The Linkielist

Linking ideas with the world

The Linkielist

Germany thinks about resurrecting the Stasi, getting rid of end-to-end chat app encryption and requiring decrypted plain-text.

Posted on by

Government officials in Germany are reportedly mulling a law to force chat app providers to hand over end-to-end encrypted conversations in plain text on demand.

According to Der Spiegel this month, the Euro nation’s Ministry of the Interior wants a new set of rules that would require operators of services like WhatsApp, Signal, Apple iMessage, and Telegram to cough up plain-text records of people’s private enciphered chats to authorities that obtain a court order.

This would expand German law, which right now only allows communications to be gathered from a suspect’s device itself, to also include the companies providing encrypted chat services and software. True and strong end-to-end encrypted conversations can only be decrypted by those participating in the discussion, so the proposed rules would require app makers to deliberately knacker or backdoor their code in order to comply. Those changes would be needed to allow them to collect messages passing through their systems and decrypt them on demand.

Up until now, German police have opted not to bother with trying to decrypt the contents of messages in transit, opting instead to simply seize and break into the device itself, where the messages are typically stored in plain text.

The new rules are set to be discussed by the members of the interior ministry in an upcoming June conference, and are likely to face stiff opposition not only on privacy grounds, but also in regards to the technical feasibility of the requirements.

Spokespeople for Facebook-owned WhatsApp, and Threema, makers of encrypted messaging software, were not available to comment.

The rules are the latest in an ongoing global feud between the developers of secure messaging apps and the governments. The apps, designed in part to let citizens, journalists, and activists communicate secured from the prying eyes of oppressive government regimes.

The governments, meanwhile, say that the apps also provide a safe haven for criminals and terror groups that want to plan attacks and illegal activities, making it harder for intelligence and police agencies to perform vital monitoring tasks.

The app developers note that even if governments do try to implement mandatory decryption (aka backdoor) capabilities, actually getting those tools to work properly, without opening up a massive new security hole in the platforms that miscreants and criminals could exploit, would be next to impossible.

Source: Germany mulls giving end-to-end chat app encryption das boot: Law requiring decrypted plain-text is in the works • The Register

Whatever happened to mail confidentiality then?

Google Now Forces Microsoft Edge Preview Users to Use Chrome for the Modern YouTube Experience – a bit like they fuck around with Firefox

Posted on by

Microsoft started testing a new Microsoft Edge browser based on Chromium a little while ago. The company has been releasing new canary and dev builds for the browser over the last few weeks, and the preview is actually really great. In fact, I have been using the new Microsoft Edge Canary on my main Windows machine and my MacBook Pro for more than a month, and it’s really good.

But if you watch YouTube quite a lot, you will face a new problem on the new Edge. It turns out, Google has randomly disabled the modern YouTube experience for users of the new Microsoft Edge. Users are now redirected to the old YouTube experience, which lacks the modern design as well as the dark theme for YouTube, as first spotted by Gustave Monce. And when you try to manually access the new YouTube from youtube.com/new, YouTube simply asks users to download Google Chrome, stating that the Edge browser isn’t supported. Ironically, the same page states “We support the latest versions of Chrome, Firefox, Opera, Safari, and Edge.”

The change affects the latest versions of Microsoft Edge Canary and Dev channels. It is worth noting that the classic Microsoft Edge based on EdgeHTML continues to work fine with the modern YouTube experience.

The weird thing here is that Microsoft has been working closely with Google engineers on the new Edge and Chromium. Both the companies engineers are working closely to improve Chromium and introduce new features like ARM64 support to Chromium. So it’s very odd that Google would prevent users of the new Microsoft Edge browser from using the modern YouTube experience. This is most likely an error on Google’s part, but it could be intentional, too — we really don’t know for now.

Source: Google Now Forces Microsoft Edge Preview Users to Use Chrome for the Modern YouTube Experience – Thurrott.com

See also:
Google isn’t the company that we should have handed the Web over to: why MS switching to Chromium is a bad idea

SpaceX Starlink satellites dazzle but pose big questions for astronomers – Musk thought things out well again, not.

Posted on by

The first batch of satellites were launched from Cape Canaveral, Florida, and deployed to orbit by a Falcon 9 rocket on May 23. Each contains a single solar array, which both captures and bounces sunlight off the satellites and, as a result, can sometimes be seen from Earth. On May 25, as the drifting luminescent army of satellites zoomed overhead, Dutch satellite tracker Marco Langbroek captured their marching, posting a stunning video to Vimeo.

In time, the satellites will drift apart and head to specific orbits so that satellite internet coverage can be beamed to every corner of the globe.

However, as the unusual display in the night sky quickly gathered steam across social media, some astronomers began to point out the potential problems the satellite system may pose for astronomy. At present, only 60 satellites are moving into their orbit, but eventually that number will reach 12,000, and a megaconstellation will encircle the Earth. Practically overnight, our view of the sky has changed.

“We’ve become used to change in space activities as slow and incremental, and suddenly, it’s fast and speeding up,” said Alice Gorman, space archeologist at Flinders University, Australia. “By its very visibility, Starlink has opened up some big questions: who gets to use Earth orbit and what for?”

Watch this: SpaceX launches first batch of Starlink satellites
7:05

Indeed, Starlink would triple the number of satellites orbiting the Earth. If thousands of satellites are sent into orbit, our view of space changes. Will we find ourselves in a position where it’s impossible to investigate the cosmos from the ground?

The quick answer: not forever, no. SpaceX designed the Starlink satellites to fall back to the Earth after about five years of service..

“The satellites are meant to put themselves in a re-entry orbit at the end of their mission life, and remove themselves from the debris population by burning up,” says Gorman.

But the long answer is: potentially. Astronomers already wrangle with the problems posed by space robots and satellites circling the Earth whenever they turn their ground-based telescopes toward the stars. Bright, reflective surfaces pose a problem because they obstruct our view of the universe.

More satellites equals cloudier vision, and Starlink plans to launch more satellites than ever.

When the sun is reflecting off the satellites’ solar panels, astronomers will have to account for the appearance of the satellites in their images. SpaceX was relatively mum about the design of the satellites leading up to launch, so it’s come as a bit of a surprise to some astronomers just how bright they are. However, the satellites will position their solar panels as they establish themselves in orbit, which should reduce their brightness.

Jonathan McDowell, an astronomer with the Harvard-Smithsonian Center for Astrophysics, perhaps summed it up best in a tweet, saying the satellites are “brighter than we had expected and still a problem, but somewhat less of a sky-is-on-fire problem.”

“Somewhat less of a sky-is-on-fire problem” sounds slightly reassuring, at least. But there do seem to be clear issues for the astronomy community..

Elon Musk, SpaceX CEO, jumped to the defense of his satellite system and noted on Twitter how “potentially helping billions of economically disadvantaged people is the greater good,” while making it clear that SpaceX plans to limit Starlink’s effects on astronomy. “We care a great deal about science,” Musk tweeted. He said he’s sent a note to the Starlink team to reduce albedo — that is, the amount of light the satellites reflect.

In addition, after a user suggested placing space telescopes using Starlink chassis into orbit to appease the astronomers, Musk said he “would love to do exactly that.” That might ease concerns, but will it slow our quickening colonization of Earth’s orbit? Unlikely.

“Space agencies and organizations have been cluttering the sky for decades and taking a very lax attitude to the long-term consequences,” said Gorman.

With a number of satellite constellations on the way, it will be critical for regulatory bodies and satellite providers to adequately manage the space debris and satellite problem, lest all of our space robots collide and lock us on Earth forever (yes, that’s a faint but possible catastrophic scenario)

Source: SpaceX Starlink satellites dazzle but pose big questions for astronomers – CNET

The Asus ZenBook Pro Duo laptop with two 4K screens – for some reason people are comparing to Apples touch bar, but has nothing to do with that.

Posted on by

The ZenBook Pro Duo has not one, but two 4K screens. (At least if you’re counting horizontal pixels.) There’s a 15-inch 16:9 OLED panel where you’d normally find the display on a laptop, then a 32:9 IPS “ScreenPad Plus” screen directly above the keyboard that’s the same width and half the height. It’s as if Asus looked at the MacBook Pro Touch Bar and thought “what if that, but with 32 times as many pixels?”

Unlike the Touch Bar, though, the ScreenPad Plus doesn’t take anything away from the ZenBook Pro Duo, except presumably battery life. Asus still included a full-sized keyboard with a function row, including an escape key, and the trackpad is located directly to the right. The design is very reminiscent of Asus’ Zephryus slimline gaming laptops — you even still get the light-up etching that lets you use the trackpad as a numpad. HP tried something similar recently, too, though its second screen was far smaller.

asus

Asus has built some software for the ScreenPad Plus that makes it more of a secondary control panel, but you can also use it as a full-on monitor, or even two if you want to split it into two smaller 16:9 1080p windows. You can also set it to work as an extension of the main screen, so websites rise up from above your keyboard as you scroll down, which is pretty unnerving. Or you could use it to watch Lawrence of Arabia while you jam on Excel spreadsheets.

The ZenBook Pro Duo has up to an eight-core Intel Core i9 processor with an Nvidia RTX 2060 GPU. There are four far-field microphones designed for use with Alexa and Cortana, and there’s an Echo-style blue light at the bottom edge that activates with voice commands. It has a Thunderbolt 3 port, two USB-A ports, a headphone jack, and a full-sized HDMI port.

Performance seemed fine in my brief time using the ZenBook Pro Duo, without any hiccups or hitches even when running an intensive video editing software demo. It’s a fairly hefty laptop at 2.5kg (about 5.5lbs), but that’s to be expected given the gaming laptop-class internals. I would also expect its battery life to fall somewhere close to that particular category of products, though we’ll have to wait and see about that.

While both of the screens looked good, I will say they looked different. Part of that is because of the searing intensity of the primary OLED panel, but the ScreenPad Plus is also coated with a matte finish, and usually looks less bright because of how you naturally view it at an off angle.

asus

Asus is also making a cheaper and smaller 14-inch model called the ZenBook Duo. The design and concept is basically the same, but both screens are full HD rather than 4K, there’s no Core i9 option, and the discrete GPU has been heavily downgraded to an MX250.

Asus hasn’t announced pricing or availability for the ZenBook Pro Duo or the ZenBook Duo, but they’re expected to land in the third quarter of this year.

Source: The Asus ZenBook Pro Duo is an extravagant laptop with two 4K screens – The Verge

Why they see any similtarity to the Apple touch bar is beyond me – this is sprung from a totally different well. The dual screen laptop concept has been around for a lot longer than Apple putting a tiny strip somewhere. This is something that’s actually useful.

Bose headphones spy on listeners, sell that information on without consent or knowledge: lawsuit

Posted on by

Bose Corp spies on its wireless headphone customers by using an app that tracks the music, podcasts and other audio they listen to, and violates their privacy rights by selling the information without permission, a lawsuit charged.

The complaint filed on Tuesday by Kyle Zak in federal court in Chicago seeks an injunction to stop Bose’s “wholesale disregard” for the privacy of customers who download its free Bose Connect app from Apple Inc or Google Play stores to their smartphones.

[…]

After paying $350 for his QuietComfort 35 headphones, Zak said he took Bose’s suggestion to “get the most out of your headphones” by downloading its app, and providing his name, email address and headphone serial number in the process.

But the Illinois resident said he was surprised to learn that Bose sent “all available media information” from his smartphone to third parties such as Segment.io, whose website promises to collect customer data and “send it anywhere.”

Audio choices offer “an incredible amount of insight” into customers’ personalities, behavior, politics and religious views, citing as an example that a person who listens to Muslim prayers might “very likely” be a Muslim, the complaint said.

“Defendants’ conduct demonstrates a wholesale disregard for consumer privacy rights,” the complaint said.

Zak is seeking millions of dollars of damages for buyers of headphones and speakers, including QuietComfort 35, QuietControl 30, SoundLink Around-Ear Wireless Headphones II, SoundLink Color II, SoundSport Wireless and SoundSport Pulse Wireless.

He also wants a halt to the data collection, which he said violates the federal Wiretap Act and Illinois laws against eavesdropping and consumer fraud.

Dore, a partner at Edelson PC, said customers do not see the Bose app’s user service and privacy agreements when signing up, and the privacy agreement says nothing about data collection.

Edelson specializes in suing technology companies over alleged privacy violations.

The case is Zak v Bose Corp, U.S. District Court, Northern District of Illinois, No. 17-02928.

Source: Bose headphones spy on listeners: lawsuit | Article [AMP] | Reuters

First American Financial Corp. Leaked 885 Million Title Insurance Records

Posted on by

The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. [NYSE:FAF] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser.

[…]

Earlier this week, KrebsOnSecurity was contacted by a real estate developer in Washington state who said he’d had little luck getting a response from the company about what he found, which was that a portion of its Web site (firstam.com) was leaking tens if not hundreds of millions of records. He said anyone who knew the URL for a valid document at the Web site could view other documents just by modifying a single digit in the link.

And this would potentially include anyone who’s ever been sent a document link via email by First American.

KrebsOnSecurity confirmed the real estate developer’s findings, which indicate that First American’s Web site exposed approximately 885 million files, the earliest dating back more than 16 years. No authentication was required to read the documents.

Many of the exposed files are records of wire transactions with bank account numbers and other information from home or property buyers and sellers.

[…]

“The title insurance agency collects all kinds of documents from both the buyer and seller, including Social Security numbers, drivers licenses, account statements, and even internal corporate documents if you’re a small business. You give them all kinds of private information and you expect that to stay private.”

[…]

A database like this also would give fraudsters a constant feed of new information about upcoming real estate financial transactions — including the email addresses, names and phone numbers of the closing agents and buyers.

Source: First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records — Krebs on Security

Samsung’s AI animates paintings and photos without 3D modeling

Posted on by

Engineers and researchers from Samsung’s AI Center in Moscow and Skolkovo Institute of Science and Technology have created a model that can generate realistic animated talking heads from images without relying on traditional methods, like 3D modeling.

[…]

“Effectively, the learned model serves as a realistic avatar of a person,” said engineer Egor Zakharov in a video explaining the results.

Well-known faces seen in the paper include Marilyn Monroe, Albert Einstein, Leonardo da Vinci’s Mona Lisa, and RZA from the Wu Tang Clan. The technology that focuses on synthesizing photorealistic head images and facial landmarks could be applied to video games, video conferences, or digital avatars like the kind now available on Samsung’s Galaxy S10. Facebook is also working on realistic avatars for its virtual reality initiatives.

Such tech could clearly also be used to create deepfakes.

Few-shot learning means the model can begin to animate a face using just a few images of an individual, or even a single image. Meta training with the VoxCeleb2 data set of videos is carried out before the model can animate previously unseen faces.

During the training process, the system creates three neural networks: The embedded network maps frames to vectors, a generator network maps facial landmarks in the synthesized video, and a discriminator network assesses the realism and pose of the generated images.

Source: Samsung’s AI animates paintings and photos without 3D modeling | VentureBeat

Beyond the Hype of Lab-Grown Diamonds

Posted on by

Billions of years ago when the world was still young, treasure began forming deep underground. As the edges of Earth’s tectonic plates plunged down into the upper mantle, bits of carbon, some likely hailing from long-dead life forms were melted and compressed into rigid lattices. Over millions of years, those lattices grew into the most durable, dazzling gems the planet had ever cooked up. And every so often, for reasons scientists still don’t fully understand, an eruption would send a stash of these stones rocketing to the surface inside a bubbly magma known as kimberlite.

Source: Beyond the Hype of Lab-Grown Diamonds

This article is an excellent analysis of the market and technologies used in Diamonds

G Suite passwords stored unhashed creds since 2005, and other passwords in plain text for 14 days for troubleshooting

Posted on by

Google admitted Tuesday its paid-for G Suite of cloudy apps aimed at businesses stored some user passwords in plaintext albeit in an encrypted form.

Administrators of accounts affected by the security blunder were warned via email that, in certain circumstances, passwords had not been hashed. Hashing is a standard industry practice that protects credentials by scrambling them using a one-way encryption algorithm.

Google was at pains to stress it was the enterprise non-consumer version of G Suite affected, that there were no signs of misuse of the passwords, and that the passwords were encrypted at rest on disk – though, we note, hashing them would have fully secured the sensitive info.

Before we get to the threat model part of this, there are essentially two security cockups at play here. The first involves a G Suite feature available from 2005 that allowed organizations’ admins to set their G Suite users’ passwords via the Google account admin console. That feature, designed for IT staff to help new colleagues set their passwords and log in, did not hash these passwords.

The second involves recording some user passwords in plaintext on disk, as they logged in, and keeping these unhashed credentials around for 14 days at a time, again encrypted at rest. This practice started in January this year, during attempts by Googlers to troubleshoot their login system, and has been stopped.

Source: G Suite’n’sour: Google resets passwords after storing some unhashed creds for months, years • The Register

Android and iOS devices impacted by new sensor calibration attack – it’s easy to follow your device everywhere online

Posted on by

A new device fingerprinting technique can track Android and iOS devices across the Internet by using factory-set sensor calibration details that any app or website can obtain without special permissions.

This new technique — called a calibration fingerprinting attack, or SensorID — works by using calibration details from gyroscope and magnetometer sensors on iOS; and calibration details from accelerometer, gyroscope, and magnetometer sensors on Android devices.

According to a team of academics from the University of Cambridge in the UK, SensorID impacts iOS devices more than Android smartphones. The reason is that Apple likes to calibrate iPhone and iPad sensors on its factory line, a process that only a few Android vendors are using to improve the accuracy of their smartphones’ sensors.

How does this technique work?

“Our approach works by carefully analysing the data from sensors which are accessible without any special permissions to both websites and apps,” the research team said in a research paper published yesterday.

“Our analysis infers the per-device factory calibration data which manufacturers embed into the firmware of the smartphone to compensate for systematic manufacturing errors [in their devices’ sensors],” researchers said.

This calibration data can then be used as a fingerprint, producing a unique identifier that advertising or analytics firms can use to track a user as they navigate across the internet.

Furthermore, because the calibration sensor fingerprint is the same when extracted using an app or via a website, this technique can also be used to track users as they switch between browsers and third-party apps, allowing analytics firms to get a full view of what users are doing on their devices.

Source: Android and iOS devices impacted by new sensor calibration attack | ZDNet

How the World’s First Digital Circuit Breaker Could Completely Change Our Powered World

Posted on by

This week the world’s first and only digital circuit breaker was certified for commercial use. The technology, invented by Atom Power, has been listed by Underwriters Laboratories (UL), the global standard for consumer safety. This new breaker makes power easier to manage and 3000 times faster than the fastest mechanical breaker, marking the most radical advancement in power distribution since Thomas Edison.

Picture the fuse box in your basement, each switch assigned to different electrical components of your home. These switches are designed to break a circuit to prevent the overloaded wires in your wall from overheating and causing a fire. When this happens, you plod down to your mechanical room and flick the switches on again.

[…]

His experienced based inquiry has revolved around a central assertion that analog infrastructure doesn’t allow us to control our power the way we should be able to. That idea has led to some pretty critical questions: “What would it take to make power systems controllable?” and “Why shouldn’t that control be built in to the circuit breaker itself

[…]

Instead of using mechanics to switch the power, we apply digital inputs,” Kennedy told Popular Mechanics. “Now I have no moving parts. Now I have the ability to connect things like iPhones and iPads for remote power management, which increases safety and improves efficiency. I can set the distribution panel to a schedule so the flow of power is seamless, unlimited, and shifts between sources automatically. You literally wouldn’t notice. The lights wouldn’t even flicker.”

[…]

For a grid-connected solar home, for example, residents sometimes have to disconnect their solar input because traditional power systems (including the circuit breakers) aren’t advanced enough to properly manage multiple power sources that change.

In short, “the modern world has outgrown the risks and constraints of traditional circuit breakers”—a company claim, but also a compelling fact when you consider these inefficiencies and the dangers of a system that requires manual remediation of power surges and failures.

“Old school breakers simply can’t operate as fast as the flow of power,” says Kennedy. “When things go wrong in larger buildings, they go really wrong because you typically have a much bigger source feeding that demand.”

[…]

Poor energy management results in 30,000 electrical hazard accidents per year. Arc flash events can take out an entire building for weeks. Due to their ability to interrupt 100,000 amps with unprecedented speed, digital breakers effectively eliminate these risks, resulting in “the safest, fastest, most intelligent system to date.”

Source: How the World’s First Digital Circuit Breaker Could Completely Change Our Powered World

Over 25,000 Linksys Smart Wi-Fi routers kept info on who connected to them and are now leaking this

Posted on by

Using data provided by BinaryEdge, our scans have found 25,617 Linksys Smart Wi-Fi routers are currently leaking sensitive information to the public internet, including:

    • MAC address of every device that’s ever connected to it (full historical record, not just active devices)
    • Device name (such as “TROY-PC” or “Mat’s MacBook Pro”)
    • Operating system (such as “Windows 7” or “Android”)

In some cases additional metadata is logged such as device type, manufacturer, model number, and description – as seen in the example below.

Example metadata leaking by Linksys Smart Wi-Fi routers

Other sensitive information about the router such as the WAN settings, firewall status, firmware update settings, and DDNS settings are also leaked publicly.

Source: Over 25,000 Linksys Smart Wi-Fi routers vulnerable to sensitive information disclosure flaw – Bad Packets Report

Phone makers and carriers receive your location data, friends and more that Facebook pulls from your phone

Posted on by

A confidential Facebook document reviewed by The Intercept shows that the social network courts carriers, along with phone makers — some 100 different companies in 50 countries — by offering the use of even more surveillance data, pulled straight from your smartphone by Facebook itself.

Offered to select Facebook partners, the data includes not just technical information about Facebook members’ devices and use of Wi-Fi and cellular networks, but also their past locations, interests, and even their social groups. This data is sourced not just from the company’s main iOS and Android apps, but from Instagram and Messenger as well. The data has been used by Facebook partners to assess their standing against competitors, including customers lost to and won from them, but also for more controversial uses like racially targeted ads.

[…]

Facebook’s cellphone partnerships are particularly worrisome because of the extensive surveillance powers already enjoyed by carriers like AT&T and T-Mobile: Just as your internet service provider is capable of watching the data that bounces between your home and the wider world, telecommunications companies have a privileged vantage point from which they can glean a great deal of information about how, when, and where you’re using your phone. AT&T, for example, states plainly in its privacy policy that it collects and stores information “about the websites you visit and the mobile applications you use on our networks.” Paired with carriers’ calling and texting oversight, that accounts for just about everything you’d do on your smartphone.

[…]

the Facebook mobile app harvests and packages eight different categories of information […] These categories include use of video, demographics, location, use of Wi-Fi and cellular networks, personal interests, device information, and friend homophily, an academic term of art. A 2017 article on social media friendship from the Journal of the Society of Multivariate Experimental Psychology defined “homophily” in this context as “the tendency of nodes to form relations with those who are similar to themselves.” In other words, Facebook is using your phone to not only provide behavioral data about you to cellphone carriers, but about your friends as well.

Source: Facebook’s Work With Phone Carriers Alarms Legal Experts

Millions of Instagram influencers had their private contact data scraped and exposed on AWS

Posted on by

A massive database containing contact information of millions of Instagram influencers, celebrities and brand accounts has been found online.

The database, hosted by Amazon Web Services, was left exposed and without a password allowing anyone to look inside. At the time of writing, the database had over 49 million records — but was growing by the hour.

From a brief review of the data, each record contained public data scraped from influencer Instagram accounts, including their bio, profile picture, the number of followers they have, if they’re verified and their location by city and country, but also contained their private contact information, such as the Instagram account owner’s email address and phone number.

Security researcher Anurag Sen discovered the database and alerted TechCrunch in an effort to find the owner and get the database secured. We traced the database back to Mumbai-based social media marketing firm Chtrbox, which pays influencers to post sponsored content on their accounts. Each record in the database contained a record that calculated the worth of each account, based off the number of followers, engagement, reach, likes and shares they had. This was used as a metric to determine how much the company could pay an Instagram celebrity or influencer to post an ad.

Source: Millions of Instagram influencers had their private contact data scraped and exposed | TechCrunch

Bits of Freedom cries to halt the shocking personal data sent out to everyone using Real Time Bidding advertising

Posted on by

During RTB, personal data such as what you read online, what you watch, your location, your sexual orientation, etc is sent to a whole slew of advertisers so they can select you as an object to show their adverts do. This, together with other profiling information sent, can be used to build up a long term profile of you and to identify you. There is no control about what happens to this data once it has been sent. This is clearly contrary to the spirit of the AVG / GDPR. The two standard RTB frameworks – Google’s Authorized Buyers and IAB’s OpenRTB both refuse to accept any responsibility about personal information, whilst both are encouraging and facilitating the trade of it.

Source: Bits of Freedom: stop met grootschalig lekken van persoonsgegevens bij real time bidding – Emerce

Google Gmail tracks purchase history through gmail, puts them on https://myaccount.google.com/purchases

Posted on by

Google tracks a lot of what you buy, even if you purchased it elsewhere, like in a store or from Amazon.

Last week, CEO Sundar Pichai wrote a New York Times op-ed that said “privacy cannot be a luxury good.” But behind the scenes, Google is still collecting a lot of personal information from the services you use, such as Gmail, and some of it can’t be easily deleted.

A page called “Purchases ” shows an accurate list of many — though not all — of the things I’ve bought dating back to at least 2012. I made these purchases using online services or apps such as Amazon, DoorDash or Seamless, or in stores such as Macy’s, but never directly through Google.

But because the digital receipts went to my Gmail account, Google has a list of info about my buying habits.

[…]

But there isn’t an easy way to remove all of this. You can delete all the receipts in your Gmail inbox and archived messages. But, if you’re like me, you might save receipts in Gmail in case you need them later for returns. There is no way to delete them from Purchases without also deleting them from Gmail — when you click on the “Delete” option in Purchases, it simply guides you back to the Gmail message.

[…]

Google’s privacy page says that only you can view your purchases. But it says “Information about your orders may also be saved with your activity in other Google services ” and that you can see and delete this information on a separate “My Activity” page.

Except you can’t. Google’s activity controls page doesn’t give you any ability to manage the data it stores on Purchases.

Google told CNBC you can turn off the tracking entirely, but you have to go to another page for search setting preferences. However, when CNBC tried this, it didn’t work — there was no such option to fully turn off the tracking. It’s weird this isn’t front and center on Google’s new privacy pages or even in Google’s privacy checkup feature.

Google says it doesn’t use your Gmail to show you ads and promises it “does not sell your personal information, which includes your Gmail and Google Account information,” and does “not share your personal information with advertisers, unless you have asked us to.”

But, for reasons that still aren’t clear, it’s pulling that information out of your Gmail and dumping it into a “Purchases” page most people don’t seem to know exists.

Source: Google Gmail tracks purchase history — how to delete it

Radio signals used for ILS plane landings can easily be spoofed using tools amounting to just $600

Posted on by

With about $600 and a few tools, hackers could fake the radio signals used by commercial airplanes to navigate and land safely, according to new research.

In a paper and demonstration from researchers at Northeastern University in Boston, a software defined radio — a non-traditional radio that uses software instead of hardware for many components — successfully tricks a simulated plane into thinking that the aircraft is traveling off-course. 

Through a process called ‘spoofing’ — a term also applied to scam and robo-callers who fake their numbers — researchers are able to deceive an aircraft’s course deviation indicator into thinking the plane is off-center.

This causes it to misalign or falsely ‘correct’ its trajectory and land adjacent to the runway.

Scroll down for video 

With about $600 and a few tools, hackers could fake the radio signals used by commercial airplanes to navigate and land safely, according to new research. In a scary demonstrations, researchers were able to simulate an attack on the radio signals used by nearly all aircraft

+3

With about $600 and a few tools, hackers could fake the radio signals used by commercial airplanes to navigate and land safely, according to new research. In a scary demonstrations, researchers were able to simulate an attack on the radio signals used by nearly all aircraft

As first reported by Ars Technica, the radio signals spoofed by their device, are the same signals used in almost every aircraft throughout the last 50 years, including those on-board large commercial jetliners.

Because of the technology’s age, radio signals used in Instrument Landing Systems (ILS), are not encrypted or authenticated like other digitally transferred data, they say.

While the tools used by researchers in the demonstration aren’t necessarily new, Ars Technica notes that the cost of such devices have come down, making the type of attack more feasible for hackers than ever before.

Researchers note that an attack using their method is possible, but in many cases, misaligned planes can swiftly be corrected by adept pilots who are able to see their positioning in clear conditions and either adjust or perform a fly-around.

Source: Radio signals used to land planes can easily be HACKED using tools amounting to just $600 | Daily Mail Online

One-Third of Ether Held by 376 People – Bloomberg

Posted on by

Just 376 people hold a third of all Ether, the cryptocurrency that powers the Ethereum blockchain, according to new research by Chainalysis Inc.

Large holders are known in the crypto market as “whales,” which Chainalysis defines as individuals who hold their assets in digital wallets and not on an exchange, Kim Grauer, a senior economist at the company, said in an interview. By comparison, 448 people own 20 percent of all Bitcoin, she said.

Chainalysis also looked at the effect Ether whales have on price, and found that large holders don’t move their cryptocurrency often.

“The majority of whales aren’t traders,” she said. “They’re mostly holding.”

Ether rises amid crypto market rally

The study also found that when a whale moves Ether from a wallet to an exchange, there is a small but statistically significant effect on market volatility.

Investor sentiment and the price of Bitcoin are strong indicators of where Ether will trade, the Chainalysis research found. As Bitcoin rallied 52 percent since the beginning of May, Ether rose 48 percent.

Source: One-Third of Ether Held by 376 People – Bloomberg

Hackers abuse ASUS cloud service to install backdoor on users’ PCs – again

Posted on by

ASUS’ update mechanism has once again been abused to install malware that backdoors PCs, researchers from Eset reported earlier this week. The researchers, who continue to investigate the incident, said they believe the attacks are the result of router-level man-in-the-middle attacks that exploit insecure HTTP connections between end users and ASUS servers, along with incomplete code-signing to validate the authenticity of received files before they’re executed.

Plead, as the malware is known, is the work of espionage hackers Trend Micro calls the BlackTech Group, which targets government agencies and private organizations in Asia. Last year, the group used legitimate code-signing certificates stolen from router-maker D-Link to cryptographically authenticate itself as trustworthy. Before that, the BlackTech Group used spear-phishing emails and vulnerable routers to serve as command-and-control servers for its malware.

Source: Hackers abuse ASUS cloud service to install backdoor on users’ PCs | Ars Technica

Scientists create mind-controlled hearing aid able to single out voices

Posted on by

A mind-controlled hearing aid that allows the wearer to focus on particular voices has been created by scientists, who say it could transform the ability of those with hearing impairments to cope with noisy environments.

The device mimics the brain’s natural ability to single out and amplify one voice against background conversation. Until now, even the most advanced hearing aids work by boosting all voices at once, which can be experienced as a cacophony of sound for the wearer, especially in crowded environments.

Nima Mesgarani, who led the latest advance at Columbia University in New York, said: “The brain area that processes sound is extraordinarily sensitive and powerful. It can amplify one voice over others, seemingly effortlessly, while today’s hearing aids still pale in comparison.”

This can severely hinder a wearer’s ability to join in conversations, making busy social occasions particularly challenging.

[…]

The hearing aid first uses an algorithm to automatically separate the voices of multiple speakers. It then compares these audio tracks to the brain activity of the listener. Previous work by Mesgarani’s lab found that it is possible to identify which person someone is paying attention to, as their brain activity tracks the sound waves of that voice most closely.

The device compares the audio of each speaker to the brain waves of the person wearing the hearing aid. The speaker whose voice pattern most closely matches the listener’s brain waves is amplified over the others, allowing them to effortlessly tune in to that person.

The scientists developed an earlier version of the system in 2017 that, while promising, had the major limitation that it had to be pre-trained to recognise speakers’ voices. Crucially, the latest device works for voices it has never heard before.

[…]

The current version of the hearing aid, which involved direct implants into the brain, would be unsuitable for mainstream use. But the team believe it will be possible to create a non-invasive version of the device within the next five years, which would monitor brain activity using electrodes placed inside the ear, or under the skin of the scalp.

In theory, Mesgarani said, the device could also be used like a pair of audio “binoculars” to covertly listen in on people’s conversations, although this was not the intended application.

Source: Scientists create mind-controlled hearing aid | Society | The Guardian

Freed whistleblower Chelsea Manning back in jail for refusing to testify before secret grand jury

Posted on by

After seven days of freedom, US Army whistleblower Chelsea Manning is back behind bars for refusing to testify before a secret federal grand jury investigating WikiLeaks.

District Court Judge Anthony Trenga ordered Manning back to prison, and said she will, in addition, be fined $500 a day for the first 30 days in the clink, and $1,000 a day after that, until she testifies. Manning previously served 63 days in the cooler for refusing to talk, 28 of which were in solitary confinement.

“We are of course disappointed with the outcome of today’s hearing, but I anticipate it will be exactly as coercive as the previous sanction — which is to say not at all,” her attorney Moira Meltzer-Cohen said in a statement on Thursday.

“In 2010 Chelsea made a principled decision to let the world see the true nature modern asymmetric warfare. It is telling that the United States has always been more concerned with the disclosure of those documents than with the damning substance of the disclosures.”

The grand jury, which was kept secret until a typo revealed its existence, is researching the 2010 WikiLeaks publication of US State Department cables and the Collateral Murder video showing two journalists being killed in Iraq by US forces, as well as other documents relating to the ongoing wars in Iraq and Afghanistan.

[…]

After nearly seven years behind bars, Manning had her sentence commuted by President Obama, and was a free woman, for a while. Her refusal to testify in front of a secret grand jury on the grounds that they are undemocratic means she has now been taken into custody again until she changes her mind.

“Facing jail again, potentially today, doesn’t change my stance,” she said before today’s hearing.

“The prosecutors are deliberately placing me in an impossible position: go to jail and face the prospect of being held in contempt again or forgoing my principles and the strong positions that I hold dear. The latter is a far worse jail than the government can produce.”

Source: Freed whistleblower Chelsea Manning back in jail for refusing to testify before secret grand jury • The Register

Bio-glue that moves with a beating heart can repair wounds in pigs

Posted on by

Uncontrolled bleeding during surgery can cause death. What if, instead of slow surgical stitching, you could rapidly glue a wound together?

A new “bio-glue” — an experimental adhesive gel that is activated by a flash of light — has been proven to stop high pressure bleeding in the hearts of pigs.
Additional research confirming the safety of this product is needed before experiments can begin in humans, according to the authors of a study published Wednesday in the journal Nature Communications.
Around the globe, more than 234 million surgeries are performed each year, the World Health Organization estimates.
Surgical suturing is especially difficult when dealing with diseased, damaged or small blood vessels, according to the study authors. Existing surgical products, such as Fibrin Glue and Surgiflo, have been effective in stopping bleeding during surgeries, but they take minutes to set and in some cases require additional stitching.
Numerous attempts have been made to create improved and swifter-acting surgical adhesives, but few nontoxic materials can meet the criteria of holding fast on wet tissues while resisting pressure and the movement of a beating heart.
A team of researchers from Zhejiang University School of Medicine in Hangzhou, China, accepted the challenge.
Inspired by the matrix composition of human connective tissues, they created a gel composed of a network of proteins and other molecules. The product, which requires ultraviolet light to activate, can adhere within seconds and then bond to wet biological tissue surfaces.
In early experiments, the research team showed that their bio-glue could seal wounds to pig livers.
Next, they demonstrated that wounds and punctures of hearts — among the most difficult of surgical challenges — could also be sealed using only the bio-glue, no stitches.

Source: Bio-glue that moves with a beating heart can repair wounds in pigs – CNN

Internet Meme Pioneer YTMND Shuts Down

Posted on by

You’re the Man Now Dog, a pioneer in the internet meme space, has shut down.

The online community at YTMND.com allowed users to upload an image or a GIF and pair it with audio for hilarious results. Traffic to the website, however, dried up years ago with the rise of Facebook, Twitter, and YouTube. In 2016, site creator Max Goldberg said YTMND would likely shut down soon due to declining ad revenue and his ill health.

“It seems like the internet has moved on,” Goldberg told Gizmodo at the time.

The site dates back to 2001 when Goldberg paired a looping audio clip of Sean Connery uttering the line “You’re the man now, dog!” with some text and placed it all on a webpage, Yourethemannowdog.com.

In 2004, Goldberg expanded on that with a site that let users pair images with audio, so they could create clips and post them online. The end result was YTMND, which by 2006 was reportedly amassing 4 million visitors a month and 120,000 contributors. By 2012, it had almost a million pages devoted to user-created memes. But it couldn’t compete with the rise of social media and the smartphone.

What prompted Goldberg to finally pull the plug on the site in recent days isn’t clear. He and the site didn’t immediately respond to a request for comment. However, all the pages have been saved on the Internet Archive and its Wayback Machine. So you’ll still be able to enjoy all the site’s content for nostalgia’s sake.

Source: Internet Meme Pioneer YTMND Shuts Down | News & Opinion | PCMag.com

A real real shame

Cambridge scientists create world’s first living organism with fully redesigned DNA

Posted on by

The lab-made microbe, a strain of bacteria that is normally found in soil and the human gut, is similar to its natural cousins but survives on a smaller set of genetic instructions.

The bug’s existence proves life can exist with a restricted genetic code and paves the way for organisms whose biological machinery is commandeered to make drugs and useful materials, or to add new features such as virus resistance.

In a two-year effort, researchers at the laboratory of molecular biology, at Cambridge University, read and redesigned the DNA of the bacterium Escherichia coli (E coli), before creating cells with a synthetic version of the altered genome.

[…]

The Cambridge team set out to redesign the E coli genome by removing some of its superfluous codons. Working on a computer, the scientists went through the bug’s DNA. Whenever they came across TCG, a codon that makes an amino acid called serine, they rewrote it as AGC, which does the same job. They replaced two more codons in a similar way.

More than 18,000 edits later, the scientists had removed every occurrence of the three codons from the bug’s genome. The redesigned genetic code was then chemically synthesised and, piece by piece, added to E coli where it replaced the organism’s natural genome. The result, reported in Nature, is a microbe with a completely synthetic and radically altered DNA code. Known as Syn61, the bug is a little longer than normal, and grows more slowly, but survives nonetheless.

Source: Cambridge scientists create world’s first living organism with fully redesigned DNA | Science | The Guardian

22 EU Member States sign new military mobility programme

Posted on by

In the margins of today’s EDA Steering Board, 22 Member States (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Estonia, France, Greece, Hungary, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Spain, Sweden) and EDA signed a new programme that will facilitate the granting of cross-border surface and air movement permissions. The programme is developed in the framework of EDA’s work on military mobility. It implements an important part of the ‘Action Plan on Military Mobility’ which was presented by the High Representative of the Union for Foreign Affairs and Security Policy (HR) and the Commission to the European Parliament and the Council in March 2018. Military mobility is also highlighted in the EU-NATO Joint Declaration signed in Warsaw in 2016.

The purpose of the programme signed today is to harmonise different national regulations of the participating Member States. It should allow Member States to reduce the administrative burden associated with different permission procedures and thus significantly shorten the timelines for granting surface and air cross border movement permissions. The programme provides the basis for important activities at technical and procedural level to develop the necessary arrangements for cross border movement per transport mode during crises, preparations for crises, training and day-to-day business. The arrangements cover surface (road, rail and inland waterways) and air movements (Remotely Piloted Aircraft Systems, fighter aircraft or helicopters). They are expected to be finalised in 2020.

Source: 22 Member States sign new military mobility programme