Mozilla Firefox will soon include a revised Referrer Policy to tighten up queries and better protect user information. From a report: Firefox 87, due to ship on March 23, will cut back on path and query string information from referrer headers "to prevent sites from accidentally leaking sensitive user data." In a blog post on Monday, developer Dimi Lee and security infrastructure engineering manager Christoph Kerschbaumer said the latest browser version will include a "stricter, more privacy-preserving default Referrer Policy." Browsers send HTTP Referrer headers to websites to indicate which location has 'referred' a user to a website server. Full URLs of referring documents are often sent in the HTTP Referrer header with other subresource requests, and while this may contain innocent information used for purposes including analytics, private user data may also be included. Referrer policies aim to protect this data, but if no policy is set by a website, this often defaults to "no-referrer-when-downgrade," an element that Firefox says does trim down the referrer when navigating to a less secure resource, but still "sends the full URL including path and query information of the originating document as the referrer."

A married pair of San Francisco entrepreneurs were indicted Thursday on multiple federal charges, the latest twist in the saga of a once trendy, now bankrupt fecal matter-testing startup. From a report: Zachary Schulz Apte and Jessica Sunshine Richman, co-founders of defunct microbiome testing company uBiome, are accused of bilking their investors and health insurance providers, federal prosecutors said. They were indicted Thursday on multiple federal charges, including conspiracy to commit securities fraud, conspiracy to commit health care fraud and money laundering. Their court appearances have not been scheduled, and it was not immediately clear if they had attorneys who could speak on their behalf. Apte, 36, and Richman, 46, founded uBiome in 2012 as a direct-to-consumer service called "Gut Explorer." Customers would submit a fecal sample that the company analyzed in a laboratory, comparing the consumer's microbiome to others' microbiomes, prosecutors said. The service cost less than $100 initially.

The U.S. Supreme Court on Monday turned away Facebook's bid to pare back a $15 billion class action lawsuit accusing the company of illegally tracking the activities of internet users even when they are logged out of the social media platform. Reuters reports: The justices declined to hear Facebook's appeal of a lower court ruling that revived the proposed nationwide litigation accusing the company of violating a federal law called the Wiretap Act by secretly tracking the visits of users to websites that use Facebook features such as the "like" button. The litigation also accuses the company of violating the privacy rights of its users under California law but Facebook's appeal to the Supreme Court involved only the Wiretap Act.

Four individuals filed the proposed nationwide class action lawsuit in California federal court seeking $15 billion in damages for Menlo Park, California-based Facebook's actions between April 2010 and September 2011. The company stopped its nonconsensual tracking after it was exposed by a researcher in 2011, court papers said. Facebook said it protects the privacy of its users and should not have to face liability over commonplace computer-to-computer communications. Facebook has more than 2.4 billion users worldwide, including more than 200 million in the United States.

The case centers on Facebook's use of features called "plug-ins" that third-parties often incorporate into their websites to track the browsing histories of users. Along with digital files called "cookies" that can help identify internet users, the plaintiffs accused Facebook of packaging this tracked data and selling it to advertisers for profit. Facebook said it uses the data it receives to tailor the content it shows its users and to improve ads on its service. [...] In its appeal to the Supreme Court, Facebook said it is not liable under the Wiretap Act because it is a party to the communications at issue by virtue of its plug-ins.

A judge has certified a class action suit against Apple for its fragile butterfly keyboard design. From a report: The suit covers anyone who purchased an Apple MacBook with a butterfly keyboard in seven states: California, New York, Florida, Illinois, New Jersey, Washington, and Michigan. That includes people who bought a MacBook model dating between 2015 and 2017, a MacBook Pro model between 2016 and 2019, or a MacBook Air between 2018 and 2019. Judge Edward Davila certified the case with seven subclasses on March 8th in California, but the order remained sealed until late last week. It raises the stakes for a suit that was first filed in 2018, three years after Apple added the controversial butterfly switches to its laptops. The butterfly keyboard was slimmer than Apple's previous design, which used industry-standard scissor switches. But many disgruntled MacBook users found that Apple's revamped keyboard failed when even tiny particles of dust accumulated around the switches. That resulted in keys that felt "sticky," failed to register keypresses, or registered multiple presses with a single hit. Apple tweaked its butterfly keyboard multiple times, but after continued complaints, it abandoned the switches in 2020.

Apple infringed on a digital rights management patent, and must pay $308.5 million, a federal jury in Texas decided this week.

"Apple said it was disappointed with the ruling and would appeal," reports Bloomberg: "Cases like this, brought by companies that don't make or sell any products, stifle innovation and ultimately harm consumers," the company said in an emailed statement...

U.S. District Judge Rodney Gilstrap last week also adopted a magistrate's recommendation denying Apple's request to find the patent invalid.

Brazil's consumer protection agency Procon-SP has fined Apple nearly $1.92 million for selling iPhone without a charger, reports Engadget (citing two technology blogs.) Apple's move was a violation of the country's Consumer Defense Code, according to the watchdog.

Procon-SP told Apple about the alleged violation in December. Apple responded by reiterating its environmental angle, arguing that it would reduce CO2 emissions and rare earth mining. It noted that many customers already had spare chargers. The agency clearly wasn't satisfied with that answer, however. In issuing the fine, Procon-SP executive director Fernando Capez told Apple it needed to respect Brazilian law.

The fine also covers allegedly misleading water resistance claims. Apple supposedly declined to repair iPhones that had suffered water damage under warranty despite touting the devices' ability to survive immersion for extended periods.

A law professor serving on the EFF's board of directors (and advisory boards for the Electronic Privacy Information Center and the Center for Democracy and Technology) offers this analysis of "the push for stricter rules for internet platforms," reviewing proposed changes to the liability-limiting Section 230 of the Communications Decency Act — and speculating about what the changes would accomplish: Short of repeal, several initiatives aim to change section 230. Eleven bills have been introduced in the Senate and nine in the House of Representatives to amend section 230 in various ways.... Some would widen the categories of harmful conduct for which section 230 immunity is unavailable. At present, section 230 does not apply to user-posted content that violates federal criminal law, infringes intellectual property rights, or facilitates sex trafficking. One proposal would add to this list violations of federal civil laws.

Some bills would condition section 230 immunity on compliance with certain conditions or make it unavailable if the platforms engage in behavioral advertising. Others would require platforms to spell out their content moderation policies with particularity in their terms of service (TOS) and would limit section 230 immunity to TOS violations. Still others would allow users whose content was taken down in "bad faith" to bring a lawsuit to challenge this and be awarded $5,000 if the challenge was successful. Some bills would impose due process requirements on platforms concerning removal of user-posted content. Other bills seek to regulate platform algorithms in the hope of stopping the spread of extremist content or in the hope of eliminating biases...

Neither legislation nor an FCC rule-making may be necessary to significantly curtail section 230 as a shield from liability. Conservative Justice Thomas has recently suggested a reinterpretation of section 230 that would support imposing liability on Internet platforms as "distributors" of harmful content... Section 230, after all, shields these services from liability as "speakers" and "publishers," but is silent about possible "distributor" liability. Endorsing this interpretation would be akin to adopting the notice-and-takedown rules that apply when platforms host user-uploaded files that infringe copyrights.
Thanks to Slashdot reader Beeftopia for sharing the article, which ultimately concludes: - Notice-and-takedown regimes have long been problematic because false or mistaken notices are common and platforms often quickly take-down challenged content, even if it is lawful, to avoid liability...

- For the most part, these platforms promote free speech interests of their users in a responsible way. Startup and small nonprofit platforms would be adversely affected by some of the proposed changes insofar as the changes would enable more lawsuits against platforms for third-party content. Fighting lawsuits is costly, even if one wins on the merits.

- Much of the fuel for the proposed changes to section 230 has come from conservative politicians who are no longer in control of the Senate.

- The next Congress will have a lot of work to do. Section 230 reform is unlikely to be a high priority in the near term. Yet, some adjustments to that law seem quite likely over time because platforms are widely viewed as having too much power over users' speech and are not transparent or consistent about their policies and practices.

The Bulletin of the Atomic Scientists published a discussion between a 77-year-old "father of the internet" and a 75-year-old "father of public key cryptography". Long before Vinton Cerf and Martin Hellman changed the world with their inventions, they were young assistant professors at Stanford University who became fast friends... More than 50 years and two technological revolutions later, the friendship between Vint and Marty — as they know each other — endures. This is despite, or perhaps because of, their sometimes different views. You see, while they do not always agree, they both enjoy a good intellectual debate, especially when the humans they sought to bring together with their inventions face existential threats.

Not long after giving the world public key cryptography, Hellman switched his focus from encryption to efforts that might avoid nuclear war. "What's the point of developing new algorithms if there's not likely to be anybody around in 50-100 years?" Hellman recalls thinking at the time... On a recent private phone call with each other, the two friends discussed the National Academies of Sciences, Engineering, and Medicine's project seeking to answer the question, "Should the U.S. use quantitative methods to assess the risks of nuclear war and nuclear terrorism?"

While both agree that the US needs to understand the risk of nuclear war, they disagree about whether a quantitative analysis is necessary.
"Quantitative estimates run either the real or perceived risk of being twisted to support whatever conclusion is desired," Cerf argues — while sharing instead an analogy he believes illustrates the risks of the 13,410 nuclear weapons currently in the world (91% divided between Russia and the U.S.)

But Hellman counters that "When the risk is highly uncertain, how do you determine who's right?" He ultimately suggests quantifying the risks would make society more fully aware of the stakes.

"I hope you will agree with either my quantitative approach or Vint's qualitative approach," Hellman concludes, "both of which conclude that the risk of a nuclear war is unacceptably high and risk reduction measures are urgently needed." But for those who accept neither approach, Hellman adds two questions:

• What evidence supports the belief that the risk of nuclear deterrence failing is currently at an acceptable level?
• Can we responsibly bet humanity's existence on a strategy for which the risk of failure is totally unknown?

If you were on the call — what would you say?

America's Environmental Protection Agency "just resurrected a website chock full of data, background and science about global warming that the Trump administration had deleted," reports Bloomberg. EPA Administrator Michael Regan cast the website's revival as part of a broader effort to ensure EPA decisions are grounded in sound science. "Trustworthy, science-based information is at the foundation of strong, achievable solutions," he said.
CBS News reports that the relaunched site "has two simple messages on an image carousel on the home page: The climate crisis is an EPA priority and public understanding of the implications of the crisis are essential to addressing it."

Thursday the agency released this statement: Climate change leads to rising seas, retreating snow and ice, and to changes in the frequency and intensity of heat waves, precipitation, and extreme weather events. These changes, occurring as a result of the buildup of greenhouse gases due to human activities, are changing the climate at a pace and in a way that threatens human health, society, and the natural environment. Children, the elderly, and the poor are among the most vulnerable to climate-related health effects.

The Biden administration "is preparing a series of aggressive cyber attacks on Russia in a major shift in tactics designed as a warning shot to rival powers," reports the Telegraph newspaper: The attack, which is expected in the next fortnight, is in retaliation for the SolarWinds hack, the large-scale infiltration of American government agencies and corporations discovered late last year that was traced back to the Kremlin... The U.S. will not target civilian structures or networks, but the hack is instead designed as a direct challenge to Mr Putin, Russia's President, and his cyber army, The Telegraph understands.

The White House confirmed it will take "a mix of actions" — both "seen and unseen" — although it did not provide specifics on when and how it would do so... "I actually believe that a set of measures that are understood by the Russians, but may not be visible to the broader world, are actually likely to be the most effective measures in terms of clarifying what the United States believes are in bounds and out of bounds, and what we are prepared to do in response," Jake Sullivan, U.S. National Security Adviser, told the New York Times last week.

Mr Sullivan stressed that traditional sanctions alone do not sufficiently raise the cost to force powers like Russia, or China.

The Verge writes: If you've ever struggled through a maze of online customer service to cancel a subscription or delete an account, you've likely encountered "dark patterns" — user interfaces that are designed to trick and frustrate users. The concept was coined in 2010 but is slowly being addressed in U.S. legislation, with California this week announcing that it is banning the use of dark patterns that stop users from opting out of the sale of their personal data.

The updated regulation strengthens enforcement of the 2018 California Consumer Privacy Act (CCPA), one of the toughest consumer privacy laws in the US. The CCPA gives Californians the right "to say no to the sale of personal information," but the state government is evidently worried that these options will be buried under byzantine menus. By banning dark patterns, California will "ensure that consumers will not be confused or misled when seeking to exercise their data privacy rights," said the state's Attorney General Xavier Becerra in a press statement.

The newly-approved regulation does not ban all uses of dark patterns, only those that have "the substantial effect of subverting or impairing a consumer's choice to opt-out" of schemes where their personal data is being sold...

Businesses found not to be in compliance with the CCPA are sent a "notice to cure," giving them a 30-day window to amend their services.

For 30 years David E. Sanger has been covering foreign policy and nuclear proliferation for The New York Times — twice working on Pulitzer Prize-winning teams. But now as American and Chinese officials meet in Alaska, Sanger argues that China's power doesn't come from weapons — nuclear or otherwise: Instead, it arises from their expanding economic might and how they use their government-subsidized technology to wire nations be it Latin America or the Middle East, Africa or Eastern Europe, with 5G wireless networks intended to tie them ever closer to Beijing. It comes from the undersea cables they are spooling around the world so that those networks run on Chinese-owned circuits. Ultimately, it will come from how they use those networks to make other nations dependent on Chinese technology. Once that happens, the Chinese could export some of their authoritarianism by, for example, selling other nations facial recognition software that has enabled them to clamp down on dissent at home.

Which is why Jake Sullivan, Mr. Biden's national security adviser, who was with Secretary of State Antony J. Blinken for the meeting with their Chinese counterparts in Anchorage, warned in a series of writings in recent years that it could be a mistake to assume that China plans to prevail by directly taking on the United States military in the Pacific. "The central premises of this alternative approach would be that economic and technological power is fundamentally more important than traditional military power in establishing global leadership," he wrote, "and that a physical sphere of influence in East Asia is not a necessary precondition for sustaining such leadership...."

Part of the goal of the Alaska meeting was to convince the Chinese that the Biden administration is determined to compete with Beijing across the board to offer competitive technology, like semiconductor manufacturing and artificial intelligence, even if that means spending billions on government-led research and development projects, and new industrial partnerships with Europe, India, Japan and Australia... But it will take months, at best, to publish a broad new strategy, and it is unclear whether corporate America or major allies will get behind it.

In 2019 Purism launched a suite of privacy-protecting, no-tracking apps and services named Librem One. And it included an encrypted, no-logging, virtual private network tunnel named Librem Tunnel.

Unfortunately, "Recently we've been forced to remove Librem Tunnel from iOS due to their unfair policies," explains a post this week on Purism's blog: Apple's policy is that applications that make in-app purchases or offer subscriptions using Apple's payment platform pay Apple 30% of their revenue. The justification behind that fee is that companies are benefiting from all of the work Apple has put into its payments platform and so the fee helps them maintain that payments infrastructure while saving app developers from having to implement their own payment or subscription infrastructure...

Recently our VPN endpoints have changed, which required us to update the Librem Tunnel application. Unfortunately our attempts to push an update were blocked, because Apple saw that the application was a VPN, which flagged it to check whether it was a subscription service (which VPNs frequently are). Even though Librem Tunnel is just part of the overall Librem One offering, because it's part of a subscription service, Apple is requiring us to add the ability to sign up and pay for Librem One subscriptions within the Librem Tunnel app before they will allow updated versions into the App Store. Why are they making that requirement even though we already have our own independent payment infrastructure? Because once that app allows in-app purchases, Apple can then automatically take their 30% cut.

We do not accept these kinds of monopolistic practices, nor do we want to fund them through our own customers. Since Apple does not allow alternatives to the App Store on their platform, we have no choice but to remove Librem Tunnel from iOS, until such time Apple changes their policies either on their own, or through government intervention.
For their existing users on iOS, "Because Librem Tunnel uses the standard, open, OpenVPN protocol, we have been working with customers to apply their OpenVPN configuration to a different iOS OpenVPN client."

A Russian man has pleaded guilty in the U.S. to offering a Tesla employee $1 million to cripple the electric car company's massive electric battery plant in Nevada with ransomware and steal company secrets for extortion, prosecutors and court records said. The Associated Press reports: In a case that cybersecurity experts called exceptional for the risks he took, Egor Igorevich Kriuchkov pleaded guilty Thursday in U.S. District Court in Reno. Prosecutors alleged that Kriuchkov acted on behalf of co-conspirators abroad and attempted to use face-to-face bribery to recruit an insider to physically plant ransomware, which scrambles data on targeted networks and can only be unlocked with a software key provided by the attackers. Typically, ransomware gangs operating from safe havens hack into victim networks over the internet and download data before activating the ransomware.

"The fact that such a risk was taken could, perhaps, suggest that this was an intelligence operation aimed at obtaining information rather than an extortion operation aimed at obtaining money," said Brett Callow, a cybersecurity analyst at anti-virus software company Emsisoft. "It's also possible that the criminals thought the gamble was worth it and decided to roll the dice," Callow said. The FBI said the plot was stopped before any damage happened. Although Kriuchkov says the Russian government was aware of his case, prosecutors and the FBI have not alleged ties to the Kremlin.

"His guilty plea to conspiracy to intentionally cause damage to a protected computer could have gotten him up to five years in prison and a $250,000 fine," the report says. "But he's expected to face no more than 10 months under terms of his written plea agreement."

An anonymous reader quotes a report from CNBC: Facebook CEO Mark Zuckerberg on Thursday said he is confident the social media company "will be able to manage through" Apple's upcoming planned privacy update to iOS 14, which will make it easier for iPhone and iPad users to block companies from tracking their activity to target ads. "We'll be in a good position," Zuckerberg said Thursday afternoon in Josh Constine's PressClub Clubhouse room. Apple's upcoming privacy changes will inform users about device ID tracking and ask them if they want to allow it. The tracking is based on a unique device identifier on every iPhone and iPad called the IDFA. Companies that sell mobile advertisements use this ID to help target ads and estimate their effectiveness. Apple has said that the change will roll out early this spring.

Zuckerberg explained that the change could benefit Facebook if more businesses decide to sell goods directly through Facebook and Instagram. "It's possible that we may even be in a stronger position if Apple's changes encourage more businesses to conduct more commerce on our platforms by making it harder for them to use their data in order to find the customers that would want to use their products outside of our platforms," Zuckerberg said. Zuckerberg on Thursday said that already Facebook has 1 million active shops on its services and 250 million people using shops actively. "Compared to the early conversations we had about how people would use this across Facebook and Instagram and our product, I think this is something that's well on track to be something that's going to be increasingly important to people," Zuckerberg said.

Distribution systems within the U.S. electrical grid are increasingly vulnerable to cyberattack, a government watchdog said in a report released Thursday. The Hill reports: In the report, the Government Accountability Office (GAO) noted that the Department of Energy's cybersecurity strategy has predominantly focused on generation and transmission systems. The watchdog recommended further attention to risks facing distribution systems, those parts of the grid that actually carry power directly to customers. Those aspects of the grid, the report states, "are becoming more vulnerable to cyberattacks, in part due of the introduction of and reliance on monitoring and control technologies." "However, the scale of potential impacts from such attacks is not well understood," it states.

Distribution systems' vulnerability is increasing due to their industrial control systems, which have increasingly been incorporating remote access. As a result, they can give bad actors access to them. The systems the report analyzed generally are not covered by federal cybersecurity standards but have in some cases taken independent action on them. Energy Department officials told GAO investigators they were unaware of any assessments underway analyzing how a cyberattack would affect distribution systems, saying the impact would likely be less significant than on generation and transmission. However, the report notes, depending on which distribution was affected it could have nationwide effects.

Police have warned students in the UK against using the Sci-Hub website, which they say lets users "illegally access" millions of scientific research papers. Specifically, the police say the website could "pose a threat to their personal information and data." The BBC reports: The police are concerned that users of the "Russia-based website" could have information taken and misused online. The Sci-Hub says its website "removes all barriers" to science. It offers open access to more than 85 million scientific papers and claims that copyright laws should be abolished and that such material should be "knowledge to all." It describes itself as "the first pirate website in the world to provide mass and public access to tens of millions of research papers."

But Max Bruce, the City of London Police's cyber protection officer, has urged universities to block the website on their network because of the "threat posed by Sci-Hub to both the university and its students." "If you're tricked into revealing your log-in credentials, whether it's through the use of fake emails or malware, we know that Sci-Hub will then use those details to compromise your university's computer network in order to steal research papers," he said. "Students should be aware that accessing such websites is illegal, as it hosts stolen intellectual property," said Det Insp Kevin Ives. He warned that visitors to the website, whose Twitter account has been suspended, are "very vulnerable to having their credentials stolen."

An anonymous reader quotes a report from Ars Technica: AT&T lied about California's net neutrality law yesterday when it claimed the law requires AT&T to stop providing "free data" to mobile customers. In reality, the California law allows AT&T to continue zero-rating HBO Max, its own video service, as long as it exempts all competing video services from data caps without charging the other video providers. But instead of zero-rating all video without collecting payments from its competitors in the online-video business, AT&T decided it would rather not exempt anything at all.

"Unfortunately, under the California law we are now prohibited from providing certain data features to consumers free of charge," AT&T claimed in its announcement that it is ending the "zero-rating" program that exempts some content from data caps. "Given that the Internet does not recognize state borders, the new law not only ends our ability to offer California customers such free data services but also similarly impacts our customers in states beyond California," the AT&T announcement also said. Going forward, AT&T will no longer exempt the AT&T-owned HBO Max from its mobile data caps and will stop the "sponsored data" program in which it charges other companies for similar exemptions from AT&T's data caps. But this is a business decision, not purely a legal one: as we already stated, AT&T could exempt all video streaming services including HBO Max from its mobile data caps without violating the California law as long as AT&T stops charging rival video companies for the same data-cap exemptions.

As WhatsApp spends months to address users' concerns and confusion about its planned policy update, there is evidently one entity it hasn't had much luck making inroads with: The Government of India. From a report: The Indian government alleged on Friday that WhatsApp's planned privacy update, which goes into effect in two months, violates local laws on several counts. In a filing to the Delhi High Court, the federal government also asked the court to prevent Facebook-owned messaging app from rolling out the update in India, WhatsApp's biggest market by users.

The U.S. Department of Justice is investigating whether Visa is engaging in anticompetitive practices in the debit-card market, the Wall Street Journal reported on Friday, citing people familiar with the matter. From a report: The department's antitrust division has been probing if Visa limited merchants' ability to route debit-card transactions over card networks that are often less expensive, the WSJ reported. Many of the department's questions are focused on online debit-card transactions, but investigators are looking into in-store issues as well, according to the report. Earlier this year, Visa and fintech startup Plaid called off their $5.3 billion merger following a lawsuit from the Justice Department aimed at blocking the deal on antitrust grounds.