Linked List: May 30, 2021

Sunday, 30 May 2021

My thanks to Point Card for once again sponsoring DF. Everyone enjoys rewards and benefits on credit cards. But there’s one thing none of us like — interest rates that pile up into debt. Unlike credit cards, debit cards are like spending cash, but typically don’t come with good rewards.

Now you can have the best of both worlds, with all the points and none of the risk or debt. Point Card is a debit card that gives you unlimited cash back on every purchase and special access to bonus point offers on some of the best brands out there. Buy your next iPhone using Point Card and you’ll get automatic insurance on the purchase, for example. The whole experience is elevated with Point App, which offers concierge-level service in a clean, obsessively designed, and easy-to-use interface. Everyday spending has never been better.

I mean just take a look at their ads over there in the sidebar: even the cards are obsessively designed.

Arizona Lawsuit Documents Detail Google’s Efforts to Collect User Location Data and Obfuscate the Settings to Control It ★

Tyler Sonnemaker, reporting for Insider:

Newly unredacted documents in a lawsuit against Google reveal that the company’s own executives and engineers knew just how difficult the company had made it for smartphone users to keep their location data private.

Google continued collecting location data even when users turned off various location-sharing settings, made popular privacy settings harder to find, and even pressured LG and other phone makers into hiding settings precisely because users liked them, according to the documents.

Jack Menzel, a former vice president overseeing Google Maps, admitted during a deposition that the only way Google wouldn’t be able to figure out a user’s home and work locations is if that person intentionally threw Google off the trail by setting their home and work addresses as some other random locations. […]

When Google tested versions of its Android operating system that made privacy settings easier to find, users took advantage of them, which Google viewed as a “problem”, according to the documents. To solve that problem, Google then sought to bury those settings deeper within the settings menu.

Arizona attorney general Mark Brnovich’s complaint (PDF), albeit partially redacted, is a cogent and damning read. It seems undeniable that Google deliberately obfuscated location privacy settings, and knew that they were confusing. From pages 12–13:

Google’s own employees have clearly identified the problem:

“Real people just think in terms of ‘location is on’, ‘location is off’ because that’s exactly what you have on the front screen of your phone.” Ex. 206 (GOOG-GLAZ-00055452) at 452.

“The current UI feels like it is designed to make things possible, yet difficult enough that people won’t figure it out.” Ex. 207 (GOOG-GLAZ-00077898) at 899.

“Some people (including even Googlers) don’t know that there is a global switch and a per-device switch.” Ex. 208 (GOOG-GLAZ-00055552) at 553.

“Today, collection of device usage and diagnostic data is smeared across 5 settings resulting in conditions that are difficult for Googlers, let alone users, to understand.” Ex. 210 (GOOG-GLAZ-00057940) at 940.

I enjoy the implicit assumption in their internal communications that Google employees are so smart that if “even” they’re confused, it must be too complicated. From page 15 (citations omitted for readability):

On August 13, 2018, the AP published an exclusive report titled “Google tracks your movements, like it or not” that publicly exposed this deception. The article explained how Google “records your movements even when you explicitly tell it not to.”

Until the AP article was published, Google represented on its public help page regarding Location History that “You can turn off Location History at any time. With Location History off, the places you go are no longer stored.”

But that was not true. Even with Location History off, Google still collected and stored location data via (at least) its Web & App Activity setting. Thus, for example, a user who had Location History off and looked up the weather where he lived or searched the web with Google’s Search app would still unknowingly send Google his location.

The day the AP story was published, Google turned into crisis mode and held a self-styled “Oh Shit” meeting in reaction to the story.

“Oh shit” indeed.

Microsoft: SolarWinds Hackers Target 150 Organizations With Phishing Campaign ★

Frank Bajak, reporting for the AP:

The state-backed Russian cyber spies behind the SolarWinds hacking campaign launched a targeted spear-phishing assault on U.S. and foreign government agencies and think tanks this week using an email marketing account of the U.S. Agency for International Development, Microsoft says.

The effort targeted about 3,000 email accounts at more than 150 different organizations, at least a quarter of them involved in international development, humanitarian and human rights work, Microsoft Vice President Tom Burt said in a blog post late Thursday.

When’s the last time a major national-newsworthy large-scale hack like this affected any organization that wasn’t running Windows for their server infrastructure?

Update: Best answer so far: Robert Morris’s worm in 1988.

Doc Searls on Apple and Surveillance Advertising ★

Doc Searls:

Here’s what’s misleading about this message: Felix would have had none of those trackers following him if he had gone into Settings → Privacy → Tracking, and pushed the switch to off […].

Key fact: it is defaulted to on. Meaning Apple is not fully serious about privacy. If Apple was fully serious, your iPhone would be set to not allow tracking in the first place. All those trackers would come pre-vaporized.

For all the criticism Apple has faced from the ad tech industry over this feature, it’s fun to see criticism that Apple isn’t going far enough. But I don’t think Searls’s critique here is fair. Permission to allow tracking is not on by default — what is on by default is permission for the app to ask. Searls makes that clear, I know, but it feels like he’s arguing as though apps can track you by default, and they can’t.

Whether setting up a new phone or upgrading an existing iPhone to iOS 14.5 or later, when apps want to track, you will get asked, and the alert is modal, with no “Ask Me Later” option. You must choose “Allow” or “Ask App Not to Track”. There are no other options.

I think that’s very fair, both to apps that want to track, and to users, so they are given explicit control over this permission, even if they have never heard of this new iOS 14 feature before. It’s not hard to find the global preference to forbid apps from even asking for permission — which screen also shows you a list of the apps that have asked for this permission. On my iPhone, with quite a few apps installed, there are only four apps on the list: Instagram, MLB, MM Live (the NCAA’s March Madness app), and Twitter. So it’s not like I’m getting badgered. I like keeping this “Allow Apps to Request to Track” option on so I can see if a new app even wants this permission.

The key is that Apple isn’t disallowing tracking — they’ve given every user the ability to disallow tracking.

And Apple never would have given every iPhone an IDFA — ID For Advertisers — in the first place. And never mind that they created IDFA back in 2013 partly to wean advertisers from tracking and targeting phones’ UDIDs (unique device IDs).

IDFA was well-intentioned, but I think in hindsight Apple realizes it was naive to think the surveillance ad industry could be trusted with anything.

And why “ask” an app not to track? Why not “tell”? Or, better yet, “Prevent Tracking By This App”? Does asking an app not to track mean it won’t?

This is Apple being honest. Apple can block apps from accessing the IDFA identifier, but there’s nothing Apple can do to guarantee that apps won’t come up with their own device fingerprinting schemes to track users behind their backs. Using “Don’t Allow Tracking” or some such label instead of “Ask App Not to Track” would create the false impression that Apple can block any and all forms of tracking. It’s like a restaurant with a no smoking policy. That doesn’t mean you won’t go into the restroom and find a patron sneaking a smoke. I think if Apple catches applications circumventing “Ask App Not to Track” with custom schemes, they’ll take punitive action, just like a restaurant might ask a patron to leave if they catch them smoking in the restroom — but they can’t guarantee it won’t happen. (Joanna Stern asked Craig Federighi about this in their interview a few weeks ago, and Federighi answered honestly.)

If Apple could give you a button that guaranteed an app couldn’t track you, they would, and they’d label it appropriately. But they can’t so they don’t, and they won’t exaggerate what they can do.

See also: Nick Heer at Pixel Envy, whose take on Searls’s post is similar to mine.

Also see also: Steve Jobs on Apple’s privacy stance back in 2010: “Ask them. Ask them every time. Make them tell you to stop asking them if they get tired of your asking them. Let them know precisely what you’re going to do with their data. That’s what we think.”

How to Use the New Apple TV Remote’s Jog-Shuttle Gesture ★

Good video demo from Dave Mark. The non-obvious trick is that you need to first pause the video you’re watching, then hold your thumb on the ring for a moment before you start spinning. You know you’re in jog mode when you see the jog cursor above the timeline of the video on screen. (In a nice touch, the rotating dot on the on-screen jog dial keeps pace with your thumb’s location on the physical ring.)

Also, I made a mistake in my review of the new remote: you can’t really use it to scroll through vertical lists on tvOS (like in the Settings app). Running your thumb around the ring in a vertical list does move the selection, but it moves the selection up and down as your thumb goes up and down. We regret the error. (This would be a nice feature for Apple to add to tvOS, in my opinion — it should work for scrolling lists.)

Matt Stoller: ‘Amazon Prime Is an Economy-Distorting Lie’ ★

Matt Stoller, writing for Big, making the case that last week’s antitrust suit against Amazon filed by D.C. attorney general Karl Racine largely hinges around Prime:

To understand why, we have to start with the idea of free shipping. Free shipping is the God of online retail, so powerful that France actually banned the practice to protect its retail outlets. Free shipping is also the backbone of Prime. Amazon founder Jeff Bezos knew that the number one pain point for online buyers is shipping - one third of shoppers abandon their carts when they see shipping charges. Bezos helped invent Prime for this reason, saying the point of Prime was to use free shipping “to draw a moat around our best customers.” The goal was to get people used to buying from Amazon, knowing they wouldn’t have to worry about shipping charges. Once Amazon had control of a large chunk of online retail customers, it could then begin dictating terms of sellers who needed to reach them.

This became clear as you read Racine’s complaint. One of the most important sentences in the AG’s argument is a quote from Bezos in 2015 where he alludes to this point. In discussing the firm’s logistics service that is the bedrock of its free shipping promise, Fulfillment by Amazon (FBA), he said, “FBA is so important because it is glue that inextricably links Marketplace and Prime. Thanks to FBA, Marketplace and Prime are no longer two things. Their economics … are now happily and deeply intertwined.” Amazon wants people to see Prime, FBA, and Marketplace as one integrated mega-product, what Bezos likes to call “a flywheel”, to disguise the actual monopolization at work. (Indeed, any time you hear the word “flywheel” relating to Amazon, replace it with “monopoly” and the sentence will make sense.)

Stoller’s argument boils down to the age-old adage that there’s no such thing as a free lunch, and that Prime’s “free” shipping is subsidized by “most favored nation” agreements with sellers in Amazon Marketplace that artificially raise the price of the products. (A Marketplace seller is not allowed to sell its own products on its own website (or competing stores) at lower prices than it offers on Amazon.)

Inside Details of the 2011 RSA Hack ★

Riveting report by Andy Greenberg for Wired:

In the decade that followed, many key RSA executives involved in the company’s breach have held their silence, bound by 10-year nondisclosure agreements. Now those agreements have expired, allowing them to tell me their stories in new detail. Their accounts capture the experience of being targeted by sophisticated state hackers who patiently and persistently take on their most high-value networked targets on a global scale, where an adversary sometimes understands the interdependencies of its victims’ systems better than victims do themselves, and is willing to exploit those hidden relationships.

The perpetrators: Chinese hackers. The attack vector that got them in the door: well, given that it was 2011, you will not be surprised.

(The opening anecdote has a somewhat Mission Impossible-y feel to it that doesn’t ring true to my ears — that the hackers moved the archive with the pilfered encryption seeds mere seconds before an RSA analyst attempted to remotely delete them. For one thing, it implies there was any hint that the archive RSA found was the only copy of the data. So take that anecdote with a Tom Cruise-size grain of salt. It’s a good inside look nonetheless.)