


iOS VPNs Have Leaked Traffic For More Than 2 Years, Researcher Claims (arstechnica.com) 45
In other words, you might expect a VPN client to kill existing connections before establishing a secure connection so they can be re-established inside the tunnel. But iOS VPNs can't seem to do this, Horowitz says, a finding that is backed up by a similar report from May 2020. "Data leaves the iOS device outside of the VPN tunnel," Horowitz writes. "This is not a classic/legacy DNS leak, it is a data leak. I confirmed this using multiple types of VPN and software from multiple VPN providers. The latest version of iOS that I tested with is 15.6."

Apple Finds Its Next Big Business: Showing Ads on Your iPhone (theverge.com) 120
The Verge writes that Apple "could eventually bring ads to more of the apps that come pre-installed on your iPhone and other Apple devices, including Maps, Books, and Podcasts." According to a report from Bloomberg's Mark Gurman, Apple has internally tested search ads in Maps, which could display recommendations when you search for restaurants, stores, or other nearby businesses. Apple already implements a similar advertising model on the App Store, as developers can pay to have their app promoted on a search page for a particular query, like "puzzle games" or "photo editor." As noted by Gurman, ads on Maps could work in the same way, with businesses paying to appear at the top of search results when users enter certain search terms.
Gurman believes that Apple could introduce ads to its native Podcasts and Books apps as well. [Gurman describes this as "likely".] This could potentially allow publishers to place ads in areas within each app, or pay to get their content placed higher in search results. Just like Maps, Podcasts and Books are currently ad-free.... Gurman mentions the potential for advertising on Apple TV Plus, too, and says the company could opt to create a lower-priced ad-supported tier, something both Netflix and Disney Plus plan on doing by the end of this year.
Bloomberg points out that Apple is already displaying ads inside its News app — where some of the money actually goes back to news publishers. ("Apple also lets publishers advertise within their stories and keep the vast majority of that money.")
And while you can disable ad personalization — which 78% of iOS users have done — Bloomberg notes that "Another ironic detail here is that the company's advertising system uses data from its other services and your Apple account to decide which ads to serve. That doesn't feel like a privacy-first policy."
Bloomberg's conclusion? "Now the only question is whether the customers of Apple — a champion of privacy and clean interfaces — are ready to live with a lot more ads."

Facing Privacy Concerns, Facebook Begins Testing End-to-End Encrypted Chats, Secure Backups (cnbc.com) 19
"As with end-to-end encrypted chats, secure storage means that we won't have access to your messages, unless you choose to report them to us."
CNBC provides some context: The announcement comes after Facebook turned over Messenger chat histories to Nebraska police as part of an investigation into an alleged illegal abortion. Meta spokesperson Andy Stone said the feature has been in the works for a while and is not related to the Nebraska case...
The feature is rolling out on Android and iOS devices this week, but it isn't yet available on the Messenger website. The company has been discussing full-scale deployment of end-to-end encryption since 2016, but critics have said the security measure would make it much more difficult for law enforcement to catch child predators....Meta said in the release that it is making progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023.
Other privacy enhancements announced Thursday by Meta:
- "We plan to bring end-to-end encrypted calls to the Calls Tab on Messenger."
- Meta announced that the deleting of messages will start syncing across your other devices "soon."
- Messenger will continue offering the option of "Disappearing" messages, in which viewed messages in an end-to-end encrypted chat automatically then disappear after a pre-specified period of time.
And there's more, according to Meta's announcement:.
"This week, we'll begin testing default end-to-end encrypted chats between some people. If you're in the test group, some of your most frequent chats may be automatically end-to-end encrypted, which means you won't have to opt in to the feature. You'll still have access to your message history, but any new messages or calls with that person will be end-to-end encrypted. You can still report messages to us if you think they violate our policies, and we'll review them and take action as necessary....
"Last year, we started a limited test of opt-in end-to-end encrypted messages and calls on Instagram, and in February we broadened the test to include adults in Ukraine and Russia. Soon, we'll expand the test even further to include people in more countries and add more features like group chats....
"We will continue to provide updates as we make progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023."

Facebook Will Begin Testing End-To-End Encryption As Default On Messenger App (theguardian.com) 13

Inside the Apple vs. Facebook Privacy Fight (wsj.com) 19
The companies also haggled over whether Apple was entitled to a piece of Facebook's sales from so-called boosted posts, said people familiar with the matter. A boost allows a user to pay to increase the number of people that see a post on Facebook or Instagram. Facebook, which considers boosts ads, has always contended that boosts are a form of advertising, in part because they are often used by small businesses to reach a bigger audience, said one of the people. Apple, which doesn't take a cut of advertising from developers, argued that Facebook boosts should be considered in-app purchases, according to a person familiar with the matter. Apple's standard terms would entitle it to take a 30% share of those sales.

Meta Injecting Code Into Websites Visited By Its Users To Track Them, Research Says (theguardian.com) 49
Krause discovered the code injection by building a tool that could list all the extra commands added to a website by the browser. For normal browsers, and most apps, the tool detects no changes, but for Facebook and Instagram it finds up to 18 lines of code added by the app. Those lines of code appear to scan for a particular cross-platform tracking kit and, if not installed, instead call the Meta Pixel, a tracking tool that allows the company to follow a user around the web and build an accurate profile of their interests. The company does not disclose to the user that it is rewriting webpages in this way. No such code is added to the in-app browser of WhatsApp, according to Krause's research. [...] It is unclear when Facebook began injecting code to track users after clicking links. "We intentionally developed this code to honor people's [Ask to track] choices on our platforms," a Meta spokesperson told The Guardian in a statement. "The code allows us to aggregate user data before using it for targeted advertising or measurement purposes. We do not add any pixels. Code is injected so that we can aggregate conversion events from pixels."
They added: "For purchases made through the in-app browser, we seek user consent to save payment information for the purposes of autofill."

DNSFilter Acquires iOS Firewall App Guardian (techcrunch.com) 1

A Phone Carrier That Doesn't Track Your Browsing Or Location (wired.com) 33
PGPP's ability to mask your phone's identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a "yes" or "no" about whether a device should get service. On the PGPP "Mobile Pro" plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There's also a "Mobile Core" plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month.
Both of these plans also include PGPP's Relay service. Similar to Apple's iCloud Private Relay, PGPP's Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you're looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay -- in this case, Invisv -- but the information about the page you're trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you're trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay. In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. The carrier is still working to bring its services to Apple's iOS. It's also worth noting that Invisv only offers mobile data; there are no voice calling services.

Zuckerberg Says Meta and Apple Are In 'Very Deep, Philosophical Competition' To Build the Metaverse (theverge.com) 132
Since rebranding Facebook's company name to Meta, Zuckerberg has been pushing for the concept of interoperability for the metaverse, or what he sees as the next major chapter of computing after mobile phones. Meta recently helped stand up the Metaverse Open Standards Group with Microsoft, Epic Games, and others. The idea is to spur the creation of open protocols that will let people easily move through future immersive, 3D worlds with their virtual goods. Apple is absent from the group, which Zuckerberg called out as not surprising in his comments to employees. He explained how Apple's approach of building hardware and software it tightly controls had worked well with the iPhone, but that for the metaverse, "it's not really clear upfront whether an open or closed ecosystem is going to be better."
[...] If VR and AR do take off like Zuckerberg hopes, it seems he wants to position Meta as the Android to Apple's iOS. There is a parallel to draw already: Meta's Quest headset already allows the side loading of apps that are not approved by Meta's VR app store, similar to how Google's Android allows for sideloading. And even though it just increased the price of the Quest by $100, Meta's hardware is still mostly sold at a loss or breakeven. [...] Zuckerberg's remarks suggest that even as he tries to invent his way out of being under Apple's thumb on mobile, the two tech giants are going to be battling for years to come.

Netflix Dodges App Store Tax With a New External Sign-Up Page on iOS (pcmag.com) 36
Reader apps, as described by Apple, provide one or more digital content types -- including magazines, newspapers, books, audio, music, or video -- as its primary function. That includes popular services such as Spotify, Zinio, Amazon Kindle, and YouTube. In the case of Netflix, new customers are diverted to a separate website at the tap of a button in the app to enter personal data, choose a payment method, and select a streaming plan. This update ensures transactions are no longer Apple's responsibility and all subscription management is therefore completed by Netflix. Once signed up, the Netflix iOS app should provide full content access.

Chromebooks With Mobile Data To Act As Wi-Fi Hotspots (9to5google.com) 15
Presumably, you would be able to choose the name and password for your Chromebook's hotspot through the Settings app in ChromeOS, where you can also toggle the hotspot on and off. If it truly follows the example of Android, there would also be an easy way to turn on your hotspot through a Quick Settings toggle.

Xbox Becomes First Game Console To Formally Support Discord Voice Chat (arstechnica.com) 20
[...] Sadly, this week's rollout of Discord on Xbox is a bit limited. The biggest issue is that there is no formal Discord app or interface on Xbox. You will need to keep a smartphone handy to initiate a "handoff" of your Discord session. Get ready for an annoying first-time setup process. Should you have an updated Xbox on the Insider OS track, its new "Try Discord Voice" prompt will initiate an account-sync process, which requires using a mobile Discord app to take a photo of a QR code displayed by your Xbox. (You'll need to re-do this if you've done so before, due to it adding a new level of credential for voice chat.) With this in place, when you are about to join a voice channel on Discord, a new "try voice chat on console" prompt will appear. Tapping through this will then, ugh, create another handover to Microsoft's dedicated Xbox app on either iOS or Android. Yes, if you want this to work, you need to install the Xbox app on your mobile device (and Discord will suggest you do so, if you haven't yet). This facilitates the key technical aspect of forwarding all Discord audio to your Xbox hardware.
With all that in place, presto: You can now talk to any participants in the Discord voice channel you chose directly on your Xbox. Its menu interface supports either muting or changing the volume level of every other user in the voice chat channel you chose, which is appreciated as a quickly accessible option during frantic gameplay. A one-button toggle in the menu allows chatters to switch between Discord voice chat and a particular game's dedicated voice-chat channel. (This is useful when you're talking to friends while in the midst of random online matchmaking, then need to turn on in-game voice chat for a second to confirm a strategy to your current teammates before going back to discussing souffle recipes with buddies.) All greater Discord control, sadly, goes back to your smartphone...

Are Lock Screens About to Change? (cnet.com) 75
And for Android phones: Glance, a Google-backed subsidiary of mobile ad tech company InMobi, also reiterated its plans to bring its lock screen platform to the U.S. [though the company also says there's "no definitive timeline."] And Google is reportedly planning to incorporate more bits of information into its own lock screen widget for Pixel phones.... Glance's lock screen will appear in the form of what it calls "spaces," which are essentially curated lock screens designed to fit specific themes. A fitness-oriented lock screen, for example, would show statistics such as calories burned and exercise goals alongside a music player. A news "space" would show headlines and the weather, while a music version could surface live concerts....
The TechCrunch report about Glance's US arrival sparked concerns that advertisements would be coming to the lock screen, too. Glance's business page shows examples of advertisers that have used its platform to reach potential customers on the very first screen they see when picking up their phone. Intel, Zomato and Garnier are among the listed case studies. But Rohan Choudhary, vice president and general manager of the Glance feed, told CNET the US version would be ad-free. "We are very clear that in the US, we will not have ads on the lock screen at all," he said....
The company says it plans to monetize its service through news subscriptions and commerce links from shopping platforms that are surfaced through Glance.
Glance's motto? "Transforming lock screens into smart surfaces."

Google Play Hides App Permissions In Favor of Developer-Written Descriptions (arstechnica.com) 33
The Play Store's new Data Safety section is Google's answer to a similar feature in iOS 14, which displays a list of developer-provided privacy considerations, like what data an app collects, how that data is stored, and who the data is shared with. At first blush, the Data Safety entries might seem pretty similar to the old list of app permissions. You get items like "location," and in some ways, it's better than a plain list of permissions since developers can explain how and why each bit of data is collected.
The difference is in how that data ends up in Google's system. The old list of app permissions was guaranteed to be factual because it was built by Google, automatically, by scanning the app. The Data Safety system, meanwhile, runs on the honor system. Here's Google's explanation to developers of how the new section works: "You alone are responsible for making complete and accurate declarations in your app's store listing on Google Play. Google Play reviews apps across all policy requirements; however, we cannot make determinations on behalf of the developers of how they handle user data. Only you possess all the information required to complete the Data safety form. When Google becomes aware of a discrepancy between your app behavior and your declaration, we may take appropriate action, including enforcement action."

Apple's iOS 16, macOS Ventura and watchOS 9 Public Betas Are Ready To Download (engadget.com) 29

Google Consolidates Its Chrome and Android Password Managers (techcrunch.com) 6

Google Warns ISPs Helped Distribute Hermit Spyware (engadget.com) 15
According to Google, Hermit can infect both Android and iOS devices. In some instances, the company's researchers observed malicious actors work with their target's internet service provider to disable their data connection. They would then send the target an SMS message with a prompt to download the linked software to restore their internet connection. If that wasn't an option, the bad actors attempted to disguise the spyware as a legitimate messaging app like WhatsApp or Instagram.
What makes Hermit particularly dangerous is that it can gain additional capabilities by downloading modules from a command and control server. Some of the addons Lookout observed allowed the program to steal data from the target's calendar and address book apps, as well as take pictures with their phone's camera. One module even gave the spyware the capability to root an Android device. Google believes Hermit never made its way to the Play or App stores. However, the company found evidence that bad actors were able to distribute the spyware on iOS by enrolling in Apple's Developer Enterprise Program. Apple told The Verge that it has since blocked any accounts or certificates associated with the threat. Meanwhile, Google has notified affected users and rolled out an update to Google Play Protect.

T-Mobile Has Started Selling Your App Data To Advertisers (androidpolice.com) 30
There is some good news (but less of it for Android fans). T-Mobile does not currently collect app data on iOS users, fearing it could run afoul of Apple's privacy rules. But we Android users are fair game, apparently. However, you can opt-out of T-Mobile's program using its official "Magenta Marketing Platform Choices" app. Alternatively, the Digital Advertising Alliance offers an app that lets you opt-out of numerous trackers, including T-Mobile Advertising Solutions, which is listed under its old name of T-Mobile Marketing Solutions.

Valve's Steam Deck Makes a Brilliant Case Against Walled Gardens (fastcompany.com) 57
Valve could have easily used the Steam Deck to lock players into its own ecosystem. It could have opted not to include a desktop mode and withheld instructions on how to lift its read-only restrictions. It could have discouraged users from installing different operating systems and made its recovery tools unavailable to the public. Console makers have long insisted that such restrictions are necessary for the good of their platforms. In 2020, for instance, Microsoft argued that because console makers sell their hardware at or below cost to create a market for their software, they shouldn't have to accommodate third-party app stores or sideloading.
Similar arguments have spilled out into the broader mobile app business as well. In response to a lawsuit from Epic Games, Apple has claimed that its investments in the App Store wouldn't be feasible if it couldn't force developers to use its in-app purchase mechanisms. Some defenders of Apple's viewpoint, such as Daring Fireball's John Gruber, have argued that iOS is more like a game console than a PC platform. So, it's all the more remarkable that Valve ignored all this hand-wringing and made the Steam Deck a haven for tinkerers. Instead of trying to shut out competitors, the company is betting that its own store will prevail on quality. If the Steam Deck successful -- as it appears to be so far -- it could upend years of conventional wisdom around walled gardens and become a threat to other consoles in more ways than one.