At its Ignite 2018 conference, Microsoft said that Windows 10 has been installed on over 700 million active devices. Neowin reports of the confusion around this estimate, noting that "the last milestone was 600 million active devices" announced on November 29, 2017, nearly 10 months ago. From the report: If you follow Windows 10 news, this might not even seem like a major development. That's because the firm's communication around this has been wildly inconsistent. It started off when Windows and Devices chief Terry Myerson announced that he's leaving Microsoft, and he wrote in a farewell letter that Windows 10 is installed on nearly 700 million active devices. That was almost six months ago. At the firm's Build conference in May and at the Insider Dev Tour in July, Microsoft announced that Windows 10 is installed on over 700 million devices, only to retract those statements later on and say they were mistakes. But today after almost six months of "nearly 700 million", Windows 10 is officially installed on over 700 million devices.

Amazon is opening a new store in New York City that sells items from its website rated 4 stars or above. The company appears to be making a bigger push into brick-and-mortar retail following its acquisition of Whole Foods and the gradual rollout of its cashier-less convenience stores. CNBC reports: The store is set to open this Thursday in New York's SoHo neighborhood, on 72 Spring Street. The company said Amazon Prime members will pay "the Amazon.com price" when they shop there. An Amazon spokeswoman said the store is permanent, not a pop-up location, as some of its shops -- including one that sold Calvin Klein merchandise in SoHo last year -- have been before.

Amazon said customers will find items like a mini skillet, card games and many of the company's own electronic devices including the Echo Spot and Fire TV Stick, in the new store, called Amazon 4-star. It said it will also include some "Trending Around NYC" items there, which Amazon is able to track on its website. Amazon said digital price tags in the new store will show how much Prime members are saving, the average star rating and how many ratings a product has received, similar to what shoppers can see on the website today.

An anonymous reader quotes a report from The New York Times: Uber will pay $148 million to settle a nationwide investigation into a 2016 data breach (Warning: source may be paywalled; alternative source), in which a hacker managed to gain access to information belonging to 57 million riders and drivers. The breach included names and driver's license numbers for 600,000 drivers. Rather than disclosing the breach when it occurred, Uber paid the hacker $100,000 through its bug bounty program. [...] The ride-hailing company persuaded him to delete the data and stay quiet about it with a nondisclosure agreement. The incident became public a year later when Uber's chief executive, Dara Khosrowshahi, announced it as a "failure" and fired the two employees who had signed off on the payment.

Tony West, Uber's chief legal officer, said the settlement was part of a larger effort inside Uber to remake the company's image. He said the company had recently hired a chief privacy officer and a chief trust and security officer. The $148 million settlement announced Wednesday will be divided among all 50 states and the District of Columbia. "Companies in California and throughout the nation are entrusted with customers' valuable private information," Xavier Becerra, California's attorney general, said. "This settlement broadcasts to all of them that we will hold them accountable to protect that data."

Mozilla announced today a new recovery option for Firefox Accounts, the user system included inside the Firefox browser. ZDNet: Starting today, users can generate a one-time recover key that will be associated with their account, and which they can use to regain access to Firefox data if they ever forget their passwords. Firefox Accounts is included with all recent versions of the Firefox browser.

Most users are familiar with it because of Firefox Sync, the system that synchronizes Firefox data such as passwords, browsing history, open tabs, bookmarks, installed add-ons, and general browser options between multiple Firefox instances. But while Sync does the actual synchronization, Firefox Accounts is at the core of Sync and is the system that manages the identities of Firefox users. Sync works by taking a user's Firefox account password and encrypting the user's browser data on the local computer.

A former Google employee has warned of the firm's "disturbing" plans in China, in a letter to US lawmakers. BBC: Jack Poulson, who had been a senior researcher at the company until resigning in August, wrote that he was fearful of Google's ambitions. His letter alleges Google's work on a Chinese product -- codenamed Dragonfly -- would aid Beijing's efforts to censor and monitor its citizens online. Google has said its work in China to date has been "exploratory." Ben Gomes, Google's head of search, told the BBC earlier this week: "Right now all we've done is some exploration, but since we don't have any plans to launch something there's nothing much I can say about it."

A report by news site The Intercept last week alleged Google had demanded employees delete an internal memo that discussed the plans. Google has not commented on the staff row, but said: "We've been investing for many years to help Chinese users, from developing Android, through mobile apps such as Google Translate and Files Go, and our developer tools." It added: "We are not close to launching a search product in China." Mr Poulson's letter details several aspects of Google's work that had been reported in the press but never officially confirmed by the company. It was submitted to the Senate Commerce Committee, which held a hearing on Wednesday in Washington DC. Google's chief privacy officer, Keith Enright, faced questions from Senator Ted Cruz about the company's intentions to launch a new search engine in China. He confirmed the existence of the project.

Kashmir Hill, reporting for Gizmodo: Last week, I ran an ad on Facebook targeted at a computer science professor named Alan Mislove. Mislove studies how privacy works on social networks and had a theory that Facebook is letting advertisers reach users with contact information collected in surprising ways. I was helping him test the theory by targeting him in a way Facebook had previously told me wouldn't work. I directed the ad to display to a Facebook account connected to the landline number for Alan Mislove's office, a number Mislove has never provided to Facebook. He saw the ad within hours.

One of the many ways that ads get in front of your eyeballs on Facebook and Instagram is that the social networking giant lets an advertiser upload a list of phone numbers or email addresses it has on file; it will then put an ad in front of accounts associated with that contact information. A clothing retailer can put an ad for a dress in the Instagram feeds of women who have purchased from them before, a politician can place Facebook ads in front of anyone on his mailing list, or a casino can offer deals to the email addresses of people suspected of having a gambling addiction. Facebook calls this a "custom audience." You might assume that you could go to your Facebook profile and look at your "contact and basic info" page to see what email addresses and phone numbers are associated with your account, and thus what advertisers can use to target you. But as is so often the case with this highly efficient data-miner posing as a way to keep in contact with your friends, it's going about it in a less transparent and more invasive way.

[...] Giridhari Venkatadri, Piotr Sapiezynski, and Alan Mislove of Northeastern University, along with Elena Lucherini of Princeton University, did a series of tests that involved handing contact information over to Facebook for a group of test accounts in different ways and then seeing whether that information could be used by an advertiser. They came up with a novel way to detect whether that information became available to advertisers by looking at the stats provided by Facebook about the size of an audience after contact information is uploaded. They go into this in greater length and technical detail in their paper [PDF]. They found that when a user gives Facebook a phone number for two-factor authentication or in order to receive alerts about new log-ins to a user's account, that phone number became targetable by an advertiser within a couple of weeks. Officially, Facebook denies the existence of shadow profiles. In a hearing with the House Energy & Commerce Committee earlier this year, when New Mexico Representative Ben Lujan asked Facebook CEO Mark Zuckerberg if he was aware of the so-called practice of building "shadow profiles", Zuckerberg denied knowledge of it.

An anonymous reader shares a report: Whether you're trying to figure out how many students are attending your lectures or how many evil aliens have taken your Space Force brethren hostage, Wi-Fi can now be used to count them all. The system, created by researchers at UC Santa Barbara, uses a single Wi-Fi router outside of the room to measure attenuation and signal drops. From the release: "The transmitter sends a wireless signal whose received signal strength (RSSI) is measured by the receiver. Using only such received signal power measurements, the receiver estimates how many people are inside the room -- an estimate that closely matches the actual number. It is noteworthy that the researchers do not do any prior measurements or calibration in the area of interest; their approach has only a very short calibration phase that need not be done in the same area." This means that you could simply walk up to a wall and press a button to count, with a high degree of accuracy, how many people are walking around. The system can measure up to 20 people in its current form.

Facebook's David Marcus, who until recently ran the Facebook Messenger before starting the blockchain group earlier this year, is defending the company and CEO Mark Zuckerberg after a WhatsApp founder spoke critically of his experience at the company. Marcus: [...] On the business model. I was present in a lot of these meetings. Again, Mark protected WhatsApp for a very long period of time. And you have to put this in the context of a large organization with businesses knocking on our door to have the ability to engage and communicate with their customers on WhatsApp the same way they were doing it on Messenger. During this time, it became pretty clear that while advocating for business messaging, and being given the opportunity to build and deliver on that promise, Brian actively slow-played the execution, and never truly went for it. In my view, if you're passionate about a certain path -- in this case, letting businesses message people and charging for it -- and if you have internal questions about it, then work hard to prove that your approach has legs and demonstrate the value. Don't be passive-aggressive about it. And by the way the paid messaging that WhatsApp is rolling out now sounds pretty similar to metered messaging from my point of view...

Lastly -- call me old fashioned. But I find attacking the people and company that made you a billionaire, and went to an unprecedented extent to shield and accommodate you for years, low-class. It's actually a whole new standard of low-class. I'll close by saying that as far as I'm concerned, and as a former lifelong entrepreneur and founder, there's no other large company I'd work at, and no other leader I'd work for. I want to work on hard problems that positively impact the lives of billions of people around the world. And Facebook is truly the only company that's singularly about people.

Another day, another hearing of tech giants in Congress. Wednesday's hearing at the Senate Commerce Committee with Apple, Amazon, Google and Twitter, alongside AT&T and Charter, marked the latest in a string of hearings in the past few months into all things tech: but mostly controversies embroiling the companies, from election meddling to transparency. This time, privacy was at the top of the agenda. The problem, lawmakers say, is that consumers have little of it. From a report: The hearing said that the U.S. was lagging behind Europe's new GDPR privacy rules and California's recently passed privacy law, which goes into effect in 2020, and lawmakers were edging toward introducing their own federal privacy law. AT&T, Apple, Charter and Google used their time in the Senate to call on lawmakers to introduce new federal privacy legislation. Tech companies spent the past year pushing back against the new state regulations, but have conceded that new privacy rules are inevitable. Now the companies realize that it's better to sit at the table to influence a federal privacy law than stand outside in the cold. In pushing for a new federal law, representatives from each company confirmed that they support the preemption of California's new rules -- something that critics oppose. AT&T's chief lawyer Len Cali said that a patchwork of state laws would be unworkable. Apple, too, agreed to support a privacy law, but noted as a company that doesn't hoard user data for advertising -- like Facebook and Google -- that any federal law would need to put a premium on protecting the consumer rather than helping companies make money. But Amazon's chief lawyer Andrew DeVore said that complying with privacy rules has "required us to divert significant resources to administrative tasks and away from invention."

India's top court refused to scrap Aadhaar, the world's largest biometric database, in a ruling announced Wednesday, upholding the validity of the sprawling digital-identity program but also imposing some restrictions on its use and proliferation. Huffington Post reports: The majority judgement of the court read down Section 57 of the Aadhaar Act of 2016, holding that private companies cannot insist on Aadhaar numbers from citizens to provide services. The court upheld the validity of linking aadhaar to PAN cards, suggesting that -- should the government wish it -- anyone who pays income tax will have to an aadhaar number anyway. However, the court held the linking of aadhaar numbers to bank accounts, as mandated by an amendment to the Prevention of Money Laundering Act of 2002, was unconstitutional. The court also held that educational institutions and bodies like the Central Board for Secondary Education (CBSE) and University Grants Commission (UGC), and schools and colleges, cannot ask for Aadhaar details of potential candidates.

Chief Justice of India Dipak Misra, and Justices AK Sikri and AM Khanwilkar delivered a concurrent majority judgement, while Justices DY Chandrachud and Ashok Bhushan delivered separate opinions. The majority judgement, read out in a packed courthouse by Justice Sikri, relied heavily on the court's landmark 2017 Privacy judgement. "Today the Supreme Court has passed a historic judgement on Aadhaar," said Supreme Court Advocate Prashant Bhushan. "They have held several parts of the Aadhaar act to be unconstitutional." The court's decision restricting private companies from demanding Aadhaar numbers, Bhushan said, would come as a relief. The ruling could come as a blow for local companies -- like Jio and Paytm -- that rely heavily (or even exclusively) on technologies such as Aadhaar's eKYC (an Aadhaar-enabled Know Your Customer service) to grow their customer base, analysts say.

A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps. What the research team found was that password managers, initially developed for desktop browsers, aren't as secure as their desktop versions. The problem comes from the fact that mobile password managers have a hard time associating a user's stored website credentials with a mobile application and then creating a link between that website and an official app.

[...] Researchers say they tested the way five Android password managers create internal maps (connections) between a locally installed app and legitimate internet sites and found that four of the five were vulnerable to abuse. Android versions of password managers from Keeper, Dashlane, LastPass, and 1Password were found to be vulnerable and have prompted the user to auto-fill credentials on fake apps during tests. Researchers found that Google's Smart Lock app did not fall for this fake package name trick, and the reason was because it used a system named Digital Asset Links to authenticate and connect apps to a particular online service.

Google, on the defensive from concerns raised about how Chrome tracks its users, has promised changes to its web browser. From a report: Two complaints in recent days involve how Google stores data about browsing activity in files called cookies and how it syncs personal data across different devices. Google representatives said Monday and Tuesday there's nothing to be worried about but that they'll be changing Chrome nevertheless. "We've heard -- and appreciate -- your feedback from the last few days, and we'll be making some product changes," tweeted Parisa Tabriz, a security team leader at Google. Google added in a blog post Tuesday evening that it will add new options and explanations for its interface and reverse one Chrome cookie-hoarding policy that undermined people's attempts to clear those cookies.

A study of school grades of more than 1.6 million students shows that girls and boys perform similarly in science, technology, engineering and math (STEM) subjects. From a report: The research, published today in Nature Communications, also shows that girls do better than boys in non-STEM subjects. Our results provide evidence that large gaps in the representation of women in STEM careers later in life are not due to differences in academic performance. One explanation for gender imbalance in STEM is the "variability hypothesis." This is the idea that gender gaps are much larger at the tails of the distribution -- among the highest and lowest performers -- than in the middle.

Brian Acton, a founder of WhatsApp, which he (along with the other founder) sold to Facebook for $19 billion four years ago, has grown tired of the social juggernaut. He left the company a year ago, and earlier this year, he surprised many when he tweeted "#DeleteFacebook", offering his support to what many described as a movement. He had started despising working at Facebook so much, that he left the company abruptly, leaving a cool $850M in unvested stock. He has also invested $50 million in encrypted chat app Signal. In an interview with Forbes, published Wednesday, Acton talked about his rationale behind leaving the company and what he thinks of Facebook now. From the story: Under pressure from Mark Zuckerberg and Sheryl Sandberg to monetize WhatsApp, he pushed back as Facebook questioned the encryption he'd helped build and laid the groundwork to show targeted ads and facilitate commercial messaging. Acton also walked away from Facebook a year before his final tranche of stock grants vested. "It was like, okay, well, you want to do these things I don't want to do," Acton says. "It's better if I get out of your way. And I did." It was perhaps the most expensive moral stand in history. Acton took a screenshot of the stock price on his way out the door -- the decision cost him $850 million.

He's following a similar moral code now. He clearly doesn't relish the spotlight this story will bring and is quick to underscore that Facebook "isn't the bad guy." ("I think of them as just very good businesspeople.") But he paid dearly for the right to speak his mind. "As part of a proposed settlement at the end, [Facebook management] tried to put a nondisclosure agreement in place," Acton says. "That was part of the reason that I got sort of cold feet in terms of trying to settle with these guys."

It's also a story any idealistic entrepreneur can identify with: What happens when you build something incredible and then sell it to someone with far different plans for your baby? "At the end of the day, I sold my company," Acton says. "I sold my users' privacy to a larger benefit. I made a choice and a compromise. And I live with that every day."

Facebook, Acton says, had decided to pursue two ways of making money from WhatsApp. First, by showing targeted ads in WhatsApp's new Status feature, which Acton felt broke a social compact with its users. "Targeted advertising is what makes me unhappy," he says. His motto at WhatsApp had been "No ads, no games, no gimmicks" -- a direct contrast with a parent company that derived 98% of its revenue from advertising. Another motto had been "Take the time to get it right," a stark contrast to "Move fast and break things." Elsewhere in the story, Acton has also suggested he was used by Facebook to help get its 2014 acquisition of WhatsApp past EU regulators that had been concerned it might be able to link accounts -- as it subsequently did.

Update: Facebook Executive Hits Back at WhatsApp Co-founder Brian Acton: 'A Whole New Standard of Low-Class'.

An anonymous reader quotes a report from NPR: A new study [published in the Proceedings of the National Academy of Sciences] by scientists at the University of Texas at Austin posit that glyphosate -- the active ingredient in the herbicide -- destroys specialized gut bacteria in bees, leaving them more susceptible to infection and death from harmful bacteria. Researchers Nancy Moran, Erick Motta and Kasie Raymann suggest their findings are evidence that glyphosate might be contributing to colony collapse disorder, a phenomenon that has been wreaking havoc on honey bees and native bees for more than a decade. They hope their results will convince farmers, landscapers and homeowners to stop spraying glyphosate-based herbicides on flowering plants that are likely to be pollinated by bees.

"No large-scale study has ever found a link between glyphosate and honey bee health issues," Bayer said in a statement, adding that the new study "does not change that." Bayer noted the study relied on a small sample of individual bees and that it does not meet regulatory research criteria on pesticides stipulated by international guidelines developed by the Organization of Economic Cooperation and Development and other international organizations. Additionally, the company suggested it is "questionable whether the concentrations of the substance tested could at all be absorbed by bee populations in the open over a relevant period of time." According to the report in the journal, the researchers focused on honey bees and used "hundreds of adult worker bees from a single hive" and treated them with varying levels of glyphosate. Editor's note: In June, Germany's pharmaceutical giant Bayer purchased Monsanto, the company that developed Roundup.