Pinboard (guardiantech)

Apple throws down privacy gauntlet >> American Civil Liberties Union

guardiantech — 2014-09-19T16:49:42+00:00

Chris Soghoian, principal technologist, on the privacy protection in iOS 8:

This was a big step for Apple, and one that likely required significant engineering work. What is so interesting and smart about this move is that rather than telling the government that they no longer want to help the government, they re-architected iOS so they are unable to help the government. Think of it as Apple playing a game of chicken, and the company has just thrown the steering wheel out of the window. That's something that's going to be difficult for most tech companies to do, because so many of them have built their businesses around access to user data. If the companies can search and analyze that data, they can be forced to turn it over to the government. Apple's business model—selling expensive, luxury hardware to consumers—gives them the freedom to lock themselves out of access to their customers' data. Apple doesn't care what you store on your phone as long as you buy a new one every two years. Although today's announcement is certainly big news, in many ways, it is far less significant than Apple's success in delivering end-to-end encrypted text, voice and video communications to the hundreds of millions of people using iMessage and FaceTime. To date, these apps have been advertised as free and easy ways for people to stay in touch with loved ones and family. However, the company could and should start advertising them as a much more secure alternative to regular telephone calls and text messages.

Thanks to "right to be forgotten," Google now censors the press in the EU >> Marketing Land

guardiantech — 2014-07-03T20:33:23+00:00

Danny Sullivan:

It’s very important to understand that the EU’s action is not causing content to be removed from publishers themselves, which would no doubt have raised a huge outcry among major news outlets. They usually don’t remove content they’ve published without an exceptionally good reason or a court order. Rather, the articles are being removed from Google, for certain searches. The court went this route understanding that if you pull something out of Google (and search engines generally), that can effectively cause the material to be hidden more easily than someone trying to track down many different publishers that might carry the same thing. That’s especially an issue when it comes to “scraper” sites, where someone might simply copy the content off another site without permission and republish it. Copyright owners know what a “whack-a-mole” situation this is, where getting one removed only makes room for another to spring up. But the EU action is arguably a de facto censorship of the press. News stories are being made to disappear without any court review. Instead, Google seems to be following the letter of the new EU mandate and rubber-stamping any reasonable request that comes along.

The first three paragraphs are correct; the start of the fourth is wrong. The press is not being censored - that is, nothing is being removed from news sites, and they aren't being told what or what not to write. However, if you do a search on a particular name, some pages won't show up in the results. But all other searches that would previously lead to that page will still lead to it. Sullivan is correct, though, that Google seems to be rubber-stamping any request, without regard to whether it passes the ECJ tests of "outdated, inaccurate, invasion of privacy, irrelevant" with the balancing test of "public figure". One other thing: it's not a "right to be forgotten". It's the Data Processing directive.

Is the web really free? >> getwired.com

guardiantech — 2014-06-19T21:44:21+00:00

Terrific unravelling of how the web now works by Wes Miller:

Imagine the response if you told a friend, family member, or colleague that you had a report/blog/study you were working on, and asked them, “Hey, I’m going to shoulder-surf you for a day and write down which Websites you visit, how often and how long you visit them, and who you send email to, okay?” In most cases, they’d tell you no, or tell you that you’re being weird. Then ask them how much you’d need to pay them in order for them to let you shoulder-surf. Now they’ll be creeped out. Finally, tell them you installed software on their computer last week, so you’ve already got the data you need, is it okay if you use that for your report. Now they’re going to probably completely overreact, and maybe even get angry (so tell them you were kidding). More than two years ago, I discussed why do-not-track would stall out and die, and in fact, it has. This was completely predictable, and I would have been completely shocked if this hadn’t happened. It’s because there is one thing that makes the Web work at all. It’s the cycle of micropayments of personally identifiable information (PII) that, in appropriate quantities, allow advertisers (and advertising companies) to tune their advertising.

Facebook adjusts its privacy controls — again >> Businessweek

guardiantech — 2014-05-22T22:28:10+00:00

Joshua Brustein:

For years people have been complaining that Facebook’s (FB) privacy controls are too confusing, and the social network made several changes to these policies on Thursday that indicate it agrees. For new users’ first post, Facebook’s default setting will be to share only with their friends. This makes sense, considering that someone who hasn’t been on Facebook before is less likely to realize what kind of risks he’s taking by posting private thoughts. “We recognize that it is much worse for someone to accidentally share with everyone when they actually meant to share just with friends, compared with the reverse,” the company says in a statement posted on its website. In addition, Facebook is rolling out a privacy checkup tool, which will remind people whom they are sharing with, which apps they’re connected to, and what kind of information they’re sharing through their profiles. Facebook users will begin seeing the checkups over the next couple of weeks.

*golf clap*

The “right to forget” a genocide >> Medium

guardiantech — 2014-05-15T15:35:24+00:00

Zeynep Tufekci:

I am not even attempting to scratch the surface of that complexity, nor defending current legal practices in Rwanda which certainly have worrisome aspects, but simply pointing out that the right, and the choice, to want to forget can occur in settings most lawyers and engineers in Palo Alto may well not be thinking about at all. They should start. Overall, “never forget” and keep every speck of memory atrocity alive is rarely how countries recover from massive spasms of violence, especially if the conditions that sparked the violence don’t just disappear. Rwanda, or a future case of ethnic cleansing, may seem like an extreme case to raise, but as the next billion comes online, such questions will become less and less theoretical. …these questions of identity, representation, and what information about you that Google shows the world, outside of your own control or wishes, is neither simple nor to be dismissed as the work of busy-body nanny über-state, and the fragile egos within it. The current legal decision may well be overdone or misplaced, but the question of who holds the keys to our collective memory is one that deserves a discussion, and not just left to a few companies. The stakes and the burden is too high.

A powerful argument.

Judgment in Case C-131/12: Google Spain SL, Google Inc. v Agencia Española de Protección de Datos >> European Court of Justice

guardiantech — 2014-05-13T17:00:46+00:00

PDF ruling (3 pages): "An internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties". And read the full text opinion (text, 20 pages). Be one of the few to have actually read it.

Google has most of my email because it has all of yours >> copyrighteous

guardiantech — 2014-05-12T17:56:45+00:00

Benjamin Mako Hill:

Despite the fact that I spend hundreds of dollars a year and hours of work to host my own email server, Google has about half of my personal email! Last year, Google delivered 57% of the emails in my inbox that I replied to. They have delivered more than a third of all the email I’ve replied to ever year since 2006 and more than half since 2010. On the upside, there is some indication that the proportion is going down. So far this year, only 51% of the emails I’ve replied to arrived from Google. The numbers are higher than I imagined and reflect somewhat depressing news. They show how it’s complicated to think about privacy and autonomy for communication between parties.

FTC notifies Facebook, WhatsApp of privacy obligations in light of proposed acquisition >> Federal Trade Commission

guardiantech — 2014-04-10T21:35:33+00:00

The director of the Federal Trade Commission’s Bureau of Consumer Protection notified Facebook and WhatsApp about their obligations to protect the privacy of their users in light of Facebook’s proposed acquisition of WhatsApp.
In a letter to the two companies, Bureau Director Jessica Rich noted that WhatsApp has made clear privacy promises to consumers, and that both companies have told consumers that after any acquisition, WhatsApp will continue its current privacy practices.
“We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook,” the letter states.

LinkedIn warns company over “Hack In” tool that shows email addresses >> Gigaom

guardiantech — 2014-04-02T16:51:10+00:00

LinkedIn is urging people to stay away from Sell Hack, a sinister-sounding service that reveals the personal email address of anyone with a profile on the professional network. LinkedIn is warning that the service’s “Hack In” tool uploads confidential information, and says it has sent Sell Hack a cease-and-desist letter.
Sell Hack is marketing the “Hack In” button to salespeople looking to reach new prospects. The company’s website claims that people who install its plug-in will be able to use the button to view the email contact of LinkedIn members with whom they’re not connected, such as LinkedIn CEO Jeff Weiner:

Raising the question of why your email would be visible through viewing the profile. LinkedIn is a social network equivalent of herpes - once you have it, you'd like to get rid of it.

Privacy and security settings in Chrome >> noncombatant

guardiantech — 2014-03-27T15:23:39+00:00

Chris Palmer:

Chrome has a lot of handy privacy and security options, but it isn’t always obvious how to use them. In this post I’ll demonstrate my favorites, and try to explain a bit about what they do.
My goal with these configuration changes is to get Chrome to expose less attack surface to potentially malicious web pages, and to be less chatty on the network.

Palmer works at Google on Chrome security.

You don’t want your privacy: Disney and the meat space data race >> GigaOm

guardiantech — 2014-01-21T15:03:02+00:00

John Foreman, chief data scientist at Mailchimp, went to a Disney park where he and his family were issued with an individually-programmed RFID-equipped wristband.

Stop a moment and dream of the MagicBand possibilities.
The pitch that Disney is making is personalization. For each band, for example, Disney asks for the name and birthday of the person who’ll be wearing it. So if your kid is having a birthday in the park and there’s a character wandering nearby, that character can be notified to sneak up on your kid and creepily wish them a happy birthday individually.
Now, let’s dig a little deeper.
What does Disney get out of the deal? In short, it tracks everything you do, everything you buy, everything you eat, everything you ride, everywhere you go in the park. If the goal is to keep you in the park longer so you’ll spend more money, it can build AI models on itineraries, show schedules, line length, weather, etc., to figure out what influences stay length and cash expenditure. Perhaps there are a few levers they can pull to get money out of you.

Consumers trusting Google less, warier of Facebook, Twitter >> Advertising Age

guardiantech — 2014-01-20T21:35:06+00:00

Asked which companies are the greatest threat to the future of privacy, 59% of 1,100 respondents cited Facebook and 40% said Twitter, according to a survey conducted by McCann; 32% pointed to Google, almost doubling from the 18% who said as much when McCann conducted the same survey in 2011.
"It's not necessary that people feel Google or Facebook has done anything bad with data to date. It's what might happen in the future. It's a nebulous fear," said Laura Simpson, global director of McCann Truth Central, during a session on privacy held by Ad Age and IPG at CES in Las Vegas.
By comparison, Amazon topped the list of companies consumers trust with their data, with 73% of respondents citing the e-commerce giant. It's worth noting that a majority of respondents also named Google to this category, but that number fell from 63% in 2011 to 53% in 2013.

Twitter is seen as a threat to privacy?

US Senator Markey calls for FTC investigation over Google's "Shared Endorsements" >> Marketing Land

guardiantech — 2013-10-16T20:54:36+00:00

Members of the FTC are furloughed and so cannot initiate an investigation right now. Regardless, this is a situation where an FTC investigation may be unwarranted. There isn’t any “deception” going on.
The larger issue of opt-out vs. opt-in is worthy of discussion in a broader context: when do consumers need to opt-in vs. being permitted to opt-out? As mentioned there’s substantial survey based evidence that most consumers would not opt-in to most online advertising programs, which would compromise the ability of publishers and ad networks to serve more targeted ads and maximize revenue.

Would be fascinating to see how it would go if Google were to make such changes opt-in instead. After all, if people approve of the idea, surely they would happily opt in?

Terms of Service; Didn't Read >> TOSDR

guardiantech — 2013-10-14T11:19:43+00:00

“I have read and agree to the Terms” is the biggest lie on the web. We aim to fix that.

Very intriguing service, via a browser add-on, which tells you about the quality of the ToS of various companies, from A (great) to E (bad). Google is a C; quite a few others are still awaiting classification. So far only DuckDuckGo and SeenThis qualify as A.

Privacy opinions >> xkcd

guardiantech — 2013-10-06T20:54:05+00:00

The six ways in which people react to stories about the NSA. Seems to cover the bases. Check the alt text, as always with XKCD: this one's is "I'm the Philosopher until someone hands me a burrito."

Data broker giants hacked by ID theft service >> Krebs on Security

guardiantech — 2013-09-25T18:52:01+00:00

Until very recently, the source of the data sold by SSNDOB has remained a mystery. That mystery began to unravel in March 2013, when teenage hackers allegedly associated with the hacktivist group UGNazi showed just how deeply the service’s access went. The young hackers used SSNDOB to collect data for exposed.su, a Web site that listed the SSNs, birthdays, phone numbers, current and previous addresses for dozens of top celebrities — such as performers Beyonce, Kayne West and Jay Z — as well as prominent public figures, including First Lady Michelle Obama, CIA Director John Brennan, and then-FBI Director Robert Mueller.

Uh-oh.

Teens and Mobile Apps Privacy >> Pew Internet & American Life Project

guardiantech — 2013-08-22T21:03:34+00:00

Half (51%) of teen apps users say that they have decided not to install a cell phone or tablet app after they found out they would have to share personal information in order to use it.
Younger teen apps users ages 12-13 are more likely than older teen apps users 14-17 to say that they have avoided apps over concerns about personal information sharing (56% vs. 49%). Boys and girls are equally likely to avoid certain apps for these reasons. There are no clear patterns of variation according to the parent’s income, education level or race and ethnicity.
One in four teen apps users have uninstalled an app because they found out it was collecting personal information that they didn’t want to share.

There's hope for the next generation yet. The report has some fascinating detail.

NSA broke privacy rules thousands of times per year, audit finds >> The Washington Post

guardiantech — 2013-08-18T21:01:05+00:00

The National Security Agency has broken privacy rules or overstepped its legal authority thousands of times each year since Congress granted the agency broad new powers in 2008, according to an internal audit and other top-secret documents.
Most of the infractions involve unauthorized surveillance of Americans or foreign intelligence targets in the United States, both of which are restricted by statute and executive order. They range from significant violations of law to typographical errors that resulted in unintended interception of U.S. e-mails and telephone calls.

In case you missed this on Friday. Question is, who watches the watchers?

What it means to be an NSA "target": new information shows why we need immediate FISA Amendments Act reform >> Electronic Frontier Foundation

guardiantech — 2013-08-09T21:51:18+00:00

First, at least this much is clear: a “target” under the FAA must be (a) a non-US person and (b) not physically located within the United States. A “person,” for purposes of the FAA, includes individuals as well as “any group, entity, association, corporation, or foreign power.” Under the FAA, the government can thus "target" a single individual (e.g., Vladimir Putin), a small group of people (e.g., Pussy Riot), or a formal corporation or entity (e.g., Gazprom).
So, when the NSA decides to “target” someone (or something), it turns its specific surveillance vacuum at them. The NSA then believes it can intercept and analyze all electronic communications of the target (telephone conversations, email conversations, chat, web browsing, etc) so long as the “target” is overseas and remains overseas. As others have noted, this includes conversations the “target” has with Americans, which would then be “incidentally” collected. Keep in mind this does not require a warrant or even the approval of a court, which is only one way Senator Feinstein's reassurance was demonstrably false. But there's still more.

More??

The battle for secure email >> Buzzfeed

guardiantech — 2013-08-09T21:13:35+00:00

For privacy advocates, the shutdowns are the latest discomforting reminder of the looming shadow of government surveillance, which has left some to question if the era of private and secure email has all but come to an end.
But according to sources in the space, that’s far from the case. While Lavabit and Silent Circle may have shuttered email services, many avenues still remain. One well-known encryption service, Hushmail, confirmed to BuzzFeed, “We have no plans to discontinue the Hushmail service.”
Like many in the privacy community, Pete Ashdown, the founder of the independent ISP XMission, sees this as a call to action. “I look at government attempts to control or monitor the internet as a challenge,” he told BuzzFeed. “It keeps my gears turning in directions to stop them.”

Hushmail's position is anomalous. Intriguing.

iPhone logs my complete movement profile >> Security Forum

guardiantech — 2013-08-08T16:52:08+00:00

i just swiped through my iPhone iOS7 Beta 5 settings and stumbled across the following new default setting:
Settings → Privacy → Location Services → System Services (at the bottom) → Frequent Locations
It kept track of my complete movement profile (location and time tracking) without me knowing anything. Just to give you an insight whats possible and already used with and without PRISM.

It's opt-in, judging by the settings, and linked to your Apple ID; seems to be to help Apple improve its Maps - and there's a hint of Google Now-ishness in that it has tags for "home" and "work", and "Frequent locations" will "allow your iPhone to learn places you frequently visit in order to provide useful location-related information." What would that be? (Thanks @Sputnikkers for the link.)

Disconnect Kids app teaches children about online privacy >> Apps Playground

guardiantech — 2013-07-29T16:26:06+00:00

“Disconnect Kids is a fun and unique educational app that teaches children (and their parents) about online privacy,” explains its App Store listing.
“Disconnect Kids also actively blocks requests for data about your web-browsing and in-app activity from the biggest mobile tracking and targeting services. It’s the first (and only) iOS app that prevents this personal data from ever leaving your device.”

Nice idea. (Via Stuart Dredge, who - disclosure - is a co-founder of Apps Playground.)

Jay-Z's Magna Carta Holy Grail app under investigation >> Guardian Music

guardiantech — 2013-07-17T19:34:37+00:00

A privacy advocacy group has asked the US Federal Trade Commission to investigate the app created for Jay-Z's new album, Magna Carta Holy Grail. The Electronic Privacy Information Centre (Epic) has accused Samsung of implementing software that is unnecessarily invasive, "depriving users of meaningful choice regarding the collection of their data".
Around 1.2 million people installed Samsung's Android-enabled Magna Carta app, affording them early access to Jay-Z's new LP.

‘I filmed the first fight and arrest through Google Glass’ >> VentureBeat

guardiantech — 2013-07-09T10:42:34+00:00

“I think if I had a bigger camera there, the kid would probably have punched me,” [Chris] Barrett told me. “But I was able to capture the action with Glass and I didn’t have to hold up a cell phone and press record.”
Barrett thinks it’s a revolution in citizen journalism and perhaps even documentary film-making. It’s certainly continuing the change that cheap portable video recording equipment has been ushering in ever since Rodney King — and probably stepping it up a notch, too.
“This is a huge step in citizen journalism,” Barrett said. “If Google Glass takes off, everyone’s going to have their entire life captured … first words, first steps … but also people getting shot, and natural disasters.”

Motorola is listening >> Beneath the Waves

guardiantech — 2013-07-02T21:44:10+00:00

Ben Lincoln:

In June of 2013, I made an interesting discovery about the Android phone (a Motorola Droid X2) which I was using at the time: it was silently sending a considerable amount of sensitive information to Motorola, and to compound the problem, a great deal of it was over an unencrypted HTTP channel.
If you're in a hurry, you can skip straight to the Analysis - email, ActiveSync, and social networking section - that's where the most sensitive information (e.g. email/social network account passwords) is discussed.

Concerning. (Thanks @ClarkeViper for the link.)

NSA slides explain the PRISM data-collection program >> The Washington Post

guardiantech — 2013-06-30T21:02:40+00:00

Returning to this point - and perhaps stirring it up again:

The FBI uses government equipment on private company property to retrieve matching information from a participating company, such as Microsoft or Yahoo and pass it without further review to the NSA.

Government equipment on private company property? Wonder what the Group Of Nine (Microsoft, Yahoo, Google, Apple, PalTalk, YouTube, Skype, AOL, Facebook) will say to that.

'Privacy' search engines see jump after NSA row >> AFP

guardiantech — 2013-06-24T20:20:44+00:00

DuckDuckGo had been growing slowly in recent years, but its traffic charts showed a surge after the first news broke June 6 of the government's PRISM surveillance program. By 20 June, traffic had hit nearly three million queries, double the level of a year earlier.
More than half of DuckDuckGo traffic comes from outside the United States, Weinberg said. "This NSA story played into the trend of people's fears" about online tracking, said Weinberg. Weinberg said another factor is that Google results are being gamed by search engine spammers and other companies trying to rank their results higher."
Dutch-based Ixquick, which also uses the name StartPage, said it too has seen a dramatic jump in usage after news of the PRISM data sharing program.

It would be educative to know how many people know of more than (or even) one alternative search engine to Google. (Thanks @EasilyLead for the link.)

Think your Skype messages get end-to-end encryption? Think again >> Ars Technica

guardiantech — 2013-06-21T21:48:22+00:00

From May 2013:

If you think the private messages you send over Skype are protected by end-to-end encryption, think again. The Microsoft-owned service regularly scans message contents for signs of fraud, and company managers may log the results indefinitely, Ars has confirmed. And this can only happen if Microsoft can convert the messages into human-readable form at will.

We've since heard that it's much worse, of course.

Privacy authorities issue Google a 'please explain' on Glass | ZDNet

guardiantech — 2013-06-19T04:57:28+00:00

Josh Taylor:

In April, Australian Privacy Commissioner Timothy Pilgrim requested a briefing with Google on the device, and today he, and nine of his colleagues from Canada, New Zealand, Israel, Mexico, and Switzerland, among others, have written to Page asking for detailed information on Google Glass, stating that their knowledge on it comes "from media reports, which contain a great deal of speculation".
The commissioners state in the letter that Google has not approached them to discuss the associated ethical issues with Google Glass while the product is in early testing stages with developers.
They have asked Google eight questions around the associated privacy issues, including asking Google to explain how Glass complies with data protection laws, what the privacy safeguards are, what information Google collects through Glass, who that information is shared with, and whether Google has undertaken a privacy risk assessment.

The suspicion is that Google itself doesn't understand all the ethical issues yet: that's partly what the early tests are for. It's a reminder that outside the early-adopter bubble, Glass' privacy implications will be on the agenda for politicians as well as the public.

We’re Not On The Web, We Are The Web >> Medium

guardiantech — 2013-06-17T20:23:03+00:00

Alfie Dennen, on Federico Zannier's Kickstarter selling his personal data to all-comers:

At the moment the value exchange we enter into when using online properties is straightforward: someone gives you a free online tool and in return they get to advertise to you. However this model is very fragile, especially if, consumers are able to simply and legally say no to advertising unless they explicitly allow it. Zannier’s project points the way to the emergence of a whole new sector of personal data driven businesses aggregating consumer data: brokerage firms, given agency to license your digital ‘biometric’; Insurance advisors, getting you the best possible car insurance, and even an oversight consortium policing these relationships.

With or without meerkat mascots.

Facebook Made Me Do It >> New York Times

guardiantech — 2013-06-16T16:26:22+00:00

Jenna Wortham:

That feedback loop of positive reinforcement is the most addictive element of social media. All those retweets, likes and favorites give us a little jolt, a little boost that pushes us to keep coming back for more. It works whether or not we post the typical social media fodder of lush vacation pictures and engagement announcements or venture into realms that showcase our most daredevilish antics and risqué behavior. It is one way to understand why people upload things that make us gasp, from my friend’s playful bare-all portrait to more sinister, illegal activities, like the defacing of parks and monuments with graffiti and other acts of outright vandalism. Our growing collective compulsion to document our lives and share them online, combined with the instant gratification that comes from seeing something you are doing or experiencing get near-immediate approval from your online peers, could be giving us more reason to act out online, for better or for worse. We are, in other words, one another’s virtual enablers.

An intriguing counterpoint to the notion that all those privacy stories will make us more cautious in what we post online. Wortham wonders whether the opposite is the case, bringing "the realization that one raunchy photo is just a single data point among hundreds".

Privacy? Screw that. Turn the tables! >> Data Dealer

guardiantech — 2013-06-06T22:20:41+00:00

Become a data dealer and get all the dirty details on your friends, neighbors and the rest of the world.

This game is just like real life!

Intel’s data economy initiative aims to help people capture the value of personal data >> MIT Technology Review

guardiantech — 2013-05-20T21:40:42+00:00

Intel is a $53bn-a-year company that enjoys a near monopoly on the computer chips that go into PCs. But when it comes to the data underlying big companies like Facebook and Google, it says it wants to “return power to the people.”
Intel Labs, the company’s R&D arm, is launching an initiative around what it calls the “data economy”—how consumers might capture more of the value of their personal information, like digital records of their their location or work history. To make this possible, Intel is funding hackathons to urge developers to explore novel uses of personal data. It has also paid for a rebellious-sounding website called We the Data, featuring raised fists and stories comparing Facebook to Exxon Mobil.

"To destabilise a company, make what it charges for into a commodity."

Welcome to Google Island >> Wired.com

guardiantech — 2013-05-20T20:59:06+00:00

Mat Honan, on his customary awesome form:

“Hello.”
The soft, froggy voice startled me. I turned around to face an approaching figure. It was Larry Page, naked, save for a pair of eyeglasses.
“Welcome to Google Island. I hope my nudity doesn’t bother you. We’re completely committed to openness here. Search history. Health data. Your genetic blueprint. One way to express this is by removing clothes to foster experimentation. It’s something I learned at Burning Man,” he said. “Here, drink this. You’re slightly dehydrated, and your blood sugar is low. This is a blend of water, electrolytes, and glucose.”
I was taken aback. “How did you…” I began, but he was already answering me before I could finish my question.

(Thanks @ClarkeViper for the link.)

Google Glass 'Winky' app lets you snap photos by winking >> PCMag.com

guardiantech — 2013-05-08T05:35:38+00:00

Google Glass is finally rolling out to developers and early adopters, and a number of interesting experiments and hacks have already appeared. But one new Glass app is certain to raise eyebrows, figuratively and literally, because it allows you to take photos with just a wink.
Winky is an app that bypasses the side-mounted touch control panel on Glass to take a photo. The app also does away with the need to speak the photo-taking command: "ok, glass, take a picture." Instead, the user simply winks slowly after firing up the app, and the device instantly and discreetly takes photos of whatever the wearer has in Glass' sights.

If the Google Glass store is anything like Google Play, apps like this will become widespread. Not sure that this is going to make people distrustful of its privacy implications more comfortable.

Who has your back? 2013 >> Electronic Frontier Foundation

guardiantech — 2013-05-01T05:47:11+00:00

Compares a large number of (US) companies against various privacy and rights categories - eg do they require a warrant for consent; tell users about government data requests; publish transparency reports; and so on.

MySpace (who?) is bottom, AT&T, Apple and Yahoo next worst (1/6). Only Twitter and Sonic.net get 6/6. If you're wondering, Sonic.net is an ISP.

Expunging Google >> Duncan Bayne

guardiantech — 2013-04-22T20:12:28+00:00

Duncan Bayne:

As I explained over on Hacker News: I don't think that Google is acting in opposition to open standards in general, because for the most part they benefit by them. What's clear is that: Google is seeking to increase the monetary value of its users the way to do that is with social media (see Facebook, who are winning this battle hands down) they will push open standards under the bus where necessary, in order to drive users to Google+.

Making it rain to make the rivers fill up and get more fish to go through the mouth of the delta. (Thanks @vassal for the link.)

Why Google’s acquisition of WhatsApp would be perilous to everyone’s privacy >> The Privacy Surgeon

guardiantech — 2013-04-10T08:12:37+00:00

Simon Davies (formerly of Privacy International):

By thrusting its hand into every data stream running to or from user devices [using WhatsApp], Google will be in an unprecedented position to gather more data about more individuals than any other entity on the planet. The transactional and associative data alone would be vast.
This prospect – combined with Google’s existing track record on privacy and compliance – is a cause for grave concern. If Google indeed is planning to acquire WhatsApp, then regulators must examine the effect of that acquisition – not only on competition – but also on consumer privacy. If they do, it will be quite clear that – at a minimum – Google should be prohibited from combining user data from WhatsApp with data collected through other products and services.
Regulators were not able to stop Google from combining user data in the past. They can and must start here.

Google's privacy director is stepping down >> Forbes

guardiantech — 2013-04-02T16:48:46+00:00

Kashmir Hill:

Whitten announced internally at Google that she is stepping down from her post with plans to retire. She’s remaining for a couple of months while the privacy team transitions to new leadership. Whitten, who has been overseeing privacy at Google from the company’s London office, will be replaced by Lawrence You, an engineer who has been with the company for eight years, and importantly, at least from my perspective, is based in Mountain View, where much of the privacy-violating magic happens. It’s certainly much closer to the Google X Lab, from whence new technologies such as Glass and driverless cars are coming, presenting novel privacy implications for review.

Ground Control, Part 1 >> The Magazine

guardiantech — 2013-04-01T20:50:58+00:00

Tom Tomorrow:

Last August, before domestic drones had become a concern worthy of a 13-hour Senate filibuster, I found myself inside a stretch limousine with a bunch of engineering students. We were on a rural highway in eastern North Dakota, rolling past bales of hay and soybean fields, the limo’s mirrored bar set with a row of empty champagne glasses. No one paid attention to them. Instead, the student engineers were deep in a marathon conversation about flying robots.

Long, and worth it.

Stop The Cyborgs

guardiantech — 2013-03-21T14:45:50+00:00

"Fighting the algorithmic future one bit at a time". Get your Google Glass Ban Signs here. Is this the first time people have seriously considered the privacy implications of a technology so far ahead of its release? Certainly feels like it.

EU privacy watchdogs tell app developers and app stores to take care of users' data >> Computerworld

guardiantech — 2013-03-14T22:00:43+00:00

New recommendations from Europe's top privacy watchdog could have big ramifications for Google Play, Apple and application developers.
The Article 29 working group, which is made up of data protection authorities from across the European Union, has issued fresh guidelines for mobile phone applications. The overall principle of data minimization - only collecting the data strictly necessary for the app to operate - is the cornerstone of the group's recommendations.
However, according to Nick Pickles, director of Big Brother Watch, there is much confusion in the market, and in February, Christopher Graham, the U.K.'s Information Commissioner, said that some app developers had a "cavalier" attitude to personal data protection.

The principal aim is to stop people being tracked by "advertisers and any other third party". Not sure where Google fits into that.

Tor exit nodes mapped and located >> HackerTarget.com

guardiantech — 2013-03-10T17:30:46+00:00

Tor Exit Nodes are the gateways where encrypted Tor traffic hits the Internet. This means an exit node can be abused to monitor Tor traffic (after it leaves the onion network). It is in the design of the Tor network that locating the source of that traffic through the network should be difficult to determine. However if the exit traffic is unencrypted and contains identifying information then an exit node can be abused.
The torproject therefore is dependent on a diverse and wide range of exit nodes. This update to an older page is where I attempt to display the exit nodes diversity in a Google map with Geolocation.

How guys will use Google Glass >> YouTube

guardiantech — 2013-03-07T14:57:35+00:00

The future is coming, ladies. Sorry about that.

"Glass, take a picture." Precisely. (From @dartanion on Twitter.)

HTC America settles FTC charges it failed to secure millions of mobile devices shipped to consumers >> FTC

guardiantech — 2013-02-22T18:19:30+00:00

Mobile device manufacturer HTC America has agreed to settle Federal Trade Commission charges that the company failed to take reasonable steps to secure the software it developed for its smartphones and tablet computers, introducing security flaws that placed sensitive information about millions of consumers at risk.
The settlement requires HTC America to develop and release software patches to fix vulnerabilities found in millions of HTC devices. In addition, the settlement requires HTC America to establish a comprehensive security program designed to address security risks during the development of HTC devices and to undergo independent security assessments every other year for the next 20 years.
…the FTC’s complaint details several vulnerabilities found on HTC’s devices, including the insecure implementation of two logging applications - Carrier IQ and HTC Loggers - as well as programming flaws that would allow third-party applications to bypass Android’s permission-based security model.

Tweaking Android makes it buggy, it seems.

How hardware hacking (almost) made me a fraudster >> BBC News

guardiantech — 2013-02-03T21:28:33+00:00

Mark Ward found his debit card declined - and got a "suspected fraud" call from his bank:

A clue came from the first transaction flagged as potentially fraudulent. What had I done on that day? . Really? Could that be it? On that day my son Callum and I engaged in some father-son bonding by swapping the faulty motherboard on the family PC - the motherboard is the bit into which you plug all the other parts of a PC - processor, graphics card, memory et cetera. Cal and I high-fived when it booted the first time we turned on the power. A good day.
Was that it? Had a bout of harmless home hardware hackery led to me being flagged as a fraudster?

WhatsApp breaches privacy laws >> CBC News

guardiantech — 2013-01-29T18:25:12+00:00

The popular mobile messaging app WhatsApp breaches Canadian and Dutch privacy laws by forcing many of its users to grant access to their entire address book in order to use it, Canada's privacy watchdog has found in a joint investigation with Dutch authorities.

Doubt that Germany or France or even the UK will be thrilled either.

Actual Facebook Graph searches >> Tumblr

guardiantech — 2013-01-23T06:25:46+00:00

Tom Scott soothingly says "Don't worry, we'll all be used to this in a few weeks' time." Examples: "people who like English Defence League and curry."

How Facebook is killing your authenticity >> steve's blog

guardiantech — 2013-01-23T00:41:09+00:00

Steve Cheney in March 2011, when Techcrunch had just adopted Facebook logins for its comments:

The problem with tying internet-wide identity to a broadcast network like Facebook is that people don’t want one normalized identity, either in real life, or virtually.
People yearn to be individuals. They want to be authentic. They have numerous different groups of real-life friends. They stylize conversations. They are emotional and have an innate need to connect on different levels with different people. This is because humans are born with an instinctual desire to understand the broader context of their surroundings and build rapport, a social awareness often called emotional intelligence.

Jan 2013: TechCrunch abandons Facebook logins for comments, saying that engagement is too low *waves to non-Facebook commenters*.

Feb 2003: Google's Privacy Problems (Google Weblog) >> Aaron Swartz

guardiantech — 2013-01-13T21:47:24+00:00

February 2003:

Conclusion: Google needs to stop sending the cookie and promise to only store aggregate data, with no connection between users and search terms. This issue was publicly raised almost a year ago; that Google still hasn't dealt with it is inexcusable.

Google's gone in completely the other direction, you'll have noticed.

Ubuntu Spyware: What to Do? >> Free Software Foundation

guardiantech — 2012-12-10T21:43:14+00:00

Richard Stallman:

Proprietary software is associated with malicious treatment of the user: surveillance code, digital handcuffs (DRM or Digital Restrictions Management) to restrict users, and back doors that can do nasty things under remote control. Programs that do any of these things are malware and should be treated as such. Widely used examples include Windows, the iThings, and the Amazon "Kindle" product for virtual book burning, which do all three; Macintosh and the Playstation III which impose DRM; most portable phones, which do spying and have back doors; Adobe Flash Player, which does spying and enforces DRM; and plenty of apps for iThings and Android, which are guilty of one or more of these nasty practices…
Ubuntu uses the information about searches to show the user ads to buy various things from Amazon. Amazon commits many wrongs (see http://stallman.org/amazon.html); by promoting Amazon, Canonical contributes to them. However, the ads are not the core of the problem. The main issue is the spying. Canonical says it does not tell Amazon who searched for what. However, it is just as bad for Canonical to collect your personal information as it would have been for Amazon to collect it.

Chrome updated with Do Not Track protocol support, but leaves it turned off by default >> The Verge

guardiantech — 2012-11-07T21:30:27+00:00

Google just released the latest stable version of Chrome, which finally includes support for the somewhat-controversial Do Not Track protocol. This makes Google the last major browser developer to support it, as Microsoft, Mozilla, Apple, and even Opera enabled it in their browsers some time ago. Google's chosen to have the option turned off by default, the opposite of Microsoft's default behavior in Internet Explorer 10.

Presidential Identifying Information >>Web Policy

guardiantech — 2012-11-04T21:44:50+00:00

Jonathan Mayer:

Sunday's New York Times included a story about how the presidential campaigns are making extensive use of third-party web trackers. In response to privacy concerns, "[o]fficials with both campaigns emphasize[d] that [tracking] data collection is 'anonymous.'"
The campaigns are wrong: tracking data is very often identified or identifiable. Arvind Narayanan has previously written a comprehensive and accessible explanation of why web tracking is hardly anonymous; my survey paper (PDF) on web tracking provides more extensive discussion.

(Mayer is the researcher who discovered that Google was hacking Apple's Safari to plant cookies on mobile devices.)

I just bought more than 1 million …Facebook data entries. OMG! >>Talk Web

guardiantech — 2012-10-24T20:51:49+00:00

I have the bloody habit to look for cheap deals on some websites and today I’ve got the featured offer to buy more than 1 million Facebook entries containing Full Name, e-mail and Facebook profile URL.

Concerning. (Thanks @Sputnikkers for the link.)

Google adds 'Do Not Track' to Chrome >> PCWorld

guardiantech — 2012-09-21T22:31:11+00:00

Google has added a Do Not Track privacy option to Chrome's developer channel, though it's late to the party compared to other browsers.
When Do Not Track is enabled in a browser, it signals to Websites and to advertisers that the user doesn't want to be followed around the web for ad targeting purposes. Ad networks and sites aren't required to comply, but several of them do, and the U.S. government is now pressuring more companies to play along, including Google.

What does Twitter know about me? My .zip file with 50Mb of data « Anne Helmond

guardiantech — 2012-09-21T21:45:43+00:00

Three weeks ago I read a tweet from @web_martin who had requested all his data from Twitter under European law and received a .zip file with his data from Twitter. He linked to the Privacy International blog which has written down step by step how to request your own data.

You, too, can play if you live in the EU - though Twitter CEO Dick Costolo has indicated that Twitter will allow you to download all your tweets by the end of this year. We'll see.

WhatsApp is broken, really broken >> fileperms

guardiantech — 2012-09-19T21:51:26+00:00

Security-wise, that is:

The authentication is a security nightmare. On Android, the password is a md5 hash of the reversed IMEI number… On iOS devices the password is generated from the devices WLAN MAC address:
The username is the users mobile phone number – an attacker would probably already know the number.
The IMEI can be obtained if you have physical access to the phone or if you control an app installed on the users device. The WLAN MAC address can be found using a network sniffer. Congratulations, you can now take over a users WhatsApp account.

Unfortunate.

1 million Apple UDIDs allegedly leaked from FBI laptop >> Marco.org

guardiantech — 2012-09-04T20:31:05+00:00

Marco Arment:

initially thought that Apple may owe us an explanation, but the last part of this description from the hackers is interesting:
…[a file] with the name of “NCFTA_iOS_devices_intel.csv” turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc. the personal details fields referring to people appears many times empty leaving the whole list incompleted on many parts.
UDIDs, APNS tokens, and some contact info? All of this information could have been collected from an app transmitting data to a server.

Now looks like it was an app called AllClear ID. Still, 12m devices having their details leaked is quite a problem.

Google hit with record fine >> Big Brother Watch

guardiantech — 2012-08-09T16:46:52+00:00

As we have often warned, where businesses rely on personal information to offer better targeted advertisements there will be inherent tension between respecting consumer privacy and pursuing profit. Staff will inevitably come under commercial pressures, as in any other business. Big Brother Watch believes that innovation and technology will address this in the future, but that regulation is essential where companies seek to over-ride consumer choices about sharing their data.

Also has a good rundown of how Google's story about what happened kept changing.

Google Adds Personal Gmail Results Into Search >> AllThingsD

guardiantech — 2012-08-09T06:40:31+00:00

Um. Good luck. So when participating users search for “Amazon,” information from their own recent purchase confirmation emails will appear on the right rail. Or, a user could type “my flights” as a search query, and see — directly at the top of their search results — itineraries drawn from their flight confirmation emails.

UK consumers deeply skeptical over data collection >> WSJ Tech Europe

guardiantech — 2012-07-10T21:52:28+00:00

Ben Rooney:

The British public is deeply skeptical of companies collecting personal data, does not trust companies to safeguard that data, and opponents of data collection overwhelmingly outnumber those who support it, according to a report published Tuesday.
Data Nation 2012, published by Deloitte, found that while 82% of the U.K. population are aware their data is collected by organizations, only 29% are confident companies will not sell or share their data with other groups without their knowledge.

Sceptical, dammit.

PayPal bans BitTorrent-friendly VPN provider >> TorrentFreak

guardiantech — 2012-06-25T16:48:31+00:00

In response to new internet surveillance initiatives there is a growing interest in privacy enhancing services such as VPNs and proxies.
TorGuard is one of the many companies catering to this demand. As the name suggests, TorGuard has several plans specifically targeted at BitTorrent users who prefer to hide their IP-addresses from the rest of the world.
Being a BitTorrent-friendly VPN appeals to a wide audience. However, the company has also learned that it has a downside. Without prior warning or detailed explanation, PayPal decided to ban TorGuard for promoting their services to BitTorrent users.

They were charging for a VPN to connect people to torrents?

Apple wants to protect your identity ... by cloning you online >> The Atlantic

guardiantech — 2012-06-25T05:21:57+00:00

One of the properties Apple won in a February acquisition of patents from Novell, the technology allows the company to fight would-be Little Brothers by cloning users' digital identities. The system - in more traditional Patent-ese, a "non-transitory computer-readable implemented method to process on a device" - works in three ways. First, it creates a fake identity (and, actually, many fake identities) for the user. Second, it takes elements of users' real identities -- interests and the like, based on browser history and cookies -- and merges those with elements that don't reflect the identity of the user, creating a close-but-not-quote shadow identity. Third, it creates actual network activity based on those false interest areas, spreading them across the network.

Can imagine companies that wouldn't like that.

What happens after you click "report" >> Facebook

guardiantech — 2012-06-21T05:19:28+00:00

Your handy download-and-stick-on-wall guide:

There are dedicated teams throughout Facebook working 24 hours a day, seven days a week to handle the reports made to Facebook. Hundreds of Facebook employees are in offices throughout the world to ensure that a team of Facebookers are handling reports at all times.

Online privacy: Home Office to write blank cheque for 'snoopers' charter' >> The Guardian

guardiantech — 2012-06-13T16:27:31+00:00

The bill will be published in draft form for the first time today (Thursday). Tin hat time.

Google Street View Case Brought Employee Denials >> NYTimes.com

guardiantech — 2012-06-13T08:16:13+00:00

Google releases nine sworn declarations by employees that they were not aware of the data collection.

ICO letter to Google over Street View >> ICO [PDF]

guardiantech — 2012-06-13T08:12:35+00:00

Read the full ICO letter to Google, including its seven detailed questions.

Google to be investigated over data cover-up claims >> The Guardian

guardiantech — 2012-06-13T08:11:11+00:00

The UK data watchdog has written to Google demanding answers after it emerged that the search engine firm knew its Street View cars could harvest personal information as they photographed homes across the globe.

French privacy watchdog to quiz Google on policy change >> BBC News

guardiantech — 2012-05-17T20:56:02+00:00

France's data protection watchdog has set up a meeting with Google to closely examine its controversial privacy policy.
The search giant consolidated 60 privacy policies into one single agreement in March. The EU expressed concern over the legality and impact of the change.
France's information commission, the CNIL, said it was not yet "totally satisfied" with Google's explanation of the amendments.