Kamis, 16 Januari 2020

Proof-of-concept exploits published for the Microsoft-NSA crypto bug - ZDNet

encryption cryptography lock

Security researchers have published earlier today proof-of-concept (PoC) code for exploiting a recently-patched vulnerability in the Windows operating system, a vulnerability that has been reported to Microsoft by the US National Security Agency (NSA).

The bug, which some have started calling CurveBall, impacts CryptoAPI (Crypt32.dll), the component that handles cryptographic operations in the Windows OS.

According to a high-level technical analysis of the bug from cyber-security researcher Tal Be'ery, "the root cause of this vulnerability is a flawed implementation of the Elliptic Curve Cryptography (ECC) within Microsoft's code."

According to both the NSA, the DHS, and Microsoft, when exploited, this bug (tracked as CVE-2020-0601) can allow an attacker to:

  • launch MitM (man-in-the-middle) attacks and intercept and fake HTTPS connections
  • fake signatures for files and emails
  • fake signed-executable code launched inside Windows

Experts: "seriously, seriously bad"

Speaking on Twitter, Acting Homeland Security Advisor Rob Joyce described the bug as "seriously, seriously bad."

US authorities reacted to the vulnerability very openly and proactively. The NSA released a rare security alert about the bug, and the DHS' CISA department issued an emergency directive, giving government agencies ten days to patch systems by applying the January 2020 Microsoft Patch Tuesday updates.

This is the first time the NSA reported a bug to Microsoft. One might say the agency is on a press tour to improve its image in the cyber-security community after the EternalBlue and Shadow Brokers disasters, when NSA-developed hacking tools were leaked online and used for some of the biggest malware infections and cyber-attacks known to date.

However, the vulnerability's severity cannot be downplayed by the NSA's attempt to "turn a new leaf" with the infosec community.

Astute and experienced security experts and cryptographers like Thomas Ptacek and Kenneth White have confirmed the vulnerability's severity and wide impact -- although it does not impact the Windows Update mechanism, which would have allowed a threat actor to fake Windows updates.

PoC exploits released online

In a blog post on Tuesday, White said he was aware that some people were days away from coming up with a working exploit for the CurveBall vulnerability.

The first one to come up with one was Saleem Rashid, who created a proof-of-concept code to fake TLS certificates and allow sites to pose as legitimate ones.

Rashid didn't publish his code, but others did, hours later. The first public CurveBall exploit came from Kudelski Security, followed by a second one from a Danish security researcher going by the name of Ollypwn.

In its official security advisory for CVE-2020-0601, Microsoft described the chance of threat actors exploit the bug as "more likely." With public demo code available, the chances of exploitation are now also ensured.

The good news in all of this is that even if users haven't had the time to schedule time to install the patches, Windows Defender has received updates to at least detect active exploitation attempts and warn users. According to Microsoft, this vulnerability impacts Windows 10, Windows Server 2019, and Windows Server 2016 OS versions.

Let's block ads! (Why?)


https://news.google.com/__i/rss/rd/articles/CBMiY2h0dHBzOi8vd3d3LnpkbmV0LmNvbS9hcnRpY2xlL3Byb29mLW9mLWNvbmNlcHQtZXhwbG9pdHMtcHVibGlzaGVkLWZvci10aGUtbWljcm9zb2Z0LW5zYS1jcnlwdG8tYnVnL9IBbmh0dHBzOi8vd3d3LnpkbmV0LmNvbS9nb29nbGUtYW1wL2FydGljbGUvcHJvb2Ytb2YtY29uY2VwdC1leHBsb2l0cy1wdWJsaXNoZWQtZm9yLXRoZS1taWNyb3NvZnQtbnNhLWNyeXB0by1idWcv?oc=5

2020-01-16 08:32:00Z
52780555628545

TikTok downloaded more than Facebook, Messenger, and Instagram in 2019 - Yahoo Finance

TikTok got over 700 million downloads globally last year, according to data from Sensor Tower. Photo: Lionel Bonaventure/AFP via Getty Images

TikTok, the China-born social media video app, was the second most downloaded app in 2019, beating Facebook, and Facebook-owned Messenger and Instagram.

According to data firm Sensor Tower, TikTok got over 700 million downloads globally last year, while Facebook received just under 700 million downloads. It was only beaten by Facebook-owned WhatsApp, which received over 850 million downloads due to its unbridled popularity in India.

The fourth quarter of the year provided the biggest uptick for TikTok with Q4 marking an all-time high with nearly 220 million installs. This marks a 24% increase compared to the previous quarter and 6% growth year-on-year.

Graphic: Sensor Tower

TikTok’s growth is comparable to that of WhatsApp, which topped the charts. Whatsapp also experienced huge growth in the fourth quarter, up 39% after initially decreasing in downloads in the previous four quarters.

TikTok’s popularity is on a seemingly inexorable rise. After entering the app download charts in 2018 at number 4, it is now in second place and is on WhatsApp’s tail.

Worldwide app downloads. Charts: Sensor Tower

Chinese tech firm Bytedance, whose last valuation of $78bn (£61bn) makes it the world's most valuable start-up, is behind the app that is dominating the lives of millennials and generation Z. It only launched in September 2016 but, outside of China, it has already amassed over a billion and a half installs to date.

For those not initiated into the phenomenon, TikTok videos use either user generated music or commentary, sound from shows, movies, or games, or actual songs or mash-ups by artists, which are called “sounds.”

Users can record videos themselves and either attach their own sound recordings or select a “sound” that is available within the app. Special effects, templates, and video timers are also available.

READ MORE: TikTok's indisputable power over influencing music sales

“Sounds” are then pooled onto their own pages that pull in all videos that use that sound — creating a long list of related videos that usually follow one tone or theme, creating a meme in the process.

Sensor Tower highlighted TikTok’s rise up the charts as a one of the top three ‘stories of the year.’

“When it comes to worldwide downloads, Facebook’s dominance among the top apps was apparent: Facebook published the top four apps in 2016 and 2017. Over the next two years, only TikTok was able to break into these top positions, demonstrating that it is still possible for new apps to emerge and compete with top social apps by publishers such as Facebook and Snap,” it said in the report.

It’s also on a revenue sprint. In the fourth quarter, TikTok sales grew 540% year-on-year. It was also the seventh non-game app by revenue in Q4.

Chart: Sensor Tower

TikTok is also expanding and considering moving its global headquarters to London, Singapore, or Dublin, according to a report in the Wall Street Journal.

Let's block ads! (Why?)


https://news.google.com/__i/rss/rd/articles/CBMic2h0dHBzOi8vZmluYW5jZS55YWhvby5jb20vbmV3cy90aWstdG9rLWRvd25sb2FkZWQtbW9yZS10aGFuLWZhY2Vib29rLW1lc3Nlbmdlci1hbmQtaW5zdGFncmFtLWluLTIwMTktMDkwOTQxNTgwLmh0bWzSAXtodHRwczovL2ZpbmFuY2UueWFob28uY29tL2FtcGh0bWwvbmV3cy90aWstdG9rLWRvd25sb2FkZWQtbW9yZS10aGFuLWZhY2Vib29rLW1lc3Nlbmdlci1hbmQtaW5zdGFncmFtLWluLTIwMTktMDkwOTQxNTgwLmh0bWw?oc=5

2020-01-16 09:09:00Z
52780556468610

Rabu, 15 Januari 2020

Windows 7 is gone, but what’s next for Windows 10? - The Verge

Yesterday’s computer news was about something old: Windows 7. After 11 years, Microsoft is officially ending support for it — though as Tom Warren notes, there’s a healthy chance the company will blink and provide some kind of security update at some point for something critical.

Windows has a reputation for shipping a good version, then a bad version. Windows 7 was one of the good versions, and upgrades to Windows 10 are free for consumers. That means you can skip right over Windows 8, and more power to you.

Now, the future for Windows is harder to divine. Microsoft won’t be releasing a “Windows 11,” but instead updating Windows 10 on whatever cadence it can decide on from year to year. Early on it seemed like it wanted to be a lot like Chrome OS in issuing updates on a regular and frequent cadence, but lately things are moving a little slower as some bugs have crept in. There’s also Windows 10X coming later this year, the version of Windows 10 designed for foldable devices.

When I interviewed Microsoft’s CEO back in May 2018 (time flies!!), it was clear to me that Microsoft wants to make sure its fortunes don’t depend on Windows — and Nadella has achieved that goal already. Microsoft is as focused on making sure its software runs well on other platforms as it is on maintaining the platform that made the company — maybe more so.

I think the action for the next while is going to be centered around the new Edge browser — based on Chromium — and what Microsoft can do with it. I’m confident the Edge browser itself will run fairly well and hopeful it’ll be less of a battery killer than Chrome. For me, the thing to watch is whether Microsoft can use that technology elsewhere in Windows and Office or if Edge will just feel tacked-on.

Goodbye, Windows 7

Microsoft bids farewell to Windows 7 and the millions of PCs that still run it

Thank you to Windows 7 for undoing some of Vista’s excesses. Thank you also to Windows 7 for being good enough to allow millions of people to skip Windows 8 because of its excesses. You have been stalwart and true, but now is the time for you to rest. May your registry always be clean and your start menu uncluttered.

I salute you, oh Windows 7, with the salute emoticon, which happily includes the number seven: o7

How to upgrade from Windows 7 to Windows 10 for free

The PC market just had its first year of growth since 2011

With Microsoft ending support for Windows 7 today, businesses around the world are being forced to upgrade their legacy devices, leading to “vibrant business demand” for Windows 10, according to Gartner.

Microsoft patches Windows 10 security flaw discovered by the NSA

It’s unusual to see the NSA reporting these types of vulnerabilities directly to Microsoft, but it’s not the first time the government agency has done so. This is the first time the NSA has accepted attribution from Microsoft for a vulnerability report, though

More news from The Verge

Trump accuses Apple of refusing to unlock criminals’ iPhones, setting the stage for a fight

Latest Galaxy S20 Plus leak shows off 120Hz display and no headphone jack

Max Weinbach is back with more details and specs. Looks like 120Hz screens is going to be baseline for Android flagships this year. I’m also intrigued by the taller/longer shape. I really did like it on the Sony Xperia phones last year.

By the way -- the consensus is that “Bloom” was the codename for Samsung’s folding phone and the actual product name is going to be “Galaxy Z Flip.” I think my concerns about addressing gender could still stand, though, depending on how Samsung positions the phone. I will say that the only thing that endears me to the phrase “Galaxy Z Flip” is that is has the last three letters of the English alphabet all a row.

Yahoo parent Verizon promises it won’t track you with OneSearch, its new privacy-focused search engine

From the company that brought you the Super Cookie, a ...privacy-focused search engine? Fool me once but I guess we could take Verizon at its word here, because it would be quite a scandal if it turned out otherwise. Maybe.

Let’s just call this a trust-but-verify kind of situation — if we’ve learned anything about tracking over the past decade, its that people find ways to do it that you never would have imagined.

Jeopardy! The Greatest of All Time is the GOAT of low-stakes television

One sign of admiration that you can see in this article and everywhere else is that we write it “Jeopardy!,” exclamation point included and do so without the usual millennial irony. (Or is it Gen X irony?). If you want to teach somebody how to be stoic, kind, funny, and empathetic all at once, you could do a lot worse than sit them down have them watch Alex Trebek host this show.

Time zones mess up more than just your sense of time

You might think you know what you’re getting into with this video by Cory Zapatka and Verge Science, but it takes a fascinating and vital turn halfway through. For some, setting their watch is a political act.

Coral is Google’s quiet initiative to enable AI without the cloud

Little, easily programmable AI chips are going to be an essential part of our computing infrastructure -- it can’t all go to the cloud. James Vincent looks into Google’s offering in that regard, Coral. It’s a little too tightly tied to Google’s own AI ecosystem for many, though.

Anyway, if you’ve heard Microsoft CEO Satya Nadella talk about “the intelligent edge” any time in the past year and wondered what he’s on about, this story is a good primer on what these devices are, why they’re needed, and what their potential might be — whether they’re made by Google or not.

Instagram starts bringing DMs to the web

Good get from Ashley Carman. Access on the desktop may not be the main way mobile chat apps are used these days, but it’s essential for people who have office jobs. If you’re staring at a certain screen all day and your fingers are on a certain keyboard, you’re more likely to use the chat app that can appear on that screen and work with that keyboard.

Google to ‘phase out’ third-party cookies in Chrome, but not for two years

Here’s me, touching briefly on what’s going on with the browser war. It really does inflame a lot of passions and I really do think every side here is not giving the other side the benefit of the doubt. And that those sides would probably say ‘you darn tootin’ we’re not giving those varmints the benefit of the doubt!’ That’s how web developers talk, you see. There are very good reasons for everybody to distrust everybody else in this whole privacy mess.

Here comes the cliche, though: good, so long as all that contention leads to a more resilient and long-lasting solution. We need to have this conversation and the web and the browsers we use to access it need to develop more quickly. Too many things are broken right now.

SpaceX continues to blast satellites into orbit as the space community worries

Elon Musk’s plan to put 42,000(!) internet-providing satellites into space raises a lot of legitimate issues, especially when it comes to tracking satellites and preventing collisions. Loren Grush has a deep, nuanced look at the current state of things for both that and astronomy. Worth your time:

The truth about Starlink is that there is no solid truth. Depending on who you ask, the constellation either won’t be that much of a problem, or it will lead to a space apocalypse

OnePlus CEO Pete Lau doesn’t think folding phones are good enough

This was a fun podcast -- Lau’s first, he says.

Let's block ads! (Why?)


https://news.google.com/__i/rss/rd/articles/CBMiVmh0dHBzOi8vd3d3LnRoZXZlcmdlLmNvbS90ZWNoLzIwMjAvMS8xNS8yMTA2NjY0MC9taWNyb3NvZnQtd2luZG93cy03LWdvbmUtZWRnZS1icm93c2Vy0gFjaHR0cHM6Ly93d3cudGhldmVyZ2UuY29tL3BsYXRmb3JtL2FtcC90ZWNoLzIwMjAvMS8xNS8yMTA2NjY0MC9taWNyb3NvZnQtd2luZG93cy03LWdvbmUtZWRnZS1icm93c2Vy?oc=5

2020-01-15 12:00:00Z
52780549999841

Goodbye Microsoft Edge, welcome Microsoft (Chromium) Edge - Ars Technica

Edge vs Chrome screenshots
Enlarge / It still takes a connoisseur to spot the differences between Chromium-based Edge and Google Chrome at a glance.
Jim Salter
As of Wednesday, January 15, Microsoft will begin pushing its new, Chromium-based version of the Edge browser to Windows 10 Home and Pro users. We covered the beta version of Chromium-based Edge in November. The beta was still pretty raw then—but "raw" is a relative term. The new Edge project began with a complete and fully-functional Web browser—Chromium—so it worked fine for browsing the Web. There were just a few rough edges as far as installing extensions, logging into them, and the like.

We've seen one take waxing nostalgic for the old, purely-Microsoft-developed version of Edge, but we don't think many people will miss it much. It's not so much that Edge was a bad browser, per se—it just didn't serve much of a purpose. Edge didn't have the breadth of extensions or the user-base enthusiasm of Chrome or Firefox—and it was no better than they are at running crusty old "Internet Explorer Only" websites and Web apps.

While there is some validity to worrying about one company "controlling the Web" and one of Google's biggest competitors now becoming a Google downstream, we don't think those concerns add up to much. We don't want to see the full-on Google Chrome become any more indispensable than it already is—but we don't think Microsoft trading in its own fully proprietary, closed-source HTML-rendering engine for one of the two biggest open source rendering engines is a bad thing.

We downloaded the final beta version of Chromium-based Edge—the one available on the afternoon of the 14th, one day before the official launch—and took it for a spin in a Windows 10 virtual machine. Mostly, it still just looks like a slightly plainer version of Chrome—which isn't a bad thing! Sites load snappily, UI elements are familiar, and so forth. One of the biggest obvious improvements since the last time we test-drove Chromium Edge is the ability to install extensions from the official Chrome Web store.

Microsoft's own Web store is still extremely sparse—we went looking for the must-have, EFF-developed HTTPS Everywhere, and instead we got a recommendation for "NBC Sports"—which does not seem well-loved by its users. However, typing "chrome Web store" in the address/search bar took us right where we needed to go and presented us with an obvious tool-tip for installing third-party extensions. That was that—HTTPS Everywhere installed with a single click, just as you'd expect it to on Chromium or Google Chrome itself.

Chromium-based Edge is still missing a couple of obvious features to compete with the full Google Chrome experience—most notably, browser history and extensions don't sync between devices yet. This is described as a temporary problem in the "Known Issues" page, and it may even be fixed already in the production version launching today.

Pushing the new Edge as something to look forward to right now is difficult—we suspect most people who really care about their browser will continue using Chrome, Firefox, or whatever less-well-known variant they've found and learned to love. Meanwhile, the people who've actually been actively using Edge likely won't notice much of a change—unless Microsoft bobbles something in the user data import functionality when they push the official, non-beta version out through Windows Update.

In all likelihood, the change absolutely will improve the lives of the folks who "just click the blue E" in the long run, though. It will likely make it easier for Microsoft to lure more technical users—who demand feature and extension parity but might be interested in Edge's Azure authentication back-end—away from Google Chrome

Let's block ads! (Why?)


https://news.google.com/__i/rss/rd/articles/CBMiX2h0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2dhZGdldHMvMjAyMC8wMS9nb29kYnllLW1pY3Jvc29mdC1lZGdlLXdlbGNvbWUtbWljcm9zb2Z0LWNocm9taXVtLWVkZ2Uv0gFlaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vZ2FkZ2V0cy8yMDIwLzAxL2dvb2RieWUtbWljcm9zb2Z0LWVkZ2Utd2VsY29tZS1taWNyb3NvZnQtY2hyb21pdW0tZWRnZS8_YW1wPTE?oc=5

2020-01-15 11:45:00Z
52780549999841

Instagram messages on the web could pose an encryption challenge - The Verge

It’s a relatively slow week on the platforms-and-democracy beat, so let’s talk about something small but fascinating in its own way: the arrival of Instagram messages on the web.

An unfortunate thing about being a xennial who grew up using (and loving) the world wide web is that most developers no longer build for it. Over the past 15 years, mobile phones became more popular than desktop computers ever were, and the result is that web development has entered a slow but seemingly inexorable decline. At the same time, like most journalists, I spent all day working on that same web. And with each passing year, the place where I do most of my work seems a little less vital.

This all feels particularly true when it comes to communications tools. Once, every messaging kingdom was united with a common API, allowing us to gather our conversations into a single place. (Shout out to Adium.) But today, our messages are often scattered across a dozen or more corporate inboxes, and accessing them typically requires picking up your phone and navigating to a separate app.

As a result, I spend a lot of time typing on a glass screen, where I am slow and typo-prone, rather than on a physical keyboard, where I’m lightning-quick. And each time I pick up my phone to respond to a message on WhatsApp, or Snapchat, or Signal, I inevitably find a notification for some other app, and the next thing I know 20 minutes have passed.

All of which is to say, I was extremely excited today to see Instagram’s announcement that it had begun rolling out direct messages on the web. (The company gave me access to the feature, and it’s glorious.) Here’s Ashley Carman at The Verge:

Starting today, a “small percentage” of the platform’s global users will be able to access their DMs from Instagram’s website, which should be useful for businesses, influencers, and anyone else who sends lots of DMs, while also helping to round out the app’s experience across devices. Today’s rollout is only a test, the company says, and more details on a potential wide-scale rollout will come in the future.

The direct messaging experience will be essentially the same through the browser as it is on mobile. You can create new groups or start a chat with someone either from the DM screen or a profile page; you can also double-tap to like a message, share photos from the desktop, and see the total number of unread messages you have. You’ll be able to receive desktop DM notifications if you enable notifications for the entire Instagram site in your browser.

Instagram didn’t state a strategic rationale for the move, but it makes sense in a world that is already moving toward small groups and private communication. Messengers win in part by being ubiquitous, and even if deskbound users like myself are in the minority, Facebook can only grab market share from rivals if it’s everywhere those rivals can be found. (iMessage and Signal, for example, have long been usable on desktop as well as mobile devices.)

Now, thanks to this move, I can make greater use of Instagram as both a social and reporting tool, and the web itself feels just a bit more vital. All of which is good news — but, asks former Facebook security chief Alex Stamos, is it secure? After all, Facebook is in the midst of a significant shift toward private, end-to-end encrypted messaging, with plans to create a single, encrypted backend for all of its messaging apps.

Stamos went on to highlight two core challenges in making web-based communications secure. One is securely storing cryptographic information in JavaScript, the lingua franca of the web. (This problem is being actively worked on, Stamos notes.) The second is that the nature of the web would allow a company to create a custom backdoor targeting an individual user — if compelled by a government, say. For that, there are few obvious workarounds.

One alternative is to take the approach that Signal and Facebook-owned WhatsApp have, and create native or web-based apps. As security researcher Saleem Rashid told me, the web version of WhatsApp generates a public key in the browser using JavaScript, then encodes it in a QR code that a users scans with their phone. This creates an encrypted tunnel between the web and the smartphone, and so long as the JavaScript involved in generating the key is not malicious, WhatsApp should not be able to encrypt any of the messages.

When I asked Instagram about how it plans to square the circle between desktop messages and encryption, the company declined to comment. I’m told that it still plans to build encryption into its products, and is still working through exactly how to accomplish this.

Granted, when I think of the tasks that I hope Facebook accomplishes this year, encrypted Instagram DMs are low on the list. But with our authoritarian president browbeating Apple today for failing to unlock a suspected criminal’s phone, the stakes for all this are relatively clear. We will either have good encrypted messaging backed by US corporations, or we won’t. As Apple put it this week:

“We have always maintained there is no such thing as a backdoor just for the good guys,” the company explained. “Backdoors can also be exploited by those who threaten our national security and the data security of our customers. ... We feel strongly encryption is vital to protecting our country and our users’ data.”

On one level, today’s Instagram news is a small story about a niche feature. But in the background, questions about the security of our private communications are swirling. Which should give us all reason to watch Facebook’s next moves here very closely.

The Ratio

Today in news that could affect public perception of the big tech platforms.

Trending down: Facebook said it doesn’t need to change its web-tracking services to comply with California’s new consumer-privacy law. The company’s rationale is that routine data transfers about consumers don’t fit the law’s definition of “selling” data. The move puts it at odds with Google, which is taking the opposite tack.

Trending down: Grindr, OkCupid and Tinder are sharing sensitive user data like dating choices and precise location to advertisers in ways that may violate privacy laws, according to a new report. I don’t want to downplay that, but if you think that data is sensitive, you should see the average Grindr user’s DMs.

Governing

Two days before the UK election in December, some 74,000 political advertisements vanished from Facebook’s Ad Library, a website that serves as an archive of political and issue ads run on the platform. The company said a bug wiped 40 percent of all political Facebook ads in the UK from the public record. Rory Smith at BuzzFeed has the story:

In the wake of the failure during the UK elections, Facebook said it had launched a review of how to prevent these issues, as well as how to communicate them more clearly.

But the events of Dec. 10 are not the first time Facebook’s Ad Library has failed since its launch in May 2018. The API, which is supposed to give researchers greater access to data than the library website, went live in March 2019 and ran into trouble within weeks of the European Parliament election in May. Researchers have been documenting a myriad of issues ever since.

The platform also drew the ire of researchers when it failed to deliver the data it promised as part of a partnership with the nonprofit Social Science Research Council and Social Science One, a for-profit initiative run by researchers — a project that was funded by several large US foundations. Facebook said it remains committed to providing data to researchers, but the SSRC and funders have begun withdrawing from the project due to the company’s delays.

Russian military hackers may have been boring into the Ukrainian gas company at the center of the impeachment inquiry, where Hunter Biden served on the board. Experts say the timing and scale of the attacks suggest that the Russians could be searching for potentially embarrassing material on the Bidens, similar to what Trump was looking for. On Twitter, security experts like Facebook’s Nathaniel Gleicher have urged caution when writing about this story, arguing that the case for attribution to Russia is thin. (Nicole Perlroth and Matthew Rosenberg / The New York Times)

There’s been an explosion of online disinformation, including the use of doctored images, from politicians. They do it for a simple reason: It’s effective at spreading their messages, and so far none have paid a price for trafficking in bogus memes. (Drew Harwell / The Washington Post)

Artificial personas, in the form of AI-driven text generation and social-media chatbots, could drown out actual human discussions on the internet, experts warn. They say the issue could manifest itself in particularly frightening ways during an election. (Bruce Schneier / The Atlantic)

The Treasury Department unveiled new rules designed to increase scrutiny of foreign investors whose potential stakes in US companies could pose a national security threat. The rules are focused on businesses that handle personal data, and come after the United States has heightened scrutiny of foreign involvement in apps such as Grindr and TikTok. (Katy Stech Ferek / The Wall Street Journal)

The Harvard Law Review just floated the idea of adding 127 more states to the union. These states would add enough votes in Congress to rewrite the Constitution by passing amendments aimed at making every vote count equally. Worth a read.(Ian Millhiser / Vox)

The New York Times editorial board interviewed Bernie Sanders on how he plans carry out his ambitious policy ideas if faced with the Republican-led Senate that stymied so many of President Barack Obama’s proposals. Notably, he says he’s not an Amazon Prime customer and tries never to use any apps.

Workers for grocery delivery platform Instacart are organizing a national boycott of the company next week to push for the reinstatement of a 10 percent default tip on all orders. One of 2020’s big stories is going to be tech-focused labor movements; this is but the latest example. (Kim Lyons / The Verge)

Microsoft CEO Satya Nadella strongly criticized a new citizenship law that the Indian government passed last month. The law, known as the Citizenship Amendment Act, fast-tracks Indian citizenship for immigrants from most major South Asian religions except Islam. India is Nadella’s birthplace, and one of Microsoft’s largest markets, making his comments all the more notable. (Pranav Dixit / BuzzFeed)

Industry

Facebook’s push into virtual reality has resulted in a slew of new patents, mostly for heads-up displays. The company won 64 percent more patents in 2019 than in 2018. Christopher Yasiejko and Sarah Frier at Bloomberg explain what this might mean:

The breadth of Facebook’s patent growth, said Larry Cady, a senior analyst with IFI, resembled that of intellectual-property heavyweights Amazon.com Inc. and Apple Inc., which were No. 9 and No. 7, respectively, with each winning more than twice as many patents as the social media titan. Facebook’s largest numbers were in categories typical of Internet-based computer companies -- data processing and digital transmission, for example -- but its areas of greatest growth were in more novel categories that may suggest where the company sees its future.

Facebook’s 169 patents in the Optical Elements category marked a nearly six-fold jump. Most of that growth stems from the Heads-Up Displays sub-category, which Cady said probably is related to virtual-reality headsets. Facebook owns the VR company Oculus and in November acquired the Prague-based gaming studio behind the popular Beat Saber game. One such patent, granted Nov. 5, is titled “Compact head-mounted display for artificial reality.”

Popular “e-boys” on TikTok are nabbing fashion and entertainment deals. They’re known mostly for making irony-steeped videos of themselves in their bedrooms wearing tragically hip outfits composed of thrifted clothes. Some observers predict that top e-boys will have success reminiscent of the boy bands of yore. (Rebecca Jennings / Vox)

YouTube signed three video stars — Lannan “LazarBeam” Eacott, Elliott “Muselk” Watkins and Rachell “Valkyrae” Hofstetter — to combat Amazon’s Twitch and Facebook. Exclusive deals for top video game streamers have been one of the big tech stories of the year so far. (Salvador Rodriguez / CNBC)

Uncanny Valley, Anna Wiener’s beautiful memoir about life working at San Francisco tech companies, is out today. Kaitlyn Tiffany has a great interview with Wiener in the Atlantic. Read this book and stay tuned for news about an Interface Live event with Wiener in San Francisco next month!

Mark Bergen, friend of The Interface and a journalist at Bloomberg, is writing a book about YouTube titled Like, Comment, Subscribe. Bergen is a former Recode colleague and ace YouTube reporter, and this book will be a must-read in our world. (Kia Kokalitcheva / Axios)

The Information published a Twitter org chart that identifies the company’s 66 top executives, including the nine people who report directly to CEO Jack Dorsey. (Alex Heath / The Information)

A new app called Doublicat allows users to put any face on a GIFs in seconds, essentially allowing them to create deepfakes. The app launches just as prominent tech companies like Facebook and Reddit ban deepfakes almost completely. (Matthew Wille / Input)

And finally...

Wired got Jack Dorsey to do 11 minutes of Twitter tech support on video. Enjoy!

Talk to us

Send us tips, comments, questions, and web-based DMs: casey@theverge.com and zoe@theverge.com.

Let's block ads! (Why?)


https://news.google.com/__i/rss/rd/articles/CBMiaWh0dHBzOi8vd3d3LnRoZXZlcmdlLmNvbS9pbnRlcmZhY2UvMjAyMC8xLzE1LzIxMDY1NTk2L2luc3RhZ3JhbS1kaXJlY3Qtd2ViLWRtcy1lbmNyeXB0aW9uLXNlY3VyaXR5LXN0YW1vc9IBdmh0dHBzOi8vd3d3LnRoZXZlcmdlLmNvbS9wbGF0Zm9ybS9hbXAvaW50ZXJmYWNlLzIwMjAvMS8xNS8yMTA2NTU5Ni9pbnN0YWdyYW0tZGlyZWN0LXdlYi1kbXMtZW5jcnlwdGlvbi1zZWN1cml0eS1zdGFtb3M?oc=5

2020-01-15 11:00:00Z
52780554390091

Google now treats iPhones as physical security keys - The Verge

The latest update to Google’s Smart Lock app on iOS means you can now use your iPhone as a physical 2FA security key for logging into Google’s first-party services in Chrome. Once it’s set up, attempting to log in to a Google service on, say, a laptop, will generate a push notification on your nearby iPhone. You’ll then need to unlock your Bluetooth-enabled iPhone and tap a button in Google’s app to authenticate before the login process on your laptop completes. The news was first reported by 9to5Google.

Two-factor authentication is one of the most important steps you can take to secure your online accounts, and provides an additional layer of security beyond a standard username and password. Physical security keys are much more secure than the six digit codes that are in common use today, since these codes can be intercepted almost as easily as passwords themselves. Google already lets you use your Android phone as a physical security key, and now that the functionality is available on iOS it means that anyone with a smartphone now owns a security key without having to buy a dedicated device.

The new process is similar to the existing Google Prompt functionality, but the key difference is that Smart Lock app works over Bluetooth, rather than connecting via the internet. That means your phone will have to be in relatively close proximity to your laptop for the authentication to work, which provides another layer of security. However, the app itself doesn’t ask for any biometric authentication — if your phone is already unlocked then a nearby attacker could theoretically open the app and authenticate the login attempt.

According to one cryptogopher working at Google, the new functionality makes use of the iPhone processor’s Secure Enclave, which is used to securely store the device’s private keys. The feature was first introduced with the iPhone 5S, and Google’s app says that it requires iOS 10 or later to function.

The new iPhone support appears to be limited to authenticating Google logins from the Chrome browser. When we attempted to use an iPhone to authenticate a login of the same service (we tested with Gmail) using Safari on a MacBook, we were prompted to insert our key fob (which we don’t have), meaning it created an extra step in our login process where we had to pick an alternative 2FA option.

Let's block ads! (Why?)


https://news.google.com/__i/rss/rd/articles/CBMiYmh0dHBzOi8vd3d3LnRoZXZlcmdlLmNvbS8yMDIwLzEvMTUvMjEwNjY3NjgvZ29vZ2xlLWlwaG9uZS1pb3Mtc2VjdXJpdHkta2V5LTItZmFjdG9yLWF1dGhlbnRpY2F0aW9u0gFvaHR0cHM6Ly93d3cudGhldmVyZ2UuY29tL3BsYXRmb3JtL2FtcC8yMDIwLzEvMTUvMjEwNjY3NjgvZ29vZ2xlLWlwaG9uZS1pb3Mtc2VjdXJpdHkta2V5LTItZmFjdG9yLWF1dGhlbnRpY2F0aW9u?oc=5

2020-01-15 10:02:45Z
52780554616329

Sony's PlayStation wrap-up reveals your top games of 2019 - Engadget

Sponsored Links

Karl Tapales via Getty Images

PlayStation has started sending out its year-end wrap-up reports, and they may bring back fond memories of the time you spent playing your favorite games last year. The report will tell you how many titles you've played in 2019, along with a list of the three you've accessed the most and the number of hours you've spent on each one. If you were ever in denial about hoarding games only to play a handful in rotation, then the report can give you a reality check.

PlayStation

The wrap-up will also reveal your top genre, as well as the number of games and trophies you've earned in that genre. Finally, it'll show you the total number of trophies you've gotten last year, which seems especially satisfying if you play to collect them. You'll receive the report through email, so long as you have a PSN account and have played on a PS4 for at least 10 hours between January 1st and December 10th, 2019. In case it doesn't arrive anytime soon, you can also just check your stats on the official wrap-up page.

via Gfycat

In addition to the report itself, you're also getting a free dynamic theme and seven different avatars that can show the type of game you enjoy the most. The one for sports game fans is a sneaker with wings, for instance, while the one for strategy game fans is a chess knight piece.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
Tweet
Share
Save

Let's block ads! (Why?)


https://news.google.com/__i/rss/rd/articles/CBMiPWh0dHBzOi8vd3d3LmVuZ2FkZ2V0LmNvbS8yMDIwLzAxLzE1L3BsYXlzdGF0aW9uLXdyYXAtdXAtMjAxOS_SAUFodHRwczovL3d3dy5lbmdhZGdldC5jb20vYW1wLzIwMjAvMDEvMTUvcGxheXN0YXRpb24td3JhcC11cC0yMDE5Lw?oc=5

2020-01-15 09:32:26Z
52780545035058