Start up: trouble with bots, big data’s fable, Google and the White House, beware iCloud phishers, and more

Google search for various speech-related commands
“Call mom” has overtaken “call home” in Google search – probably voice commands. Dad still lingers a way behind.

You can sign up to receive each day’s Start Up post by email. Isn’t that something.

A selection of 11 links for you. Well, it is Monday. I’m charlesarthur on Twitter. Observations and links welcome.

How big data creates false confidence » Nautilus

Jesse Dunietz:

»If I claimed that Americans have gotten more self-centered lately, you might just chalk me up as a curmudgeon, prone to good-ol’-days whining. But what if I said I could back that claim up by analyzing 150 billion words of text? A few decades ago, evidence on such a scale was a pipe dream. Today, though, 150 billion data points is practically passé. A feverish push for “big data” analysis has swept through biology, linguistics, finance, and every field in between.

Although no one can quite agree how to define it, the general idea is to find datasets so enormous that they can reveal patterns invisible to conventional inquiry. The data are often generated by millions of real-world user actions, such as tweets or credit-card purchases, and they can take thousands of computers to collect, store, and analyze. To many companies and researchers, though, the investment is worth it because the patterns can unlock information about anything from genetic disorders to tomorrow’s stock prices.

But there’s a problem: It’s tempting to think that with such an incredible volume of data behind them, studies relying on big data couldn’t be wrong. But the bigness of the data can imbue the results with a false sense of certainty. Many of them are probably bogus — and the reasons why should give us pause about any research that blindly trusts big data.

«

link to this extract

 


Google’s remarkably close relationship with the Obama White House, in two charts » The Intercept

David Dayen:

»[Mikey] Dickerson led the U.S. Digital Service, a new agency whose mission was to fix other technology problems in the federal government. Ex-Google staffers were prevalent there as well. Dickerson attended nine White House meetings with Google personnel while working for the government between 2013 and 2014.

Meetings between Google and the White House, viewed in this context, sometimes function like calls to the IT Help Desk. Only instead of working for the same company, the government is supposed to be regulating Google as a private business, not continually asking it for favors.

Much of this collaboration could be considered public-minded — it’s hard to argue with the idea that the government should seek outside technical help when it requires it. And there’s no evidence of a quid pro quo. But this arrangement doesn’t have to result in outright corruption to be troubling.

The obvious question that arises is: Can government do its job with respect to regulating Google in the public interest if it owes the company such a debt of gratitude?

Google doesn’t think its activities present an antitrust problem. It doesn’t feel constrained from holding incredible amounts of data. But should Google be in a position to make that determination itself? How much influence is too much influence?

«

It’s a very, very comprehensive look at how close Google is to the White House. Would it be any different under Clinton?
link to this extract

 


SMS phishing attackers continue to pursue Apple users » WeLiveSecurity

Graham Cluley:

»A week ago I reported on my personal blog how criminals were spamming out SMS messages that claimed to come from Apple, but were actually designed to steal personal information for the purposes of identity theft.

The messages all used a cunning piece of social engineering – posing as a notice from Apple that their Apple ID was due to expire that very day – to get unsuspecting users to click on a link to a phishing website.

The SMS messages were even more convincing because they referred to recipients by name, most likely fooling some into believing that there was a genuine reason to act upon the alert and visit the site pointed to by the criminals.

Although the site the criminals were initially using – appleexpired.co.uk – was quickly blocked by the major web browsers and taken down, that didn’t take the wind out of the criminals’s sails.

In the days since it has become clear that the identity thieves have registered a series of other domains – all claiming to be related to Apple or Apple ID. Examples have included icloudauth.co.uk, mobileicloud.uk, and icloudmobile.co.uk.

«

There was a big run of these over the weekend; my wife received two, which used her name. They do come via SMS; it seems that once someone’s address book is hacked, messages are then sent out to people in the address book. Standard phishing attack, jumping from one victim to the potential next.

Apple needs to be proactive and set up a way for people to forward these to its security team. And make two-factor authentication easier to implement. (Too late for those who have been hit.)
link to this extract

 


Microsoft Android patent-licensing revenue falling » Business Insider

Matt Rosoff:

»Microsoft missed earnings expectations by a couple of cents per share on Thursday afternoon because of an unexpected tax adjustment that skimmed $0.04 off its earnings per share.

In the release, Microsoft noted that its patent-licensing revenue was down 26% from a year ago. And it’s because of Android.

Android phones are still selling just fine, but the market is dominated by cheap handsets being sold in developing countries like China and India.

“The mix of devices in that market has shifted to the low end,” said Chris Suh, Microsoft’s head of investor relations.

Microsoft’s cut is also sinking. Suh also noted that not every Android manufacturer has a licensing deal with Microsoft. He didn’t name names, but Chinese phone makers typically take a very loose approach toward licensing American intellectual property, and as those inexpensive phones take over the world, Microsoft doesn’t benefit as much.

«

Well, OK, but there may be another part to the drop. Read on..
link to this extract

 


April 2015: Microsoft reportedly cutting patent fees in exchange for pre-installed apps » AndroidAuthority

Rob Triggs, in April 2015:

»Last month, Microsoft announced a global partnership with Samsung and other hardware manufacturers to bring its mobile productivity services, such as its Office suite, to consumers and business users. But there may be more to it than simply offering customers compelling services, DigiTimes Research suggests that Microsoft is tempting Android manufacturers to pre-install its software in exchange for discounts on its licensing fees.

Android hardware manufacturers have all signed a patent licensing agreement with Microsoft for various essential technologies developed by the company. However, according to findings from Taiwan’s and China’s smartphone/tablet upstream supply chain, Microsoft is offering discounts to those who pre-install Office programs such as Word, Excel, PowerPoint and OneNote, as well as OneDrive and Skype onto their Android devices. So far, 11 hardware partners are signed up to the deal.

«

link to this extract

 


As search changes, Google changes » Search Engine Land

Adam Dorfman:

»Recently, a company known as MindMeld, which provides voice search technologies, surveyed US smartphone users and found that 60% had started using voice search within the past year. You can also see a rise in search queries that are clearly voice commands when you look at Google Trends for phrases such as “call mom,” which are highly unlikely to be typed into a search box.

Voice search is no longer coming. It’s here.

These changes do not bode well for Google’s traditional revenue model, which relies on serving up ads while you search on Google.com. The user interface of talking to your mobile phone or wearable device to order a pizza does not leave any room for a paid search ad. So it’s not surprising that display advertising spend is overtaking search ad spend, and the gap between the two will widen over the next few years.

«

But, as Dorfman points out, Google is adapting. That graph of “call mom” is definitely one which would merit playing around with using a few other search terms. Here’s “Call home” against “call Mom” against “call Dad” and “call John” and “call Mary” (also at top of page).
link to this extract

 


Amazon unintentionally paying scammers to hand you 1000 pages of crap you don’t read » Consumerist

Kate Cox on a scam related to Kindle Unlimited:

»if you read 75 pages on your Kindle today, then turn the WiFi on and sync it, Amazon will mark you at page 75. If you never pick up the book again, that’s your furthest synced point. If it’s a 300 page book and you finish it, page 300 is your furthest synced point.

But e-books don’t have to be linear. You might, for example, open up a new Kindle book and find it has a link on the first page, to take you to a later chapter or a table of contents or another language. Tapping that link could put you hundreds of pages into the book — which means that the author of that file is now making money off you, even if you haven’t read a word… or even if there’s not a single real word there to be read.

And that is exactly what’s happening. Scammers are basically uploading “books” that are nothing but files full of nonsense with some link on page 1 that puts readers on page 300 or 3000 (the maximum page length for which Amazon will pay out) almost instantly. In between there’s nothing but nonsense, but the scammer can use click farms to drive up the ranking of their book and so people download it anyway.

The user hasn’t paid for this book directly, because they have an unlimited subscription, so they just close the file, forget about it, and move on to the next. But if dozens, hundreds, or even thousands of readers get tricked into the same maneuver, that “author” has just made a decent amount of money for something like 15 minutes’ worth of total work.

«

link to this extract

 


Bangladesh Bank exposed to hackers by cheap switches, no firewall: police » Reuters

Serajul Quadir:

»Bangladesh’s central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world’s biggest cyber heists said.

The shortcomings made it easier for hackers to break into the Bangladesh Bank system earlier this year and attempt to siphon off nearly $1 billion using the bank’s SWIFT credentials, said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police’s criminal investigation department.

“It could be difficult to hack if there was a firewall,” Alam said in an interview.

«

The Internet of Astonishingly Insecure Things.
link to this extract

 


Bots won’t replace apps. Better apps will replace apps » Dan Grover

Grover points out the nonsense of people thinking AI-driven chatbots will take over from touch-and-choose visual interfaces:

»It shouldn’t require any detailed analysis, then, to point out the patent inanity of these other recent examples of bots and conversational UI proffered by companies on the vanguard of the trend:

This notion of a bot handling the above sorts of tasks is a curious kind of skeumorphism. In the same way that a contact book app (before the flat UI fashion began) may have presented contacts as little cards with drop shadows and ring holes to suggest a Rolodex, conversational UI, too, has applied an analog metaphor to a digital task and brought along details that, in this form, no longer serve any purpose. Things like the small pleasantries in the above exchange like “please” and “thank you”, to asking for various pizza-related choices sequentially and separately (rather than all at once). These vestiges of human conversation no longer provide utility (if anything, they impede the task). I am no more really holding a conversation than my contact book app really is a l’il Rolodex. At the end, a single call to some ordering interface will be made.

«

Earlier Grover points out that the “quick and easy way to order pizza with your chatbot” takes 73 precise clicks (of virtual keys), whereas doing it through the visual menu interface on the Pizza Hut app takes 16 fat-fingered ones.

Case closed.
link to this extract

 


Four fresh presentations, four key charts » Creative Strategies, Inc

Ben Bajarin looks at why people who have a PC aren’t upgrading, what people like about wearables, who wants virtual reality, and also whether people in India are interested in PCs:

»My gut told me there was an interesting opportunity brewing in India. I decided to commission a study, in collaboration with local researchers, to see if India was ready to move beyond the smartphone. We focused on the regions in India where PCs, smartphones, and tablets have the highest penetration — Delhi, Bangalore, Mumbai, Hyderabad, and Chennai. We did a mix of online studies, focus groups, and 1:1 interviews of 525 Indian consumers in this market.

The theory was simple. As consumers in India mature and have owned more than a few smartphones, they will look to more traditional PC form factors to use for work, school, and more. But with Windows PC penetration in India at less than 10% of the total population and Windows largely being an enterprise/workplace requirement in India, our theory was Android would be more popular as an operating system. As it turns out, it was for the overwhelming majority of consumers looking to buy their first PC in India. Which is encouragingly high for a market that began their journey on the internet on a smartphone.

«

link to this extract

 


Microsoft, Google end regulatory disputes » WSJ

Stephen Fidler and Sam Schechner:

»According to a person familiar with the matter, the two companies have agreed to talk to each other first in the future before taking any problems to regulators.

The change reflects the shift in approach that followed Microsoft’s 2014 appointment of Satya Nadella as its new chief executive. Mr. Nadella has taken a less combative stance than his predecessor Steve Ballmer, according to a person familiar with the matter.

“The relationship between the two companies has changed,” the person said, adding that “Nadella has made most of the difference.”

Microsoft’s business priorities also have changed, among other things, with the growth of cloud computing.

The relationship between the two companies began publicly to thaw last year as they worked together to settle their long-running patent war involving roughly 20 pending lawsuits, said a person close to Google.

Microsoft also resigned from FairSearch, a group of digital companies—including Nokia Corp. and Oracle Corp.—that are prominent Google complainants. In addition, the software maker has discouraged ICOMP, another lobby group of which it was a member, from pursuing Google.

«

Wow. Going to be interesting to see whether Icomp and Fairsearch can continue without funding from Microsoft.
link to this extract

 


Errata, corrigenda and ai no corrida: none notified.

Start up: Surface Book review, Google v EC redux, where are the iPad Pro apps?, after Google Flu, and more


Is this a perfect app signup? Photo by kastner on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Aren’t they pretty? I’m charlesarthur on Twitter. Observations and links welcome.

Final words – the Microsoft Surface Book review » Anandtech

Brett Howse likes it a lot. Apart from the lack of ports. And also..

The other issue with the hardware is one that plagues all 2-in-1 devices which offer a detachable display. Because the display has to house all of the PC components it gets heavy. The Surface Book display/Clipboard is 1.6 lbs (726 grams) and all of this weight is out over the hinge. The Surface Book does better than any other detachable convertible device for balance, but at the end of the day it is still more top heavy than a traditional notebook. On a desk it’s not going to be an issue, but if you do have to type in your lap, depending on the seating arrangement, it may want to tip backwards. This is compounded by the feet on the bottom not having a lot of grip. The Surface Book’s display travel is also limited to prevent it from tipping over, although it does open far enough that it should not be an issue for almost any situation.

The hardware is overall very good. Where the Surface Book is let down though is on software. It’s kind of ironic that the hardware is well done but the software can’t keep up when you consider Microsoft is first and foremost a software company, and one that has only been in the PC market for a couple of years at that. But there have been a lot of issues with software. When the Surface Book first launched, it suffered from display driver crashes along with hue changes and flickering on the screen when doing certain tasks. Luckily these issues seem to have been corrected with a firmware update issues on November 2nd. But there are still outstanding issues. The fact that you can’t close the lid and expect the laptop to actually go to sleep is a terrible bug. Leaving the Surface Book unplugged but sleeping is going to result in a dead battery. Just yesterday, I closed the lid on the Surface Book, only to notice the fans had kicked in and it was very hot.

I find the coexistence of a laptop that can turn into a tablet (Surface Book) and a tablet that can turn into a laptop (Surface Pro) suggestive of a “let’s turn this ship around any way we can” approach. Also, the Surface Book sure is pricey.

link to this extract


Google faces new round of EU probing over Android mapping apps » Bloomberg Business

Aoife White:

Google faces a fresh round of European Union questions about its Android operating system for mobile devices as regulators quizzed rivals and customers over applications for maps, e-mail and other services.

The EU wants to know whether Google Maps for phones has supplanted portable or in-car navigation devices, such as those produced by TomTom NV and the HERE unit of Nokia Oyj, according to a document sent to companies and seen by Bloomberg.

Officials are also seeking data, such as user numbers, about downloaded or pre-installed mapping apps on devices, as well as costs mapmakers face to produce a mobile-ready app.

Wonder how long that one will take to reach any decision. 2017? 2018?
link to this extract


Google EU antitrust response argues Amazon, eBay robust competitors » Re/code

Mark Bergen, who has seen a redacted copy of Google’s response to the EC:

Google points to the number of online price aggregators — sites that collate retail prices elsewhere on the Internet — born in Europe: 180 between 2008 and 2014. The EU’s charge sheet, or statement of objections (SO), “focuses on a handful of aggregators that lost free Google traffic, but ignores many that gained traffic,” Google’s lawyers wrote. Google says it drove 20bn “free clicks” to these aggregators in Europe over the past decade.

More critical to Google’s defense is the argument that online marketplaces, like eBay and Amazon, should be considered peers to Google’s shopping service, a position at odds with the EU, which charges that these merchants are “irrelevant” when it comes to price comparisons. Google’s lawyers claim, using internal data, that Web visitors prefer merchant links over aggregators and go directly to Amazon for product searches. (They do.) Google also argues that these giant merchants consider the smaller price aggregators as rivals as well — in the response, Google cites Amazon SEC filings where the e-commerce company lists “comparison shopping websites” and “Web search engines” as competitors. Ergo, Google contends, the EU should see them that way too.

And echoing the company’s internal note to the charges in April, Google spells out how Amazon and eBay are far more dominant as online retailers in Europe than Google’s service.

Pretty much all these points of Google’s were rebutted thoroughly by Foundem (a price aggregation service which complained to the EC) in June.
link to this extract


Where are Apple’s iPad Pro apps for pros? » Lou Miranda

There’s a big gap in Apple’s pro app lineup, with Aperture being retired along with iPhoto. iPhoto’s replacement is the Photos app, but there is no Aperture replacement yet. What better device to introduce a Photos Pro app than a giant-screened iPad Pro with a pressure sensitive Pencil?

Likewise with Final Cut Pro X. There’s no reason to make it iPad Pro-only, but it would certainly shine on an iPad Pro. This is similar to Macs: sure you can run Photoshop or FCP X on a MacBook Air, but they really shine on a MacBook Pro or Mac Pro. I discussed this at length in my post “There’s No Such Thing as an iPad App“.

So why would Apple release an iPad Pro without its own pro apps?

My feeling is that the iPad Pro is much like Apple TV: the hardware was ready before the software, and Apple is soft-pedaling both, mostly to developers and early adopters. (You could argue Apple does this with every new device, and I wouldn’t argue with you.)

link to this extract


AI will reorganize the human population » Medium

Silver Keskkula, who is working on the “Teleport” app which aims to find the best place for you to live:

Matching people to locations is hard — there are more things to account for than might be feasible to code into a human understandable model. Although today we’ve managed to keep things simple and are missing a purely machine learning driven parameter from our search, I’m more than convinced that in the very near future we will need to resort to AI to help guide people’s search into where to live (our first tests are quite encouraging).

All and all we’re all just inefficient computational machines running on wetware and largely biased by evolutionary adaptations more suited to the hunter-gatherer era, so getting AI involved in our next wave of migrations might not be such a bad thing.

link to this extract


This is how you design your mobile app for maximum growth » First Round Review

[Primer CEO] Kamo Asatryan may very well be one of the best kept secrets in the startup ecosystem. He’s one of a small handful of people who have observed hundreds of mobile apps, thought deeply and scientifically about their mechanics, and determined what they could change to grow faster.

To demonstrate his particular brand of magic: Asatryan’s team recently worked with an app that required users to swipe through four screens explaining the product in-depth before they could sign up. Then the permissions screen literally begged them to let the app access their location data. 60% said no and went on to a dead-end experience.

To turn things around, Asatryan tested a radically different approach: assume that users who installed the app already understood the need to provide their location data. This allowed them to axe the long-winded welcome flow and make the permissions request the second screen. The text was changed to say that users needed to “Enable Location Permissions” (making it clear that it would be for their benefit), and they were literally not able to move on from the screen without saying yes. This sounds risky, but after the shift, 95% of users said yes and went on to a much better product experience.

This is a long article, but every single element of it will be useful if you’re in any way involved in designing or critiquing mobile app design. Today’s must-read. (Via Dave Verwer’s iOS Dev Weekly.)
link to this extract


New flu tracker uses Google search data better than Google » Ars Technica

Beth Mole:

With big data comes big noise. Google learned this lesson the hard way with its now kaput Google Flu Trends. The online tracker, which used Internet search data to predict real-life flu outbreaks, emerged amid fanfare in 2008. Then it met a quiet death this August after repeatedly coughing up bad estimates.

But big Internet data isn’t out of the disease tracking scene yet.

With hubris firmly in check, a team of Harvard researchers have come up with a way to tame the unruly data, combine it with other data sets, and continually calibrate it to track flu outbreaks with less error. Their new model, published Monday in the Proceedings of the National Academy of Sciences, out-performs Google Flu Trends and other models with at least double the accuracy. If the model holds up in coming flu seasons, it could reinstate some optimism in using big data to monitor disease and herald a wave of more accurate second-generation models.

I wrote about the failure of Google Flu Trends in March 2014; in 2008 it had claimed 90% correlation. Google said then it would “welcome feedback”. The old data is still available.
link to this extract


TLC NAND SSDs: The crippling problem storage makers don’t advertise » PCWorld

Jon Jacobi:

With last week’s release of Crucial’s BX200 SSD, a drive that features TLC (triple-level cell) NAND, it’s time to shine a light on this burgeoning segment of the SSD market—especially as vendors happily quote numbers that would have you believe that these SSDs perform just like any other.

Most of the time TLC SSDs perform quite well. But copy a large amount of data to a TLC drive, and part way through the operation you’ll see something discomforting—a startling drop in write speed. With some drives it’s relatively mild, but in the case of many recent TLC drives, the drop is so drastic you’ll wonder if the SSD is dying. It’s not, but you may wish it was.  

While this is true, it turns out you’ll only hit the problem if you’re transferring more data than fits in the disk cache – which could be 3GB or more. Still, a subtle gotcha.
link to this extract


Microsoft CEO Satya Nadella shows ‘iPhone Pro,’ reveals how much time he spends on email » IB Times

David Gilbert:

Speaking at the company’s Future Decoded conference in London on Tuesday, Nadella, who took the reins at Microsoft over 18 months ago, demonstrated the power of Windows 10 and gave us a glimpse into what he does and how he works on a day-to-day basis.

Using Delve — an Office 365 app which automatically tracks a user’s activities throughout the week by monitoring calendars, emails and the other productivity tools — Nadella showed the audience that last week he spent a total of 16 hours in meetings, well within his goal of under 20 hours per week.

Nadella failed to meet his goal of spending less than nine hours per week on emails, clocking up 9.6 hours in the past seven days. He also fell short on the time he wanted to spend focusing – which he described simply as “time for work.” Nadella considered himself “focused” for only two hours last week, just half of his assigned goal.

Notice how he didn’t show us what devices – and in particular phone – he uses. (Sure, it will be a Lumia, but which?) The “iPhone Pro” is just an iPhone loaded with Microsoft software. Puzzled by how a machine measures your “focus hours”. How does it know?
link to this extract


No Comcast app on the new Apple TV » Tech Insider

Tim Stenovec:

Marcien Jenckes, the executive vice president of consumer services for Comcast Cable, told Tech Insider in an interview last week that Comcast isn’t working on an app for the new Apple TV.

“We’re not philosophically against it,” Jenckes said of developing an app for the new device. “We just haven’t seen the need to run out and do that, given the fact that we’re already delivering content to the TVs in a way that has our customers already satisfied.”

If American customers were that satisfied, they wouldn’t be buying set-top boxes and TV sticks by the million.
link to this extract


Errata, corrigenda and ai no corrida: none reported.

Start up: Wi-Fi Sense explained, another giant Android vulnerability, the US’s sleepiest cities, and more


What happens when you create a way for any programmer to analyse peoples’ DNA? (Hint: not good things.) Photo by micahb37 on Flickr.

A selection of 11 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Wi-Fi Sense in Windows 10: Yes, it shares your passkeys; no, you shouldn’t be scared » Ars Technica

Sebastian Anthony:

For a start, when a Wi-Fi passkey is shared with your PC via Wi-Fi Sense, you never actually see the password: it comes down from a Microsoft server in encrypted form, and is decrypted behind the scenes. There might be a way to see the decrypted passkeys if you go hunting through the registry, or something along those lines, but it’s certainly not something that most people are likely to do.

Perhaps more importantly, though, just how sacred is your Wi-Fi password anyway? Corporate networks notwithstanding (and you shouldn’t share those networks with Wi-Fi Sense anyway), most people give out their Wi-Fi keys freely. You could even argue that Wi-Fi Sense is more secure: if I ask Adam for his Wi-Fi password, I am free to give it away to anyone. If I receive the password via Wi-Fi Sense, I can still connect to Adam’s network, but I can’t tell anyone else the password.

And it only goes to immediate-circle friends, not friends of friends of.. So probably not such a big thing to worry about.
link to this extract


Why Grooveshark failed » The Verge

Stephen Witt:

The Grooveshark streaming application launched in April of 2008 — several months ahead of Spotify. The service proved explosively popular from the outset. Users, especially younger users, loved on-demand music delivery, and Greenberg left school to focus on Grooveshark full time. But there was a problem: Grooveshark still relied on peer-to-peer infrastructure similar to Napster, Kazaa, and bitTorrent. In other words, although it functioned as a streaming service, it still sourced the music from its users’ file libraries. And to the record companies, that looked like copyright infringement.

Without approval from the labels, Grooveshark struggled to attract venture capital. In its first five years of existence, the company raised just under a million dollars. In the same time, Spotify, with equity buy-in from the music majors, raised a hundred times as much.

It didn’t “look like” copyright infringement; it clearly was infringement, in just the same way that the original Napster was. That’s why it was sued into the ground. Grooveshark never played by the rules (artists demanded their music be removed; Grooveshark staff re-uploaded it, or ignored new uploads). They failed because they could never stay inside the rules.
link to this extract


Drones and spyware: the bizarre tale of a brutal kidnapping » WIRED

Kevin Poulsen with a wonderful tale of how truth is stranger than fiction:

efforts to trace the new emails were in vain. The author boasted that he was using Tor as well as other anonymizing precautions that would withstand even an “Egotistical Giraffe exploit,” a reference to an NSA de-anonymizing technique that surfaced in the Edward Snowden leaks. He sent the messages through the Singapore-based anonymous remailer anonymousemail.com, and shared the photos—stripped of metadata—through the anonymous image sharing site Anony.ws.

Evidently unconvinced, the Vallejo police still insisted the crime was a put-on, but the FBI was also on the case. And, it turned out, despite his sophistication, the kidnapper had left a digital trail.

The kidnapper had slipped by using a disposable Tracfone to call Quinn after the abduction. The FBI reached out to Tracfone, which was able to tell the agents that the phone was purchased from a Target store in Pleasant Hill on March 2 at 5:39 pm. Target provided the bureau with a surveillance-cam photo of the buyer: a white male with dark hair and medium build. AT&T turned over records showing the phone had been used within 650 feet of a cell site in South Lake Tahoe.

But the real break in the case came when the kidnapper evidently struck again.

link to this extract


Trend Micro discovers vulnerability that renders Android devices silent » Trend Micro

Wish Wu (Mobile Threat Response Engineer):

We have discovered a vulnerability in Android that can render a phone apparently dead – silent, unable to make calls, with a lifeless screen. This vulnerability is present from Android 4.3 (Jelly Bean) up to the current version, Android 5.1.1 (Lollipop). Combined, these versions account for more than half of Android devices in use today. No patch has been issued in the Android Open Source Project (AOSP) code by the Android Engineering Team to fix this vulnerability since we reported it in late May.

This vulnerability can be exploited in two ways: either via a malicious app installed on the device, or through a specially-crafted web site. The first technique can cause long-term effects to the device: an app with an embedded MKV file that registers itself to auto-start whenever the device boots would case the OS to crash every time it is turned on.

In some ways, this vulnerability is similar to the recently discovered Stagefright vulnerability. Both vulnerabilities are triggered when Android handles media files, although the way these files reach the user differs.

Seems like the media file handling is where everyone is focussing for Android weaknesses just now.
link to this extract


September 2014: iPhone 6 and Android value » Benedict Evans

From September 2014:

with the iPhone 6 and iOS8, Apple has done its best to close off all the reasons to buy high-end Android beyond simple personal preference. You can get a bigger screen, you can change the keyboard, you can put widgets on the notification panel (if you insist) and so on. Pretty much all the external reasons to choose Android are addressed – what remains is personal taste.

Amongst other things, this is a major cull of Steve Jobs’ sacred cows – lots of these are decisions he was deeply involved in. No-one was quicker than Steve Jobs himself to change his mind, but it’s refreshing to see so many outdated assumptions being thrown out. 

Meanwhile, with the iPhone 6 Plus (a very Microsofty name, it must be said) Apple is also tackling the phablet market head on. The available data suggests this is mostly important in East Asia but not actually dominant even there – perhaps 10-20% of units except in South Korea, where it is much larger.  Samsung has tried hard to make the pen (or rather stylus) a key selling point for these devices, but without widespread developer support (there is nothing as magical as Paper for the Note) it is not clear that these devices have actually sold on anything beyond screen size and inverse price sensitivity (that is, people buy it because it’s the ‘best’ and most expensive one). That in turn means the 6 Plus could be a straight substitute. 

Now we have Samsung’s results (out by the time you read this) and LG’s results, where the latter specifically says that sales were lower in South Korea than expected. Evans seems to have been borne out: the only differentiator between premium Android and iPhones was screen size.
link to this extract


Busy-ness data on Google search results » Google

Do you ever find yourself trying to avoid long lines or wondering when is the best time to go grocery shopping, pick up coffee or hit the gym (hint: avoid Monday after work)? You’re in luck!

Now, you can avoid the wait and see the busiest times of the week at millions of places and businesses around the world directly from Google Search. For example, just search for “Blue Bottle Williamsburg”, tap on the title and see how busy it gets throughout the day. Enjoy your extra time!

busy-ness data from Google

That’s very clever. (Location data from Android phones, one guesses.)
link to this extract


Android security, bugs and exploits » Google+

Adrian Ludwig is head of security for Android:

There’s common, mistaken assumption that any software bug can be turned into a security exploit.  In fact, most bugs aren’t exploitable and there are many things Android has done to improve those odds. We’ve spent the last 4 years investing heavily in technologies focused on one type of bug – memory corruption bugs – and trying to make those bugs more difficult to exploit. 

A list of some of those technologies that have been introduced since since Ice Cream Sandwich (Android 4.0) are listed here. The most well known of these is called Address Space Layout Randomization (‘ASLR’), which was fully completed in Android 4.1 with support for PIE (Position Independent Executables) and is now on over 85% of Android devices. This technology makes it more difficult for an attacker to guess the location of code, which is required for them to build a successful exploit.

What Ludwig doesn’t mention: the Stagefright bug. Is it right to say it could be used to take over a phone via MMS? Or would ASLR defeat that? You’d hope the head of security for Android would tackle this in a public blogpost talking about security. But he doesn’t. Which tends to make one think the worst.
link to this extract


Which cities get the most sleep? » The Jawbone Blog

Tyler Nolan:

One of the major findings in our study of city sleep was that people living in cities just don’t get enough. No major city in the United States averages above the NIH-recommended seven hours of sleep per night. But it’s only part of the picture. The vast majority of the suburban and rural counties have much healthier sleep numbers.

Geography has a profound effect on the routines we follow and the habits we form. Our sleep cycles adapt to the pace and lifestyle of the world we live in and the world by which we are surrounded. We look forward to further investigating the effects of geography and how it influences UP wearers in all parts of the world.

Technical Notes: This study was based on over one million UP wearers who track their sleep using UP by Jawbone. Less populous counties were blended with neighboring counties to generate significant results. This technique revealed patterns at finer granularity than the state level, such as time zone boundaries. All data is anonymized and presented in aggregate.

One still gets that little tingle of concern that your sleep data could be tracked directly back to you by someone malicious or stalker-y at Jawbone. (The visualisations are lovely, though.)
link to this extract


Brinks’ super-secure smart safes: not so secure » WIRED

Kim Zetter:

Vulnerabilities found in CompuSafe Galileo safes, smart safes made by the ever-reliable Brinks company that are used by retailers, restaurants, and convenience stores, would allow a rogue employee or anyone else with physical access to them to command their doors to open and relinquish their cash, according to Daniel Petro and Oscar Salazar, researchers with the security firm Bishop Fox, who plan to demonstrate their findings next week at the Def Con hacker conference in Las Vegas.

The hack has the makings of the perfect crime, because a thief could also erase any evidence that the theft occurred simply by altering data in a back-end database where the smartsafe logs how much money is inside and who accessed it. If done well, the only telltale sign of an attack would be left on security cameras—if anyone bothered to look.

They’re “smart” because they can tally how much money is put into them. Dumb because they run Windows XP Embedded. And there’s an external USB port for “troubleshooting”.
link to this extract


Retailer Acceptance » Contactless Life

Duncan Stevenson has compiled a gigantic table of which companies accept contactless and Apple Pay payments (and to what amount).

In theory Apple Pay should be accepted at all retailers that accept contactless, and this seems to be the case for Mastercard and Visa cards, however American Express cards are currently experiencing issues with Apple Pay in certain retailers (hence the existence of the “Amex Apple Pay” column).  I have a blog post coming soon covering the issues with American Express Apple Pay in the UK.

(It’s a real HTML table too.)
link to this extract


Your 23andMe DNA can be used in racist, discriminatory ways » BuzzFeed News

This week, an anonymous programmer posted on GitHub an early-stage program called Genetic Access Control. It basically worked as a log-in mechanism. The third-party program was designed to hook up to the company’s API and mine the 23andMe accounts of users who agreed to share their information, as they would agree to let apps connect to their Facebook or Twitter profiles. Websites using Genetic Access Control could scan that data for information about “sex, ancestry, disease susceptibility, and arbitrary characteristics” — and then restrict users’ access to the site based on this information.

For example, people with only the “right” amount of European ancestry would be allowed to access a website that used Genetic Access Control:

Ways to use 23andMe API

But 23andMe shut down the developer’s access to its API on Wednesday, two days after the code was published. 23andMe spokesperson Catherine Afarian told BuzzFeed News the program violated a policy that forbids use of the API for, among other things, “hate materials or materials urging acts of terrorism or violence.”

I think a programmer who actually wanted to cause trouble (as opposed to one, as here, just showing 23andMe how blithely trusting it is) could reasonably point out that they’re not creating hate materials or anything to do with terrorism or violence.

And – whoever they were – succeeded with a beautiful example of why you don’t really want to have open public access to a DNA database. As well as why 23andMe are twits for ever having thought so.
link to this extract


Start up: Google kills Pirate Bay apps, Uber in the spotlight, Secret to pivot?, Microsoft Band five weeks on, and more


Uber in Dubai. Photo by khawaja on Flickr.

A selection of 9 links for you. (Only one post today.) Not for sale in Delaware. I’m charlesarthur on Twitter. Observations and links welcome.

Exclusive: upcoming version of Google Translate will include WordLens image translation and auto-detection for conversation mode >> Android Police

Michael Crider:

A few months ago Google purchased the developer of the impressive WordLens app, which translates text and signs from another language into your own simply by pointing your camera at it. The text appears in your language through the lens, as if you had super-powered Translate-O-Vision. As with Waze and Google Maps, it looks like Google’s own Translate app will soon see the benefit of that acquisition. Check out the screenshots below, taken from an upcoming version of Google Translate.

Logical purchase for Google; translation looks very impressive.


Google removes Pirate Bay apps from Play Store >> TorrentFreak

A few weeks ago the company implemented a major change to its search algorithm, aimed at downranking sites that often link to copyright infringing material.

Another drastic move came today when Google began removing many Pirate Bay related apps from its Play store. The apps in question include “The Pirate Bay Proxy,” “The Pirate Bay Premium,” “The Pirate Bay Mirror” and “PirateApp.”

The apps targeted by Google offer mobile optimized web-browsers for The Pirate Bay. In addition, many of them used proxy sites so users could easily circumvent local ISP blockades.

The apps appear to have been removed proactively as there is no mention of a DMCA takedown notice.

Reason for removal: “violation of the intellectual property… provisions of the Content Policy.” The Pirate Bay Proxy had had 900,000 downloads and 45,000 active users per day.


We can’t trust Uber >> NYTimes.com

Zeynep Tufekci and Brayden King:

We use these apps and websites [such as Uber, Facebook, Pandora, etc] because of their benefits. We discover new music, restaurants and movies; we meet new friends and reconnect with old ones; we trade goods and services. The paradox of this situation is that while we gain from digital connectivity, the accompanying invasion into our private lives makes our personal data ripe for abuse — revealing things we thought we had not even disclosed.


Pro tip: don’t tell Google Wallet you sell crack >> Daily Dot

Reddit user kag0 may not have actually been pushing the white stuff, but Google was watching nonetheless: 

So sometimes when I show friends or people how you can request money over Google Wallet, I’ll send a request for a few thousand bucks to close friends with a note saying something like “for my ransom” or “need crack”. They know whats up, they read it, chuckle and reject the request, it’s all good. 

 The tutorial went awry when Google caught kag0’s payment, complete with annotation that it was for “Drugs, Crack,” and shut things down. Apparently selling more than $20K worth of crack via Google’s e-payments platform is a no-go, violating two sections of the Google Wallet Terms of Service. 

Fool. Shoulda used Apple Pay.


With bullying app Secret on life support, investors learn the risk of investing in assholes >> PandoDaily

Paul Carr, after enumerating the many ways Secret (that’s the app that’s not Whisper) is in trouble:

there’s one major difference between Uber and Secret: For all its flaws, Uber is a genuinely useful service, and one that promises to give work to 1m new drivers next year alone. It just so happens to be operated by a deeply unpleasant company. That’s a hugely risky state of affairs, but clearly survivable.

Secret, by contrast, is an unpleasant company offering an inherently unpleasant service. As the company’s amoral investors have learned to their cost, that combination is nearly always going to be fatal.

(Disclosure: I know and like Paul Carr.) I tried Secret for a while, screwed up on a story because of it, and then generally found it like the scaly brown underside of Twitter – info I can’t use, people I didn’t like. (Even though they were meant to be “friends” or “friends of friends”.) I deleted it ages ago, and I don’t think there’s any pivot that would make me reinstall it.

Equally, I deleted Uber ages ago too.


Living with the Microsoft Band >> Tirias Research

Kevin Krewell has been wearing a Microsoft Band (on and off) for five weeks:

The biggest failing I see with the Band application is that it doesn’t directly connect you with the data in a meaningful way without significant work by the user. I preferred if the data was automatically charted and provided me with insightful health information about trends or other health related information. Today it requires research by the user to find any useful information from the tracking software. Certainly more automated information would be helpful. I’m hopeful that as the software evolves, there will be additional health tracking benefits to wearing the Band.

To this day I find the band is still clunky to wear – it catches on the lining of my sports jacket. Sometimes it feels like it’s a home detention bracelet on my wrist, but I grow more used to the bulk. I’ve had continuous trouble keeping the ban in sync with my iPhone application. Initially it would say that it could not sync now sometimes it says it is syching but no data appears on the application. There’s definitely room for improvement here. I’ve also found I had multiple BT connections listed in iPhone Setup for the Band.


Uber launches in Portland without city’s approval >> KGW Portland

Mayor Charlie Hales said the launch was illegal. The mayor’s office did not receive any advance notice from Uber about the Dec. 5 launch.

City Commissioner Steve Novick said Uber is choosing to break the law and the city is prepared to issue civil and criminal penalties against drivers and the company. Drivers could get hit with up to $3,750 for first-time offenses.

“There’s nothing sharing about this so-called ‘sharing economy’ company,” Novick said. “They want to profit in Portland without playing by the same rules as existing cab companies.”

What’s unclear here is what being registered with the city adds to the system. The point on the “sharing” economy is completely true, though. And if the cab registration helps pay for road upkeep, is that not useful? Does Uber pay that too?


Mark Zuckerberg and Facebook’s plan to wire the world >> Time

Lev Grossman:

[Zuckerberg says] “Our mission is to connect every person in the world. You don’t do that by having a service people pay for.” I suggest that Facebook’s users are paying, just with their attention and their personal information instead of with cash. A publicist changes the subject.

But before that happens Zuckerberg also notes — and it was the only time I saw him display irritation — that Apple CEO Tim Cook wrote something similar in September in a statement spelling out Apple’s privacy policy: “When an online service is free, you’re not the customer. You’re the product.” The shot was probably meant for Google, but Facebook was definitely in the blast radius. “A frustration I have is that a lot of people increasingly seem to equate an advertising business model with somehow being out of alignment with your customers,” Zuckerberg says. “I think it’s the most ridiculous concept. What, you think because you’re paying Apple that you’re somehow in alignment with them? If you were in alignment with them, then they’d make their products a lot cheaper!”

Zuckerberg’s frustration might be understandable – as I understand it, Facebook was definitely in the blast radius, because unlike some companies (plural) but in common with some companies (plural), it didn’t think the NSA’s Prism program was any reason to collect less data about users.

He’s certainly overlooking the fact that if you’re ad-funded, you have customers – the ones who pay you, who are called advertisers – and users, who you connect to the advertisers. It’s exactly the same model as news organisations have used for ages. But news organisations weren’t able to profile you exactly, or collect huge amounts of data about you. Having customers who aren’t users, and users who aren’t customers, creates huge potential for conflict. Noticed how Google’s ads take up more of the desktop results page? Noticed Google+? Noticed those autoplay video ads on Facebook?

Apple, on the other hand, tends to focus only on having users who are customers, and vice-versa. There’s no split; that’s the alignment. As to lower prices: that’s simply not how Apple rolls. Never has. Probably never will. But its users are absolutely its customers. At Pando Daily, Nathaniel Mott takes much the same position – with more examples.


When data gets creepy: the secrets we don’t realise we’re giving away >> The Guardian

Ben Goldacre:

I recently found myself in the quiet coach on a train, near a stranger shouting into her phone. Between London and York she shared her (unusual) name, her plan to move jobs, her plan to steal a client list, and her wish that she’d snogged her boss. Her entire sense of privacy was predicated on an outdated model: none of what she said had any special interest to the people in coach H. One tweet with her name in would have changed that, and been searchable for ever.

Just think of what that one tweet would have set in chain. Terrific piece from Goldacre which delves into how data affects privacy in medicine, shopping and so much more.