AmiMoJo writes: The use of "invisible" tracking tech in emails is now "endemic", according to a messaging service that analysed its traffic at the BBC's request. Hey's review indicated that two-thirds of emails sent to its users' personal accounts contained a "spy pixel", even after excluding for spam. Its makers said that many of the largest brands used email pixels, with the exception of the "big tech" firms. Defenders of the trackers say they are a commonplace marketing tactic. And several of the companies involved noted their use of such tech was mentioned within their wider privacy policies. Emails pixels can be used to log: if and when an email is opened, how many times it is opened, what device or devices are involved, the user's rough physical location, deduced from their internet protocol (IP) address - in some cases making it possible to see the street the recipient is on.

This information can then be used to determine the impact of a specific email campaign, as well as to feed into more detailed customer profiles. Hey's co-founder David Heinemeier Hansson says they amount to a "grotesque invasion of privacy". And other experts have also questioned whether companies are being as transparent as required under law about their use.

New York's attorney general, Letitia James, sued Amazon on Tuesday evening, arguing that the company provided inadequate safety protection for workers in New York City during the pandemic and retaliated against employees who raised concerns over the conditions. From a report: The case focuses on two Amazon facilities: a large warehouse on Staten Island and a delivery depot in Queens. Ms. James argues that Amazon failed to properly clean its buildings, conducted inadequate contact tracing for known Covid-19 cases, and "took swift retaliatory action" to silence complaints from workers. "Amazon's extreme profits and exponential growth rate came at the expense of the lives, health and safety of its frontline workers," Ms. James argued in the complaint, filed in New York Supreme Court. Kelly Nantel, a spokeswoman for Amazon, said the company cared "deeply about the health and safety" of its workers. "We don't believe the attorney general's filing presents an accurate picture of Amazon's industry-leading response to the pandemic," Ms. Nantel said. Last week, Amazon preemptively sued Ms. James in federal court in an attempt to stop her from bringing the charges. The company argued that workplace safety was a matter of federal, not state, law.

The current COVID-19 pandemic and the subsequent stay-at-home and social distancing directives might have played a major role in romance scams losses reaching record levels in 2020, the US Federal Trade Commission said in a report last week. From a report: Total losses were estimated at a record $304 million, up about 50% from 2019, with the average loss last year being estimated at $2,500 per individual. "From 2016 to 2020, reported total dollar losses increased more than fourfold, and the number of reports nearly tripled," the agency said. The FTC believes that the 50% spike in extra losses recorded in 2020 can be attributed to the COVID-19 pandemic, which has limited people's ability to meet in person and has forced more users towards using online long-distance and impersonal communications, such as dating apps. In most cases, the ruse of these scams is that the targets of a romance scam have to send money back to the crooks.

Criminals who keep their funds in cryptocurrency tend to launder funds through a small cluster of online services, blockchain investigations firm Chainalysis said in a report last week. From a report: This includes services like high-risk (low-reputation) crypto-exchange portals, online gambling platforms, cryptocurrency mixing services, and financial services that support cryptocurrency operations headquartered in high-risk jurisdictions. Criminal activity studied in this report included cryptocurrency addresses linked to online scams, ransomware attacks, terrorist funding, hacks, transactions linked to child abuse materials, and funds linked to payments made to dark web marketplaces offering illegal services like drugs, weapons, and stolen data. But while you'd expect that the money laundering resulting from such a broad spectrum of illegal activity to have taken place across a large number of services, Chainalysis reports that just a small group of 270 blockchain addresses have laundered around 55% of cryptocurrency associated with criminal activity.

"The developers of audio chat room app Clubhouse plan to add additional encryption to prevent it from transmitting pings to servers in China," reports The Verge, "after Stanford researchers said they found vulnerabilities in its infrastructure." In a new report, the Stanford Internet Observatory (SIO) said it confirmed that Shanghai-based company Agora Inc., which makes real-time engagement software, "supplies back-end infrastructure to the Clubhouse App." The SIO further discovered that users' unique Clubhouse ID numbers — not usernames — and chatroom IDs are transmitted in plaintext, which would likely give Agora access to raw Clubhouse audio. So anyone observing internet traffic could match the IDs on shared chatrooms to see who's talking to each other, the SIO tweeted, noting "For mainland Chinese users, this is troubling."

The SIO researchers said they found metadata from a Clubhouse room "being relayed to servers we believe to be hosted in" the People's Republic of China, and found that audio was being sent to "to servers managed by Chinese entities and distributed around the world." Since Agora is a Chinese company, it would be legally required to assist the Chinese government locate and store audio messages if authorities there said the messages posed a national security threat, the researchers surmised...

The company told SIO that it was going to roll out changes "to add additional encryption and blocks to prevent Clubhouse clients from ever transmitting pings to Chinese servers" and said it would hire an external security firm to review and validate the updates.

Slashdot reader DevNull127 writes: The U.S. Cyber Command, headed by the National Security Agency's director, has been a part of America's Department of Defense since 2009.

Today this unified combatant command wished its followers on Twitter a happy Valentine's Day, adding "As our gift to you, we present 12 crypto challenges designed by the information security community.

"Love is in the air, find it if you can. #BeOurValentine #cryptochallenge #VDayGifts."

They shared a link to the official U.S. Cyber Command Valentine's Day 2021 Cryptography Challenge Puzzles.
There are 12 tricky puzzles in all — 3 .jpgs, 6 .pngs, 2 .mp3s and a .bmp file — and I couldn't solve a single one of 'em.

Each one has a hint — though that hint is just the number of words in the answer, as well as its number of characters.

Amazon is using AI cameras to monitor drivers of its delivery vans for safety issues — but also a second driver safety app on their phones.

Though it's named Mentor, Mashable reports that "it doesn't seem to be helping..." CNBC talked to drivers who said the app mostly invades their privacy or miscalculates dangerous driving behavior. One driver said even though he didn't answer a ringing phone, the app docked points for using a phone while driving. Another worker was flagged for distracted driving at every delivery stop she made.

The incorrect tracking has real consequences, ranging from restricted payouts and bonuses to job loss. The app gives a safety score which is used to rank drivers and compare them to colleagues.

The App Store description calls this "a little friendly competition!"
CNBC reports that one driver even created a YouTube video showing how Amazon's delivery van drivers could appease the app: by wrapping their cellphone in a sweater and then shoving it in their glovebox.

Otherwise, "If your device moves at all, it's going to count against you."

"A cryptocurrency company that owns 67,000 acres in rural northern Nevada wants state government to grant technology companies power to form local governments on land they own," reports the Associated Press.

Jeffrey Berns, CEO of Nevada-based Blockchains LLC, ultimately envisions "a city where people not only purchase goods and services with digital currency but also log their entire online footprint — financial statements, medical records and personal data — on blockchain."

The Associated Press calls him "a cryptocurrency magnate" who "hopes to turn dreams of a futuristic "smart city" into reality." To do that, he's asking the state to let companies like his form local governments on land they own, which would grant them power over everything from schools to law enforcement...

The company wants to break ground by 2022 in rural Storey County, 12 miles east of Reno. It's proposing to build 15,000 homes and 33 million square feet of commercial and industrial space within 75 years. Berns, whose idea is the basis for draft legislation that some lawmakers saw behind closed doors last week, said traditional government doesn't offer enough flexibility to create a community where people can invent new uses for his technology.

"There's got to be a place somewhere on this planet where people are willing to just start from scratch and say, 'We're not going to do things this way just because it's the way we've done it,'" Berns said. He wants Nevada to change its laws to allow "innovation zones," where companies would have powers like those of a county government, including creating court systems, imposing taxes and building infrastructure while making land and water management decisions...

If lawmakers back the proposal, technology companies with 50,000 acres of land that promise a $1 billion investment could create zones governed by three people like county commissioners. The draft legislation says two of them initially would be from the company itself... The former consumer protection attorney said the idea was born from how he sees government as an unnecessary middleman between people and ideas.

"For us to be able to take risks and be limber, nimble and figure things out like you do when you're designing new products, that's not how government works. So why not let us just create a government that lets us do those things?" Berns said.
The article notes that "innovation zones" and Blockchains LLC were both a key part of the governor's annual "State of the State" address last month. And that both the governor's campaign and an affiliated political action committee "received a combined $60,000 from the company."

How does the trendy new audio-chatroom app Clubhouse handle user privacy? Recode reports: What if you didn't give Clubhouse access to your contacts, specifically because you didn't want all or any of them to know you were there? I regret to inform you that Clubhouse has made it possible for them to know anyway, encourages them to follow you, and there isn't much you can do about it. When I joined, I didn't give Clubhouse access to my contacts; as has been my policy since childhood, only I may decide who enters my clubhouse. Nevertheless, a few minutes later, I had a bunch of followers from my contacts. Even worse: I got followers who weren't in my contacts at all — but I was in theirs.

It turns out that your privacy on Clubhouse depends not just on what you do but also on what those who have your information in their contacts do. For now, you can only get invited to Clubhouse through your phone number, which is attached to your account and can't be removed. So if someone has your phone number in their contacts, and they've given Clubhouse access to those contacts, they'll get a notification when you join the app and a recommendation to follow you...

It's not clear why Clubhouse doesn't have better options for users to manage their privacy or more information for users about how their data might be used or linked to them. The company is reportedly operating with a small staff, but it also has millions of users and millions of dollars worth of funding from major Silicon Valley venture capital firms, including Andreessen Horowitz, and a valuation of $1 billion. It's not the first well-funded social media app to push the boundaries of data privacy. But you'd at least think Clubhouse would have learned from the unicorns that came before it.

Miami's mayor Francis Suarez is trying to attract tech talent to his city. (The New York Times recently noted he's joined by "a few venture capital influencers trying to tweet the city's startup world into existence.") So he's still pushing a proposal to use bitcoin in a few city operations as "part of a larger play if you will to position Miami as one of the most tech-forward cities in the country," according to Reuters.

Bloomberg reports: The mayor wants to allow the City of Miami's workers to choose to receive all or a portion of their pay in Bitcoin, according to a resolution passed by the city's governing commission. In addition, the mayor proposed allowing people to pay all or part of property taxes or city fees in crypto.

Although the commission approved the resolution 4-1, it significantly dialed back its original wording. It only agreed to study the practicality of such steps, rather than taking action, as the original proposal had suggested...

Suarez also wants the city to analyze the feasibility to invest some government funds in Bitcoin, the resolution said. It's not clear how much of that is actually possible: Florida statutes have strict limitations on how local governments can invest surplus funds, generally restricting investments to low-volatility instruments such as those issued by the U.S. government. In the past year alone, Bitcoin has shown it can double in price — or lose half its value — in a month's time....

Ken Russell, vice-chairman of the city commission, said he's "certainly not opposed" to the idea of integrating Bitcoin into the city's business, but it's important to ensure "we all know what we're getting into."

"What needs to be done is diligence, and not just from the legal perspective," he said in an interview Wednesday. "It's not just a currency, it's a concept."
Bloomberg also points out that the mayor of the City of Miami "doesn't control the budget or municipal workforce or get a vote on the commission.

"He asked voters to give him more managerial power, but the initiative failed."

The Associated Press reports: Amazon is suing the attorney general of New York in a bid to stop her from suing the company over its coronavirus safety protocols and the firing of one of its outspoken workers.

In the lawsuit filed Friday in Brooklyn federal court, Amazon said Attorney General Letitia James overstepped her authority by trying to regulate coronavirus safety protocols at its warehouse in New York's Staten Island borough. The company said James threatened to sue if Amazon didn't agree to her list of demands, including rehiring the worker, Christian Smalls, and paying him and another fired worker large sums of money.

James said Friday that she will continue to review her legal options. In a statement, she called Amazon's lawsuit "a sad attempt to distract from the facts and shirk accountability for its failures to protect hardworking employees from a deadly virus..."

The company argued in court documents that only the federal government can mandate COVID-19 safety protocols and that the attorney general's office doesn't have the legal authority "it purports to wield against Amazon." Seattle-based Amazon is asking the court to stop James from pursuing any action against the company, and to declare that she doesn't have authority on COVID-19 safety measures or to regulate claims that a worker was retaliated against.

An anonymous reader quotes a report from ZDNet: Russian search engine and email provider Yandex said today that it caught one of its employees selling access to user email accounts for personal gains. The company, which did not disclose the employee's name, said the person was "one of three system administrators with the necessary access rights to provide technical support" for its Yandex.Mail service. The Russian company said it's now in the process of notifying the owners of the 4,887 mailboxes that were compromised and to which the employee sold access to third-parties. Yandex officials also said they re-secured the compromised accounts and blocked what appeared to be unauthorized logins. They are now asking impacted account owners to change their passwords. It also said that there was no evidence to suggest that user payment data was accessed during the recent incident.

Apple's upcoming iOS 14.5 release will ship with a feature that will re-route all Safari's Safe Browsing traffic through Apple-controlled proxy servers as a workaround to preserve user privacy and prevent Google from learning the IP addresses of iOS users. From a report: The new feature will work only when users activate the "Fraudulent Website Warning" option in the iOS Safari app settings. This enables support for Google's Safe Browsing technology in Safari. The Safe Browsing technology works by taking an URL the user is trying to access, sending the URL in an anonymized state to Google's Safe Browsing servers, where Google accesses the site and scans for threats. If malware, phishing forms, or other threats are found on the site, Google tells the user's Safari browser to block access to the site and show a fullscreen red warning. While years ago, when Google launched the Safe Browsing API, the company knew what sites a user was accessing; in recent years, Google has taken several steps to anonymize data sent from user's devices via the Safe Browsing feature. But while Google has anonymized URL strings, by sending the link in a cropped and hashed state, Google still sees the IP address from where a Safe Browsing check comes through. Apple's new feature basically takes all these Safe Browsing checks and passes them through an Apple-owned proxy server, making all requests appear as coming from the same IP address.

The kingpin or kingpins of the world's biggest illicit credit card marketplace have retired after making an estimated fortune of over $1 billion in cryptocurrency, according to research by blockchain analysis firm Elliptic shared with Reuters. From the report: The "Joker's Stash" marketplace, where stolen credit cards and identity data traded hands for bitcoin and other digital coins, ceased operations this month, Elliptic said on Friday, in what it called a rare example of such a site bowing out on its own terms. Criminal use of cryptocurrencies has long worried regulators, with U.S. Treasury Secretary Janet Yellen and European Central Bank President Christine Lagarde calling last month for tighter oversight. While terrorist financing and money laundering are top of law-enforcement concerns, narcotics, fraud, scams and ransomware are among the chief areas of illegal use of digital currencies, according to Elliptic co-founder Tom Robinson. Joker's Stash was launched in 2014, with its anonymous founder "JokerStash" -- which could be one or more people -- posting messages in both Russian and English, Elliptic said. It was available on the regular web and via the darknet, which hosts marketplaces selling contraband.

An anonymous reader quotes a report from CNET: GameStop's stock price shot through the roof in late January thanks to traders on Reddit. Now at least two government agencies are reportedly investigating why it happened as well as what roles Reddit and trading app Robinhood played in the stock market craziness. The Department of Justice's fraud section and the San Francisco US attorney's office are seeking information about the trading frenzy from social media companies and trading platforms, according to a report Thursday from The Wall Street Journal. Prosecutors have reportedly subpoenaed information from Robinhood, where many of the trades happened. According to the Journal, Reddit is under investigation by the Commodity Futures Trading Commission (CFTC) as well for its part in possible misconduct with traders at the subreddit r/WallStreetBets who spurred the buying spree of GameStop along with other "meme" stocks. Congress is already planning a hearing on Feb. 18 about the events. Rep. Maxine Waters, a Democrat from California, told Cheddar on Feb. 3 that her committee would hear from Reddit, GameStop, Robinhood and others involved.

Germany says its citizens will be able to use smartphones to store their government-issued ID cards and prove their identity online. The Associated Press reports: The Interior Ministry said Wednesday that from this fall, citizens will be able to use the electronic ID stored in their smartphones together with a PIN number to prove they are who they claim to be when communicating with authorities or private businesses. Separately, the ministry said the Cabinet has agreed on a bill that will make government-generated data openly available to businesses and private individuals where possible, to spur the development of new applications.

Germans are frequently required to present credit card-sized cards featuring their photo and personal details, such as when applying for benefits, opening bank accounts or registering a vehicle. While there are already ways of doing this online, the physical card and a card reader are currently required.

An anonymous reader quotes a report from ZDNet: Google is rolling out its virtual private network (VPN) service for subscribers of its Fi network that should help people when they're using online services on public Wi-Fi. "We plan to roll out the VPN to iPhone starting this spring," Google notes. Google is also bringing its privacy and security hub to Android devices, offering users a shortcut to features available to Android users, such as its VPN.

Finally, Fi users can expect free spam call warnings and blocking to stop identified robocalls and scams and the company is stepping up its game to protect users from SIM swapping scams. "Your Fi number is tied to your Google Account and comes with security features that protect your phone number from threats like SIM swaps -- that's when bad actors try to take someone's phone number and assign it to another SIM card without their consent," Google said. "On Fi, you receive extra layers of protection by default, including a robust account recovery process and notifications for suspicious activity. You can also enable 2-step verification for more protection."

Federal authorities are investigating a massive counterfeit N95 mask operation in which fake 3M masks were sold in at least five states to hospitals, medical facilities and government agencies. From a report: The foreign-made knockoffs are becoming increasingly difficult to spot and could put health care workers at grave risk for the coronavirus. These masks are giving first responders "a false sense of security," said Steve Francis, assistant director for global trade investigations with the Homeland Security Department's principal investigative arm. He added, "We've seen a lot of fraud and other illegal activity." Nearly a year into the pandemic, fraud remains a major problem as scammers seek to exploit hospitals and desperate and weary Americans. Federal investigators say they have seen an increase in phony websites purporting to sell vaccines as well as fake medicine produced overseas and scams involving personal protective equipment. The schemes deliver phony products, unlike fraud earlier in the pandemic that focused more on fleecing customers.

Similar to Nintendo's "Joy-Con drift," Sony's PlayStation 5 DualSense controller is apparently suffering from drift: movement on-screen that doesn't correspond to any button press or input. ExtremeTech reports: Users have reported DualSense drift as quickly as 10 days after purchasing a PlayStation 5, which tracks with some of the shorter reports we've heard about Nintendo as well. We can assume that some DualSense controllers will suffer drift because no consumer company can guarantee that literally 100 percent of its products will not contain a defect of some kind. One key factor to look for when judging the seriousness of claims like this is how many people encounter the same issue repeatedly. [...] Kotaku reports that Sony is honoring requests to repair DualSense controllers under warranty, but you'll have to pay the shipping fee to send your controller to the company. Return shipping and the cost of repairs or replacement will be covered by Sony. According to IGN, the U.S.-based law firm of Chimicles Schwartz Kriner & Donaldson-Smith LLP has set up a questionnaire page on its website, allowing PS5 owners to report problems with their DualSense controllers.

No action has been take yet, but CSK&D stated that it is "investigating a potential class action based upon reports that Sony PS5 DualSense controllers for the PlayStation 5 console can experience drift issues and/or fail prematurely," reads the page introduction. "Specifically, it is reported that the joystick on certain PS5 DualSense controllers will automatically register movement when the joystick is not being controlled and interfere with gameplay." The firm was one of the firms that handled the Nintendo "Joy-Con drift" situation last year.

The North Dakota Senate recently introduced a new bill that would prevent Apple and Google from requiring developers to use their respective app stores and payment methods, paving the way for alternative app store options.

In response, Apple Chief Privacy Engineer Erik Neuenschwander said that it "threatens to destroy the iPhone as you know it" by requiring changes that would "undermine the privacy, security, safety, and performance" of the iPhone. Neuenschwander said that Apple "works hard" to keep bad apps from the App Store, and North Dakota's bill would "require us to let them in." MacRumors reports: According to Senator Kyle Davison, who introduced Senate Bill 2333 yesterday, the legislation is designed to "level the playing field" for app developers in North Dakota and shield customers from "devastating, monopolistic fees imposed by big tech companies," which refers to the cut that Apple and Google take from developers. Specifically, the bill would prevent Apple from requiring a developer to use a digital application distribution platform as the exclusive mode of distributing a digital product, and it would keep the company from requiring developers to use in-app purchases as the exclusive mode of accepting payment from a user. There's also wording preventing Apple from retaliating against developers who choose alternate distribution and payment methods.

Apple does not allow apps to be installed on iOS devices outside of the "App Store" and there are no alternate app store options that are available. Apple reviews every app that is made available for its customers to download, something that would not happen with a third-party app store option. Apple also does not let app developers accept payments through methods other than in-app purchase except in select situations, a policy that has led to Apple's legal fight with Epic Games.

No federal legislation has been introduced as of yet, and the North Dakota Senate committee did not take action on the bill. Senator Jerry Klein said that there's "still some mulling to be done" in reference to the bill.