×
Encryption

UK Gov't Plans Publicity Blitz To Undermine Privacy of Your Chats (rollingstone.com) 53

The UK government is set to launch a multi-pronged publicity attack on end-to-end encryption, Rolling Stone has learned. From the report: One key objective: mobilizing public opinion against Facebook's decision to encrypt its Messenger app. The Home Office has hired the M&C Saatchi advertising agency -- a spin-off of Saatchi and Saatchi, which made the "Labour Isn't Working" election posters, among the most famous in UK political history -- to plan the campaign, using public funds. According to documents reviewed by Rolling Stone, one the activities considered as part of the publicity offensive is a striking stunt -- placing an adult and child (both actors) in a glass box, with the adult looking "knowingly" at the child as the glass fades to black. Multiple sources confirmed the campaign was due to start this month, with privacy groups already planning a counter-campaign.
Bitcoin

Spain Moves To Rein in Crypto-asset Advertising (reuters.com) 17

Spain moved on Monday to regulate rampant advertising of crypto assets, including by social media influencers, tasking the stock market supervisor with authorising mass campaigns and making sure investors are aware of risks. From a report: The rapid growth of cryptocurrencies and digital assets pegged to traditional currencies has drawn attention from regulators worldwide, who fear they could put the financial system at risk if not monitored. The Spanish government said in its official bulletin advertisers and companies that market crypto assets will have to inform the CNMV watchdog at least 10 days in advance about the content of campaigns targeting more than 100,000 people. The new regulations will start from mid-February and allow the CNMV to specifically monitor advertising for all types of crypto assets and to include warnings about risks involved in such investment.
Facebook

Zuckerberg and Pichai Allegedly Signed Off On Illegal Facebook-Google Ad Deal (buzzfeednews.com) 23

BuzzFeed News reports: Google CEO Sundar Pichai and Facebook CEO Mark Zuckerberg personally signed off on a secret advertising deal that allegedly gave Facebook special privileges on Google's ad platform, according to newly unredacted court documents filed on Friday.

The allegation is from a complaint first filed in December 2020 by Texas and several other states against Google for engaging in "false, deceptive, or misleading acts" while operating its buy-and-sell auction system for digital ads. In the complaint, state attorneys general claim Google illegally teamed up with Facebook, its fiercest competitor in the digital advertising market, for a 2018 deal Google dubbed "Jedi Blue" in a reference to Star Wars. Prior to the alleged deal, Facebook appeared to threaten Google's dominance in the market by backing an ad-buying technique called "header bidding." "Google understood the severity of the threat to its position if Facebook were to enter the market and support header bidding," the complaint reads. "To diffuse this threat, Google made overtures to Facebook."

In the end, Facebook backed off after Google agreed to give the social network "information, speed, and other advantages" in auctions run by Google, the complaint says.

The newly unredacted version of the complaint shows that the deal was allegedly struck at the highest levels of the companies, a noteworthy level of cooperation from two of the most powerful companies in the world.

Businesses

Moxie Marlinspike Has Stepped Down as CEO of Signal (theverge.com) 29

Signal founder Moxie Marlinspike is stepping down as CEO of the company, he announced in a blog post on Monday. Executive chairman Brian Acton will serve as acting CEO until a replacement is found. From a report: "Every day, I'm struck by how boundless Signal's potential looks, and I want to bring in someone with fresh energy and commitment to make the most of that," Marlinspike wrote. "I now feel very comfortable replacing myself as CEO based on the team we have." The company has met with several CEO candidates "over the last few months," Marlinspike wrote, but the search remains ongoing. Founded in 2014, Signal has grown into one of the most trusted and robust apps for encrypted messaging. The service has more than 40 million monthly users and is regularly recommended in security guides. Established as a nonprofit, the company is not supported by advertising or app sales, instead relying on donations and a recently launched sustainer program.
The Courts

Lawsuit Says Google Pays Apple To Keep Away From Internet Search Market (pymnts.com) 76

A class action lawsuit has been filed in California against Google, Apple and the CEOs of both tech giants for allegedly violating antitrust laws, according to a press release. The complaint calls for the breakup of Google and Apple into separate and independent companies in keeping with the precedent of the of Standard Oil company into Exxon, Mobile, Conoco, Amoco, Sohio, Chevron and others, the release stated. PYMNTS.com reports: Charges in the suit allege that Google and Apple have agreed that Apple would keep out of the internet search business against Google, according to the release. It also claims Google shares its search profits with Apple and gives Apple preferential treatment for all Apple devices; annual multi-billion-dollar payments by Google to Apple not to compete in the search business; suppression of smaller competitors to keep them from the search sector; and acquiring competing companies. Allegations also include higher advertising rates than rates that would be in a competitive system, the release stated.

Attorneys are seeking an end to the alleged billion-dollar payments to Apple from Google and asking the court to prohibit non-compete agreements between the two companies and end the profit-sharing agreement and the preferential treatment for Google on Apple devices, according to the release. "These powerful companies abused their size by unlawfully foreclosing and monopolizing major markets which in an otherwise free enterprise system would have created jobs, lowered prices, increased production, added new competitors, encouraged innovations and increased the quality of services in the digital age," Joseph M. Alioto of Alioto Law, who is representing the plaintiffs, said in the release.

Transportation

New French Law Requires Car Commercials To Tell People To Walk or Bike Instead (thedrive.com) 116

An anonymous reader shares a report: Whether it's cigarettes or alcohol, many governments have legislated that companies must warn consumers of the negative effects of their products. This is often achieved on packaging or required in advertising. France is now intending to bring such measures to the automotive industry, forcing carmakers to supplement ads with messages about greener transport alternatives, as reported by CTV News. Coming into force on March 1st, the legislation is the product of years of lobbying from French environmental groups. The law requires the mention of one of three statements in any given advert. Roughly translated, these are "For short journeys, walk or cycle," as well as "think about carpooling" and "Take public transport daily."

These messages must be included in all advertising, whether in print, online, or broadcast on radio or TV. The messages must be clearly visible on screen, or in the case of radio ads, be spoken aloud after the ad proper is finished. A hashtag, #SeDeplacerMoinsPolluer, is also required to be displayed in certain contexts, which translates to "Move without pollution." Fines for non-compliance can range up to $56,450. It's part of a wider push to cut down on transport emissions in France, with private cars making up a full 15 percent of the country's greenhouse gas output. The country has already pledged to end the sale of gas and diesel-powered cars by 2040, while the city of Paris has banned older, more polluting vehicles from the city center.

Security

Cyberattack On One of Norway's Largest Media Companies Shuts Down Presses (therecord.media) 11

An anonymous reader quotes a report from The Record: Amedia, the largest local news publisher in Norway, announced on Tuesday that several of its central computer systems were shut down in what it is calling an apparent "serious" cyberattack. The attack is preventing the company from printing Wednesday's edition of physical newspapers, and presses will continue to be halted until the issue is resolved, Amedia executive vice president of technology Pal Nedregotten said in a statement. The hack also impacts the company's advertising and subscription systems, preventing advertisers from purchasing new ads and stopping subscribers from ordering or canceling subscriptions.

The company said it is unclear whether personal information has been compromised -- the subscription system affected by the attack contains names, addresses, phone numbers, and subscription history of customers. Data such as passwords, read history, and financial information are not affected, the company said. Amedia publishes more than 90 newspapers and other publications that reach more than 2.5 million Norwegians, according to the company's website. The attack on Amedia is the third major Norwegian cyberattack reported over the last several days.
"We are in the process of gaining an overview of the situation, but do not yet know the full potential for damage. We have already implemented comprehensive measures to limit the damage and to restore normal operations as quickly as possible," said Nedregotten in a translated statement on the company's website.
Transportation

Concerns About Big Tech's Next Potential Monopoly: Connected Cars (politico.com) 102

Politico reports: When Ford announced that starting in 2023 its cars and trucks would come with Google Maps, Assistant and Play Store preinstalled, CEO Jim Farley called the partnership between his iconic U.S. automaker and the search giant a chance to "reinvent" the automobile — making it an office-on-wheels, with more connectivity than any phone or laptop. "We were spending hundreds and hundreds and hundreds of millions every year, keeping up with basically a generic experience that was not competitive to your cellphone," Farley crowed on CNBC, announcing the six-year deal with the tech giant.... But many tech-industry watchdogs looked at the Ford-Google car of the future with different eyes. They fear that tech companies will soon be doing to cars what they did to phones: Tying their exclusive operating systems to specific products to force out competitors and dominate a huge swath of the global economy.

Indeed, the smartphone wars are over, and Google and Apple won. Now they — and Amazon — are battling to control how you operate within your car. All three see autos as the next great opportunity to reach American consumers, who spend more time in the driver's seat than anywhere outside their home or workplace. And automakers, after years of floundering to incorporate cutting-edge technologies into cars on their own, are increasingly eager for Silicon Valley's help — hoping to adopt both its tech and its lucrative business models where consumers pay monthly for ongoing services instead of shelling out for a product just once. Now, having missed the boat as the tech giants cornered the market on smartphones, some policymakers and regulators believe the battle over connected cars represents a chance to block potential monopolies before they form.

State attorneys general who sued Google in 2020 for monopolizing online search highlighted concerns about the company's move into autonomous cars in their federal antitrust complaint. Meanwhile, in Europe, the EU's competition authority has opened a probe into Google's contracts related to connected cars... While Silicon Valley and automakers are thrilled about the future of connected and autonomous cars, regulators and privacy advocates are less so. "These companies have an amount of data on us that they shouldn't have, and they have a history of not using it in responsible ways," said Katharine Trendacosta of the digital civil liberties group Electronic Frontier Foundation. "They have a history of going back on promises they have made about that data."

She cited Google's pledge during the DoubleClick acquisition in 2008 — which it later reneged on — not to combine data from its consumer products with that from its advertising services.

The article quotes Tennessee Attorney General Herbert Slatery III, who last December complained that "When smartphones took off, Google made sure they controlled search on Apple's iPhone. They are doing the same thing on voice and connected cars. It's a similar playbook." And an executive at an automotive supplier that competes with Google tells Politico that Google is already "corralling everything through their system and controls what information is released downstream."

And Jim Heffner, a vice president at Cox Automotive Mobility, adds that "The ride is no longer the point. Data is the cornerstone. ... Apple and Google and others want to be at the epicenter of that."
The Almighty Buck

Twitch Co-Founder Gets Discord Hacked, $150,000 Stolen From Users In NFT Scam (kotaku.com) 22

Luke Plunkett writes via Kotaku: Justin Kan, a co-founder of Twitch and the dude Justin.TV was named for, last week decided to launch a site called Fractal. It was to be a 'marketplace' where in-game items could be bought and sold as NFTs. Later, in Fractal's Discord server, a link appeared advertising a drop of 3,333 NFTs. You may have guessed what happened next. As Twitch reporter Zach Bussey has detailed, the message, which appeared legit since it was coming from inside the house, had actually been posted by someone gaining access to Fractal's Discord bot, pointing towards 'Fractai', not Fractal. The scammers managed to "sell" 3,294 NFTs before the plug was pulled. There were of course no actual NFTs being sold at all, just money being straight up stolen -- over $150,000 -- though you'd be forgiven for wondering what the difference is.

In response, the Fractal team issued a statement acknowledging the breach, along with a promise they are "going to make this right." [...] ractal say they are "planning to fully compensate these 373 victims," before adding the extraordinary warning, "We must use our best judgement as there's no 'undo button' in crypto," making the entire post read like a textbook example of showcasing why this is such a shitty space. Meanwhile, Kan issued a short video statement of his own, alongside warnings that this Discord scam had been perpetrated on other NFT communities as well.

Education

Study Finds 'Serious Security Risks' In K-12 School Apps (therecord.media) 16

An anonymous reader quotes a report from The Record: Many apps used by schools contain features that can lead to the "unregulated and out of control" sharing of student data to advertising companies and other security issues, according to a report published Monday by the nonprofit Me2B Alliance. The report follows up on research published by the group in May, which audited 73 apps used by 38 schools to find that 60% of them were sending student data to a variety of third parties. Roughly half of them were sending student data to Google, while 14% were sending data to Facebook.

In the update, Me2B specifically looked at the use of a common feature called "WebView," which allows developers to integrate web pages into apps. Although the feature allows schools to include dynamic details -- like calendars and results of sporting events -- in apps without having to update the app itself, it can lead to the siphoning of student data and, in particularly bad cases, students and parents being targeted by scams. For example, on several occasions the researchers observed the hijacking of web pages linked to by school apps, leading users to malicious sites. An app used by Maryland's largest school district accidentally directed users to a compromised site that once was used for the district's sports teams. The Quinlan, Texas school district had a sports domain integrated into its app that was purchased by an unknown actor for $30 before anyone took action -- a security threat that's sometimes called a "dangling domain."
Some of the recommendations to mitigate security risks include "training for app administrators, creating processes at schools for keeping track of expiring URLs, requiring schools to report lost or dangling domains within a specific time, and launching a 'privacy bounty program' at the US Department of Education to audit school apps," reports The Record. "But perhaps the fastest way to reduce these risks is to alter the way the apps work."

"Apple and Google can change rules for in-app WebView links to ensure app developers can't overrule a local device browser preference," said Zach Edwards, who is in charge of data integrity testing for the Me2B Alliance.
Microsoft

Cortana Would Be Named Bingo if Steve Ballmer Had His Way (theverge.com) 61

Steve Ballmer wanted Microsoft's Cortana AI to be called "Bingo" so it would be more Microsoft-branded. From a report: That's according to former Microsoft product manager Sandeep Paruchuri, who recounted the story of how Microsoft's AI assistant got its name to writer Alice Newton Rex as part of a deep dive into Cortana's origins. While we've gotten a pretty good idea of Microsoft's ambitious vision for the AI assistant in the years since it leaked then launched, Paruchuri and Rex gave the inside story of how Cortana was named, pitched to management, and the clash that happened between dreams and reality. Also included are interesting details about how the assistant became one of the main advertising points for the doomed Windows Phone platform.
Google

Why Google Has Sat on the Web3 Sidelines (bloomberg.com) 56

An anonymous reader shares a report: Google doesn't accept cryptocurrencies for ad buying, its payments service or its app store. Until recently, Google had banned several categories of crypto ads. Google hasn't touched NFTs. In a recent interview with Bloomberg Television, Chief Executive Officer Sundar Pichai copped that he "dabbled" in crypto, but didn't own any. Some staffers at Google have also dabbled with the technology, according to multiple current and former employees at the company. Still, Google hasn't laid out a plan for inserting itself into web3. A Google spokesperson said its mobile payments service is "working with several companies" such as Coinbase, Bitpay and Gemini "to support crypto cards, which transact in fiat currencies."

There are a few reasons Google might not want to dive into the new arena -- one is defensive. Web3 evangelists see the technology as "decentralized," controlled by its many participants. They draw stark contrasts to the business models of Google, Facebook and Amazon. These boosters see the blockchain as inherently trustworthy, unlike the current web titans. "Can't do evil > don't be evil," tweeted Chris Dixon, an Andreessen Horowitz partner, in a clear dig at Google. And many Silicon Valley visions for web3 activity, search engines and media decidedly don't involve advertising, Google's main business. But the company isn't completely averse to cryptocurrency. Google has been willing to take crypto money for its cloud business. In September, the division signed a deal with Dapper Labs, a Canadian blockchain company. It also has agreements with Hadera, Block.one and others. Given web3's escalating computing demands, Google will certainly look to ink more of these. (Google will have to weigh crypto's energy needs versus the company's zero-emissions targets.) In some ways, the wait-and-see strategy is typical of Pichai, who has a more deliberate management style than his predecessors. And that doesn't mean the company isn't quietly exploring the technology.

Firefox

Mozilla Expects To Generate More Than $500M in Revenue This Year (techcrunch.com) 21

The Mozilla Foundation today released its financial report for 2020. As usual, this gives us a good picture of the organization's financial health from a year ago, but for the first time this year, Mozilla also provided us with more recent data. From a report: It's no secret that Mozilla recently went through a number of difficult years, with major layoffs in 2020 as it restructured its for-profit arm, Mozilla Corporation. Its flagship Firefox browser, despite a number of technical advances, is also struggling in a marketplace that is now dominated by Chromium-based browsers. Still, in 2020, Mozilla Corporation's revenue was $466 million from its search partnerships (largely driven by its search deal with Google), subscriptions and advertising revenue. That's essentially the same as in 2019, when Mozilla Corporation generated $465 million from these sources.

For 2021, the organization forecasts revenue of over $500 million. What's maybe most important, though, is that Mozilla's new products like its Mozilla VPN service, Firefox Relay Premium, Pocket and other commercial initiatives are slowly but surely starting to pay off. As Mozilla executive VP Angela Plohman and CFO Eric Muhlheim noted in today's announcement, revenue from new product offerings will grow 150% this year and account for 14% of the organization's revenue in 2021. The Mozilla VPN service saw a revenue increase of 450% from 2020 to 2021.

Facebook

Two US Senators Urge Federal Investigations Into Facebook About Safety - and Ad Reach (cnbc.com) 6

Two leading U.S. Senators "are urging federal regulators to investigate Facebook over allegations the company misled advertisers, investors and the public about public safety and ad reach on its platform," reports CNBC: On Thursday, Senator Warren urged the heads of the Department of Justice and Securities and Exchange Commission to open criminal and civil investigations into Facebook or its executives to determine if they violated U.S. wire fraud and securities laws. A day earlier, Senator Cantwell, chair of the Senate Commerce Committee, encouraged the Federal Trade Commission to investigate whether Facebook, now called Meta, violated the agency's law against unfair or deceptive business practices. Cantwell's letter was made public on Thursday...

In her letter to the FTC, Cantwell focused on Facebook's claims about the safety of its products, in addition to the allegedly inflated ad projections... She suggested the agency investigate Facebook and, depending what the evidence shows, pursue monetary relief for advertisers and disgorgement of allegedly ill-gotten gains.

Senator Warren points to a whistleblower's recent allegations that Facebook misled both investors and advertising customers about their ad reach, according to the article. But Warren's letter also argued the possibility Facebook violated securities law with "breathtakingly illegal conduct by one of the world's largest social media companies," according to the article. And in addition, Warren "wrote that evidence increasingly suggests executives were aware the metric 'was meaningfully and consistently inflated.'"

Bloomberg adds this quote from Senator Cantwell's letter: "A thorough investigation by the Commission and other enforcement agencies is paramount, not only because Facebook and its executives may have violated federal law, but because members of the public and businesses are entitled to know the facts regarding Facebook's conduct as they make their decisions about using the platform."
United States

'China Will Soon Lead the US in Tech' (nytimes.com) 289

Graham Allison, a professor of government at Harvard, and Eric Schmidt, former CEO of Google, writing in a column for WSJ: Last year China produced 50% of the world's computers and mobile phones; the U.S. produced only 6%. China produces 70 solar panels for each one produced in the U.S., sells four times the number of electric vehicles, and has nine times as many 5G base stations, with network speeds five times as fast as American equivalents. In the advanced technology likely to have the greatest effect on economics and security in the coming decade -- artificial intelligence -- China is ahead of the U.S. in crucial areas.

A spring 2021 report from the National Security Commission on AI warned that China is poised to overtake the U.S. as the global leader in AI by 2030. U.S.-born students are earning roughly as many doctorates each year in AI-related fields as in 1990, while China is on track to graduate twice as many science, technology engineering and mathematics Ph.D.s as the U.S. by 2025. The Harvard report adds that China now clearly tops the U.S. in practical AI applications, including facial recognition, voice recognition and fintech.

The U.S. still has a dominant position in the semiconductor industry, which it has held for almost half a century. But China may soon catch up in two important arenas: semiconductor fabrication and chip design. China's production of semiconductors has surpassed America's, with its share of global production rising to 15% from less than 1% in 1990, while the U.S. share has fallen from 37% to 12%. In 5G, the Pentagon's Defense Innovation Board reports that China is on track to replicate the economic and military advantages America gained from being the global leader in 4G. China has installed 950,000 base stations to America's 100,000. By the end of last year, 150 million Chinese were using 5G mobile phones with average speeds of 300 megabits a second, while only six million Americans had access to 5G with speeds of 60 megabits a second. America's 5G service providers have put more focus on advertising their capabilities than on building infrastructure. The Chinese Communist Party has made no secret of its ambitions: China intends to become the global leader in the technologies that will shape the decades ahead.

United States

NYC, Facing Housing Crisis, Targets Illegal Airbnb Owners (nytimes.com) 83

An anonymous reader quotes a report from The New York Times: Airbnb recently announced that it had its best quarter ever, reflecting a surging thirst for travel and tourism as the pandemic's grip loosens. But in New York City, the company is at the center of a different narrative: City leaders, after fighting for years to limit the proliferation of illegal short-term rentals, are poised to impose more stringent restrictions on the online platform. The City Council on Thursday is expected to approve a bill that would for the first time require hosts to register with the city before renting out their homes on a short-term basis or for less than 30 days. The measure mirrors regulations in other cities like Boston and Santa Monica, Calif.

In New York City, one of Airbnb's biggest domestic markets, city officials and housing advocates have long complained that landlords and tenants have exacerbated the housing crisis by circumventing laws and setting aside homes to rent out for a few days at a time to tourists or other visitors. Short-term rentals are often more lucrative than long-term leases. And the hotel industry, which has been decimated by the pandemic, has long complained about Airbnb and similar online rental companies, accusing them of siphoning away business. The new bill is designed to prevent rentals that violate those laws -- including a New York State law that largely bars apartment rentals for less than 30 days when the host is not present -- from even appearing online. Supporters said the new restrictions could lead to the gradual removal of thousands of listings for such illegal rentals from short-term rental websites.

The bill's supporters said New York's proposed law had been designed to ensure compliance because it requires online rental platforms like Airbnb to verify that a listing has been properly registered with the city before the platform can collect any fees. Fines for hosts who fail to abide by the rule could be up to $5,000, and platforms like Airbnb could be fined $1,500 for every illegal transaction. [...] It's not clear exactly how many of the listings in New York City are illegal, and the effectiveness of the new bill will depend in part on how well the city enforces the new law. In places like Santa Monica, Boston and San Francisco, data has shown a modest to significant decrease in the number of listings after a registration system went into place. Based on the number of listings advertising short-term rentals for entire homes or apartments in the city, suggesting a host may not be present, supporters of the bill estimate that up to roughly 19,000 Airbnb listings could be illegal and eventually delisted.
"According to data from Inside Airbnb, an independent data-tracking website, there were more than 37,700 Airbnb listings in New York City at the beginning of November 2021," the report notes. "That was significantly below the prepandemic level of more than 49,200 in November 2019."

Stephen Smith, a co-founder of real estate firm Quantierra, said the bill would not do enough to stem the city's housing crisis. "These politicians seem to think that this is going to do something for affordability, and in fact it's likely to do very little," he said. The combination of the bill along with another city initiative to curb new hotel development could greatly reduce the number of affordable places visitors to the city can stay, Mr. Smith said. "If you really make it difficult enough for people to come to New York, they're going to stop coming to New York," he said.
Chrome

EFF Warns Chrome Users: 'Manifest V3 Is Deceitful and Threatening' (eff.org) 46

In a recent blog post from the Electronic Frontier Foundation, the digital rights group warns that Google Chrome's latest specification for building Chrome extensions, known as Manifest V3, "is outright harmful to privacy efforts." EFF technologist Daly Barnett writes: Like FLoC and Privacy Sandbox before it, Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks. [...] It will restrict the capabilities of web extensions -- especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit. Under the new specifications, extensions like these -- like some privacy-protective tracker blockers -- will have greatly reduced capabilities. Google's efforts to limit that access is concerning, especially considering that Google has trackers installed on 75% of the top one million websites.

It's also doubtful Mv3 will do much for security. Firefox maintains the largest extension market that's not based on Chrome, and the company has said it will adopt Mv3 in the interest of cross-browser compatibility. Yet, at the 2020 AdBlocker Dev Summit, Firefox's Add-On Operations Manager said about the extensions security review process: "For malicious add-ons, we feel that for Firefox it has been at a manageable level... since the add-ons are mostly interested in grabbing bad data, they can still do that with the current webRequest API that is not blocking." In plain English, this means that when a malicious extension sneaks through the security review process, it is usually interested in simply observing the conversation between your browser and whatever websites you visit. The malicious activity happens elsewhere, after the data has already been read. A more thorough review process could improve security, but Chrome hasn't said they'll do that. Instead, their solution is to restrict capabilities for all extensions.

As for Chrome's other justification for Mv3 -- performance -- a 2020 study (PDF) by researchers at Princeton and the University of Chicago revealed that privacy extensions, the very ones that will be hindered by Mv3, actually improve browser performance. The development specifications of web browser extensions may seem in the weeds, but the broader implications should matter to all internet citizens: it's another step towards Google defining how we get to live online. Considering that Google has been the world's largest advertising company for years now, these new limitations are paternalistic and downright creepy.

Privacy

Apple Reaches Quiet Truce Over iPhone Privacy Changes (ft.com) 43

Apple has allowed app developers to collect data from its 1 billion iPhone users for targeted advertising, in an unacknowledged shift that lets companies follow a much looser interpretation of its controversial privacy policy. Financial Times: In May Apple communicated its privacy changes to the wider public, launching an advert that featured a harassed man whose daily activities were closely monitored by an ever-growing group of strangers. When his iPhone prompted him to "Ask App Not to Track," he clicked it and they vanished. Apple's message to potential customers was clear -- if you choose an iPhone, you are choosing privacy.

But seven months later, companies including Snap and Facebook have been allowed to keep sharing user-level signals from iPhones, as long as that data is anonymised and aggregated rather than tied to specific user profiles. For instance Snap has told investors that it plans to share data from its 306m users -- including those who ask Snap "not to track" -- so advertisers can gain "a more complete, real-time view" on how ad campaigns are working. Any personally identifiable data will first be obfuscated and aggregated. Similarly, Facebook operations chief Sheryl Sandberg said the social media group was engaged in a "multiyear effort" to rebuild ad infrastructure "using more aggregate or anonymised data."

These companies point out that Apple has told developers they "may not derive data from a device for the purpose of uniquely identifying it." This means they can observe "signals" from an iPhone at a group level, enabling ads that can still be tailored to "cohorts" aligning with certain behaviour but not associated with unique IDs. This type of tracking is becoming the norm.

Businesses

Amazon Charges Sellers Fees That Are High Enough To Offset Losses from Prime, a New Report Says (theverge.com) 64

The massive reach of Amazon's e-commerce platform is appealing for any small business that wants to sell its products online. But a new report suggests that the cost of doing business can become a Faustian bargain for a third-party seller, as the fees that Amazon charges them can quickly eat into profits. From a report: Amazon Toll Road, a report from the nonprofit Institute for Local Self-Reliance (ILSR), found that Amazon charged third-party sellers a total of $121 billion in fees this year alone. According to the report, written by ILSR co-director Stacy Mitchell, those fees -- for things like advertising, referrals, and shipping -- usually mean that small businesses lose money to Amazon; Mitchell said that in 2014, sellers paid Amazon $19 of every $100 in sales, and today, it's more like $34 per $100 in sales.

And, Amazon obscures the profit it makes from these small businesses in its financial reports, lumping it in with other less lucrative divisions "because showing that they generate these profits from small businesses is not a good look," Mitchell said in an interview with The Verge. But its Amazon Prime subscription service -- believed to be a money loser for the e-commerce giant -- provides Amazon a loyal base of shoppers who want to get their money's worth of free shipping. The profits Amazon makes from seller fees subsidize the losses from its Prime division, according to the report.

Security

The Virtual Phone Farms Scammers Use To Set Up Fake Accounts (vice.com) 22

An anonymous reader quotes a report from Motherboard: When a scammer wants to set up an account on Amazon, Discord, or a spread of other online services, sometimes a thing that stands in their way is SMS verification. The site will require them to enter a phone number to receive a text message which they'll then need to input back into the site. Sites often do this to prevent people from making fraudulent accounts in bulk. But fraudsters can turn to large scale, automated services to lease them phone numbers for less than a cent. One of those is 5SIM, a website that members of the video game cheating community mention as a way to fulfill the request for SMS verification.

Various YouTube videos uploaded by the company explain how people can use its service explicitly for getting through the SMS verification stage of various sites. The videos include instructions specifically on PayPal, Instagram, Facebook, Telegram, and dating site Plenty of Fish. Instagram told Motherboard it is concerned by sites that suggest people can use services to bypass Instagram's measures to then abuse the platform. Instagram said it uses SMS verification to prevent the creation of fake accounts and to make account recovery possible. "We have many measures in place to protect against scripted account creation and block millions of fake accounts at registration every day," an Instagram spokesperson said.

Some online services don't allow users to perform SMS verification with VoIP numbers, presumably in an effort to mitigate against fraud. 5SIM's numbers, however, are just like ordinary phone numbers, the site claims. When people buy 5SIM's services, they must only use it for receiving texts related to an online account. "Different SMS will [be] rejected," the website adds. 5SIM also offers an API to automate parts of the service. 5SIM's rules say that customers are "Forbidden to use the service for any illegal purposes as well as not to take actions that harm the service and (or) third parties." The website also includes a denylist of words that its service may block.
In an email to Motherboard, 5SIM said: "5sim service is prohibited to use for illegal purposes. In cases, where fraudulent operations with registered accounts are detected, restrictions may be imposed on the 5sim account until the circumstances are clarified. 5sim is used by those who want to get a discount or bonus, webmasters, SMM specialists, owners of business for advertising and increasing business loyalty."

Slashdot Top Deals