Source: Hacker News
Source: Ars Technica
Enlarge / Apple's HQ, as seen in Apple Maps. (credit: Samuel Axon)
Apple is looking into significantly ramping up its ads business, according to Bloomberg reporter Mark Gurman, and has already internally explored adding ads to the iPhone's Maps app, with other potential expansions also on the horizon.
The shift may be driven in part by a recent change within the company's reporting structure: Gurman wrote in his email newsletter this week that Apple advertising VP Todd Teresi began reporting directly to Apple services head Eddie Cue a few months back. He also wrote that Teresi plans to increase Apple's advertising revenue from $4 billion annually to billions in the double digits.
As Gurman notes, advertising is already a part of Apple's strategy, but it's limited in scope and to certain places. The most traditional advertisements you'll see in an Apple-made app are the ones in the Stocks and News apps. There, you'll see display ads just like those you see on news websites—both outside of stories and inside of them.
Source: Schneier on Security
Scammers were able to convince YouTube that other peoples’ music was their own. They successfully stole $23 million before they were caught.
No one knows how common this scam is, and how much money total is being stolen in this way. Presumably this is not an uncommon fraud.
While the size of the heist and the breadth of the scheme may be very unique, it’s certainly a situation that many YouTube content creators have faced before. YouTube’s Content ID system, meant to help creators, has been weaponized by bad faith actors in order to make money off content that isn’t theirs. While some false claims are just mistakes caused by automated systems, the MediaMuv case is a perfect example of how fraudsters are also purposefully taking advantage of digital copyright rules.
YouTube attempts to be cautious with who it provides CMS and Content ID tool access because of how powerful these systems are. As a result, independent creators and artists cannot check for these false copyright claims nor do they have the power to directly act on them. They need to go through a digital rights management company that does have access. And it seems like thieves are doing the same, falsifying documents to gain access to these YouTube tools through these third parties that are “trusted” with these tools by YouTube.
Source: Hacker News
Source: Hacker News
Source: Schneier on Security
My personal definition of a brilliant idea is one that is immediately obvious once it’s explained, but no one has thought of it before. I can’t believe that no one has described this taxonomy of access control before Ittay Eyal laid it out in this paper. The paper is about cryptocurrency wallet design, but the ideas are more general. Ittay points out that a key—or an account, or anything similar—can be in one of four states:
safe Only the user has access,
loss No one has access,
leak Both the user and the adversary have access, or
theft Only the adversary has access.
Once you know these states, you can assign probabilities of transitioning from one state to another (someone hacks your account and locks you out, you forgot your own password, etc.) and then build optimal security and reliability to deal with it. It’s a truly elegant way of conceptualizing the problem.
Source: Ars Technica
Enlarge / FTC Chair Lina Khan said the commission intends to act on commercial data collection, which happens at "a massive scale and in a stunning array of contexts." (credit: Getty Images)
The Federal Trade Commission has kicked off the rulemaking process for privacy regulations that could restrict online surveillance and punish bad data-security practices. It's a move that some privacy advocates say is long overdue, as similar Congressional efforts face endless uncertainty.
The Advanced Notice of Proposed Rulemaking, approved on a 3-2 vote along partisan lines, was spurred by commercial data collection, which occurs at "a massive scale and in a stunning array of contexts," FTC Chair Lina M. Khan said in a press release. Companies surveil online activity, friend networks, browsing and purchase history, location data, and other details; analyze it with opaque algorithms; and sell it through "the massive, opaque market for consumer data," Khan said.
Companies can also fail to secure that data or use it to make services addictive to children. They can also potentially discriminate against customers based on legally protected statuses like race, gender, religion, and age, the FTC said. What's more, the release said, some companies make taking part in their "commercial surveillance" required for service or charge a premium to avoid it, employing dark patterns to keep the systems in place.
Source: Engadget
Meta has long been working on end-to-end encryption for its messaging products, but so far, only WhatsApp has switched on the privacy feature by default. In its latest update about its efforts, Meta said it will start testing default end-to-end encrypted chats for select users on Messenger. Those chosen to be part of the test will find that some of their most frequent chats have been automatically end-to-end encrypted. That means there's no reason to start "Secret Conversations" with those friends anymore.
The company is also testing secure storage for encrypted chats, which gives users access to their conversation history in case they lose their phone or want to restore it on a new device. To be able to access their backups through security storage, users will have to create a PIN or generate codes that they'll then have to save. Those two are end-to-end encrypted options and provide another layer of protection. That said, users can also opt to use cloud services to restore conversations — those with iOS devices, for instance, can use iCloud to store the secret key needed to access their backups. Meta will also begin testing secure storage this week, but only on Android and iOS. It's still not available for Messenger on the web or for unencrypted chats.
The other tests Meta is rolling out in the coming weeks include bringing regular Messenger features to end-to-end encrypted chats. It will test the ability to unsend messages and to send replies to Facebook Stories as encrypted chats, and it's also planning to bring end-to-end encrypted calls to the Calls Tab on Messenger. Ray-Ban Stories users will be able to send encrypted hands-free messages through Messenger, as well.
In addition, Meta is launching a new security feature called Code Verify, which is an open-source browser extension for Chrome, Firefox and Microsoft Edge. As its name implies, it can verify the authenticity of the Messenger website's web code and ensure that it hasn't been tampered with. As for Instagram, the company is retiring the app's vanish mode chats, which aren't encrypted, while also expanding ongoing tests for opt-in end-to-end encrypted messages and calls on the service.
All of these are part of Meta's preparations as it works its way towards the global rollout of default end-to-end encryption for messages and calls on its services. It plans to launch even more tests and updates before its target rollout sometime in 2023.
Source: Hacker News
