"> Privacy Archives - Engr Kabir Saleh

Posts Tagged

Privacy

Apple wants privacy laws to protect its users

Your iPhone (like most smartphones) knows when it is picked up, what you do with it, who you call, where you go, who you know – and a bunch more personal information, too.

The snag with your device knowing all this information is that once the data is understood, that information can be shared or even used against you.

Information is power

Jane Horvath, Apple’s senior director for global privacy, appeared at CES 2020 this week to discuss the company’s approach to smartphone security. She stressed the company’s opposition to the creation of software backdoors into devices, and also said:

“Our phones are relatively small and they get lost and stolen. If we’re going to be able to rely on our health data and finance data on our devices, we need to make sure that if you misplace that device, you’re not losing your sensitive data.”

Privacy should not be a leaking bucket

Her approach is correct, of course. After all, once you create a security backdoor for one government, you’ll be forced to share it with every government. Once that happens, it’s only a matter of time before that information leaks into the hands of bad actors, with the result that no one’s data is safe.

Enterprise data will also become less safe, which threatens the security of connected infrastructure across the board.

Think of a security backdoor as being a hole in a bucket that only gets larger over time. Eventually the bucket stops working, water gets everywhere and all your secrets slip.

How Apple sees things

Apple’s approach to security:

  1. It tries to minimize the amount of personal information it gathers about its users, and tries to disconnect that data from a person’s identity.
  2. It aims to create services that require minimal personal data while using on-device AI to personalize user experiences – that way the data is never seen or used by the company. Differential privacy, CoreML, and assigning Siri and Maps requests to a random number rather than using a person’s Apple ID form part of this effort.
  3. It offers iCloud as a secured space in which customers can store their documents, images and other information.
  4. It attempts to empower users with tools with which to control their privacy.

What’s important to understand with this model is that while much of the information your device gathers is protected (unless you grant permission to specific apps to access it), data held in iCloud is not subject to the same protection and can be made available subject to warrant.

At the same time, Apple’s privacy protections can be confusing; the company’s recent decision to make it possible for people to opt out of sharing Siri recordings for “grading” was welcome, but the tools are still rather opaque.

iCloud thinks different

This is why Apple has teams whose job it is to help law enforcement with criminal/security queries. The information on your device is impossible to access, while data held in iCloud is accessible once a warrant is presented and accepted.

Not only can a great deal of information concerning location also be gathered by a request from cellular providers, but some of the most incriminating information is almost certainly available in the less-secured iCloud account.

Horvath referred to this during her CES appearance when she confirmed the company uses a set of tools to scan iCloud Photo libraries for child pornography.

To me, it seems reasonable to assume that those aren’t the only egregious acts Apple might monitor accounts for. That Apple actively already works to protect the public rather undermines the argument that even more access to personal data is required.

Privacy is a confusing mess

On an industry-wide basis, there’s still too much confusion. Internet services have been offering convenience in exchange for personal information for so long that many people have become accustomed to sharing data.

Added to that, the lack of a consistent set of principle or access protocols regarding  user privacy makes for a lack of a core set of consumer privacy standards.

Apple seems to believe government regulation is required in order to help promote a more consistent approach to privacy.

“We should consider a strong privacy law that is consistent across all 50 states that provides all consumers, regardless of where they live, the same protections,” said Horvath.

We’ve some way to go, as continued attempts to force tech firms to create those security backdoors in their products prove some in government don’t grasp the challenge of privacy in a digital age. (Though some do get it.)

While we wait for the industry and government to figure out a consistent approach, here are some guides to help iOS users manage their privacy using the tools Apple provides:

Finally, I currently recommend iPhone users take a look at the incredibly useful Jumbo app. This provides a range of privacy management and monitoring tools designed to easily put you in charge of what entities such as Apple, Facebook, Google or others are doing with your information.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.





Source link

Apple’s wants privacy laws to protect its users

Your iPhone (like most smartphones) knows when it is picked up, what you do with it, who you call, where you go, who you know – and a bunch more personal information, too.

Information is power

The snag with your device knowing all this information is that once the data is understood than that information can be shared or even used against you.

Jane Horvath, Apple’s senior director for global privacy, appeared at CES 2012 to discuss the company’s approach to smartphone security.

She stressed the company’s opposition to the creation of software backdoors into devices, and also said:

“Our phones are relatively small and they get lost and stolen. If we’re going to be able to rely on our health data and finance data on our devices, we need to make sure that if you misplace that device, you’re not losing your sensitive data.”

Privacy should not become a leaking bucket

Her approach is correct, of course. After all, once you create a security backdoor for one government, you’ll be forced to share them with every government.

Once this happens it’s only a matter of time before that information leaks into the hands of bad actors, with the result that no one’s data is safe.

Enterprise data will also become less safe, which threatens the security of connected infrastructure across the board.

Think of a security backdoor as being a hole in a bucket that only gets larger over time.

Eventually the bucket stops working, water gets everywhere and all your secrets slip.

How Apple sees things

Apple’s approach to security:

  1. It tries to minimize the amount of personal information it gathers about its users, and tries to disconnect that data it does gather from a person’s identity.
  2. It aims to create services that require minimal personal data while using on-device AI to personalize user experiences – that way the data is never seen or used by the company. Differential privacy, CoreML, and sending Siri and Maps requests assigned to a random number rather than using a person’s Apple ID form part of this attempt.
  3. It offers iCloud as a secured space in which customers can store their documents, images and other information.
  4. It attempts to empower users with tools with which to control their privacy.

What’s important to understand with this model is that while much of the information your device gathers is protected (unless you grant permission to specific apps to access it), data held in iCloud is not subject to the same protection and can be made available subject to warrant.

At the same time, Apple’s privacy protections can be confusing – it’s recent decision to make it possible for people to opt out of sharing Siri recordings for ‘grading’ was welcome, but the tools are still rather opaque.

iCloud thinks different

This is why Apple has teams whose job it is to help law enforcement with criminal/security queries.

The information on your device is impossible to access, while data held in your iCloud is accessible once a warrant is presented and agreed.

Not only can a great deal of information concerning location also be gathered by request from cellular providers, but some of the most incriminating information is almost certainly available in the less-secured iCloud account.

Horvath referred to this during her CES 2020 appearance when she confirmed the company uses a set of tools to scan iCloud Photo libraries for child pornography.

To me it seems reasonable to assume that those aren’t the only egregious acts Apple might monitor accounts for. That Apple actively already works to protect the public rather undermines the argument that even more access to personal data is required.

Privacy is a confusing mess

On an industry-wide basis, there’s still too much confusion.

Internet services have been offering convenience in exchange for personal information for so long that many people have become accustomed to sharing data.

Added to which, the lack of a consistent set of principle or access protocols with regard to user privacy makes for a lack of a core set of agreed consumer privacy standards.

Apple seems to believe government regulation is required in order to help promote a more consistent approach to privacy.

“We should consider a strong privacy law that is consistent across all 50 states that provides all consumers, regardless of where they live, the same protections,” said Horvath.

We’ve some way to go, as those continued attempts to force tech firms to create those security backdoors in their products prove some in government don’t grasp the challenge of privacy in a digital age. (Though some do get it).

While we wait for the industry and government to figure out a consistent approach, here are some guides to help iOS users manage their privacy using the tools Apple provides:

Finally, I currently recommend iPhone users take a look at the incredibly useful Jumbo app. This provides a range of privacy management and monitoring tools designed to easily put you in charge of what entities such as Apple, Facebook, Google or others are doing with your information.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.





Source link

Amid privacy and security failures, digital IDs advance

Frustration over a growing number of privacy and security failures in recent years is driving the creation of digital identities controlled only by those whose information they contain.

Known as “self-sovereign identities,” the digital IDs will be used by consumers, businesses, their workers and governments over the next few years to verify everything from credit worthiness and college diplomas to licenses and business-to-business credentials.

“We are slowly graduating from crawling to walking. It takes one to two years ’til we have reliable capabilities to spark meaningful decentralized identity adoption,” said Homan Farahmand, a senior research director at Gartner. “A major non-technical hurdle is for organizations to learn the concept and take the necessary steps to appropriately adapt their business processes to decentralized identity ecosystems.”

A growing number of organizations is looking to better understand decentralized identity technology, which is predicated on blockchain electronic ledgers. Currently, there are more proof-of-concept projects than production systems involving a small number of organizations. The pilots, being trialed in government, financial services, insurance, healthcare, energy and manufacturing, don’t yet amount to an entire ecosystem, according to Farahmand.

“While these projects help identify gaps such as governance, user experience, standardization and interoperability issues, none of them [rise to the level of] a practical decentralized ecosystem to bootstrap pervasive adoption at this point,” Farahmand said.

What is a self-sovereign identity?

Self-sovereign identity envisions consumers and businesses eventually taking control of their identifying information on electronic devices and online, enabling them to provide validation of credentials without relying on a central repository, as is done now. Self-sovereign identity technology also takes the reins away from the centralized ID repositories held by the social networks, banking institutions and government agencies.

A person’s credentials would be held in an encrypted digital wallet for documenting trusted relationships with the government, banks, employers, schools and other institutions. But it’s important to note that self-sovereign ID systems are not self-certifying. The onus on whom to trust depends on the other party. Whoever you present your digital ID to has to decide whether the credentials in it are acceptable.

“For example, If I apply for a job…, and they require me to prove I graduated from a specific school and need to see my diploma, I can present that in digital form.” said Ali. “And, most likely that credential would have to be cryptographically signed by the school that issued it. So the relying party – my place of work – would have to decide when I present the credential if the signing key is something they trust.”

For example, a place of employment could issue an electronic confirmation or “credential” that could be stored in that employee’s digital wallet saying you work for the XYZ Company. Even something as simple as a health club membership verification could be added to a user’s wallet and presented through a mobile app.

For consumers who are mindful of their online information – credit card numbers, date of birth, annual income, etc. – a blockchain-based network means the user controls who can see their data or get purchasing approval without releasing details such as their annual income or their age and address.

For businesses such as banks, rules such as know-your-customer (KYC) regulations  make blockchain-based digital identities attractive.

How a self-sovereign ID works

Self-sovereign identities can work like this: the user has a bank confirm a credit limit or an employer confirm annual income; that confirmation information is encrypted, but available, on a public blockchain ledger to which the consumer holds the private and public cryptographic keys.

A consumer who wants a car loan from an auto dealership, for example, can give the dealer permission through a public key to confirm that he or she has enough credit or annual income to buy a vehicle – without revealing an exact dollar amount. So, for example, if the dealer wants to ensure a consumer earns more than $50,000 a year, that’s all the blockchain ledger will confirm (not that the person actually earns, say,  $72,587 or some other exact figure).

The confidentiality technique is known as zero-knowledge proof (ZKP), a cryptography technology that allows a user to prove that funds, assets or identifying information exist without revealing the details behind it.

Who’s leading the charge?

Self-sovereign identities extend to businesses or other organizations that want to be able to verify – or be verified – for transactions with other businesses or government agencies. For example, Ernst & Young has created a public blockchain that lets companies use ZKPs to complete business transactions confidentially without exposing sensitive business data.

In another example, CULedger, a cooperative owned by dozens of credit unions for the purpose of providing back-office services, worked with blockchain company R3 to create CUPay, a secure electronic funds transfer (EFT) payment network that is built on R3’s Corda blockchain platform. CUPay acts as an settlement rail for cross-border customer payments.

The blockchain-based settlement system also acts as a distributed identity platform, enabling users to be verified by their credit union and then take their digital ID with them for use in cross-border payments, no matter what country they’re in or what financial institutions are involved.

CUPay utilizes R3’s Corda for organizational identity and CULedger’s MyCUID, a personal digital ID technology created through a partnership with the Sovrin Foundation and digital ID company Evernym. The solution provides integrated KYC and AML services and can be integrated into multiple networks, eliminating the need for manual entry of recipient details and providing built-in compliance management for credit unions.

“So, the PoC they developed was built to use the SWIFT payment rail, but they can use whatever rail they want, and it can even use a cryptocurrency to settle [a financial transaction] if they need it to,” said Abbas Ali, R3’s head of identity management.

R3, created five years ago by a consortium of leading financial services firms, heads up a group of more than 300 companies working to build distributed applications on top of Corda, their blockchain platform. Third parties can develop dApps (known as CorDapps), for use on the Corda platform in any number of industries, including financial services, insurance and healthcare.

“In simple terms, you can think of the [blockchain] platform kind of like the operating system. It provides all parts of identity on the network; it provides a protocol for participants to communicate with each other, but that’s as far as it goes. Any specific use case or business application on top of that would be based in the form of a CorDapp,” Ali said.

“At the application level, we have a lot of partners developing identity access management solutions using what’s called decentralized identity [DiD],” he added.

Credit unions are in the thick of it

CULedger’s CUPay eliminates the need for user names and passwords and relieves  credit union call centers from the obligation of resetting them when a customer loses them. The digital identity, which is encrypted using a public key infrastructure (PKI), is controlled solely by the credit union customer.

CUPay differs from modern payment rail systems in that a user’s identity is attached to every transaction they make. Current systems, such as SWIFT’s settlement rail, don’t send the user’s identity with a wire transfer; it remains separate from the wire instructions, meaning only the bank sending the money knows who is sending it.

“The advantage is for the receiving party,” Ali said. “For them, this is just one example of the use case they developed this PoC for, but they have a bigger vision. They want people to have flexibility to move between different providers. You have an identity on your phone or, let’s say your credit union-issued application…. [If] you decide to transfer to a new state or country or change credit union provider, you can take that identity with you. That’s the bigger use case there.”

CULedger’s MyCUID mobile app  >  Examples CULedger

How CULedger’s MyCUID mobile app works: The image on the left shows a credit union member being asked to verify their identity. The second image (right) shows the member confirming it is indeed them. Had the member pressed “no,” the credit union would be alerted that they might be dealing with be a bad actor or non-member.

The financial services industry as a whole is focused on developing decentralized identity systems that would eliminate today’s method of identifying users by keeping their information in siloes controlled by one company or a federation of partner companies, Ali said.

Key to a DID is that no one entity or person verifies a business’s or person’s identity. The onus for identification verification is on the relying party.

“Whoever you present your digital identity to has to decide if the proofs you’re presenting through the wallet are acceptable,” Ali said. “What’s most important isn’t what you say about yourself but what a trusted organization says about you.”

That means a bank, government, healthcare organization or any other entity verifying information about a self-sovereign identity user becomes responsible for ensuring the info can be trusted.

Self-sovereign academic credentials

For example, in 2017, MIT began piloting Blockcerts, a blockchain-based network and application for storing and sharing academic credentials. MIT worked with Digital ID company Learning Machine to develop the application.

Today, Blockcerts is up and running and used by 69% of graduates. In the last graduating class of 3,718 students, 2,561 opted to have their diplomas digitized and made available through the blockchain-based application, according to Mary Callahan, MIT’s registrar.

Blockcerts creates a single digital identity wallet a graduate can present through a link to would-be employers or other schools to verify academic achievements.

mit Blockcert MIT

MIT’s Blockcerts mobile application stores verified digital diplomas that students can share with potential employers or other schools.

“As you might imagine, having… a piece of paper that indicates you graduated is a valuable commodity in the world. So fraud was an issue,” Callahan said. “There’s also the opportunity to really recognize a student’s lifelong learning. For our students, this is one stop along their learning trajectory. They may be obtaining certificates, badges, masters degrees, PhDs, and this can put them all together in one simple portfolio of their credentials.” 

MIT has aggressively marketed Blockcerts to students through the school’s newspaper, display boards and the administrators of various academic departments – an effort that lead to a doubling of its uptake over the past year, according to Peter Hayes, assistant registrar at MIT.

“One thing we’re doing in terms of outreach now is working with the career services office to raise the profile for potential employers. They host career fairs with 400 to 500 employers on campus,” Hayes said.

Last year alone, the Blockcert application was used 4,124 times to verify graduate credentials, Hayes said. “So, while students haven’t given us direct feedback, we can see … numbers [that] indicate they are using it,” he said.

The movement is real

The self-sovereign identity movement spans industries, according to Gartner.

Examples of efforts to create DID infrastructures include:

A growing number of startups and traditional identity and security vendors are also entering the decentralized identity market directly or indirectly, according to Gartner’s Farahmand.

For decentralized identity and verifiable claim exchanges to become ubiquitous, however, there needs to be industry standardization, interoperability, and autonomous operation by pushing some legal agreements and policies into the decentralized protocols (e.g. smart contracts).

“That’s where we hope to see more collaboration between decentralized identity and blockchain communities to leverage smart contracts and initiatives such as [the] Accord project,” Farahmand said. (The Accord project an ongoing effort to make it easier for anyone to build smart contracts and documents on a neutral platform.)

Decentralized identity and verifiable claim exchanges are key to enabling functions such as user authentication, digital signature, consent and verifiable claims, according to Farahmand. “While we observe implementation of all these use cases for consumers, workforce and business-to-business scenarios, verifiable claim exchange is by far the most impactful because it can disrupt the way we exchange identity data,” he said.

A verifiable claim exchange could be relevant across many industries such as finance, healthcare, education, retail, professional services and even IoT.

R3’s Ali agreed, saying it will take a greater standards effort to advance a global decentralized identity network.

“You need to remove one of biggest hurdles, which is lack of interoperability,” Ali said. “You need interoperability, because we don’t believe one blockchain can rule them all.”

Copyright © 2020 IDG Communications, Inc.



Source link

When does protecting privacy morph into invading privacy?

Recently, I tried to toy around with some of the better security apps for my iPhone and checked out a very impressive package called Lookout. One of its features seeks to make identity theft a little more difficult. So far, so good.

The service says that it searches the dark web and various databases looking for any leak, quite likely from a breach. That sounds worth doing.

So I start filling out the online forms, and before long my head was filled with the protesting voices of every chief privacy officer I have ever spoken with. Lookout starts by asking for all of your email addresses and phone numbers, before moving on to complete driver’s license number, medical insurance card numbers and full passport number. It also seeks full banking account details (routing numbers, too), all credit and debit card numbers and Social Security number, and asks to connect to Facebook, Twitter, LinkedIn and Instagram.

To be fair, I do see what Lookout is doing — and, in an interview, Lookout’s senior director of product management, David Richardson, stressed that customers can skip all or some of those questions — but my first reaction was, “Hey! We just met. Why are you doing your best to sound like the most blatant identity thief this side of the North Pole?”

Given that Lookout’s goal is clearly stated (I have no reason to doubt the company, at this time), what is the concern? A few things. One, merely having that extensive a range of PII in one place about one individual is dangerous. If a breach against Lookout does somehow happen — no security is perfect — it would be a bonanza for the cyberthief. From a security perspective, this company’s marketing about this service could itself make identity and cyber thieves attracted to the site. They might spend extra resources and effort to break in, which is truly not what a customer wants.

Two, it sends the wrong message. Privacy advocates rightly argue to never give anyone or any site more information than they absolutely need (“need to know” is appropriate here). And when the company is directly asking for such a gold mine of PII data (it was probably the passport data request that really sent me soaring), it makes people worried. What, people may wonder, if that page is a phishing page that was designed to merely look like a Lookout page? How is a user supposed to tell the difference?

Three, in 2020 (OK, when we’re this close to 2020), no company is an island. What if one of its employees turned to the dark side? What if the company you use for backup gets breached? What if the firm used for disaster recovery gets breached? What if your cloud vendor gets breached?  

Mostly, though, this is a perception issue about privacy. What if a police department offered a service where it maintained an online listing of all of your most valuable possessions, to speed up recovery and insurance efforts should you be the victim of a burglar? Sounds attractive. Then you go to the PD’s page and it asks for the cost of your most valuable possessions, where they are located, your safe’s combination (in case the police need to quickly gain access, to dust for fingerprints), days and hours when you expect the house to be empty, the nature and passcodes for any security system, where you leave your house keys, the code to access your garage door, etc. Wouldn’t it raise more concerns than offer comfort? Even if it’s legitimate, wouldn’t the sensitivity of the questions (and the fact that it is a wishlist of everything a burglar would want to know) suggest that it’s a bad idea?

Privacy is not just a concrete concept. It’s also abstract and it needs people to change how they think about PII. It needs an attitude adjustment, to encourage people to be far more cautious and careful. Enterprise CISOs and CIOs want and need this perception change to happen. No matter how excellent an offering Lookout and other similar products and services are, they must support the perception change. Starting the registration process by asking for everything we want people to never reveal except in need-to-know situations is probably suboptimal. Very suboptimal.

Copyright © 2019 IDG Communications, Inc.



Source link

All about the latest iPhone location privacy scare

That story going round that claims iPhone 11 devices are secretly harvesting your location information even though you’ve told them not to do so? You don’t need to worry about it, and here’s why:

What’s the story?  

The tale begins when a security researcher noticed the devices seemed to be sending out location data even when Location Services were switched off on the iPhone.

He thought this was weird, but Apple reassured him that this was “expected behaviour” – and while the company took a little time to figure out what to say about this, it’s answer is convincing, once you know what it means.

What Apple said

The matter relates to iPhone 11’s U1 chip, which brings in an exciting (yet veteran) technology called Ultra Wideband (UWB).

Speaking to TechCrunch, Apple described UWB as an industry standard that is also subject to some regulatory usage limitations, meaning it can’t operate all the time.

Devices implementing it have to turn it off in some places, the company said.

Apple uses Location Services with UWB in order to ensure it is disabled in those places it is not permitted for use:

“The management of ultra wideband compliance and its use of location data is done entirely on the device and Apple is not collecting user location data,” a company spokesperson told TechCrunch.

Security researchers seem to back this opinion up, saying there’s no evidence this location data gets shared beyond the device.

What is UWB?

I’ve written quite a lot about UWB, which is an old tech (first authorized in 2002) only now entering the light as the cost of its components fall and the case of using it grows.

The best way to see UWB is as a complementary technology to Bluetooth and Wi-Fi (it can also replace them, but all three have advantages).

Apple media tend to focus on its time-of-flight capabilities, as it uses such data to figure out its position.

“The new Apple‑designed U1 chip uses Ultra Wideband technology for spatial awareness — allowing iPhone 11 Pro to precisely locate other U1‑equipped Apple devices. It’s like adding another sense to iPhone, and it’s going to lead to amazing new capabilities,” Apple has said.

What are the advantages of the standard?

However, UWB’s advantages are:

  • Can pass through walls better than both Bluetooth and Wi-Fi.
  • Has a range up to 100-meters.
  • Accurate up to 10cms.
  • Transmit data at 8 megabits (+) per second in mobile devices.
  • It requires very little energy.
  • Resistant to interference.

In other words, UWB is a low power solution that’s capable of sharing data in a hyper-local network that is also equipped enough to know where it is in relation to a compatible system it wants to communicate with.

Apple only has one current use for UWB in iPhones:

If you want to share items using AirDrop from one iPhone 11 to another, you just need to point your device at the other and that device will be first on your Share list.

This seems to me to be just the tip of the iceberg, given the standard’s other advantages.

It may certainly have implementation in Apple’s future product matrix.

What about security?

It is also highly secure – meaning its signals are hard to intercept and hard to crack, as I explained in this report:

“UWB is inherently more secure than Bluetooth. It works by sending out short pulses to other devices in range which then return the signal.

“The low range and wide wave bands supported by the standard make it much harder to spoof those pulses, while time-of-flight means the standard can tell precisely where an object is located.

“This means your keyless car entry system will actually know you are standing near the vehicle, and those pulsed and highly secured signals are much harder to intercept in man-in-the-middle and relay attacks. Not only do cars and doors know where you are, but the whole exchange is much harder to hack as the right signal coming from the wrong location won’t work.”

What this also means is that while your device is picking up location data which isn’t being shared, it is doing so in ways that cannot easily be hacked, cracked, hijacked or stolen.

Up next

UWB is already in use across factories and warehouses using UWB tags.

Car manufacturers are exploring the technology as a highly secure tool for keyless locking systems. Volkswagen recently demonstrated use of the standard (with AI) to provide walking pattern recognition, so the vehicle doesn’t just recognize the key, but also learns to understand who should be using that key.

Of course, in the current climate around the tech industry it’s no surprise so many people are concerned at machines that gather so much data about us – why wouldn’t we be?

It’s also fair to say that UWB is packed with features that could conceivably be used in some way to abuse privacy – it’s useful for indoor mapping, for example.

However, I guess Apple’s gamble here is to figure out how to provide convenience in conjunction with privacy, given that’s been its game plan for the last couple of years.

Though this doesn’t necessarily mean those products will remain as focused on user privacy in the event laws change, or management focus moves away from company-wide protection of it.

No company can really resist government regulation, after all.

But, if you want my reading of the current situation around UWB, the concern around its use of location is a little overblown, particularly because the data stays on the device.

In future it may become a lot more acceptable if you are able to use mesh-based UWB systems to find lost and stolen Apple devices logged into your Apple ID.

Which seems to me to be just one of the potential scenarios for this tech.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2019 IDG Communications, Inc.





Source link

Can You Trust Facebook Portal Devices With Your Privacy?

The social media giant’s latest bold move is to launch the Facebook Portal. These devices are designed for video chats with motion-sensitive cameras, smart displays, and Alexa built-in.

But this is the company with an extensive history of privacy scandals, including concerns about data collection and facial recognition. Can you really trust Facebook Portals with sensitive information?

What Is Facebook Portal?

The Facebook Portal lets you make video calls via Messenger or WhatsApp. Each unit has a 12MP motion-sensitive camera which follows you around the room with a 140-degree field of view. It also uses Augmented Reality (AR) to integrate animation into chats, reminiscent of Snapchat’s filters, lenses, and stickers.

Because Alexa is built-in, you can search the web (in a limited capacity), play music via Spotify, and control your smart home.

A standard Portal features a 10-inch display, though cheaper alternatives include the Mini (eight-inch display) and TV. The latter integrates with your smart television, meaning chats can be carried over to the biggest screen in your house.

It sounds like a handy device akin to other voice assistant devices like the Amazon Echo or Google Home Hub


Facebook Portal vs. Google Home Hub vs. Amazon Echo Show, Compared




Facebook Portal vs. Google Home Hub vs. Amazon Echo Show, Compared

Got your eye on a smart video assistant like Facebook Portal, Google Home Hub, or Amazon Echo Show? Here’s what you need to know.
Read More

, right? So what’s the problem?

Why Should You Worry About Facebook Portal?

A camera permanently trained on your living room should immediately raise concerns. So, too, should its microphone, which some think can be used to listen in on everything you do.

After all, worries about smart devices spying on you persist. Just look at those reports of targeted advertisements apparently based on discussions had with family and friends


Cortana Is Listening Into Your Skype Conversations




Cortana Is Listening Into Your Skype Conversations

Microsoft is adding Cortana to Skype, but to make use of the intelligent assistant you’ll have to let her listen in on your conversations.
Read More

.

People are now naturally sceptical of Facebook’s intentions. Admittedly, that doesn’t stop millions from using it every day. Still, you can reduce the amount of information you put online. The main potential issue with Facebook Portal is that you don’t know what’s collected and who can access that data.

We’ll come back to that.

It’s especially concerning as Facebook isn’t known for its transparency. In July 2019, the Federal Trade Commission fined Facebook $5 billion for failing to tell its users about a data leak which led to the Cambridge Analytica scandal. CEO, Mark Zuckerberg, however, now admits the firm has a responsibility to look after personal information.

What Safety Features Do Facebook Portals Have?

Facebook says that the Portal was created with “privacy, safety, and security in mind”, so what exactly does that mean? How does the Facebook Portal protect your privacy?

The camera and microphone can be disabled with the touch of a button. A red light demonstrates that they’re inactive. But why should you trust that? After all, even Zuckerberg covers the camera on his laptop with tape—a smart move given how snoopers can spy on you through such devices.

With that in mind, second-generation Portals have a physical cover you can slide over the lens. This doesn’t automatically disable the microphone, however, because you may still want to use the voice interface.

You can also activate the screen lock. It’s like your smartphone: it stops others from using the device without inputting a four- to 12-digit passcode.

And as Portals piggyback off Messenger and WhatsApp, calls are encrypted. This means data sent between units (whether Portal to Portal or via another device) is scrambled in transit so is difficult, though not impossible, to intercept.

Perhaps most importantly, the Portal can’t record and save videos or broadcast using Facebook Live. Your video calls aren’t listened to or stored anywhere.

Can Facebook Portal Identify Faces?

You’ve seen facial recognition at work. Tags are suggested when you add photos of family and friends on Facebook. This uses the company’s Deep Face technology to build an artificial map of faces. Naturally, you should be wondering, does Facebook Portal use facial recognition software? Does it know who’s talking?

Fortunately not. The Portal doesn’t recognise your face. The AI is used to track motion, so the camera can pan across a room. It isn’t there for malicious intent. Nonetheless, it can lock onto faces, so the Portal automatically zooms and still keeps you in shot. It’s also used when activating AR.

This AI runs locally, meaning on your actual Portal, not on Facebook’s servers.

Does Facebook Portal’s Microphone Listen All the Time?

As previously mentioned, you can disable the microphone. You have to physically turn it back on again before it’ll listen to voice commands again. If you use the camera shutter to cover the lens, your mic stays on, so it can still react when you say “Hey Portal”.

The Portal activates when it detects you saying that phrase then waits for commands. If activated, a notification appears at the bottom of the screen.

But no system is infallible, so Facebook coyly warns about “false wakes”, i.e. when it incorrectly identifies something you say as “Hey Portal”. These misunderstandings are deleted within 90 days.

What Information Does Facebook Portal Collect?

Read that last sentence again. Because yes, Facebook nonetheless collects some information from you. This primarily relates to voice commands.

Once the unit hears “Hey Portal”, it records and transcribes what it hears. This information is then sent to Facebook’s servers, including background noises. Facebook deletes this—eventually. It can take three years.

To prevent this and “false wakes”, you need to turn your microphone off. It means it won’t respond to “Hey Portal”, however.

So does Facebook Portal store anything related to your video calls? Unsurprisingly, the answer is: yes. Though your actual video contents stay private, technical details are sent to Facebook. The company says this includes “volume level, number of bytes received, or frame resolution”.

Further data is logged on your Portal and only sent to Facebook in the form of crash reports. This can tell the social network how many people were in frame when the Portal stopped working and their distances from the microphones.

This is indicative of more information sent to Facebook. The onus is on performance, so it’ll also collate data about ambient light, system logs, and settings.

That’s what happens to your video calls. What about third-party apps? The Portal has an in-built browser and a limited app store; some apps are pre-loaded too. And yes, these open more questions about privacy. Facebook communicates with third-parties.

voice assistant promotion social network

Sometimes, this is merely about app usage: frequency, bugs, and length of time you use them. Sometimes, more information is mined. To find out more, you have to check out the independent privacy policies of each app. It takes time, but it’s worth finding out exactly what personal details you’re surrendering.

How Is Collected Information Used?

Facebook assures users that most of the data collected is for performance reasons only. Information develops the AIs, so, for instance, results to “Hey Portal” enquiries are accurate. These are reviewed by actual people, not merely a computer. These Facebook workers are monitored so they comply with privacy and security strictures.

But your voice commands can be shared with third parties. Recordings and transcripts are sent to service providers like Alexa once more to improve the service. Transcripts are shared with apps for accuracy in response to “Hey Portal” enquiries.

An added caveat is in your favor: the pitch of your voice is altered so no one can personally identify you that way.

However, further identifiers are shared, like your Portal’s name, IP address, and zip code.

How Can You Protect Your Information?

“Hey Portal” is only available in English at the time of launch, so if you select another language, voice commands are disabled. This will greatly reduce how useful your device is, though.

Fortunately, there is something you can do to protect your privacy. Thanks to the General Data Protection Regulation (GDPR), you can access and delete your recordings—meaning Facebook won’t store any voice commands.

You can disable storage completely in your Portal Settings, so you can still use “Hey Portal” but it won’t log what you say. The downside is that it won’t be as fast or as accurate as devices which store data, although it’s doubtful you’ll even notice this lag.

System usage is still logged. The company can tell what times you use Portal and how often.

find social media logins and likes in your profile

To alter this, you’ll need to sign into Facebook, navigate to your profile, then click on Activity Log. This is a list of every time you’ve signed into Portal or Facebook, plus all your reacts and comments. You can delete accordingly. It may take some time if you’ve never looked before.

There’s nothing you can do about the company sharing device information like IP address, sadly.

Don’t forget that anyone else who uses your Portal can access your recordings. If you’re nervous about this, use a passcode.

Can You Trust Facebook Portal With Your Privacy?

This might surprise you, but… Yes. We’re very nervous about Facebook’s security scandals, but the Portal is designed with your privacy in mind. It’s not perfect, of course. You’ve should be wary of “false wakes”, where information is recorded when the unit thinks you’ve said “Hey Portal”.

Then again, that’s a concern with all voice assistants. The Facebook Portal is as safe as such devices get right now.

But of course, you should always stay vigilant about your privacy. It’s always worth reviewing the data you submit to Facebook


The Complete Facebook Privacy Guide




The Complete Facebook Privacy Guide

Privacy on Facebook is a complex beast. Many important settings are hidden out of sight. Here’s a complete look at every Facebook privacy setting you need to know about.
Read More

.





Source link

What That Means for Your Privacy

We thought VPNs were secure, but with an increasing number of secure services reporting server breaches, that seems not to be the case. But how do these secure services get hacked in the first place, and how do hackers capitalize on it?

Here’s how VPNs get hacked and what it means for your privacy.

The VPN’s (Seemingly) Unbreakable Security

A diagram showing how a VPN works
Image Credit: vaeenma/DepositPhotos

If we take a brief look at how a VPN works, it looks unhackable. This is the primary draw of a VPN, as people feel they can trust the service to maintain their privacy.

For one, your computer encrypts the connection before it leaves for the internet. This encryption makes a VPN a solid layer of defense against spying, as anyone snooping on the connection can’t read what you’re sending. Hackers can use public Wi-Fi connections to steal your identity


5 Ways Hackers Can Use Public Wi-Fi to Steal Your Identity




5 Ways Hackers Can Use Public Wi-Fi to Steal Your Identity

You might love using public Wi-Fi — but so do hackers. Here are five ways cybercriminals can access your private data and steal your identity, while you’re enjoying a latte and a bagel.
Read More

, but a VPN can protect you from all attacks bar someone looking over your shoulder.

Even your ISP can’t see the packets you send, which makes VPNs useful for hiding your traffic from a strict government.

If a hacker manages to break into a VPN’s database, they may leave empty-handed. Many top VPNs hold a “no-logging policy,” which states that they won’t save records of how you use their service. These logs are a potential goldmine for hackers, and refusing to keep them means your privacy is maintained even after a database leak.

From these points, it’s easy to assume that a VPN is “unhackable.” However, there are ways that hackers can breach a VPN.

How VPNs Are Susceptible to Hacking

A hacker’s best point of entry is near the outer reaches of the VPN network. VPN companies sometimes opt not to set up servers in all the countries they want to support. Instead, they’ll hire out data centers established within the target country.

This plan often doesn’t introduce any complications and the VPN service adopts the servers without any issues. However, there is the rare chance that there is a hidden oversight in the data center that the VPN company isn’t aware of. In one reported case, a server that NordVPN rented out had a forgotten-about remote connection tool installed.

This tool was insecure and hackers used it to break in.

From there, the hacker found some additional files. The Register reports that this includes an expired encryption key and a DNS certificate. The key didn’t allow the hacker to snoop on traffic, and if they did, NordVPN says they’d only see the same data an ISP would see.

How Hackers Can Capitalize on a VPN Attack

This flaw is the main weakness that a hacker will try to exploit. Because the VPN doesn’t store logs of connections, a hacker’s best bet is to watch the data flow in real-time and analyze the packets.

This tactic is called the “man-in-the-middle


What Is a Man-in-the-Middle Attack? Security Jargon Explained




What Is a Man-in-the-Middle Attack? Security Jargon Explained

If you’ve heard of “man-in-the-middle” attacks but aren’t quite sure what that means, this is the article for you.
Read More

” (MITM) attack. It’s when a hacker gets their information from monitoring data as it passes through.  It’s not easy to pull off, but it’s not impossible to achieve. Should a hacker get their hands on an encryption key, they can reverse the VPN’s protection and peek at the packets as they pass through.

Of course, this doesn’t give hackers free rein over the traffic. Any data encrypted with HTTPS won’t be readable, as the hacker won’t have the key for it. Anything that’s plaintext, however, will be readable and potentially editable, which would be a severe privacy breach.

Should You Be Concerned About Your VPN Privacy?

While this does sound terrifying, don’t worry just yet. Before you panic, consider why you use or would use a VPN service. At the base level, a hacker monitoring a VPN connection would only see what an ISP would see. For some, this kind of breach doesn’t affect them at all; for others, it’s a severe breach of trust.

On one end of the spectrum, let’s assume you use a VPN so you can get around geo-blocks. You don’t boot up the VPN often, and when you do, it’s to watch shows on Netflix that aren’t available in your home country. In this case, do you mind that a hacker knows you’re watching the newest Labyrinth series?

If not, you may not want to protect yourself further—although some would argue that surrendering any part of your privacy is never right!

On the other side, VPNs are more than just a way to watch TV shows from overseas. They’re a way to browse the internet and speak freely without intervention from the government. For these people, a breach of their privacy could have severe ramifications.

If the thought of your privacy leaking in an attack is too much to bear, it’s worth taking the extra steps to protect yourself.

How to Protect Your Privacy With Additional Security

To start, it’s essential to realize that these breaches aren’t commonplace. Also, the hacker in the NordVPN case only gained access to one of the 5000+ servers. This means that the majority of the service was safe, and only a small section of users was under threat. As such, a VPN is still a useful way to protect your privacy.

However, if you’re very serious about staying anonymous, a VPN shouldn’t be your only line of defense. The attacks on VPNs have shown that they do have flaws, but that doesn’t mean that they’re entirely useless. The best way to maintain your privacy is to add another layer of privacy to what the VPN provides. That way, you’re not wholly dependent on your VPN service to protect you.

For instance, you can boot up your VPN, then use the Tor browser


Really Private Browsing: An Unofficial User’s Guide to Tor




Really Private Browsing: An Unofficial User’s Guide to Tor

Tor provides truly anonymous and untraceable browsing and messaging, as well as access to the so called “Deep Web”. Tor can’t plausibly be broken by any organization on the planet.
Read More

to browse the web. The Tor browser connects to the Tor network, which uses triple-encryption for its traffic. This encryption is applied before your computer sends it, much like a VPN.

If a hacker performs a MITM attack on your VPN connection, The Tor network’s encryption keeps your data safe. On the other hand, if your connection is compromised on the Tor network, the trail leads back to the VPN. If the VPN doesn’t store logs, the trail back to you goes dead.

As such, using two layers of security is an effective way to protect your privacy. Regardless of which side suffers a breach, the other one will pick up the slack.

How to Use a VPN Properly

VPNs can help secure your connection, but they’re not impenetrable. As we’ve seen from these incidents, hackers can infiltrate a VPN server and use keys to initiate a MITM attack. If you’re concerned about your privacy, it’s worth backing up a VPN with another layer of defense. That way, if one layer falls, the other is there to back you up.

Invulnerability behind a VPN service is one of the common VPN myths you shouldn’t believe


5 Common VPN Myths and Why You Shouldn’t Believe Them




5 Common VPN Myths and Why You Shouldn’t Believe Them

Planning to use a VPN? Not sure where to start, or confused about what they do? Let’s take a look at the top five myths about VPNs and why they’re simply not true.
Read More

, so it’s worth knowing what’s true and what’s fake.



Source link

Duck Duck Go offers Mac users even more privacy

People are finally waking up to the importance of privacy and the risk of entities over whom we have no control hoovering up the details of our digital lives, and that’s why the latest news from Duck Duck Go is so worthwhile.

Apple’s good privacy just got better

We know Apple is working to protect privacy – its newly updated privacy website shares a huge amount of information on its efforts, while the newly-published Safari white paper confirms the browser’s privacy protections include (among other things):

  • Protection from cross-site tracking.
  • Ad measurement tools that respect user privacy.
  • Secure payments.
  • Sign-in with Apple.
  • Privacy-focused extensions.

The white paper also discusses Safari Extensions, a feature the company has developed with privacy in mind.

This is why you are told what information extensions can access when installed, and also why developers of content-blocking solutions aren’t actually able to access your browsing data. It is also why Apple continues its work to ensure AI-based decisions take place on your device, rather than in the cloud.

Duck Duck Go launches better privacy for Macs

Safari Extensions is also where Duck Duck Go comes in. The private-by-design search engine has introduced its new Privacy Essentials extension for Safari users on Catalina. You can get it on the App Store. iPad and iPhone users can use the DuckDuckGo Privacy Browser for iOS.

The Safari browser extension for macOS includes a range of useful privacy protections, including third-party tracker blocking and a privacy dashboard.

This isn’t the first time Duck Duck Go has offered these tools to Safari users. But major structural changes in Safari 12 required the company to remove the software from the Safari extensions gallery.

Apple has made some changes in macOS Catalina, which means the tools can now be offered once again.

There are two main components:

Tracker blocking:

You can whitelist some sites if you wish, but once you install the Safari extensions they will automatically block hidden third-party trackers on sites you visit.

Privacy Dashboard:

This handy tool shows you how the extensions enhance each site’s privacy – including a Privacy Grade for each place you visit. 

Private search:

You can set your Mac up for private search simply by setting Duck Duck Go as your default search engine: Safari>Preferences>Search, select Duck Duck Go.

Duck Duck Go says it had to make a lot of changes in order to get its new collection of extensions compatible with Safari on a Mac. The new version identifies and blocks more trackers and provides an improved user interface.

Unfortunately, the company’s popular Smarter Encryption tool did not make the transition, though Duck Duck Go promises to restore this functionality in future.

Why these tools matter

We’ve seen plenty of incidents in recent years that prove the threat untrammelled collection of personal data poses – this information is used in ways that go far beyond more acceptable uses in advertising, marketing and click-fraud prevention. (Apple CEO Tim Cook, has described the nature of these technologies as a form of “surveillance.”)

With stakes so high, it’s important to note that tools such as these new extensions from Duck Duck Go and the many privacy protections inside Safari don’t utterly prevent data grabbing – but they do form a line of defense.

Getting around such defenses has become a business in itself.

Cross-site tracking is just one method. But some entities use a technology called “fingerprinting” to identify and track users. This kind of technology identifies information about your device (such as fonts, browsers, plug-ins) in order to track what you do with it.

What Apple is doing

Apple’s response has been to limit the data made available to such tools. Apple is also working to prevent other ways of tracking users through Bluetooth or Wi-Fi, and has developed its own Private Click Measurement tools to enable advertisers to accurately track their campaigns.

One additional fact that may help understand how Apple sees privacy – and why Duck Duck Go is a perfect companion to the company’s products: Whatever you read on Apple News is also private, which means no one will track and assess you for your interests or beliefs based on what you read there.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2019 IDG Communications, Inc.





Source link

Duck Duck Go gives Mac users even more privacy

People are finally waking up to the importance of privacy and the risk of entities over whom you have no control hoovering up the details of our digital lives, and that’s why the latest news from Duck Duck Go is so worthwhile.

Apple’s good privacy just got better

We know Apple is working to protect our privacy – its newly updated privacy website shares a huge amount of information on this, while the newly-published Safari white paper confirms the browser’s privacy protections include (among other things):

  • Protection from cross-site tracking.
  • Ad measurement tools that respect user privacy.
  • Secure payments.
  • Sign-in with Apple
  • Privacy-focused extensions

The white paper also discusses Safari Extensions, a feature the company has also developed with privacy in mind.

This is why you are told what information extensions can access when installed, and also why developers of content blocking solutions aren’t actually able to access your browsing data. It is also why Apple continues its work to ensure AI-based decisions take place on your device, rather than in the cloud.

Duck Duck Go launches better privacy for Macs

Safari Extensions is also where Duck Duck Go comes in.

The private by design search engine has introduced its new Privacy Essentials extension for Safari users on Catalina. You can get it on the App Store right here. iPad and iPhone users can use the DuckDuckGo Privacy Browser for iOS.

The Safari browser extension for the Mac includes a range of useful privacy protections, including third-party tracker blocking and a privacy dashboard.

This isn’t the first time Duck Duck Go has offered these tools to Safari users, but major structural changes in Safari 12 meant that it had to remove the software from the Safari extensions gallery.

Apple has made some changes in macOS Catalina which means it is now able to offer the tools once again.

There are two main components:

Tracker blocking:

You can whitelist some sites if you wish, but once you install the Safari extensions they will automatically block hidden third-party trackers on sites you visit.

Privacy Dashboard:

This handy tool shows you how the extensions enhance each site’s privacy – including a Privacy Grade for each place you visit. 

Private search:

You can set your Mac up for private search simply by setting Duck Duck Go as your default search engine: Safari>Preferences>Search, select Duck Duck Go.

Duck Duck Go says it had to make a lot of changes in order to make its new collection of extensions compatible with Safari on a Mac. The new version identifies and blocks more trackers and provides an improved user interface.

Unfortunately, the company’s popular Smarter Encryption tool was unable to make the transition, though it promises to restore this functionality in future.

Why do these tools matter?

We’ve seen plenty of incidents in recent years that prove the threat untrammelled collection of personal data poses – this information is used in ways that go far beyond more acceptable uses in advertising, marketing and click fraud prevention.

Apple CEO, Tim Cook, has described the nature of these technologies as a form of “surveillance”.

With stakes so high, it’s important to note that tools such as these new extensions from Duck Duck Go and the many privacy protections inside Safari don’t utterly prevent data grabbing, but they do form a line of defence.

Getting around such defences has become a business in itself.

Cross site tracking is just one method, but some entities use a technology called ‘fingerprinting’ to identify and track users. This kind of technology identifies information about your device (such as fonts, browsers, plug-ins) in order to track what you do with it.

What Apple is doing

Apple’s response has been to limit the data made available to such tools.

Apple is also working to prevent other ways of tracking users through Bluetooth or Wi-Fi, and has developed its own Private Click Measurement tools to enable advertisers to accurately track their campaigns.

One additional fact that may help understand how Apple sees privacy – and why Duck Duck Go is a perfect companion to the company’s products: Whatever you read on Apple News is also private, which means no one will track and assess you for your interests or beliefs based on what you read there.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2019 IDG Communications, Inc.





Source link

Apple updates its privacy pages, and you should take a look

Apple has updated its Privacy website and published several white papers explaining its approach to the topic and how its products protect your privacy.

Apple is offering more information than ever

The updated website delivers much more information than before with a broad overview of what the company is doing. It includes pages detailing features and controls as well as its privacy policy and transparency report. 

The site also offers a selection of approachable white papers that explain how the privacy controls in Safari, Location Services, Photos and Sign-in With Apple work. These contain a huge amount of information on Apple and its services.

Hey Siri, spell ‘debacle’

Apple likes to update users with more information concerning its ongoing attempts to protect user privacy annually, but the update is particularly significant this year following the debacle around Siri grading.

Since that story broke, Apple has taken steps to make the Siri grading process more transparent and to give users more control.

Not only can you now prevent the process completely, but you can also delete any recordings Siri’s system may have on you. The company has also taken the grading process in-house.

Apple’s decision to protect user privacy isn’t just altruistic:

It recognizes that each time you pick up a smartphone, make a call, check a message or visit anywhere the sensors inside the device can track that action.

This means your smartphones gather a huge quantity of information about you.  

Apple says it has designed its systems, so such information stays on your device and such data is not shared with the company (beyond what is required to make systems work – and even then it is encrypted).

That’s unique in the industry, as server-based smartphone platforms (you know who they are) do gather this information in order to make the OS (and their revenue models) work.

Not Apple.

Human/not human

Your iPhone does make use of this kind of information on a device level, but only in order to assess things like human/not human requests as are typical of developers and other service providers who ask for bot/not bot data.

(Apple calls this its Real User Indicator).

This kind of operation is what helps prevent large scale advertising click fraud, for example – if a device tells the service it thinks it is being run by a bot, then that click can be ignored.

Apple’s new website goes into plenty of detail concerning how you can use its platforms to protect your privacy, including a plea to the one-in-four iPhone users who have not yet done so to enable two-factor authentication.

The page also explains the many privacy improvements in iOS 13, including much tighter controls over location information.

For example, when you install a new app you now have the opportunity to share location data just once in order to try the app and make it work.

Apple’s system now provides users with highly visual reminders of what information specific apps gather about them as a way to jog us all into reviewing which apps gather what data from time-to-time.

Inside the white papers

Apple’s new white papers are relatively approachable documents for any iOS user.

They carry a wealth of detail concerning Apple’s products and its approach, including a few items I’d not been aware of before. Did you know that over a trillion photos and videos are captured every year on iPhones?.

I’ve gathered one interesting data point from each of the white papers, but please do Tweet me with any that catch your eye (as I’d urge you to read them):

Location Services White Paper:

“Apple Maps shows your current location using a blue marker. Because the precision with which your location can be determined is limited, a blue halo will appear around this marker. The size of the halo shows approximately how precisely your location can be determined: the smaller the halo, the greater the precision.”

Photos White Paper:

“In order for the Days view to highlight a user’s best shots, photos that are considered clutter are shown in the All Photos view and intelligently hidden in the Days view.

Days automatically hides:

— Screenshots

— Screen recordings

— Blurry photos

— Photos with bad framing and lighting

Photos also identifies specific objects likely considered clutter and hides them in the Days view. They include photos of:

— Whiteboards

— Receipts

— Documents

— Tickets

— Credit cards.”

Sign in with Apple white paper

“Apple has gone to great lengths to ensure the [Real User Indicator] is calculated in a privacy-preserving manner. First, on-device machine learning (ML) is employed to measure if the device the account is originating from is being used in a way that’s consistent with ordinary, everyday behavior such as moving from place to place, sending messages, receiving emails, or taking photos. This analysis yields a tamper-proof numerical score that is sent to Apple indicating a level of confidence that the device is being used by a real person. The score cannot be reverse-engineered by Apple to reveal any personal information, and none of the specific inputs to the ML models ever leaves the user’s device.”

“The device score is then combined with select information on recent account activity. The sum of this information is abstracted into the binary Real User indicator that is passed to the developer at account setup time. Developers can incorporate this information into any existing anti-fraud systems they currently use to help make determinations about how to handle a new customer.”

In other words, your device figures out if you are a real person, or not. Developers/service providers can then choose not to demand additional verification, or to do so if you might be a bot.

Safari White Paper

“Safari now includes the ability to offer Private Click Measurement, an innovative way of doing ad click measurement that prevents cross-site tracking but still enables advertisers to measure the effectiveness of web campaigns.

“It is built into the browser itself and runs on device, which means that neither advertisers, merchants, nor Apple can see what ads are clicked or which purchases are made. This solution avoids placing trust in any of the parties involved—the ad network, the merchant, or other intermediaries—so none of them are able to track users as they click on ads and make purchases in Safari…. “Apple has proposed Private Click Measurement as a new web standard to the World Wide Web Consortium.”

You can explore all Apple’s latest resources at its revamped privacy site here.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2019 IDG Communications, Inc.





Source link