Changes to how we're surveilled on the web. Using AI to create targeted emails.
A reminder about 'Incognito Mode.' And smartphone use linked to an "unprecedented" drop in academic performance.
Cookies
This year sees a major change in the way advertisers track our activity on the web. Yesterday, Google began a mass test of a new version of its Chrome browser that by default eliminates the little text files used to analyse our online behaviour. These ‘third-party cookies’ underpin Google’s vast advertising business, so you wouldn’t expect such surveillance to end completely. Google’s solution is a feature called Protected Audience, which is part of its Privacy Sandbox initiative. The way it works is complex but, at its simplest, it places users in interest groups based on recent browsing activity. This means they can still be targeted with adverts but without handing over any personal data. Or at least that’s the theory.
The test had barely begun before Microsoft popped up with a warning that the change is causing problems for some of its users. Among the apps affected are SharePoint Online, OneDrive for Business and Teams. Microsoft says issues include being unable to access recent documents and create SharePoint sites. While Google’s trial only involves 1% of Chrome users, the browser is so widespread that this still equates to 30 million people. If you’re one of them, you’ll see a popup message in Chrome titled ‘Enhanced ad privacy.’ There is a degree of irony in this because if you really want to enhance your privacy, the best solution is to use a browser like Firefox, Safari and DuckDuckGo.
A key part of Google’s new system is that everything takes place on the user’s device. This has raised concerns about using up storage space and draining battery life. Regulators are also expected to examine the new system in detail to see whether it enhances Google’s dominance of the online advertising market. The Register and Gizmodo look at the new system in detail, while the advertising industry tells The Wall Street Journal that Google hasn’t done enough to prepare the market for the change.
Threats
Google: Several types of malicious software can access compromised Google accounts even after a password is changed. They do this by exploiting “session tokens” – these are small files (“cookies”) designed to make it easier to log into websites and services without repeatedly entering credentials. Google says the solution is to close a session completely by signing out of the service on the affected browser. N.B. simply closing the browser may not be sufficient. The Register Bleeping Computer
Vaccinations: Scammers on Telegram are impersonating doctors to sell fake vaccination certificates for Covid-19 and other diseases. Wired reports that the operation has been running since at least June 2022 with more than a thousand accounts on XTwitter posting links that push people toward the Telegram channels selling “vaccine passes.”
AI
Spearphishing: OpenAI’s GPT models can be fine tuned to generate highly targeted phishing emails and revise them rapidly until they get a response. The research was published last May but since then has attracted growing attention. “My findings reveal that these messages are not only realistic but also cost-effective, with each email costing only a fraction of a cent to generate,” the author wrote. VentureBeat
Evasion: Researchers say they’ve trained an AI tool to generate new ways of evading the defences of other AI chatbots as well creating malicious software to inject into vulnerable systems. Vice
Satellite: Combining satellite imagery with machine learning has revealed the extent of the “dark” fishing industry, i.e. boats that aren’t officially tracked. The research puts the figure at 75% of industrial fishing vessels. TechCrunch
In brief
Incognito: Google appears to have settled a lawsuit alleging that it abused people’s expectations of privacy when using Chrome’s Incognito Mode to browse the web. The key thing to remember about Incognito Mode is that its doesn’t record your activity on your device. That is not at all the same thing as saying your activity can’t be observed by Google, your internet provider and any websites you visit. Data Breach Today
Space: One might think China would have used some of its super secret satellites to communicate with the spy balloon that flew across the US last year. Nothing so fancy, according to US intelligence officials. China just subscribed to a (so far unnamed) US internet service provider. NBC News
Starlink: Elon Musk’s satellite company will shortly start offering cellular connectivity for customers in the US, Canada, Japan, Australia, New Zealand, Switzerland, Chile and Peru. Text messaging is due to be available this year with voice calls in 2025. The service will work with ordinary LTE phones though the available bandwidth will be tiny and so data is a no go.
23andMe: The ancestry research company appears to be blaming its users for a data breach that ultimately affected nearly seven million people. Initially, attackers were able to access only 14,000 accounts; the other 6.9 million people had opted to share their data using the service’s DNA Relatives feature. 23andMe said users had “negligently recycled and failed to update their passwords” following past unrelated security incidents. TechCrunch
Porn: Pornhub and other adult websites have been blocked in Montana and North Carolina after the states introduced age verification laws. The sites’ owners (Ethical Capital Partners - yes, really) are currently trying to create new solutions to the longstanding problem of online age verification. Ars Technica
Intelligence: The latest International Student Assessment suggests there’s a strong link between increasing use of smartphones and “an unprecedented drop in [academic] performance.” It says the fall is “nearly three-times as large as any prior change.” Students spending less than an hour on phones at school scored significantly higher in maths, with a 50-point difference compared to those on screens for over five hours. The Atlantic examines ($) some worrying statistics.
Updates
iOS: iPhone users are reporting connectivity problems with the latest iPhone update. The issue seems to mainly affect iPhone 15 models and stops the devices from using cellular connectivity. Some advice has suggested installing iOS 17.3 which is a beta (i.e. test) release. We don’t think that’s a good idea, not least because it’s been causing even worse problems.
LastPass: The password manager company says it will force customers to use complex passwords with a minimum of 12 characters. It will also check passwords to make sure they haven’t appeared in previous data breaches. LastPass experienced two serious security breaches in 2022.
Thanks for reading. We wish you and yours all the very best for 2024.