An anonymous reader quotes a report from Motherboard: Using two-factor authentication, a security mechanism that requires a second step to login into an account other than the password, is widely considered an essential measure to protect yourself online. Yet, only a small percentage of people use this feature, mostly because it can be burdensome and it's rarely required by default, leaving users with the responsibility to turn it on. Now, Facebook may have given people yet another reason not to bother. Last week, Emojipedia founder Jeremy Burge warned in a viral Twitter thread that anyone could look him up on Facebook using his phone number, which he provided to the social network in order to enable two-factor authentication. What's worse, it looks like there's no way to completely remove your phone number that Facebook has collected. If you check your privacy settings, under "Who can look you up using the phone number you provided?" there are only three options: Everyone, Friends of friends, and Friends. "Everyone" is the default.

Even if you remove your phone number from the two-factor authentication settings page, nothing changes in the privacy settings, indicating Facebook still has your phone number. This screw-up, intentional or not, could discourage adoption of two-factor authentication, leaving people at risk of getting hacked. Facebook's decision to use phone numbers that were given to it for a specific security purpose for reasons other than security are a betrayal, and is training people more broadly that turning over more personal information to an internet company for security features could backfire. "Phone number is such a private, important security link," Zeynep Tufecki, a professor at the University of North Carolina, Chapel Hill, who has worked with dissidents and human rights activists, wrote on Twitter. "But Facebook will even let you be targeted for ads through phone numbers INCLUDING THOSE PROVIDED *ONLY* FOR SECOND FACTOR AUTHENTICATION. Messing with 2FA is the anti-vaccination misinformation of security."

An anonymous reader shares a report: The story we're used to hearing is that women get paid less than men. In Google's case, according to its own internal pay audit, it turned out male-identified Level 4 Software Engineers received less money than women in that same role. That led to Google paying $9.7 million to adjust pay for 10,677 employees. It's not clear how many of the employees who received pay adjustments were men but Google does cite the underpaying of men as a reason for why the company paid more in adjustments for 2018 than in 2017. But The New York Times reports men received a disproportionately higher percentage of the money.

Over the weekend, a disturbed Android TV owner took to Twitter when he realized, through the Google Home app, he could access a massive list of random accounts, as well as photos they'd added to their Google Photos albums. From a report: If someone were to click on "linked accounts" while setting your Google Photos screensaver, the Google Home bug apparently showed a giant, scrolling list of users. From there, the bug allowed limited access to users' personal images in Google Photos, which could then be displayed as Ambient Mode screensavers. That is, someone could have theoretically displayed your photos as screensavers on their Android TV without you knowing it. The user who discovered this bug theorized that the list of accounts were other users with the same TV model, but that hasn't been confirmed yet. There's no answer yet on where this bug came from, but Google is working on a fix and has disabled Google Photos screensavers in the meantime.

Google is still pursuing its plan to launch a censored search engine for China, The Intercept reported Monday, citing unnamed employees. From the report: Late last year, bosses moved engineers away from working on the controversial project, known as Dragonfly, and said that there were no current plans to launch it. However, a group of employees at the company was unsatisfied with the lack of information from leadership on the issue -- and took matters into their own hands. The group has identified ongoing work on a batch of code that is associated with the China search engine, according to three Google sources. [...] The employees have been keeping tabs on repositories of code that are stored on Google's computers, which they say is linked to Dragonfly. The code was created for two smartphone search apps -- named Maotai and Longfei -- that Google planned to roll out in China for users of Android and iOS mobile devices.

Microsoft is working on a new lightweight version of Windows to power dual-screen devices and Chromebook competitors, according to a new report. The Verge: Sources familiar with Microsoft's plans tell The Verge that the software maker is stripping back its Windows user interface with dual screens in mind. This new hardware could launch as early as later this year, depending on chip and PC maker readiness. "Windows Lite," as it's codenamed internally, is a more stripped-down version of Windows that is initially being prioritized for dual-screen devices. Intel has been pushing OEMs to create this new hardware category, and machines could appear much like Microsoft's Courier concept, dual-screen laptops, or even foldable displays in the future. Either way, Microsoft wants Windows to be ready for PC makers to take advantage of it.

Thousands of people could soon be receiving letters threatening to cut off vital housing benefits as they face being incorrectly targeted by a new automated fraud detector. From a report: The government-backed London Counter Fraud Hub, developed by BAE, has been hailed a success after being trialled in four boroughs - Camden, Ealing, Croydon and Islington. Using vast quantities of data from millions of households, it is designed to target potential fraud cases involving the single person council tax discount, subletting in local authority housing and business rate relief and rating.

Ealing, the lead council for the project, found the automated elements of the system targeting single person discount fraud was 80% effective -- which is seen as an acceptable benchmark. With just over one million claimants of council tax single person discount in London, the London Counter Fraud Hub estimates it will detect around 40,000 fraudulent cases in the first year. Critics say the 20% error rate is unacceptable as around 8,000 people will receive letters wrongly accusing them of fraud.

Hundreds of millions of private chat logs from Chinese users have been left exposed on the internet, a researcher has found, in another worrying case of weak data protection in China. Financial Times reports: Victor Gevers, a security researcher at the cyber-security organisation GDI Foundation, said that he had found a database of 364m records [Editor's note: the link may be paywalled; alternative source.], containing social media profiles and chat logs linked to names and identity card numbers.

The database was freely accessible online to anyone who searched for its IP address, and user profiles were stored together with photographs, addresses and locations, said Mr Gevers. The main database was piping data to 17 other servers depending on which area the data came from, Mr Gevers said. [...] A large number of the records had the names and addresses of web cafes on them. Chinese cyber-security experts have long warned that web cafes collect vast amounts of customer data.

At a Taipei event earlier today, Intel revealed that USB 4 will once again utilize dual channels to achieve 40Gbps speeds, even on existing 40Gbps-certified USB-C cables. A report adds: Better yet, thanks to Intel finally offering Thunderbolt 3 to manufacturers with open licensing, USB 4 will be integrating this tech and thus effectively becoming the "new" Thunderbolt 3. In other words, USB 4 will pretty much be the mother of all wired connectivity options, and will be ready for more powerful PCIe plus DisplayPort devices. It is expected to take 18 months between the final spec of USB 4 being published in the second half of this year, and the first devices hitting the market, so don't expect to see USB 4-powered commercial devices until sometime in 2021.
Further reading, from last week: USB-IF Confusingly Merges USB 3.0 and USB 3.1 Under New USB 3.2 Branding.

The World Wide Web Consortium (W3C) today declared that the Web Authentication API (WebAuthn) is now an official web standard. From a report: First announced by the W3C and the FIDO Alliance in February 2016, WebAuthn is now an open standard for password-free logins on the web. It is supported by W3C contributors, including Airbnb, Alibaba, Apple, Google, IBM, Intel, Microsoft, Mozilla, PayPal, SoftBank, Tencent, and Yubico. The specification lets users log into online accounts using biometrics, mobile devices, and/or FIDO security keys. WebAuthn is supported by Android and Windows 10. On the browser side, Google Chrome, Mozilla Firefox, and Microsoft Edge all added support last year. Apple has supported WebAuthn in preview versions of Safari since December.

An anonymous reader writes: Linus Torvalds has released Linux 5.0 in kicking off the kernel's 28th year of development. Linux 5.0 features include AMD FreeSync support, open-source NVIDIA Turing GPU support, Intel Icelake graphics, Intel VT-d scalable mode, NXP PowerPC processors are now mitigated for Spectre Variant Two, and countless other additions. eWeek adds: Among the new features that have landed in Linux 5.0 is support for the Adiantum encryption system, developed by Google for low power devices. Google's Android mobile operating system and ChromeOS desktop operating system both rely on the Linux kernel. "Storage encryption protects your data if your phone falls into someone else's hands," Paul Crowley and Eric Biggers, Android Security and Privacy Team at Google wrote in a blog post. "Adiantum is an innovation in cryptography designed to make storage encryption more efficient for devices without cryptographic acceleration, to ensure that all devices can be encrypted. Memory management in Linux also gets a boost in the 5.0 kernel with a series of improvements designed to help prevent memory fragmentation, which can reduce performance.

"For anyone who thought that there was too much Tesla news this weekend, I've got some bad news for you," writes long-time Slashdot reader Rei, sharing new information gleaned from a series of tweets.

"Elon Musk just announced the unveiling of the Model Y SUV on March 14th at Tesla's LA Design Studio." A surprising number of details were revealed, including non-falcon doors, a similar appearance to the Model 3, and pricing about 10% more than a Model 3, with slightly lower range, due to the increased mass and cross section.

The unveiling will not include the Tesla pickup truck; that will be later this year. Model Y is to share 75% of its hardware with Model 3 to simplify the development process, with volume production targeted for late 2020, and initial production in early 2020. Musk also stated: "First public Tesla V3.0 Supercharger Station goes live Wed 8pm" (V3 is the much awaited new generation of higher power, cheaper to operate Superchargers).
"Personally, I'm most excited by the Tesla Truck," Musk posted on Twitter. "Maybe it will be too futuristic for most people, but I love it."

Help Net Security shared an interesting statistic from the 2019 Webroot Threat Report. 40 percent of malicious URLs were found on good domains. Legitimate websites are frequently compromised to host malicious content.

To protect users, cybersecurity solutions need URL-level visibility or, when unavailable, domain-level metrics, that accurately represent the dangers.
The report also found that while Google was the single most impersonated brand in phishing, 77% of all phishing attacks impersonated financial institutions. (The good news? After 12 months of security awareness training, end users were 70% less likely to fall for phishing attacks.)

And Windows 10 devices were "at least twice as secure as those running Windows 7. Webroot has seen a relatively steady decline in malware on Windows 10 machines for both consumer and business."

"Facebook threatened to pull investment projects from Europe and Canada if lobbying demands from COO Sheryl Sandberg were not met," reports Business Insider, adding "Canada buckled immediately."

And that's just the beginning. The Observer reports: Facebook has targeted politicians around the world -- including the former UK chancellor, George Osborne -- promising investments and incentives while seeking to pressure them into lobbying on Facebook's behalf against data privacy legislation, an explosive new leak of internal Facebook documents has revealed. The documents, which have been seen by the Observer and Computer Weekly, reveal a secretive global lobbying operation targeting hundreds of legislators and regulators in an attempt to procure influence across the world, including in the UK, US, Canada, India, Vietnam, Argentina, Brazil, Malaysia and all 28 states of the EU...

The documents appear to emanate from a court case against Facebook by the app developer Six4Three in California, and reveal that Sandberg considered European data protection legislation a "critical" threat to the company. A memo written after the Davos economic summit in 2013 quotes Sandberg describing the "uphill battle" the company faced in Europe on the "data and privacy front" and its "critical" efforts to head off "overly prescriptive new laws...." John Naughton, a Cambridge academic and Observer writer who studies the democratic implications of digital technology, said the leak was "explosive" in the way it revealed the "vassalage" of the Irish state to the big tech companies. Ireland had welcomed the companies, he noted, but became "caught between a rock and a hard place... Its leading politicians apparently saw themselves as covert lobbyists for a data monster."

A spokesperson for Facebook said the documents were still under seal in a Californian court and it could not respond to them in any detail: "Like the other documents that were cherrypicked and released in violation of a court order last year, these by design tell one side of a story and omit important context."

Tesla's now taking orders for Model 3's with a "full self-driving capability" -- meaning "automatic driving on city streets." CNN reports that experts on self-driving technology "say CEO Elon Musk is playing fast and loose with definitions, overselling the technology and potentially creating safety issues." Experts say Tesla's "full self-driving" feature is really a partial self-driving feature that handles minor driving tasks such as keeping pace with other cars on a highway and still requires diligent human oversight. To most autonomous vehicle experts, "full self-driving" means a car in which a person could safely fall asleep behind the wheel, and the steering wheel and pedals aren't even needed...

Dean Pomerleau, of Carnegie Mellon University, who in 1995 drove a minivan that steered itself across the country, told CNN Business he has "grave concerns" about Tesla's practices on autonomous driving. "Claiming its vehicles will soon be 'feature complete' for full self-driving is one more step in the unconscionable practices that Tesla is already engaged in with Autopilot -- overselling its capabilities and reliability when marketing its vehicles and then blaming the driver for not reading the manual and paying constant attention when the technology inevitably fails," Pomerleau said.
CNN notes a 2018 study which found that 71% of drivers believe they could already purchase a self-driving car today -- despite the fact that currently there are no such fully-autonomous vehicles. "Experts warn that this lack of understanding could be deadly as humans may put too much trust in systems like Tesla's, leading to crashes...."

"A Tesla spokeswoman declined to comment on details around the automatic driving option, and pointed CNN Business to fine print on Tesla's order page that tells buyers the currently enabled features require 'active' driver supervision and do not make the vehicle autonomous."

On Thursday, Google began officially selling their new .dev domains to anyone, Engadget reports: To claim a .dev, all you need to do is sign up with your registrar of choice (Google, naturally, is an option). As a bonus, Google is offering a free .dev domain to anyone who applied for a ticket to the Google I/O event happening this May.

The domains will be secure by default, as they all require HTTPS, and Google has already moved many of its own sites (including web.dev, opensource.dev and flutter.dev) to the domain.
"The internet has come a long way from the days of .com, .org and .net," writes Engadget. "Now, you can get domains ending in anything from .cool to .ninja."

UPDATE (3/3/2019): Apparently the domain emacs.dev now points to the web site for Vim.

Remember when dozens of Americans said their names were used for fake comments sent to America's FCC opposing net neutrality?

Now Gizmodo's taken a hard look at their past interviews with Dan Germain, the CTO of a company that helps lobbyists construct digital "grassroots" campaigns -- and at the conservative nonprofit Center for Individual Freedom (CFIF). Attempting to confirm or disprove the alleged link between CQ and CFIF, Gizmodo initiated its own review of the API data logs last week, focusing on comments from dozens of people who claim they were impersonated online.... [T]imestamps contained in the API logs reveal an unmistakable correlation between the use of CQ's API key and numerous identical comments containing CFIF's text... By comparing the API logs to comment data that the FCC had already made publicly available, Gizmodo found more than a dozen comments containing CFIF's boilerplate language... In each successful case, the comments were received by the FCC while CQ's API key was in use, with the logs reflecting deviations in the timestamps roughly equivalent to the blink of an eye...

Prior to CQ becoming a subject of interest in an ongoing criminal investigation, Germain explained at length that his company had created a platform specifically to direct comments to the FCC and that it had been operational since at least 2016.... Whereas many of the groups responsible for uploading millions of comments requested only one or two API keys, logs show that CQ, over a period of several months, requested no fewer than 114.
The article notes that identical comments using language from CFIF "are now suspected of having been uploaded using CQ's software" -- and that they were submitted to the FCC "several hundred thousand times."

An anonymous reader quotes a report from Bloomberg: Facebook and its Instagram unit sued four companies and three people based in China for promoting the sale of fake accounts, likes and followers that the social network giant says can be used for nefarious purposes. The Chinese companies advertised and created the fake accounts over the last two years and marketed them for sale on six websites, selling them in bulk quantities, according to a complaint filed Friday in San Francisco federal court. "Fake and inauthentic accounts can be used for spam and phishing campaigns, misinformation campaigns, marketing scams, advertising fraud, and other fraud schemes which are profitable at scale," Facebook and Instagram alleged. They said fake accounts were also created on Amazon, Apple, Google, LinkedIn and Twitter. The companies named as defendants -- 9 Xiu Shenzhen, 9 Xiu Feishu, 9 Xiufei and Home Network -- are based in Longyan and Shenzhen. They are affiliated manufacturers of electronics and hardware, as well as providers of software and online advertising services, according to the complaint.

the_newsbeagle writes: In newborn intensive care units (NICUs) today, tiny fragile babies lie in incubators, wired to a variety of monitors that track their vital signs. This mess of wires makes it complicated for nurses to pick up the babies for routine tasks like diaper changes, and makes it hard for new parents to pick up their infants for cuddling. Skin-to-skin contact between parents and infants has been proven not only to help with bonding, but also to have a host of medical benefits for the infants, so the wires that tether babies to their beds are a real problem. At Northwestern University, an electrical engineer who works on flexible, stretchable electronics teamed up with a pediatric dermatologist to invent a solution. They devised a system of stick-on wireless biosensors (with a gentle adhesive that's safe even for thin preemie skin) that actually provide more information than today's standard setup. The system "is composed of two sensors, one that sticks to the chest to record electrocardiograms (providing heart rate), another that sticks to the foot to record photoplethysmograms (measuring blood oxygenation) and skin temperature," reports IEEE Spectrum. "The foot sensor required the engineering team to create software that could compensate for movement artifacts in the data. Time-syncing these two sensors also provides a continuous measurement of blood pressure; the system knows when the heart pumps out a pulse of blood and when it arrives at the foot, and that time measurement correlates well with blood pressure."

"The sensors use near-field communication (NFC) to connect to a module that can be attached to the baby's bed, and which both receives the data and sends wireless power to the sensors," the report adds. "That module transmits the data via bluetooth to a mobile phone or tablet."

An anonymous reader quotes a report from ZDNet: This week, the Russian government has published a document outlining new rules that limit foreign communications satellite operators inside the country. The Russian government will require all foreign communications satellite companies to pass all incoming traffic through a ground gateway station. This means satellite operators won't be able to beam communications directly to customers without going through a ground station first. The Russian government cited an espionage threat of allowing foreign satellite companies to transmit data directly within the country's border, but critics of the Kremlin regime say the new requirement will enable Russian government agencies to intercept any incoming traffic. The new rules, set to enter into effect in six months, will also force all foreign communications satellite companies to obtain a permit from Russian authorities even before operating in the country. The Russian Defense Ministry, the Federal Security Service (FSB), and Federal Protective Service (FSO) will be in charge of reviewing applicants.

Facebook, Twitter, and Google still aren't doing enough to battle disinformation on their platforms, European Union officials said in a statement released this week. "As part of a plan to fight disinformation on social media, the companies signed on to a voluntary proposal to crack down on the problem last year, which included making plans to increase transparency and fight fake accounts," reports The Verge. "The European Commission is now publicizing monthly progress reports on the topic, and has released the first, covering January." From the report: In the statement, the officials criticized the companies' responses, saying "we need to see more progress." "Platforms have not provided enough details showing that new policies and tools are being deployed in a timely manner and with sufficient resources across all EU Member States," the statement said. "The reports provide too little information on the actual results of the measures already taken."

Facebook, Twitter, and Google were each singled out for not providing enough information in their reports to officials, who said in today's statement that they remain "concerned by the situation." The statement pressed the platforms to move faster ahead of European Parliament elections in May. In an accompanying op-ed in The Guardian this week, EU commissioners said, "if we do not see sufficient long-term progress, we reserve the right to reconsider our policy options -- including possible regulation."