An anonymous reader quotes a report from The Verge: District of Columbia Attorney General Karl Racine is suing Grubhub for deceptive business practices, saying its food delivery app covertly inflates prices for diners who order through it. The suit demands an end to a laundry list of allegedly illegal practices as well as financial restitution and civil penalties. The newly filed lawsuit (PDF) argues that Grubhub's promises of "free" online orders -- and "unlimited free delivery" for Grubhub Plus -- are misleading. While customers can make pickup orders for free, the company charges delivery and service fees for standard orders and service fees for Grubhub Plus orders, displaying the service fee until recently as part of a single line with sales taxes. "Grubhub misled District residents and took advantage of local restaurants to boost its own profits, even as District consumers and small businesses struggled during the COVID-19 pandemic," said Racine in a statement. "Grubhub charged hidden fees and used bait-and-switch advertising tactics -- which are illegal."

The complaint says Grubhub orders often cost more than ordering the same item at a restaurant and argues that the company fails to reasonably disclose this to consumers. "Because Grubhub already charges consumers several different types of fees for its services ... consumers expect that the menu prices listed on Grubhub are the same prices offered at the restaurant or on the restaurant's website," it says. Grubhub has also listed many restaurants without their permission to expand its service, routing orders through its services and taking a commission. The complaint says it listed "over a thousand" restaurants in DC that had no connection with the company, asserting that the unapproved listings often contained menu errors and resulted in orders that would "take longer to fill, would be filled incorrectly, would be delivered cold, or would eventually be cancelled altogether."

Grubhub -- which also operates Seamless and several other food delivery apps -- has made more elaborate attempts to insert itself into restaurant transactions as well. The lawsuit notes its launch of unsanctioned microsites that appear to be official restaurant sites, as well as custom phone numbers that let it charge fees when customers call restaurants, even when the calls didn't result in orders. The company also offered a "Supper for Support" promotion that required restaurants to foot the bill for a special discount; it offered restaurants $250 in compensation after a backlash. "During the past year, we've sought to engage in a constructive dialogue with the DC attorney general's office to help them understand our business and to see if there were any areas for improvement," said Katie Norris, director of corporate communications, in a statement. "We are disappointed they have moved forward with this lawsuit because our practices have always complied with DC law, and in any event, many of the practices at issue have been discontinued. We will aggressively defend our business in court and look forward to continuing to serve DC restaurants and diners."

According to The Verge, Grubhub "says the app no longer lists restaurants that haven't agreed to work with it, and it's retired its microsites and the Supper for Support program." It will also make it more clear to users that prices might be lower when ordering directly from the restaurant, "and it will specify in marketing that only pickup orders are free," adds The Verge. The company maintains that it "has not misrepresented its fees," however.

A judge on Brazil's Supreme Court has reversed a ban on Telegram, two days after blocking the messaging app for ignoring orders. Engadget reports: Telegram CEO Pavel Durov said the company missed the court's emails. "We complied with an earlier court decision in late February and responded with a suggestion to send future takedown requests to a dedicated email address," Durov wrote on Telegram on Friday. "Unfortunately, our response must have been lost, because the Court used the old general-purpose email address in further attempts to reach us. As a result, we missed its decision in early March that contained a follow-up takedown request. Luckily, we have now found and processed it, delivering another report to the Court today."

Durov added that Telegram will appoint a representative in Brazil and set up a framework so it can address requests more promptly. According to The New York Times, Telegram complied with the court's demands by taking down classified information posted on President Jair Bolsonaro's channel and deleting the accounts of a Bolsonaro supporter who was allegedly spreading misinformation. The court then reversed the ban. Telegram reacted so swiftly that the ban (which was imposed by a judge who is running multiple investigations into Bolsonaro and his allies for spreading misinformation) was never actually in effect. The court order gave Apple, Google, ISPs and phone providers five days to block the app. Telegram will also "start promoting verified information and labeling posts containing falsehoods," adds Engadget. "It will also monitor the 100 most popular channels in the country," which account for 95 percent of views of public posts.

An anonymous reader quotes a report from TorrentFreak: U.S. Senators Thom Tillis and Patrick Leahy have introduced the SMART Copyright Act of 2022. The bill requires online hosting services to implement standard technical protection measures, designated by the Copyright Office. The general idea is to grant the Copyright Office the power to designate standard technical protection measures to be implemented by online hosting platforms. These STMs can be tailored to specific niches such as audio and video, which offers much more flexibility than the current regime under the DMCA.

In short, the bill will give the government more tools to facilitate and encourage the implementation of anti-piracy mechanisms, while allowing online services to keep their safe harbors. The full text of the bill provides more details on how the approval process of a proposed protection measure works. In addition to hearing stakeholders, experts, and the public, the designated protection measures have to be weighed on factors such as cost and availability. They shouldn't create any major burdens for online services. Similarly, the rights of the public are taken into account as well. This includes the impact a technical measure may have on privacy and data protection, as well as on free speech issues such as criticism and news.

Finally, it is worth noting that online services will be able to appeal officially designated protection measures in court. In addition, they can also choose not to implement them. However, that opens the door to lawsuits from copyright holders. The statutory damages amounts for services that fail to implement the designated technical protection measures are capped at $150,000 for a single violation, but that number can shoot up for repeat offenders. [...] Rightsholders see the proposal as a great step forward to protect creators, while opponents classify it as a filtering tool that will censor free speech.

"A former Apple employee has been charged with defrauding the tech giant out of more than $10 million," reports NBC News, "by taking kickbacks, stealing equipment and laundering money, federal prosecutors said." Dhirendra Prasad, 52, worked for 10 years as a buyer in Apple's Global Service Supply Chain department. A federal criminal case unsealed Friday alleges that he exploited his position to defraud the company in several schemes, including stealing parts and causing the company to pay for items and services it never received.

A court has allowed the federal government to seize five real estate properties and financial accounts worth about $5 million from Prasad, and the government is seeking to keep those assets as proceeds of crime, the U.S. Attorney's office in San Jose said in a news release...

Two owners of vendor companies that did business with Apple have admitted to conspiring with Prasad to commit fraud and launder money, prosecutors said.

An anonymous reader quotes a report from The Register: Last year, the Graph Foundation had to rethink how it develops and distributes its Open Native Graph Database (ONgDB) after it settled a trademark and copyright claim by database biz Neo4j. The Graph Foundation agreed [PDF] it would no longer claim specific versions of ONgDB, its Neo4j Enterprise Edition fork, are a "100 percent free and open source version" of Neo4J EE. And last month, two other companies challenged by Neo4j -- PureThink and iGov -- were also required by a court ruling to make similar concessions.

ONgDB is forked from Neo4j EE, which in May 2018 dropped the GNU Affero General Public License (AGPL) and adopted a new license that incorporates the AGPLv3 alongside additional limitations spelled out in the Commons Clause license. This new Neo4j EE license forbade non-paying users of the software from reselling the code or offering some support services, and thus is not open source as defined by the Open Source Initiative. The Graph Foundation, PureThink, and iGov offered ONgDB as a "free and open source" version of Neo4j in the hope of winning customers who preferred an open-source license. That made it more challenging for Neo4j to compete.

So in 2018 and 2019 Neo4j and its Swedish subsidiary pursued legal claims against the respective firms and their principals for trademark and copyright infringement, among other things. The Graph Foundation settled [PDF] in February 2021 as the company explained in a blog post. The organization discontinued support for ONgDB versions 3.4, 3.5 and 3.6. And it released ONgDB 1.0 in their place as a fork of AGPLv3 licensed Neo4j EE version 3.4.0.rc02. Last May, the judge hearing the claims against PureThink, and iGov granted Neo4j's motion for partial summary judgment [PDF] and forbade the defendants from infringing on the company's Neo4j trademark and from advertising ONgDB "as a free and open source drop-in replacement of Neo4j Enterprise Edition" The defendants appealed, and in February the US Court of Appeals for the Ninth Circuit affirmed a lower court decision that the company's "statements regarding ONgDB as 'free and open source' versions of Neo4j EE are false." "Stop saying Open Source when it's not," said the Open Source Initiative in a blog post. "The US Court of Appeals for the Ninth Circuit recently affirmed a lower court decision concluding what we've always known: that it's false advertising to claim that software is 'open source' when it's not licensed under an open source license."

An anonymous reader quotes a report from ZDNet: Proposed UK laws could see top managers at tech companies be jailed if they fail to meet the demands of regulators. The laws, coming in the form of an Online Safety Bill, were introduced to Parliament on Thursday after almost a year of consultation. The UK government commenced work on the proposed laws in May last year to push a duty of care onto social media platforms so that tech companies are forced to protect users from dangerous content, such as disinformation and online abuse.

Under the proposed legislation, executives of tech companies could face prosecution or jail time if they fail to cooperate with information notices issued by Ofcom, UK's communications regulator. Through the Bill, Ofcom would gain the power to issue information notices for the purpose of determining whether tech companies are performing their online safety functions. A raft of new offenses have also been added to the Bill, including making in-scope companies' senior managers criminally liable if they destroy evidence, fail to attend or provide false information in interviews with Ofcom, or obstruct the regulator when it enters company offices.

The Bill also looks to require social media platforms, search engines, and other apps and websites that allow people to post their own content to implement various measures to protect children, tackle illegal activity and uphold their stated terms and conditions. Among these measures are mandatory age checks for sites that host pornography, criminalizing cyberflashing, and a requirement for large social media platforms to give adults the ability to automatically block people who have not verified their identity on the platforms. The proposed laws, if passed, would also force social media platforms to up their moderation efforts, with the Bill calling for platforms to remove paid-for scam ads swiftly once they are alerted of their existence. A requirement for social media platforms to moderate "legal but harmful" content is also contained in the Bill, which will make large social media platforms have a duty to carry risk assessments on these types of content. Platforms will also have to set out clearly in terms of service how they will deal with such content and enforce these terms consistently.

An anonymous reader quotes a report from CoinDesk: U.S. Sen. Elizabeth Warren (D-Mass.) announced Thursday a new bill to block cryptocurrency companies from conducting business with sanctioned companies. The Digital Assets Sanctions Compliance Enhancement Act, introduced with Sens. Jack Reed (D-R.I.), Mark Warner (D-Va.), Jon Tester (D-Mont.) and others, would allow the U.S. president to add non-U.S.-based crypto companies to sanctions list if they support sanctions evasion.

"This is a bill that would authorize the president to sanction foreign cryptocurrency firms that are doing business with sanctioned Russian entities and authorize the Secretary of Treasury to act," she said. According to a draft of the bill, the presidential administration would be tasked with identifying "any foreign person" who operates a crypto exchange or otherwise facilitates digital asset transactions who has also supported sanctions evasion by Russian individuals named to the Office of Foreign Asset Control's sanctions list. Moreover, the U.S. president could sanction these exchange operators unless there was a national security interest in not doing so. The U.S. Treasury secretary could also require that crypto exchanges operating in the U.S. not conduct transactions for, or otherwise work with, crypto addresses belonging to people based in Russia if this is deemed to be in the national interest. The Treasury secretary would have to report to Congress about this decision.

The bill seems to extend beyond just Russian sanctions. Another provision would authorize the Financial Crimes Enforcement Network (FinCEN) to identify users transacting with more than $10,000 in crypto. "Not later than 120 days after the date of enactment of this Act, the Financial Crimes Enforcement Network shall require United States persons engaged in a transaction with a value greater than $10,000 in digital assets through [one] or more accounts outside of the United States to file a report," the bill said. The Treasury secretary would also be tasked with identifying exchanges that could be at "high risk for sanctions evasion" or other crimes, and reporting these entities to Congress. "Any exchange included in the report may petition the Office of Foreign Assets Control for removal, which shall be granted upon demonstrating that the exchange is taking steps sufficient to comply with applicable United States law," the bill said.

According to Reuters, Brazil's Supreme Court Justice Alexandre de Moraes ordered the suspension of Telegram, claiming it had "repeatedly refused to adhere to judicial orders or comply with the country's laws." From the report: Moraes' decision, which is likely to stoke debate about freedom of speech in politically polarized Brazil, represents the latest chapter in the crusading justice's battle with far-right President Jair Bolsonaro and his allies. The president and his supporters have increasingly come to rely on Telegram as a form of mass communication as larger tech companies like Meta, which owns messaging app WhatsApp, Google and Twitter have been forced by the Supreme Court to drop offending accounts over allegedly spreading disinformation.

Moraes has been leading a series of Supreme Court probes into the president and his supporters for disseminating fake news that have enraged many on the right and sparked questions of judicial overreach. According to Moraes' ruling, Telegram has repeatedly failed to block offending accounts and ignored the court's decisions. He gave Wilson Diniz Wellisch, the head of telecoms regulator Anatel, 24 hours to implement the suspension, which would stand until Telegram complies with outstanding judicial orders, pays a series of fines, and presents a country representative before the court. Moraes also ordered Apple and Google to help block users on their platforms from being able to use Telegram in Brazil.

An anonymous reader quotes a report from Ars Technica: Minnesota state lawmakers are trying to prohibit social media platforms from using algorithms to recommend content to anyone under age 18. The bill was approved Tuesday by the House Commerce Finance and Policy Committee in a 15-1 vote. The potential state law goes next to the House Judiciary Finance and Civil Law Committee, which has put it on the docket for a hearing on March 22. The algorithm ban applies to platforms with at least 1 million account holders and says those companies would be "prohibited from using a social media algorithm to target user-created content at an account holder under the age of 18." There are exemptions for content created by federal, state, or local governments and by public or private schools.

"This bill prohibits a social media platform like Facebook, Instagram, YouTube, WhatsApp, TikTok, and others, from using algorithms to target children with specific types of content," the bill summary says (PDF). "The bill would require anyone operating a social media platform with more than one million users to require that algorithm functions be turned off for accounts owned by anyone under the age of 18." Social media companies would be "liable for damages and a civil penalty of $1,000 for each violation." Tech-industry lobbyists say the bill would violate the First Amendment, prevent companies from recommending useful content, and require them to collect more data on the ages and locations of users. TechDirt's Mike Masnick slammed the bill in an article titled, "Minnesota pushing bill that says websites can no longer be useful for teenagers."

"I get that for computer illiterate people the word 'algorithm' is scary," Masnick wrote. "And that there's some ridiculous belief among people who don't know any better that recommendation algorithms are like mind control, but the point of an algorithm is... to recommend content. That is, to make a social media (or other kind of service) useful. Without it, you just get an undifferentiated mass of content, and that's not very useful."

A dentist in Wisconsin has been found guilty of deliberately breaking his patients' teeth with a drill so he could collect millions of dollars to repair the damage with dental crowns. ArsTechnica reports: The alleged scheme by licensed Grafton dentist Scott Charmoli, 61, appears to have begun in 2015, when the number of crowns he installed abruptly increased. In 2015, Charmoli installed 1,036 crowns, well over the 434 crowns he did in 2014. Amid the royal boom, his income increased by more than a million dollars, going from $1.4 million in 2014 to $2.5 million in 2015, according to court documents. From 2016 to 2019, Charmoli billed insurers and patients over $4.2 million for crown procedures, according to federal prosecutors. Charmoli ranked at or above the 95th percentile for the number of crowns installed by dentists in the state in each of those years, the report added.

The New York Times, which acquired Wordle in January, is putting an end to unofficial takes of the game. The latest casualty is Wordle Archive, a website that let users play through hundreds of previous daily five-letter Wordle puzzles. According to Ars Technica, the site "has been taken down at the request of Wordle owner The New York Times." From the report: The archival site, which offered a backward-looking play feature that's not available in the NYT's official version of Wordle, had been up since early January. But it was taken down last week and replaced with a message saying, "Sadly, the New York Times has requested that the Wordle Archive be taken down." A Twitter search shows dozens of daily Wordle Archive players who were willing to share their results on social media up through March 7. "The usage was unauthorized, and we were in touch with them," a New York Times representative said in response to an Ars Technica comment request. "We don't plan to comment beyond that."

The Wordle Archive is still fully playable in its own archived form (as of March 5) at the Internet Archive, appropriately enough. Other sites that allow you to play archived Wordle puzzles are not hard to find, as are sites that let you play unlimited Wordle puzzles beyond the usual one-a-day limit. But some of those sites may be under threat, if the Times' treatment of Wordle Archive is any indication.

Senator Elizabeth Warren and House Representative Mondaire Jones have introduced legislation in their respective congressional chambers that would effectively ban large technology mergers. Engadget reports: The Prohibiting Anticompetitive Mergers Act (PAMA) would make it illegal to pursue "prohibited mergers," including those worth more than $5 billion or which provide market shares beyond 25 percent for employers and 33 percent for sellers. The bills would also give antitrust regulators more power to halt and review mergers. They would have authority to reject mergers outright, without requiring court orders. They would likewise bar mergers from companies with track records of antitrust violations or other instances of "corporate crime" in the past decade. Officials would have to gauge the impact of these acquisition on labor forces, and wouldn't be allowed to negotiate with the companies to secure "remedies" for clearing mergers.

Crucially, PAMA would formalize procedures for reviewing past mergers and breaking up "harmful deals" that allegedly hurt competition. The Federal Trade Commission has signaled a willingness to split up tech giants like Meta despite approving mergers years earlier. PAMA might make it easier to unwind those acquisitions and force brands like Instagram and WhatsApp to operate as separate businesses.

Several outlets -- including Slashdot -- reported last week that LimeWire is making a comeback as an NFT marketplace. But as it turns out, the new LimeWire project has absolutely nothing to do with the team that originally developed the file-sharing software. They just happen to share the same name. TorrentFreak, a news website that tracks piracy and copyright, interviewed Mark Gorton, founder and chief executive of the original LimeWire company, called Lime Group LLC. An excerpt from the story: Gorton says that he had never even heard of this NFT project before it hit the news. "I was not approached about this NFT project, and I didn't hear about it until the public announcement," Gorton tells TorrentFreak. There was probably no legal obligation to inform the former LimeWire chief. The original trademarks have expired and the NFT website uses a new logo, so they can use the brand. However, Gorton is not happy to see the name used in a way that deviates from its original purpose. "I am not thrilled about an unrelated group of people using the LimeWire name. Using the LimeWire name in this way creates confusion and falsely uses that brand that we created for purposes for which it was never intended," Gorton says. The new LimeWire does have at least one asset that previously belonged to the original LimeWire team; the Limewire.com domain name.

Netflix will soon launch a test letting primary account holders pay an additional fee for users outside their households -- a new attempt by the company to address illicit password-sharing. From a report: According to the Netflix terms of service, a customer's account "may not be shared with individuals beyond your household." After years of turning a blind eye to password-sharing behavior that falls outside that requirement, the company last year ran a limited test prompting users to enter their account credentials as a way to nudge freeloaders into paying for their own accounts. Now, in an upcoming test launching in three countries -- Chile, Costa Rica and Peru -- Netflix will let members who share their accounts with people outside their household do so "easily and securely, while also paying a bit more," according to Chengyi Long, director of product innovation at Netflix. The new options will roll out in the next few weeks in the three countries (and may or may not expand beyond those markets).

An anonymous reader quotes a report from KrebsOnSecurity: Aleksei Burkov, a cybercriminal who long operated two of Russia's most exclusive underground hacking forums, was arrested in 2015 by Israeli authorities. The Russian government fought Burkov's extradition to the U.S. for four years -- even arresting and jailing an Israeli woman to force a prisoner swap. That effort failed: Burkov was sent to America, pleaded guilty, and was sentenced to nine years in prison. But a little more than a year later, he was quietly released and deported back to Russia. Now some Republican lawmakers are asking why a Russian hacker once described as "an asset of supreme importance" was allowed to shorten his stay.

"An ICE spokesperson stated that Burkov is wanted by Russian authorities, and a DOJ spokesperson denied that a prisoner exchange took place," the letter reads. "The decision to prematurely release Burkov is curious given the lengths to which the U.S. government went to secure Burkov's arrest." The letter, signed by the ranking members of the House Judiciary, Homeland Security, Intelligence and Foreign Affairs committees, demanded to know why Burkov was released prematurely, and whether the U.S. received anything in return. The lawmakers also asked for a list of all Russian nationals convicted of crimes in the U.S. who were released early since President Biden took office.

Records show Burkov was in the custody of either Israeli or U.S. authorities for almost five years prior to his sentencing in 2020. At the time of his release, Burkov had already been incarcerated for nearly six years. So where did the other years of his sentence go? That remains unclear, but it is possible he cut some sort of deal to lessen his sentence. On June 16, 2021, a "sealed pleading" was added to Burkov's court record, followed by a sealed document entered on Aug. 18 -- a week before Burkov's deportation. The motion to seal these and other documents related to the pleading was made by U.S. federal prosecutors, and those documents remain hidden from public viewing. "A native of St. Petersburg, Russia, Burkov admitted to running CardPlanet, a site that sold more than 150,000 stolen credit card accounts, and to being a founder of DirectConnection -- a closely guarded online community that attracted some of the world's most-wanted Russian hackers," notes Krebs. "A 2019 deep dive into Burkov's hacker alias 'K0pa' revealed he also was co-administrator of the secretive Russian cybercrime forum 'Mazafaka.' Like DirectConnection, Mazafaka's member roster was a veritable 'Who's Who?' of the Russian hacker underground, and K0pa played a key role in vetting new members and settling disputes for both communities."

An anonymous reader quotes a report from Axios: The Senate passed a measure that would make Daylight Savings Time permanent across the U.S. The bill -- the Sunshine Protection Act co-sponsored by Sen. Sheldon Whitehouse (D-R.I.) and Sen. Marco Rubio (R-Fla.) -- was passed by unanimous consent. It would make Daylight Savings time permanent in 2023. If the legislation clears the House and is signed into law by President Biden, it will mean Americans will no longer have to change their clocks twice a year.

Health groups have called for an end to the seasonal shifting of clocks, a ritual first adopted in the U.S. more than a century ago. At a house hearing last week, health experts cited sleep deprivation and health problems as negative effects associated with changing clocks. Nearly two-thirds of Americans want to stop changing their clocks, according to a 2021 Economist/YouGov poll. Axios has learned that Rep. Vern Buchanan (R-Fla.) "will be leading a letter to Speaker Pelosi calling for immediate House passage of his bill."

By making DST permanent, legislators are prioritizing more daylight in the evening, which could improve our health and allow for more sunshine during the most productive hours of the day. According to a new study published yesterday, sleeping in the dark may reduce your risk of heart disease and diabetes. "The results from this study demonstrate that just a single night of exposure to moderate room lighting during sleep can impair glucose and cardiovascular regulation, which are risk factors for heart disease, diabetes and metabolic syndrome," said study author Dr Phyllis Zee.

Democratic lawmakers are entering a crypto collision course. Politico reports: Questions around how to police digital currency and whether to support its adoption are driving a rift not just between the party's liberal and centrist wings but also among progressives who often see eye-to-eye on financial regulation. Sen. Elizabeth Warren of Massachusetts -- who has long led the left's charge to crack down on banks and Wall Street -- has emerged as one of the party's most vocal cryptocurrency critics, warning that it exposes consumers to danger, is ripe for financial crimes and is an environmental threat because of its electricity usage. But a new generation of progressives -- and a number of other senior Democrats -- are embracing the startup industry. They're arguing against regulations that could stifle what proponents say is a new avenue for financial inclusion and a breakthrough alternative to traditional banks. "The project of radically decentralizing the internet and finance strikes me as a profoundly progressive cause," Rep. Ritchie Torres (D-N.Y.) said in an interview. "You should never define any technology by its worst uses. ... There's more to crypto than ransomware, just like there's more to money than money laundering."

The simmering conflict is set to intensify in the coming months. President Joe Biden last week asked federal agencies to start solidifying the federal government's approach to crypto, framing the step as supportive of innovation rather than an industry crackdown. The price of Bitcoin surged on the news. Separately, Democratic lawmakers have started to draft a host of crypto regulation bills that are also exposing a wide range of views on the government's role in the $1.7 trillion market for digital assets. The lack of consensus among Democrats means it's unlikely Congress will act anytime soon to pass major legislation laying out the direction of regulation of the new market. Some Democrats and lobbyists had expected initial votes early this year, but that timeline has slipped.

TorGuard has settled a copyright infringement lawsuit filed by several movie companies last year. The VPN provider stood accused of failing to take action against subscribers who were pirating films. As part of the settlement, TorGuard agrees to block BitTorrent traffic on U.S. servers; however, it stresses that user privacy is in no way affected by this decision. TorrentFreak reports: "Pursuant to a confidential settlement agreement, Plaintiffs have requested, and Defendant has agreed to use commercially reasonable efforts to block BitTorrent traffic on its servers in the United States using firewall technology," a joint statement reads. This is quite a far-reaching measure as a broad BitTorrent blockade will also affect legal traffic, which includes software updates from Twitter and Facebook. That said, people can still use BitTorrent on servers in other regions. [...]

The company confirms that it's blocking torrent traffic on U.S. servers, but that doesn't change anything for the privacy of users. "TorGuard has not been forced to log network usage data. Due to the nature of shared IP's and related hardware technicalities of how TorGuard's network was built it is impossible for us to do so," the VPN provider writes. "We have a responsibility to provide high quality uninterrupted VPN and proxy services to our client base at large while mitigating any related network abuse that should arise. This commitment to user privacy and service reliability is the reason we have taken measures to block Bittorrent traffic on servers within the United States."

An anonymous reader quotes a report from Ars Technica: Cryptographic keys generated with older software now owned by technology company Rambus are weak enough to be broken instantly using commodity hardware, a researcher reported on Monday. This revelation is part of an investigation that also uncovered a handful of weak keys in the wild. The software comes from a basic version of the SafeZone Crypto Libraries, which were developed by a company called Inside Secure and acquired by Rambus as part of its 2019 acquisition of Verimatrix, a Rambus representative said. That version was deprecated prior to the acquisition and is distinct from a FIPS-certified version that the company now sells under the Rambus FIPS Security Toolkit brand.

Researcher Hanno Bock said that the vulnerable SafeZone library doesn't sufficiently randomize the two prime numbers it used to generate RSA keys. (These keys can be used to secure Web traffic, shells, and other online connections.) Instead, after the SafeZone tool selects one prime number, it chooses a prime in close proximity as the second one needed to form the key. "The problem is that both primes are too similar," Bock said in an interview. "So the difference between the two primes is really small." The SafeZone vulnerability is tracked as CVE-2022-26320. Cryptographers have long known that RSA keys that are generated with primes that are too close together can be trivially broken with Fermat's factorization method. French mathematician Pierre de Fermat first described this method in 1643. Fermat's algorithm was based on the fact that any number can be expressed as the difference between two squares. When the factors are near the root of the number, they can be calculated easily and quickly. The method isn't feasible when factors are truly random and hence far apart. The security of RSA keys depends on the difficulty of factoring a key's large composite number (usually denoted as N) to derive its two factors (usually denoted as P and Q). When P and Q are known publicly, the key they make up is broken, meaning anyone can decrypt data protected by the key or use the key to authenticate messages.

So far, Bock has identified only a handful of keys in the wild that are vulnerable to the factorization attack. Some of the keys belong to printers originally branded as Fuji Xerox and now belonging to Canon. Printer users can use the keys to generate a Certificate Signing Request. The creation date for the keys was 2020 or later. The weak Canon keys are tracked as CVE-2022-26351. Bock also found four vulnerable PGP keys, typically used to encrypt email, on SKS PGP key servers. A user ID tied to the keys implied they were created for testing, so he doesn't believe they're in active use. Bock said he believes all the keys he found were generated using software or methods not connected to the SafeZone library. If true, other software that generates keys might be easily broken using the Fermat algorithm. It's plausible also that the keys were generated manually, "possibly by people aware of this attack creating test data." The researcher found the keys by searching through billions of public keys that he either had access to, were shared with him by other researchers, or that were available through certificate transparency programs. UPDATE: The headline incorrectly stated that a "600-Year-Old Algorithm" was used. It's been changed to "379-Year-Old-Algorithm" to reflect the updated headline on Ars.

Reuters reports: Ukraine's defense ministry on Saturday began using Clearview AI's facial recognition technology, the company's chief executive told Reuters, after the U.S. startup offered to uncover Russian assailants, combat misinformation and identify the dead. Ukraine is receiving free access to Clearview AI's powerful search engine for faces, letting authorities potentially vet people of interest at checkpoints, among other uses, added Lee Wolosky, an adviser to Clearview and former diplomat under U.S. presidents Barack Obama and Joe Biden.

The plans started forming after Russia invaded Ukraine and Clearview Chief Executive Hoan Ton-That sent a letter to Kyiv offering assistance, according to a copy seen by Reuters. Clearview said it had not offered the technology to Russia, which calls its actions in Ukraine a "special operation...."

The Clearview founder said his startup had more than 2 billion images from the Russian social media service VKontakte at its disposal, out of a database of over 10 billion photos total. That database can help Ukraine identify the dead more easily than trying to match fingerprints and works even if there is facial damage, Ton-That wrote.... Ton-That's letter also said Clearview's technology could be used to reunite refugees separated from their families, identify Russian operatives and help the government debunk false social media posts related to the war.

The exact purpose for which Ukraine's defense ministry is using the technology is unclear, Ton-That said. Other parts of Ukraine's government are expected to deploy Clearview in the coming days, he and Wolosky said.