The New and Improved Privacy Badger 2.0 Is Here | Electronic Frontier Foundation

Privacy Badger is a browser extension that automatically blocks hidden third-party trackers that would otherwise follow you around the web and spy on your browsing habits. Privacy Badger now has approximately 900,000 daily users and counting.

Third-party tracking—that is, when advertisers and websites track your browsing activity across the web without your knowledge, control, or consent—is an alarmingly widespread practice in online advertising. Privacy Badger spots and then blocks third-party domains that seem to be tracking your browsing habits (e.g. by setting cookies that could be used for tracking, or by fingerprinting your browser). If the same third-party domain appears to be tracking you on three or more different websites, Privacy Badger will conclude that the third party domain is a tracker and block future connections to it.

Privacy Badger always tells how many third-party domains it has detected and whether or not they seem to be trackers. Further, users have control over how Privacy Badger treats these domains, with options to block a domain entirely, block just cookies, or allow a domain.

Source: The New and Improved Privacy Badger 2.0 Is Here | Electronic Frontier Foundation

Uber begins collection of rider location data – whether using the app or not

The app update (it’s 3.222.4, for those keeping track) changes the way Uber collects location data from its users. Previously, Uber only collected location information while a user had the app open – now, Uber asks users to always share their location with the ride-hailing company.

Uber says that, even though it can harvest your location constantly while its app is running in the background on your phone, it won’t use that capability. Instead, Uber claims it just needs a little bit more location data to improve its service, and it has to ask for constant access because of the way device-level permissions are structured.

Specifically, Uber wants access to a rider’s location from the moment she requests a ride until five minutes after the driver drops her off, even if the app is not in the foreground of her phone. Previously, Uber would not collect a rider’s background location during the trip, or her location after drop-off.

Source: Uber begins background collection of rider location data | TechCrunch

They have many excuses as to why, but who knows what the truth is? You have become the product of Uber and having them follow you around is just creepy.

The FBI Just Got Disturbing New Hacking Powers

Under the old version of “Rule 41,” agencies like the FBI needed to apply for a warrant in the right jurisdiction to hack a computer, presenting difficulties when investigating crimes involving suspects who had anonymized their locations or machines in multiple places. Under the new version, a federal judge can approve a single search warrant covering multiple computers even if their owners are innocent or their locations are unknown.

Source: The FBI Just Got Disturbing New Hacking Powers

So, who cares about innocent until proven guilty? Or probable cause? Or mass surveillance and breach of privacy? Or security for your own devices?

These Are The 48 Organizations That Now Have Access To Every Brit’s Browsing History

While the UK was obsessing with Brexit and its aftermath, parliament quietly passed a contentious snooping law that gives authorities, everyone from police and spies to food regulators, fire officials and tax inspectors, the right to legally look at the internet browsing records of everyone in the country.
[…]
Which government agencies have access to the internet history of any British citizen? Here is the answer courtesy of blogger Chris Yuo, who has compiled the list:

Metropolitan police force
City of London police force
Police forces maintained under section 2 of the Police Act 1996
Police Service of Scotland
Police Service of Northern Ireland
British Transport Police
Ministry of Defence Police
Royal Navy Police
Royal Military Police
Royal Air Force Police
Security Service
Secret Intelligence Service
GCHQ
Ministry of Defence
Department of Health
Home Office
Ministry of Justice
National Crime Agency
HM Revenue & Customs
Department for Transport
Department for Work and Pensions
NHS trusts and foundation trusts in England that provide ambulance services
Common Services Agency for the Scottish Health Service
Competition and Markets Authority
Criminal Cases Review Commission
Department for Communities in Northern Ireland
Department for the Economy in Northern Ireland
Department of Justice in Northern Ireland
Financial Conduct Authority
Fire and rescue authorities under the Fire and Rescue Services Act 2004
Food Standards Agency
Food Standards Scotland
Gambling Commission
Gangmasters and Labour Abuse Authority
Health and Safety Executive
Independent Police Complaints Commissioner
Information Commissioner
NHS Business Services Authority
Northern Ireland Ambulance Service Health and Social Care Trust
Northern Ireland Fire and Rescue Service Board
Northern Ireland Health and Social Care Regional Business Services Organisation
Office of Communications
Office of the Police Ombudsman for Northern Ireland
Police Investigations and Review Commissioner
Scottish Ambulance Service Board
Scottish Criminal Cases Review Commission
Serious Fraud Office
Welsh Ambulance Services National Health Service Trust

Source: These Are The 48 Organizations That Now Have Access To Every Brit’s Browsing History

That’s a lot of places to potentially spill a very important dataset! Remember, they only have to break into one of the above places for it all…

The FBI Hacked Over 8,000 Computers In 120 Countries Based on One Warrant

In January, Motherboard reported on the FBI’s “unprecedented” hacking operation, in which the agency, using a single warrant, deployed malware to over one thousand alleged visitors of a dark web child pornography site. Now, it has emerged that the campaign was actually an order of magnitude larger.

In all, the FBI obtained over 8,000 IP addresses, and hacked computers in 120 different countries, according to a transcript from a recent evidentiary hearing in a related case.

The figures illustrate the largest ever known law enforcement hacking campaign to date, and starkly demonstrate what the future of policing crime on the dark web may look like. This news comes as the US is preparing to usher in changes that would allow magistrate judges to authorize the mass hacking of computers, wherever in the world they may be located.

Source: The FBI Hacked Over 8,000 Computers In 120 Countries Based on One Warrant

Britain has passed the ‘most extreme surveillance law ever passed in a democracy’

The UK has just passed a massive expansion in surveillance powers, which critics have called “terrifying” and “dangerous”.

The new law, dubbed the “snoopers’ charter”, was introduced by then-home secretary Theresa May in 2012, and took two attempts to get passed into law following breakdowns in the previous coalition government.

Four years and a general election later — May is now prime minister — the bill was finalized and passed on Wednesday by both parliamentary houses.

But civil liberties groups have long criticized the bill, with some arguing that the law will let the UK government “document everything we do online”.

It’s no wonder, because it basically does.

The law will force internet providers to record every internet customer’s top-level web history in real-time for up to a year, which can be accessed by numerous government departments; force companies to decrypt data on demand — though the government has never been that clear on exactly how it forces foreign firms to do that that; and even disclose any new security features in products before they launch.

Not only that, the law also gives the intelligence agencies the power to hack into computers and devices of citizens (known as equipment interference), although some protected professions — such as journalists and medical staff — are layered with marginally better protections.

In other words, it’s the “most extreme surveillance law ever passed in a democracy,” according to Jim Killock, director of the Open Rights Group.

Source: Britain has passed the ‘most extreme surveillance law ever passed in a democracy’ | ZDNet

Google’s Photo Scan App Makes Backing Up Old Snapshots Easy as Hell

The Photo Scan app launched by Google today for iOS and Android lets you scan printed photos in just a couple of seconds, using machine learning to correct imperfections in the capture process that they look great every time.

Here’s how it works: Download the app, and open it up. You’ll see a viewfinder. Hold your phone over the printed photo you want to make a digital copy of, and make sure it fits entirely in the frame. Tap the shutter button once.

Next, four white dots will appear on the screen in each corner of the photo you’re backing up. You connect the dots by moving your phone over the dots until they turn blue. After you’ve scanned each individual dot, the photo will be saved within the Photo Scan app and can be saved to your Google Photos library with the push of a button.

Source: Google’s Photo Scan App Makes Backing Up Old Snapshots Easy as Hell

Of course, you do give Google your old photos to analyse with an AI. Worry about the privacy aspect of that!

Shazam listens to you on macs, even when you turn the mic off

Once installed, Shazam automatically begins listening for music,

Most (security-conscious) users probably don’t want Shazam listening all the time. Shazam appears to oblige, seemingly providing an option to disable this listening:

However, sliding the selector to ‘OFF’ did not generate the expected, “Mic was deactivated” OverSight alert.

My first thought was perhaps OverSight had ‘missed’ the Mic deactivation, or contained some other bug or limitation. However testing seemed to confirm that OverSight works as expected.

So is Shazam still listening even when the user attempts to toggle it to ‘OFF’? One way to find out – let’s reverse the app!

The post then goes into how to reverse engineer an app and sure enough, the mic doesn’t get turned off.

Shazam says this is a “feature” but it sounds to me like a huge gaping security hole. When you turn something off, it should go off, especially a listening device!

Source: Objective-See

Chemical traces on your phone reveal your lifestyle, scientists say

Scientists say they can deduce the lifestyle of an individual, down to the kind of grooming products they use, food they eat and medications they take, from chemicals found on the surface of their mobile phone.

Experts say analysis of someone’s phone could be a boon both to healthcare professionals, and the police.

“You can narrow down male versus female; if you then figure out they use sunscreen then you pick out the [people] that tend to be outdoorsy – so all these little clues can sort of narrow down the search space of candidate people for an investigator,” said Pieter Dorrestein, co-author of the research from the University of California, San Diego.

Writing in the Proceedings of the National Academy of Sciences, researchers from the US and Germany describe how they swabbed the mobile phone and right hand of 39 individuals and analysed the samples using the highly sensitive technique of mass spectrometry.

The results revealed that each person had a distinct “signature” set of chemicals on their hands which distinguished them from each other. What’s more, these chemicals partially overlapped with those on their phones, allowing the devices to be distinguished from each other, and matched to their owners.

“If one looks at the hands of an individual they are unique in 99% of the samples investigated. In two cases we could not do that perfectly, but in one of those cases people lived together,” said Dorrestein. “In 69% of the cases we could perfectly match up the chemical profile, the molecular profile, on the phone to the person that it belonged to.”

But, he adds, the promise of the technique lies not in identifying individuals, but in building a profile of the phone’s owner.

Analysis of the chemical traces using a reference database allowed the team to match the chemicals to known substances or their relatives to reveal tell-tale clues from each individual’s life – from whether they use hair-loss treatments to whether they are taking antidepressants.

Some of the chemicals, such as the mosquito repellent DEET, were found more than four months after the product was last used by the phone’s owner.

The approach, the authors say, could be extended to produce a wide-ranging database that could be used by police to predict the lifestyle of an individual based on the specific set of trace chemicals found on their phone, keys or other objects.

Source: Chemical traces on your phone reveal your lifestyle, scientists say | Science | The Guardian

Facebook Will Let Brands Send You Ads If You’ve Messaged Them Before

According to Facebook, if you send a message to a company, they then have permission to send you sponsored messages—or as we humans call them, ads. These will be unprompted “highly targeted, in-context” ads. Businesses that already have chat bots set up can start using the new feature immediately.

Source: Facebook Will Let Brands Send You Ads If You’ve Messaged Them Before

It seems to me a good reason to not use Facebook to get in touch with a company

Nvidia Tracking you on Windows now – and how to stop it (for now)

In the case of Nvidia, Telemetry gets installed alongside the driver package. While you may — and should — customize the installation of the Nvidia driver so that only the bits that you require are installed, there is no option to disable the Telemetry components from being installed. These do get installed even if you only install the graphics driver itself in the custom installation dialog.

Source: Disable Nvidia Telemetry tracking on Windows – gHacks Tech News

This starts with version 375.70

Come on, who told these companies it was alright to just suck stuff off your machine without consent? And a EULA isn’t consent!

Turkey Doubles Down on Censorship With Block on VPNs, Tor

In what’s a significant escalation in its censorship efforts, the Turkish government now wants to block the very same tools that tech-savvy citizens use to get around the government-imposed social media blocks.

On Friday, the Turkish information technologies and communications authority, or BTK, ordered internet providers in the country to block Tor and several other censorship-circumvention Virtual Private Networks or VPNs, such as VPN Master, Hotspot Shield, Psiphon, Zenmate, TunnelBear, Zero, Vypr, Express, according to multiple local reports.

Earlier in the day, the government had already blocked Twitter, Facebook and YouTube, and restrictions on messaging apps like WhatsApp and Skype were also reported. The independent monitoring organization TurkeyBlocks also reported throttling and other forms of censorship on Friday, linking the disruptions and blocks to the arrests of pro-Kurdish party leaders.

Source: Turkey Doubles Down on Censorship With Block on VPNs, Tor | Motherboard

Just in case you were in any doubt that Turkey is a dictatorship.

Inaudible Soundwaves Expose a Spooky New Pathway for Hackers

The underlying technology in question is known as ultrasonic cross-device tracking, or uXDT. Cross-device tracking has been called a ‘holy grail’ for marketers, allowing them to, for instance, tell your phone when you’re watching a particular TV show, or share data about laptop web browsing to your tablet.

[…]

The UCL team says the lack of disclosure and opt-out options on widely-installed uXDT apps represents an even bigger threat, though. Such apps often actively listen for ultrasound signals, even when the app itself is closed, creating a new and relatively poorly-understood pathway for hacking.

The researchers have already found ways to mine cloaked IP addresses. Speaking to New Scientist, UCL team member Vasilios Mavroudis suggests that an app’s always-on microphone access could be leveraged to monitor conversations (and, if you’re not paranoid already, to decipher what you’re typing). The ‘beacons’ that transmit ultrasound data can also be spoofed to manipulate apps’ user data.

Source: Inaudible Soundwaves Expose a Spooky New Pathway for Hackers

Hotel CEO openly celebrates higher prices after NYC anti-Airbnb law passes

A hotel executive said a recently-passed New York law cracking down on Airbnb hosts will enable the company to raise prices for New York City hotel rooms, according to the transcript of the executive’s words on a call with shareholders last week.

The law, signed by New York’s Governor Andrew Cuomo on Friday, slaps anyone who lists their apartment on a short-term rental site with a fine up to $7,500. It “should be a big boost in the arm for the business,” Mike Barnello, chief executive of the hotel chain LaSalle Hotel Properties, said of the law last Thursday, “certainly in terms of the pricing.”

Source: Hotel CEO openly celebrates higher prices after anti-Airbnb law passes – The Washington Post

Well of course it would – and it’s pretty surprising that in 2016 government officials (governors!) still understand so little about technology and innovation that they enact idiot protectionist laws to keep the old way of doing things in place instead of making the old people innovate themselves if they want to stay relevant. Unless, of course, the governor is in the pocket of some hotel lobbyists.

Meanwhile, in America: Half of adults’ faces are in police databases

Images representing 117 million American adults – almost half the grownups in the country – can be found in the facial recognition databases maintained by US law enforcement agencies, according to a study conducted by the Center on Privacy and Technology at Georgetown Law School.

That figure is expected to grow as facial recognition technology becomes more capable and more commonplace. Yet such systems have very little oversight.
[…]
“Transparency makes a lot of the problems we’ve noticed easier to detect,” said Frankle.

Some of these problems include: the disproportionate representation of African Americans in US law enforcement databases; the potentially chilling effect of facial recognition on free speech; lack of reliable information on the accuracy of facial recognition systems; and unsettled questions about the circumstances under which facial recognition might violate Fourth Amendment protections against unreasonable searches.
[…]
At the same time, the utility of the technology remains open to question. Where public data about the efficacy of facial recognition searches exists, it’s not particularly compelling. “Of the FBI’s 36,420 searches of state license photo and mug shot databases, only 210 (0.6 per cent) yielded likely candidates for further investigations,” the study says. “Overall, 8,590 (4 per cent) of the FBI’s 214,920 searches yielded likely matches.”

What’s more, reliable metrics for the accuracy of facial recognition systems are scarce. For example, FaceFirst, facial recognition vendor, advertises “an identification rate above 95 per cent.” The CPT study claims this is misleading and cites a 2015 contract with the San Diego Association of Governments that disclaims any specific success rate: “FaceFirst makes no representations or warranties as to the accuracy and reliability of the product in the performance of its facial recognition capabilities.”
[…]
The study cites a facial recognition test conducted with real-time video in Mainz, Germany, from 2006 to 2007, where accuracy was 60 per cent during the day and 10 to 20 per cent at night.
[…]
“Face recognition can and should be used to respond to serious crimes and public emergencies,” the study concludes. “It should not be used to scan the face of any person, at any time, for any crime.”

Source: Meanwhile, in America: Half of adults’ faces are in police databases

Using search warrants to get into fingerprint-locked phones

Investigators in Lancaster, Calif., were granted a search warrant last May with a scope that allowed them to force anyone inside the premises at the time of search to open up their phones via fingerprint recognition, Forbes reported Sunday.The government argued that this did not violate the citizens’ Fifth Amendment protection against self incrimination because no actual passcode was handed over to authorities. Forbes was able to confirm with the residents of the building that the warrant was served, but the residents did not give any more details about whether their phones were successfully accessed by the investigators.”I was frankly a bit shocked,” said Andrew Crocker, a staff attorney at the Electronic Frontier Foundation (EFF), when he learned about the scope of search warrant. “As far as I know, this warrant application was unprecedented.”Crocker said that it’s both the fingerprint lock method and the wide reach of the warrant that are so surprising. Search warrants are typically required to be narrow and clear in scope, but this one was extended to include any phone that happens to be on the property, and all of the private data that that entails. He also described requiring phones to be unlocked via fingerprint, which does not technically count as handing over a self-incriminating password, as a “clever end-run” around constitutional rights.

Source: Using search warrants to get into fingerprint-locked phones

Court finds GCHQ and MI5 engaged in illegal bulk data collection

The mysterious Investigatory Powers Tribunal, which oversees Blighty’s snoops, has ruled that the bulk collection of personal data — conducted by GCHQ and MI5 between 1998 and 2015 — was illegal.

Responding to a claim brought by Privacy International, the 70-page judgment handed down this morning [PDF] found that the spooks’ surveillance activities had been taking place without adequate safeguards or supervision for over a decade; and as such were in breach of Article 8 of the European Convention on Human Rights.

[…]

There are huge risks associated with the use of bulk communications data. It facilitates the almost instantaneous cataloguing of entire populations’ personal data. It is unacceptable that it is only through litigation by a charity that we have learnt the extent of these powers and how they are used.

The public and Parliament deserve an explanation as to why everyone’s data was collected for over a decade without oversight in place and confirmation that unlawfully obtained personal data will be destroyed.

Source: Court finds GCHQ and MI5 engaged in illegal bulk data collection

One win for transparency. Will the UK gov care? Doubt it.

UK wants to monitor fake boobs, claims event 6 years ago is catalyst

The Breast and Cosmetic Implant Registry (BCIR) is intended to prevent a repeat of faulty Poly Implant Prothèse (PIP) silicone breast implants scandal in 2010, in which fraudulently manufactured silicone gel implants affected thousands of women.

Its establishment is in response to recommendation 21 in Sir Bruce Keogh’s Review of the Regulation of Cosmetic interventions, which called for a cosmetic implant registry “to provide better monitoring of patient outcomes and device safety”.

[…]

The registry is expected to record more than 20,000 cases of implant surgery annually. Reporting of data will be done by the provider, via an online portal.

Source: New UK National silicone database will help avoid boobs

This makes no sense whatsoever to me, but for the life of me I can’t understand what other purpose the UK has in collecting such a specific set of surgery data.

Dutch net neutrality law does well, pisses off monopolists

The Dutch Senate has passed the revised Net Neutrality Law as part of an amendment to the country’s Telecommunications Act. The strict new law seeks to ensure that telcos and ISPs treat all internet traffic equally and cannot favour one internet app or service over another. Opponents, however, say the legislation, which was approved by the lower house of parliament in May this year, is overly severe and is out of line with the EU’s own open internet standards.

Afke Schaart, Vice President Europe at mobile industry body the GSMA, commented: ‘We are greatly disappointed with the outcome of today’s vote. We believe that the Dutch Net Neutrality Law goes far beyond the intent of the EU regulation. We therefore call on the European Commission to ensure the harmonised implementation of Europe’s Open Internet rules.’ The GSMA says the tighter laws in the Netherlands will ‘hinder development of innovative services and consumer choice’.

Source: Dutch net neutrality law goes too far say critics

Actually, Afke Schaart, monopolies hinder innovation and consumer choice. It’s a good thing that the NL has used it’s sovereignity to go beyond the minimum that Brussels proscribes – The EU mandarins have obviously been in touch with too many large companies with money in their pockets, seeking to protect their own lazy positions to have made a good job of the net neutrality laws.

Dozens of suspicious court cases, with missing defendants, aim at getting web pages taken down or deindexed – The Washington Post

There are about 25 court cases throughout the country that have a suspicious profile:

All involve allegedly self-represented plaintiffs, yet they have similar snippets of legalese that suggest a common organization behind them. (A few others, having a slightly different profile, involve actual lawyers.)
All the ostensible defendants ostensibly agreed to injunctions being issued against them, which often leads to a very quick court order (in some cases, less than a week).
Of these 25-odd cases, 15 give the addresses of the defendants — but a private investigator (Giles Miller of Lynx Insights & Investigations) couldn’t find a single one of the ostensible defendants at the ostensible address.

Now, you might ask, what’s the point of suing a fake defendant (to the extent that some of these defendants are indeed fake)? How can anyone get any real money from a fake defendant? How can anyone order a fake defendant to obey a real injunction?

The answer is that Google and various other Internet platforms have a policy: They won’t take down material (or, in Google’s case, remove it from Google indexes) just because someone says it’s defamatory. Understandable — why would these companies want to adjudicate such factual disputes? But if they see a court order that declares that some material is defamatory, they tend to take down or deindex the material, relying on the court’s decision.

Yet the trouble is that these Internet platforms can’t really know if the injunction was issued against the actual author of the supposed defamation — or against a real person at all.

Source: Dozens of suspicious court cases, with missing defendants, aim at getting web pages taken down or deindexed – The Washington Post