal Age Discrimination in Employment Act of 1967, which prohibits bias against people 40 or older in hiring or employment. Many jurisdictions make it a crime to “aid” or “abet” age discrimination, a provision that could apply to companies like Facebook that distribute job ads.

“It’s blatantly unlawful,” said Debra Katz, a Washington employment lawyer who represents victims of discrimination.

Facebook defended the practice. “Used responsibly, age-based targeting for employment purposes is an accepted industry practice and for good reason: it helps employers recruit and people of all ages find work,” said Rob Goldman, a Facebook vice president.

Source: Dozens of Companies Are Using Facebook to Exclude Older… — ProPublica

The statement by Rob Goldman defies belief! Being ageist is good for people of all ages? No, Rob, being ageist is only good for those people who’s age you are targetting.

Ghostery, uBlock, Privacy Badger lead the anti-tracking browser extensions

A group of researchers in France and Japan say RequestPolicyContinued and NoScript have the toughest policies, while Ghostery and uBlock Origin offer good blocking performance and a better user experience.

The study also gave a nod to the EFF’s Privacy Badger, which uses heuristics rather than block lists, but once trained is nearly as good as Ghostery or uBlock, demonstrating that its heuristics are reliable.

Source: Ghostery, uBlock lead the anti-track pack

How to Track a Cellphone Without GPS—or Consent

Using only data that can be legally collected by an app developer without the consent of a cellphone’s owner, researchers have been able to produce a privacy attack that can accurately pinpoint a user’s location and trajectory without accessing the device’s Global Position System—GPS. And while the ramifications of this ability falling into the wrong hands are distressing, the way in which they pulled it off is nothing short of genius.
[…]
In fact, all you really need is your phone’s internal compass, an air pressure reading, a few free-to-download maps, and a weather report.

Your cellphone comes equipped with an amazing array of compact sensors that are more or less collecting information about your environment at all time. An accelerometer can tell how fast you’re moving; a magnetometer can detect your orientation in relation to true north; and a barometer can measure the air pressure in your surrounding environment. You phone also freely offers up a slew of non-sensory data such as your device’s IP address, timezone, and network status (whether you’re connected to Wi-Fi or a cellular network.)

All of this data can be accessed by any app you download without the type of permissions required to access your contact lists, photos, or GPS. Combined with publicly available information, such as weather reports, airport specification databases, and transport timetables, this data is enough to accurately pinpoint your location—regardless of whether you’re walking, traveling by plane, train, or automobile.
[…]
To track a user, you first need to determine what kind of activity they’re performing. It’s easy enough to tell if a person is walking versus riding in a car, speed being the discriminant factor; but also, when you’re walking you tend to move in one direction, while your phone is held in a variety of different positions. In a car, you make sudden stops (when you brake) and specific types of turns—around 90 degrees—that can be detected using your phone’s magnetometer. People who travel by plane will rapidly change time zones; the air pressure on a plane also changes erratically, which can be detected by a cellphone’s barometer. When you ride a train, you tend to accelerate in a direction that doesn’t significantly change. In other words, determining your mode of travel is relatively simple.

The fact that your cellphone offers up your time zone as well as the last IP address you were connected to really narrows things down—geolocating IP addresses is very easy to do and can at least reveal the last city you were in—but to determine your exact location, with GPS-like precision, a wealth of publicly-available data is needed. To estimate your elevation—i.e., how far you are above sea level—PinMe gathers air pressure data provided freely by the Weather Channel and compares it to the reading on your cellphone’s barometer. Google Maps and open-source data offered by US Geological Survey Maps also provide comprehensive data regarding changes in elevation across the Earth’s surface. And we’re talking about minor differences in elevation from one street corner to the next.

Upon detecting a user’s activity (flying, walking, etc.) the PinMe app uses one of four algorithms to begin estimating a user’s location, narrowing down the possibilities until its error rate drops to zero, according to the peer-reviewed research. Let’s say, the app decides you’re traveling by car. It knows your elevation, it knows your timezone, and if you haven’t left the city you’re in since you last connected to Wi-Fi, you’re pretty much borked.

With access to publicly available maps and weather reports, and a phone’s barometer and magnetometer (which provides a heading), it’s only a matter of turns. When PinMe detected one of the researchers driving in Philadelphia during a test-run, for example, the researcher only had to make 12 turns before the app knew exactly where they were in the city. With each turn, the number of possible locations of the vehicles dwindles. “[A]s the number of turns increases, PinMe collects more information about the user’s environment, and as a result it is more likely to find a unique driving path on the map,” the researchers wrote.

Source: How to Track a Cellphone Without GPS—or Consent

Email tracking now extends to your acquantances: 1 in 5!

According to OMC’s data, a full 19 percent of all “conversational” email is now tracked. That’s one in five of the emails you get from your friends. And you probably never noticed.“Surprisingly, while there is a vast literature on web tracking, email tracking has seen little research,” noted an October 2017 paper published by three Princeton computer scientists. All of this means that billions of emails are sent every day to millions of people who have never consented in any way to be tracked, but are being tracked nonetheless. And Seroussi believes that some, at least, are in serious danger as a result.

Source: You Give Up a Lot of Privacy Just Opening Emails. Here’s How to Stop It | WIRED

New Google Home Mini update 1.29 restores top tap functionality with long-press on the side: doesn’t record everything anymore?

The Google Home Mini is a super-affordable way to get Google Assistant in your life, but Google was forced to hobble the device shortly after launch because a sticky touch sensor caused Artem’s Mini to record everything he said. Part of that functionality is now coming back with a small tweak. Instead of tapping the top of the device, you’ll be able to long-press the side.

Source: New Google Home Mini update 1.29 restores top tap functionality with long-press on the side

Don’t Buy Anyone an Echo

Let me make this point dreadfully clear, though: Your family members do not need an Amazon Echo or a Google Home or an Apple HomePod or whatever that one smart speaker that uses Cortana is called. And you don’t either. You only want one because every single gadget-slinger on the planet is marketing them to you as an all-new, life-changing device that could turn your kitchen into a futuristic voice-controlled paradise. You probably think that having an always-on microphone in your home is fine, and furthermore, tech companies only record and store snippets of your most intimate conversations. No big deal, you tell yourself.

Actually, it is a big deal. The newfound privacy conundrum presented by installing a device that can literally listen to everything you’re saying represents a chilling new development in the age of internet-connected things. By buying a smart speaker, you’re effectively paying money to let a huge tech company surveil you. And I don’t mean to sound overly cynical about this, either. Amazon, Google, Apple, and others say that their devices aren’t spying on unsuspecting families. The only problem is that these gadgets are both hackable and prone to bugs.

Before getting into the truly scary stuff, though, let’s talk a little bit about utility. Any internet-connected thing that you bring into your home should make your life easier. Philips Hue bulbs, for instance, let you dim the lights in an app. Easy! A Nest thermostat learns your habits so you don’t have to turn up the heat as often. Cool! An Amazon Echo or a Google Home, well, they talk to you, and if you’re lucky, you might be able to figure out how to talk back in the right way and do random things around the house. Huh?

Source: Don’t Buy Anyone an Echo

A good and concise explanation of why these useless devices are something to be very afraid of.