An anonymous reader quotes a report from CBC.ca: You may not give a second thought to the tunes spinning on a constant loop at your favorite cafe or coffee shop, but one writer and podcaster who had to listen to repetitive music for years while working in bars and restaurants argues it's a serious workers' rights issue. "[It's] the same system that's used to [...] flood people out of, you know, the Branch Davidian in Waco or was used on terror suspects in Guantanamo -- they use the repetition of music," Adam Johnson told The Current's Anna Maria Tremonti. "I'm not suggesting that working at Applebee's is the same as being at Guantanamo, but the principle's the same."

Earlier this year, irritated Starbucks employees took to Reddit to rage about how they had to listen to the same songs from the Broadway hit musical Hamilton on repeat while on the job. One user wrote that if they heard a Hamilton song one more time, "I'm getting a ladder and ripping out all of our speakers from the ceiling." As a solution, he suggested health inspectors could enforce better working conditions, or a tip line could be created for people to report poor working conditions, like repetitive music. Another solution? Communication, says neuroscientist Jessica Grahn. She studies music, which science has shown to be one of the strongest influencers of mood, she said. It can calm dementia patients struggling with depression or anger, or increase our endurance when we're working out. However, there are downsides to the power of music. Unlike how we can close our eyes to things we don't want to see, we can't close our ears to sound. Having control over one's environment can make a big difference, said Grahn, which is why she recommends employers and employees talk about why certain music is being played, or what they can do to switch things up.

The Securities and Exchange Commission has asked a federal judge to hold CEO Elon Musk in contempt for breaking terms of a settlement agreement with a tweet. The SEC cited an "inaccurate" February 19 tweet about production. Musk tweeted alongside a photo: "4000 Tesla cars loading in SF for Europe." He replied to the tweet adding: "Tesla made 0 cars in 2011, but will make around 500k in 2019." Fast Company reports: It's that "will make around 500K in 2019" part that angered the SEC, which had this to say in legal papers filed with a Manhattan federal court: "He once again published inaccurate and material information about Tesla to his over 24 million Twitter followers, including members of the press, and made this inaccurate information available to anyone with Internet access." The SEC says the tweet violated an agreement that was part of a settlement Tesla made with the regulator last year. Musk promised to consult with Tesla's board before he made any statements on social media that could affect the stock price of the company. Tesla also agreed to pay $40 million in penalties and Musk agreed to step down as chairman of the board.

schwit1 shares a report from Ars Technica: In September of 2018, an anonymous independent security researcher (who we'll call X) noticed that their power company's website was offering to email -- not reset! -- lost account passwords to forgetful users. Startled, X fed the online form the utility account number and the last four phone number digits it was asking for. Sure enough, a few minutes later the account password, in plain text, was sitting in X's inbox. This was frustrating and insecure, and it shouldn't have happened at all in 2018. But this turned out to be a flaw common to websites designed by the Atlanta firm SEDC. After finding SEDC's copyright notices in the footer of the local utility company's website, X began looking for more customer-facing sites designed by SEDC. X found and confirmed SEDC's footer -- and the same offer to email plain-text passwords -- in more than 80 utility company websites. Those companies service 15 million or so clients (estimated from GIS data and in some cases from PR brags on the utility sites themselves). But the real number of affected Americans could easily be several times that large: SEDC itself claims that more than 250 utility companies use its software.

Microsoft CEO Satya Nadella is defending the company's $479 million contract with the Pentagon to supply augmented reality headsets to the U.S. military. "We made a principled decision that we're not going to withhold technology from institutions that we have elected in democracies to protect the freedoms we enjoy," he told CNN Business at Mobile World Congress. "We were very transparent about that decision and we'll continue to have that dialogue [with employees]," he added during the exclusive interview. From the report: Microsoft was awarded the contract to supply "Integrated Visual Augmentation System" prototypes to the U.S. military in November. The company could eventually deliver over 100,000 headsets under the contract. Microsoft's HoloLens augmented reality technology allows users to see the world around them, but with virtual graphics overlaid. The Israeli military, which has taken delivery of some HoloLens headsets, says the technology can be used to help commanders visualize the battlefield and field medics to consult doctors. According to procurement documents, the U.S. military is seeking a single platform that provides its forces with "increased lethality, mobility and situational awareness" in combat. Microsoft employees have recently circulated a letter addressed to Nadella and Brad Smith, the company's president and chief legal officer, arguing that the company should not supply its HoloLens technology to the U.S. military. "It's not about taking arbitrary action by a single company, it's not about 50 people or 100 people or even 100,000 people in a company," he said. "It's really about being a responsible corporate citizen in a democracy."

The CEO of Vodafone, the world's second-largest mobile operator, warned excluding Huawei from Europe's 5G networks could be "hugely disruptive" to national infrastructure and consumers. CEO Nick Read said that it would be "very very expensive" for operators and consumers if companies were forced to swap their Huawei equipment in favor of competitors', adding it would delay Europe's 5G rollout by "probably two years." CNBC reports: Speaking at a press conference at Mobile World Congress in Barcelona Monday, Vodafone CEO Nick Read said banning Huawei from providing 5G infrastructure in Europe would hamper competition in the supply chain. China's Huawei, Finland's Nokia and Sweden's Ericsson are the three biggest providers of telecommunications equipment in the world, accounting for more than half of revenues in the market, according to research firm Dell'Oro Group. "If we concentrate it down to two players I think that's an unhealthy position not just for us as an industry but also for national infrastructure in the country," Read said.

"It structurally disadvantages Europe," he said "Of course the U.S. don't have that problem because they don't put Huawei equipment in." Vodafone's Read said governments need to take a "fact-based" approach to assessing security concerns with Huawei, adding he will not be meeting with any U.S. officials in Barcelona this week. "I would at this stage prefer to be working with governments and securities on a national basis and making sure we have a fact-based conversation," he said. Vodafone's Read said there is "high competition" among the three equipment providers but added Huawei has had "leading technology." In a roundtable with media on Sunday in Barcelona, Huawei's rotating chairman Guo Ping claimed the company is 12 months ahead of its competitors when it comes to 5G technology. Huawei has been left out of the U.S. market with officials citing security concerns that its technology could enable spying from the Chinese government, accusations Huawei denies. The U.S., the UK and Germany are weighing possible bans on Huawei's 5G equipment citing security risks.

An anonymous reader quotes a report from ZDNet: A team of academics from the Ruhr-University Bochum in Germany say they've managed to break the digital signing system and create fake signatures on 21 of 22 desktop PDF viewer apps and five out of seven online PDF digital signing services. This includes apps such as Adobe Acrobat Reader, Foxit Reader, and LibreOffice, and online services like DocuSign and Evotrust --just to name the most recognizable names. The five-person research team has been working since early October 2018 together with experts from Germany's Computer Emergency Response Team (BSI-CERT) to notify impacted services. The team went public with their findings over the weekend after all affected app makers and commercial companies finished patching their products. In research published today, the Ruhr-University Bochum team described three vulnerabilities that they found in the digital signing process used by several desktop and web-based PDF signing services. Summarized, they are:

1. Universal Signature Forgery (USF) -- vulnerability lets attackers trick the signature verification process into showing users a fake panel/message that the signature is valid.
2. Incremental Saving Attack (ISA) -- vulnerability lets attackers add extra content to an already signed PDF document via the "incremental saving (incremental update)" mechanism, but without breaking the already-existing signature.
3. Signature Wrapping (SWA) -- vulnerability is similar to ISA, but the malicious code also contains extra logic to fool the signature validation process into "wrapping" around the attacker's extra content, effectively digitally signing the incremental update. Additional details about the three vulnerabilities are available in this PDF research paper [1, 2], this blog post, and this dedicated website.

A new privacy survey from IBM's Institute for Business Value found that 81% of consumers say they've become more concerned about how companies use their data, while 87% think companies should be more heavily regulated on personal data management. Three-quarters of the people felt like they were less likely to trust companies with data and 89% said companies should be clearer about how their products use data. Given these findings, you'd think people would take actions in response to companies losing or misusing their data -- but they're not. Fortune reports: 71% said that they were willing to give up privacy to get access to what technology can offer. Only 45% have updated their privacy settings on products in response and 16% walked away from a company because of data misuse. It's already been clear that one reasons for big data leaks is because there is little financial risk to companies, as Motherboard reported. This new data suggests that companies have even less to worry about, as most people are willing to keep doing business with them.

bbsguru writes: Windstream Holdings Inc. of Arkansas filed for Chapter 11 bankruptcy on Monday, less than two weeks after a federal court judge found that the 2015 spinoff of its fiber and copper assets into a separate company ran afoul of bond covenants, exposing the company to a $310 million judgment. Windstream, a spinoff of the old Alltel Corp. of Arkansas, reported $5.8 billion in revenue in 2017. It employs about 13,000 companywide. CEO Tony Thomas said in a press release that the reorganization is "a necessary step to address the financial impact" of the judge's decision and "the impact it would have on consumers and businesses across the states in which we operate."

"Taking this proactive step will ensure that Windstream has access to the capital and resources we need to continue building on Windstream's strong operational momentum while we engage in constructive discussions with our creditors regarding the terms of a consensual plan of reorganization," Thomas said. "We acted decisively to secure the long-term financial stability of Windstream, and we are confident that, upon completion of the reorganization process, we will be even better positioned to invest in our business, expand our speed and capabilities for our customers and compete for the long term." A court approval of a reorganization plan will allow the company to continue paying its employees and maintain relationships with vendors, business partners and customers, Thomas said.

An anonymous reader quotes a report from TechCrunch: A group of academics have found three new security flaws in 4G and 5G, which they say can be used to intercept phone calls and track the locations of cell phone users. The findings are said to be the first time vulnerabilities have affected both 4G and the incoming 5G standard, which promises faster speeds and better security, particularly against law enforcement use of cell site simulators, known as "stingrays." But the researchers say that their new attacks can defeat newer protections that were believed to make it more difficult to snoop on phone users. [Rafiul Hussain, one of the co-authors of the paper, along with Ninghui Li and Elisa Bertino at Purdue University, and Mitziu Echeverria and Omar Chowdhury at the University of Iowa are set to reveal their findings at the Network and Distributed System Security Symposium in San Diego on Tuesday.

The paper, seen by TechCrunch prior to the talk, details the attacks: the first is Torpedo, which exploits a weakness in the paging protocol that carriers use to notify a phone before a call or text message comes through. The researchers found that several phone calls placed and cancelled in a short period can trigger a paging message without alerting the target device to an incoming call, which an attacker can use to track a victim's location. Knowing the victim's paging occasion also lets an attacker hijack the paging channel and inject or deny paging messages, by spoofing messages like Amber alerts or blocking messages altogether, the researchers say. Torpedo opens the door to two other attacks: Piercer, which the researchers say allows an attacker to determine an international mobile subscriber identity (IMSI) on the 4G network; and the aptly named IMSI-Cracking attack, which can brute force an IMSI number in both 4G and 5G networks, where IMSI numbers are encrypted. AT&T, Verizon, Sprint and T-Mobile are all affected by Torpedo, "and the attacks can be carried out with radio equipment costing as little as $200," the report adds. One U.S. network is reportedly vulnerable to the Piercer attack, but the researcher wouldn't name which one.

Sprint has shared some of its plans when it comes to 5G service in the U.S. The company announced at MWC in Barcelona that mobile customers in Atlanta, Chicago, Dallas and Kansas City can expect 5G service as soon as May 2019. From a report: If you don't live in one of those cities, maybe you live in Houston, Los Angeles, New York City, Phoenix or Washington D.C. Sprint also promises 5G coverage in those cities soon after the initial launch, at some point before the end of June 2019. Overall, Sprint expects to cover 1,000 square miles in nine cities by the end of the first half of 2019. It's going to take years to roll out 5G coverage across the U.S.

An anonymous reader shares a report: News subscription service Scroll, which is yet to launch to consumers but has received the backing of several top publishers, courted another major player today: Mozilla. The browser maker says it will work with Scroll to better understand how consumers react to ad-free experiences on the web and subscription-based funding models. As part of the deal, Mozilla said it would test features and product ideas provided by Scroll, which itself has been conducting internal tests with a number of outlets. Small groups of Firefox users will be invited at random to share feedback and also respond to surveys, Mozilla said.

A full 81% of consumers say that in the past year they've become more concerned with how companies are using their data, and 87% say they've come to believe companies that manage personal data should be more regulated, according to a survey out Monday by IBM's Institute for Business Value. From a report: They aren't totally convinced they should care about how their data is being used, and many aren't taking meaningful action after privacy breaches, according to the survey. Despite increasing data risks, 71% say it's worth sacrificing privacy given the benefits of technology. [...] Despite increasing awareness of privacy and security breaches, most consumers aren't taking consequential action to protect their personal data. Fewer than half (45%) report that they've updated privacy settings, and only 16% stopped doing business with an entity due to data misuse.

The UK's NHS has been told to stop using pagers for communications by 2021, in order to save money. The health service still uses about 130,000 pagers, which is about 10% of the total left in use globally. From a report: They cost the NHS about $8.6 million a year, because only one service provider supports them. Health Secretary Matt Hancock called them "outdated" and said he wanted to rid the NHS of "archaic technology like pagers and fax machines". However, many in the medical industry say that pagers are quick and reliable - especially in emergencies -- and proposed replacements have their own shortcomings.

The SD Association has unveiled microSD Express, a new format that will bring speeds of up to 985 MB/s to the tiny memory cards used in smartphones and other devices. From a report: Like SD Express, it exploits the NVMe 1.3 and PCIe 3.1 interfaces used in PCs to power high-speed SSDs. The tech is incorporated onto the second row of microSD pins, so the cards will work faster in next-gen devices while maintaining backward compatibility with current microSD tech. PCIe 3.1 allows for low power sub-states, so the cards will not only offer much (much) higher transfer speeds, but consume less power than regular microSD cards. It'll also open up features like bus mastering, which lets memory cards communicate with other components without going through the CPU first.

An anonymous reader shares a report: Email provider FastMail says it has lost customers and faces "regular" requests to shift its operations outside Australia following the passage of anti-encryption laws. The Victorian company, which offers ad-free email services to users in 150 countries, told a senate committee that the now-passed laws were starting to bite.

"The way in which [the laws] were introduced, debated, and ultimately passed ... creates a perception that Australia has changed - that we are no longer a country which respects the right to privacy," FastMail CEO Bron Gondwana said. "We have already seen an impact on our business caused by this perception. Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." "Still, we have seen existing customers leave, and potential customers go elsewhere, citing this bill as the reason for their choice. We are [also] regularly being asked by customers if we plan to move."

The FIDO Alliance -- a consortium that develops open source authentication standards -- has been pushing to expand its secure login protocols to make seamless logins a reality for several years. Today, it has hit the jackpot: Google. From a report: On Monday, Google and the FIDO Alliance announced that Android has added certified support for the FIDO2 standard, meaning that the vast majority of devices running Android 7 or later will now be able to handle password-less logins in mobile browsers like Chrome. Android already offered secure FIDO login options for mobile apps, where you authenticate using a phone's fingerprint scanner or with a hardware dongle like a YubiKey. But FIDO2 support will make it possible to use these easy authentication steps for web services in a mobile browser instead of laboriously typing in your password every time you want to log in. Web developers can now design their sites to interact with Android's FIDO2 management infrastructure.

The internet's address book keeper has warned of an "ongoing and significant risk" to key parts of the domain name system infrastructure, following months of increased attacks. From a report: The Internet Corporation for Assigned Names and Numbers, or ICANN, issued the notice late Friday, saying DNS, which converts numerical internet addresses to domain names, has been the victim of "multifaceted attacks utilizing different methodologies." It follows similar warnings from security companies and the federal government in the wake of attacks believe to be orchestrated by nation state hackers.

[...] ICANN's chief technology officer David Conrad told the AFP news agency that the hackers are "going after the Internet infrastructure itself." The internet organization's solution is calling on domain owners to deploy DNSSEC, a more secure version of DNS that's more difficult to manipulate. DNSSEC cryptographically signs data to make it more difficult -- though not impossible -- to spoof.

A federal judge has blocked Washington State's 2004 cyberstalking law after ruling that a key provision violated First Amendment protections for free speech due to vague terms. "Its prohibitions against speech meant to 'harass, intimidate, torment or embarrass' weren't clearly defined, according to the judge, and effectively criminalized a 'large range' of language guarded under the Constitution," reports Engadget. "You could theoretically face legal action just by criticizing a public figure." From the report: The ruling came after a retired Air Force Major, Richard Rynearson III, sued to have the law overturned. He claimed that Kitsap County threatened to prosecute him under the cyberstalking law for criticizing an activist involved with a memorial to Japanese victims of U.S. internment camps during World War II. While Rynearson would use "invective, ridicule, and harsh language," the judge said, his language was neither threatening nor obscene.

Officials had contended that the law held up because it targeted conduct, not the speech itself. They also maintained that Rynearson hadn't shown evidence of a serious threat -- just that the prosecutor's office would see how Rynearson behaved and take action if necessary. A county court had already tossed out the activist's restraining order against Rynearson over free speech. It's not clear whether Washington will appeal the decision. If the ruling stays, though, it could force legislators to significantly narrow the scope if it wants a cyberstalking law to remain in place. This might also set a precedent that could affect legislation elsewhere in the country. The Electronic Frontier Foundation praises the judge's decision, adding: "This is all valuable speech that is protected by the First Amendment, and no state law should be allowed to undermine these rights. We are pleased that the judge has agreed."

theodp writes: Facebook may be facing the threat of a multi-billion dollar FTC fine for privacy lapses that included allowing companies to obtain users' email addresses from their friends, but that didn't discourage Bill Gates from taking to Twitter to urge his 46.5 million followers to give up the names and email addresses of teachers so they can be contacted by tech-bankrolled Code.org for a chance to receive a "Computer Science Scholarship" (attend Professional Development workshops). Or Amazon. Or Google. "The success of our professional learning program depends on the work of our partners to spread the word," explained Code.org in a Medium Post. "Corporate partners like Amazon, Infosys, and Google are rallying their employees and communities to nominate a teacher, and so are fellow teachers, parents, and students. We couldn't do it without you! [...] Code.org (and these scholarships) are supported by: Amazon, Bill and Melinda Gates Foundation, Facebook, Google, Infosys Foundation USA, Microsoft [...] Code.org has prepared almost 100,000 educators to teach our courses, and they give our program rave reviews. We welcome teachers from all subject areas-no CS experience needed!"

In May, Code.org announced it was crowdsourcing a database of U.S. K-12 schools that teach -- or don't teach -- CS, with a goal to "gather data for 100% of U.S. schools by the end of 2018." The database would be used by the nonprofit and the CS community to "make our shared vision [for every school to teach computer science] a reality." Several months later, Amazon disclosed its involvement with the data collection effort, explaining it "will help us bring access to the schools that need it most." Amazon on Thursday announced it had selected 1,000 high schools to receive Amazon-funded CS classes and will be tapping another lucky 1,000 schools in the next few months. An Amazon press release said the company hopes to "inspire and educate 10 million children and young adults each year from underprivileged, underrepresented, and underserved communities to pursue careers in the fast-growing field of computer science and coding" through its Amazon Future Engineer program, which the e-tailer describes as "a four-part, childhood-to-career program."

LG's flagship G8 smartphone has been officially launched today, bringing many expected features that were teased over the past few months and several not-so-expected features. One such unusual feature in the G8 is its palm vein recognition, dubbed Hand ID, which LG claims is the first to offer this capability. TechCrunch reports: From the company's press materials, "LG's Hand ID identifies owners by recognizing the shape, thickness and other individual characteristics of the veins in the palms of their hands." It turns out, like faces and fingerprints, everyone's got a unique set of hand veins, so once registered, you can just however your hot blue blood tubes over the handset to quickly unlock in a few seconds. The Z camera also does depth-sensing face unlock that's a lot harder to spoof than the kind found on other Android handsets. LG's also put the tech to use for a set of Air Motion gestures, which allow for hands-free interaction with various apps like the camera (selfies) and music (volume control). Other features of the G8 include a 6.1-inch QHD+ "Crystal Sound OLED" display that uses the screen as an audio amplifier. There's a Snapdragon 855 processor with 6GB of RAM and 128GB internal storage, three cameras on the rear including a 16-megapixel Super Wide (F1.9), 12-megapixel Standard (F1.5), and 12-megapixel Telephoto (F2.4), a 3,500mAh battery that charges via USB-C, a headphone jack, and 32-bit Hi-Fi Quad DAC.