Microsoft is dropping its 60-day password expiration policy starting with the Windows 10 May 2019 Update. "Once removed, the preset password expiration settings should be replaced by organizations with more modern and better password-security practices such as multi-factor authentication, detection of password-guessing attacks, detection of anomalous log on attempts, and the enforcement of banned passwords lists (such as Azure AD's password protection currently available in public preview)," reports Bleeping Computer. From the report: Microsoft's Aaron Margosis states that the password expiration mechanism which requires periodic password changes is in itself a flawed defense method given that, once a password is stolen, mitigation measures should be taken immediately instead of waiting for it to expire as per the set expiration policy. In addition, the soon to be removed policies are "a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity."

The removal of the password-expiration policies without the addition of other password-oriented security configurations does not directly translate into a decrease in security but, instead, it simply stands as proof that security-conscious organizations need to implement extra measures to enforce their users' security. As Microsoft further detailed, "to try to avoid inevitable misunderstandings, we are talking here only about removing password-expiration policies -- we are not proposing changing requirements for minimum password length, history, or complexity."

LG, the South Korean electronics and phone company, is relocating their mobile production facility in South Korea for the year, and focusing instead on one of its plants in Haiphong, Vietnam. CNET reports: Though LG overall is profiting, its mobile division posted a $172 million loss in the second quarter of 2018. And while smartphone sales are down globally, things are especially difficult for LG. Its last couple of flagship phones didn't take off, and it still must compete against bigger companies like Samsung, Huawei and Apple, too. With the relocation, the company does not plan to downsize its phone business, however. The move is to make LG "much more competitive for the global market," said LG senior director of global corporate communications Ken Hong. "Korea will continue to be the hub for smartphone R&D, design, quality assurance, etc." As reported by Reuters, the factory in South Korea mostly makes premium phone models, which would include devices like the LG G8 ThinQ or the upcoming V50 ThinQ, and manufactures about 10% to 20% of LG's total smartphones. In addition to South Korea and Vietnam, the company also has factories in China, Brazil and India.

An anonymous reader quotes a report from Ars Technica: The U.S. mobile industry's top lobbying group is opposing a proposed California state law that would prohibit throttling of fire departments and other public safety agencies during emergencies. As reported yesterday by StateScoop, wireless industry lobby group CTIA last week wrote to lawmakers to oppose the bill as currently written. CTIA said the bill's prohibition on throttling is too vague and that it should apply only when the U.S. president or California governor declares emergencies and not when local governments declare emergencies.

The group's letter also suggested that the industry would sue the state if the bill is passed in its current form, saying the bill would result in "serious unintended consequences, including needless litigation." "[T]he bill's vague mandates, problematic emergency trigger requirement, and failure to include notification requirements could work to impede activities by first responders during disasters," CTIA wrote. The group said that it "must oppose AB 1699 unless it is amended to address the foregoing concerns." CTIA represents Verizon, AT&T, T-Mobile, Sprint, and other carriers. Despite CTIA's opposition, the bill proposed by State Assemblymember Marc Levine (D-Marin County) sailed through an Assembly committee yesterday. The Committee on Communications and Conveyance voted 12-0 to advance the bill, Levine's chief of staff, Terry Schanz, told Ars today. A committee analysis of the bill says that CTIA was the only organization to register opposition. The next stop for the bill is an April 30 hearing with the Assembly Privacy and Consumer Protection Committee. It is in response to Verizon throttling an "unlimited" data plan used by Santa Clara firefighters last year during the state's largest-ever wildfire.

The UK Culture Secretary Jeremy Wright said on Thursday he could not rule out a criminal investigation over the "unacceptable" disclosure of confidential discussions on the role of China's Huawei in 5G network supply chains. From a report: Huawei, the world's biggest producer of telecoms equipment, is under intense scrutiny after the United States told allies not to use its technology because of fears it could be a vehicle for Chinese spying. Huawei has categorically denied this. Sources told Reuters on Wednesday Britain's National Security Council (NSC) had decided to bar Huawei from all core parts of the country's 5G network and restrict its access to non-core parts. The leak of information from a meeting of the NSC, first reported in national newspapers, has sparked anger in parliament because the committee's discussion are supposed to be secret. "We cannot exclude the possibility of a criminal investigation here," Wright said, speaking in response to an urgent question on Huawei in parliament. "I do not think that the motivation for this leak matters in the slightest. This was unacceptable and it is corrosive to the ability to deliver good government."

GoDaddy removed a cluster of more than 15,000 fraudulent websites discovered by a researcher at Palo Alto Networks' Unit 42 analysis team. From a report: The scam, which sold products like weight loss pills, used breached websites to add legitimacy to its sales and involved using fake celebrity endorsements. Jeff White, the researcher at Unit 42, started researching the network of sites more than 2 years ago when he noticed spam messages that looked visually similar and used similar language. The products were sold on commission as part of an affiliate marketing program and used low initial pricing and tiny print to get people signed up for costly subscriptions. The sales took place on hacked GoDaddy websites, where hackers had set up subdomains on legitimate websites.

Cox Cable is testing a new "Elite Gamer Service" a form of fast lane service for gamers that would prioritize internet use for those willing to pay an extra $15 a month. From a report: The service is currently being tested in Arizona and only works with Windows PCs. Cox Elite Gamer "automatically finds a faster path for your PC game data, reducing the lag, ping spikes, and jitter that stand in the way of winning," according to the official site for the service. The site also notes that compared to standard Cox Internet, users will experience up to 34% less lag, 55% fewer ping spikes, and 45% less jitter. The $15 a month service includes access for two computer users and requires Cox Internet Preferred 100 Internet service or above. In the terms of service on the website, Cox notes that membership to the Cox Elite Gamer Service permits users to route their game activity for select games through a dedicated gaming network.

Uber drivers in seven US cities are planning protests to highlight what they claim are poor working conditions and low wages at the ride-hailing firm. The drivers say they are paid below minimum wage levels required by some states and barely above national rates. From a report: The richest and most highly anticipated IPO of the year is just around the corner. But a group of drivers dissatisfied with shrinking pay, no benefits, a lack of transparency, and little voice within the company are hoping to turn that singular IPO moment in their own favor by organizing a seven-city strike around the country including at Uber headquarters for 12 hours on May 8 leading up to Uber's initial public offering.

Joseph Cox, and Jason Koebler, reporting for Motherboard: At a Twitter all-hands meeting on March 22, an employee asked a blunt question: Twitter has largely eradicated Islamic State propaganda off its platform. Why can't it do the same for white supremacist content? An executive responded by explaining that Twitter follows the law, and a technical employee who works on machine learning and artificial intelligence issues went up to the mic to add some context.

With every sort of content filter, there is a tradeoff, he explained. When a platform aggressively enforces against ISIS content, for instance, it can also flag innocent accounts as well, such as Arabic language broadcasters. Society, in general, accepts the benefit of banning ISIS for inconveniencing some others, he said. In separate discussions verified by Motherboard, that employee said Twitter hasn't taken the same aggressive approach to white supremacist content because the collateral accounts that are impacted can, in some instances, be Republican politicians. The employee argued that, on a technical level, content from Republican politicians could get swept up by algorithms aggressively removing white supremacist material. Banning politicians wouldn't be accepted by society as a trade-off for flagging all of the white supremacist propaganda, he argued.

Privacy watchdogs are accusing Facebook of "serious contraventions of Canadian privacy laws" in the Cambridge Analytica scandal. From a report: In a joint report released Thursday, the Privacy Commissioner of Canada and the Privacy Commissioner of British Columbia said the Menlo Park, California-based technology giant didn't obtain proper consent from users to disclose their personal data, didn't have adequate safeguards to protect that data and didn't take proper responsibility for the information under its control. "Facebook's refusal to act responsibly is deeply troubling given the vast amount of sensitive personal information users have entrusted to this company," Privacy Commissioner of Canada Daniel Therrien said in a news release. "Their privacy framework was empty, and their vague terms were so elastic that they were not meaningful for privacy protection." Therrien's office plans to take the matter to Federal Court to "seek an order to force the company to correct its privacy practices," according to the release.

From a report: A small part of us always knew the Laundroid was too good to be true. The black obelisk, developed by Japanese company Seven Dreamers, was supposed to be a washing machine, dryer, ironing and laundry-folding robot rolled into one. It was the perfect appliance, in short, for chore-dodging so-and-sos who hate dealing with grimy clothes. But that dream has come to a predictable end. This week, Seven Dreamers filed for bankruptcy in Japan, all but ensuring its halo product will never reach store shelves. According to Teikoku Databank, a private credit research agency, the company owes 2.25 billion yen ($20.1 million USD) to 200 creditors.

Forty-one percent of voice assistant users are concerned about trust, privacy and passive listening, according to a new report from Microsoft focused on consumer adoption of voice and digital assistants. From a report: And perhaps people should be concerned -- all the major voice assistants, including those from Google, Amazon, Apple and Samsung, as well as Microsoft, employ humans who review the voice data collected from end users. [...] While some users may not have realized the extent of human involvement on Alexa's backend, Microsoft's study indicates an overall wariness around the potential for privacy violations and abuse of trust that could occur on these digital assistant platforms. For example, 52 percent of those surveyed by Microsoft said they worried their personal information or data was not secure, and 24 percent said they don't know how it's being used. Thirty-six percent said they didn't even want their personal information or data to be used at all.

An anonymous reader quotes a report from The Wall Street Journal: The National Security Agency has recommended that the White House abandon a surveillance program that collects information about U.S. phone calls and text messages (Warning: source paywalled; alternative source), saying the logistical and legal burdens of keeping it outweigh its intelligence benefits, according to people familiar with the matter. The recommendation against seeking the renewal of the once-secret spying program amounts to an about-face by the agency, which had long argued in public and to congressional overseers that the program was vital to the task of finding and disrupting terrorism plots against the U.S.

The latest view is rooted in a growing belief among senior intelligence officials that the spying program provides limited value to national security and has become a logistical headache. Frustrations about legal-compliance issues forced the NSA to halt use of the program earlier this year, the people said. Its legal authority will expire in December unless Congress reauthorizes it. It is up to the White House, not the NSA, to decide whether to push for legislation to renew the phone-records program. The White House hasn't yet reached a policy decision about the surveillance program, according to the people familiar with the matter.

An anonymous reader quotes a report from the BBC: The team at the University of California, San Francisco says the technology is "exhilarating." They add that their findings, published in the journal Nature, could help people when disease robs them of their ability to talk. The mind-reading technology works in two stages. First an electrode is implanted in the brain to pick up the electrical signals that maneuver the lips, tongue, voice box and jaw. Then powerful computing is used to simulate how the movements in the mouth and throat would form different sounds. This results in synthesized speech coming out of a "virtual vocal tract." "The system is better with prolonged sounds like the 'sh' in ship than with abrupt sounds such as the 'buh' sound in 'books,'" the report adds. "In experiments with five people, who read hundreds of sentences, listeners were able to discern what was being spoken up to 70% of the time when they were given a list of words to choose from."

SonicSpike shares a report from Reason: The Department of Justice has been dismissing child pornography cases in order to not reveal information about the software programs used as the basis for the charges. An array of cases suggest serious problems with the tech tools used by federal authorities. But the private entities who developed these tools won't submit them for independent inspection or hand over hardly any information about how they work, their error rates, or other critical information. As a result, potentially innocent people are being smeared as pedophiles and prosecuted as child porn collectors, while potentially guilty people are going free so these companies can protect "trade secrets." The situation suggests some of the many problems that can arise around public-private partnerships in catching criminals and the secretive digital surveillance software that it entails (software that's being employed for far more than catching child predators).

With the child pornography cases, "the defendants are hardly the most sympathetic," notes Tim Cushing at Techdirt. Yet that's all the more reason why the government's antics here are disturbing. Either the feds initially brought bad cases against people whom they just didn't think would fight back, or they're willing to let bad behavior go rather than face some public scrutiny. An extensive investigation by ProPublica "found more than a dozen cases since 2011 that were dismissed either because of challenges to the software's findings, or the refusal by the government or the maker to share the computer programs with defense attorneys, or both," writes Jack Gillum. Many more cases raised issues with the software as a defense. "Defense attorneys have long complained that the government's secrecy claims may hamstring suspects seeking to prove that the software wrongly identified them," notes Gillum. "But the growing success of their counterattack is also raising concerns that, by questioning the software used by investigators, some who trade in child pornography can avoid punishment."

Apple allegedly wanted to hurt Qualcomm before it ever filed suit against the company, according to documents obtained by Qualcomm as the two companies prepared to meet in court. CNET reports on what has been made public: In September 2014, a document from Apple titled "QCOM - Future scenarios" detailed ways the company could exert pressure on Qualcomm, including by working with Intel on 4G modems for the iPhone. Apple and its manufacturing partners didn't actually file suit against Qualcomm until more than two years later. A second page of that document, titled "QCM - Options and recommendations (2/2)" revealed that Apple considered it "beneficial to wait to provoke a patent fight until after the end of 2016," when its contracts with Qualcomm would expire. "They were plotting it for two years," Qualcomm attorney Evan Chesler, of the firm Cravath, Swaine & Moore, said during his opening arguments last week. "It was all planned in advance. Every bit of it."

The unknown Apple team behind the September 2014 document recommended applying "commercial pressure against Qualcomm" by switching to Intel modems in iPhones. Apple ultimately started using Intel modems in about half of its iPhones with devices that came out in 2016. In the US, it embedded Intel modems in AT&T and T-Mobile models of the iPhone 7 and 7 Plus, but it still used Qualcomm in versions for Verizon and Sprint. Qualcomm, for its part, knew by June 2014 about Apple's plans to use Intel chips in 2016, according to an internal email from its president, Cristiano Amon, that was displayed during opening arguments. "Decision already has been made and beyond the point of no return on the 2nd source (Intel) for the 2016 premium tier," Amon wrote to CEO Steve Mollenkopf, CTO Jim Thompson, General Counsel Don Rosenberg and then-licensing chief Derek Aberle.

Apple "said that as a result of our policies, other chip companies can't compete with us," Chesler said during his opening arguments. "Where did Intel get the chips from? From god? They made them using our technology." Another Apple internal document from June 2016 said the company wanted to "create leverage by building pressure three ways," according to a slide shown in court. The internal document said, in part, that Apple wanted to "hurt Qualcomm financially" and "put Qualcomm's business model at risk."

Ford is investing $500 million in electric pickup truck maker Rivian, saying the two companies will work together to develop a new battery plug-in vehicle for Ford. CNN reports: Company executives said Ford will still move ahead with its own electric vehicle development efforts, including a plug-in version of the Ford F-150 pickup. They said the vehicle it will develop with Rivian will be an addition to its future lineup. Ford has announced plans to spend $11 billion transforming the company in coming years, including a move toward electric and self-driving vehicles. It said Wednesday that this $500 million investment is in addition to that $11 billion effort. It also said the joint effort with Rivian is in addition to Ford's plans to work with Volkswagen to develop a number of vehicles, including electric ones.

Rivian has yet to start production of its electric trucks. Its first vehicle, a high-end electric pickup truck with planned range of more than 400 miles on a single charge, will be available in late 2020, the company says. Rivian has nevertheless attracted significant investment from many deep-pocket investors, including a $700 million investement from Amazon announced in February.

An anonymous reader quotes a report from Bloomberg: An Amazon team auditing Alexa users' commands has access to location data and can, in some cases, easily find a customer's home address, according to five employees familiar with the program. The team, spread across three continents, transcribes, annotates and analyzes a portion of the voice recordings picked up by Alexa. The program, whose existence Bloomberg revealed earlier this month, was set up to help Amazon's digital voice assistant get better at understanding and responding to commands.

Team members with access to Alexa users' geographic coordinates can easily type them into third-party mapping software and find home residences, according to the employees, who signed nondisclosure agreements barring them from speaking publicly about the program. While there's no indication Amazon employees with access to the data have attempted to track down individual users, two members of the Alexa team expressed concern to Bloomberg that Amazon was granting unnecessarily broad access to customer data that would make it easy to identify a device's owner. When Bloomberg first reported on the Alexa auditing program, Amazon said "employees do not have direct access to information that can identify the person or account as part of this workflow."

In a new statement responding to this story, Amazon said "access to internal tools is highly controlled, and is only granted to a limited number of employees who require these tools to train and improve the service by processing an extremely small sample of interactions. Our policies strictly prohibit employee access to or use of customer data for any other reason, and we have a zero tolerance policy for abuse of our systems. We regularly audit employee access to internal tools and limit access whenever and wherever possible."

Databricks, the company founded by the original developers of the Apache Spark big data analytics engine, today announced that it has open-sourced Delta Lake, a storage layer that makes it easier to ensure data integrity as new data flows into an enterprise's data lake by bringing ACID transactions to these vast data repositories. TechCrunch reports: Delta Lake, which has long been a proprietary part of Databrick's offering, is already in production use by companies like Viacom, Edmunds, Riot Games and McGraw Hill. The tool provides the ability to enforce specific schemas (which can be changed as necessary), to create snapshots and to ingest streaming data or backfill the lake as a batch job. Delta Lake also uses the Spark engine to handle the metadata of the data lake (which by itself is often a big data problem). Over time, Databricks also plans to add an audit trail, among other things.

What's important to note here is that Delta lake runs on top of existing data lakes and is compatible with the Apache spark APIs. The company is still looking at how the project will be governed in the future. "We are still exploring different models of open source project governance, but the GitHub model is well understood and presents a good trade-off between the ability to accept contributions and governance overhead," said Ali Ghodsi, co-founder and CEO at Databricks. "One thing we know for sure is we want to foster a vibrant community, as we see this as a critical piece of technology for increasing data reliability on data lakes. This is why we chose to go with a permissive open source license model: Apache License v2, same license that Apache Spark uses." To invite this community, Databricks plans to take outside contributions, just like the Spark project.

Devices using Qualcomm chipsets, and especially smartphones and tablets, are vulnerable to a new security bug that can let attackers retrieve private data and encryption keys that are stored in a secure area of the chipset known as the Qualcomm Secure Execution Environment (QSEE). From a report: Qualcomm has deployed patches for this bug (CVE-2018-11976) earlier this month; however, knowing the sad state of Android OS updates, this will most likely leave many smartphones and tablets vulnerable for years to come. The vulnerability impacts how the Qualcomm chips (used in hundreds of millions of Android devices) handles data processed inside the QSEE.

Mozilla this week released the 2019 Internet Health Report, an analysis that brings together insights from 200 experts to examine issues central to the future of the internet. From a report: This year's report chose to focus primarily on injustice perpetuated by artificial intelligence; what NYU's Natasha Dow Schull calls "addiction by design" tech, like social media apps and smartphones; and the power of city governments and civil society "to make the internet healthier worldwide." The Internet Health Report is not designed to issue the web a bill of health, rather it is intended as a call to action that urges people to "embrace the notion that we as humans can change how we make money, govern societies, and interact with one another online."

[...] The modern AI agenda, the report's authors assert, is shaped in part by large tech companies and China and the United States. The report calls particular attention to Microsoft and Amazon's sale of facial recognition software to immigration and law enforcement agencies. The authors point to the work of Joy Buolamwini, whom Fortune recently named "the conscience of the AI revolution." Through audits published by Buolamwini and others in the past year, facial recognition software technology from Microsoft, Amazon's AWS, and other tech companies was found to be less capable of recognizing people with dark skin, particularly women of color.