Last April, Meta revealed that it would no longer support original shows, like Jada Pinkett Smith’s Red Table Talk talk show, on Facebook Watch. Meta’s streaming business that was once viewed as competition for the likes of YouTube and Netflix is effectively dead now; Facebook doesn’t produce original series, and Facebook Watch is no longer available as a video-streaming app.

The streaming business’ demise has seemed related to cost cuts at Meta that have also included layoffs. However, recently unsealed court documents in an antitrust suit against Meta [PDF] claim that Meta has squashed its streaming dreams in order to appease one of its biggest ad customers: Netflix.

Facebook allegedly gave Netflix creepy privileges

As spotted via Gizmodo, a letter was filed on April 14 in relation to a class-action antitrust suit that was filed by Meta customers, accusing Meta of anti-competitive practices that harm social media competition and consumers. The letter, made public Saturday, asks a court to have Reed Hastings, Netflix’s founder and former CEO, respond to a subpoena for documents that plaintiffs claim are relevant to the case. The original complaint filed in December 2020 [PDF] doesn’t mention Netflix beyond stating that Facebook “secretly signed Whitelist and Data sharing agreements” with Netflix, along with “dozens” of other third-party app developers. The case is still ongoing.

The letter alleges that Netflix’s relationship with Facebook was remarkably strong due to the former’s ad spend with the latter and that Hastings directed “negotiations to end competition in streaming video” from Facebook.

One of the first questions that may come to mind is why a company like Facebook would allow Netflix to influence such a major business decision. The litigation claims the companies formed a lucrative business relationship that included Facebook allegedly giving Netflix access to Facebook users’ private messages:

By 2013, Netflix had begun entering into a series of “Facebook Extended API” agreements, including a so-called “Inbox API” agreement that allowed Netflix programmatic access to Facebook’s users’ private message inboxes, in exchange for which Netflix would “provide to FB a written report every two weeks that shows daily counts of recommendation sends and recipient clicks by interface, initiation surface, and/or implementation variant (e.g., Facebook vs. non-Facebook recommendation recipients). … In August 2013, Facebook provided Netflix with access to its so-called “Titan API,” a private API that allowed a whitelisted partner to access, among other things, Facebook users’ “messaging app and non-app friends.”

Meta said it rolled out end-to-end encryption “for all personal chats and calls on Messenger and Facebook” in December. And in 2018, Facebook told Vox that it doesn’t use private messages for ad targeting. But a few months later, The New York Times, citing “hundreds of pages of Facebook documents,” reported that Facebook “gave Netflix and Spotify the ability to read Facebook users’ private messages.”

Meta didn’t respond to Ars Technica’s request for comment. The company told Gizmodo that it has standard agreements with Netflix currently but didn’t answer the publication’s specific questions.

https://arstechnica.com/?p=2013174

After public outcry, General Motors has decided to stop sharing driving data from its connected cars with data brokers. Last week, news broke that customers enrolled in GM’s OnStar Smart Driver app have had their data shared with LexisNexis and Verisk.

Those data brokers in turn shared the information with insurance companies, resulting in some drivers finding it much harder or more expensive to obtain insurance. To make matters much worse, customers allege they never signed up for OnStar Smart Driver in the first place, claiming the choice was made for them by salespeople during the car-buying process.

Now, in what feels like an all-too-rare win for privacy in the 21st century, that data-sharing deal is no more.

“As of March 20th, OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk. Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies,” GM told us in a statement.

https://arstechnica.com/?p=2012276

Airbnb, like hotels and rival vacation rental site Vrbo, will no longer allow hosts to record guests while they’re inside the property. Airbnb previously allowed hosts to have disclosed cameras outside the property and in “common areas” inside, but Airbnb’s enforcement of the policy and the rules’ lack of specificity made camera use troubling for renters.

Airbnb announced today that as of April 30, it’s “banning the use of indoor security cameras in listings globally as part of efforts to simplify our policy on security cameras and other devices” and to prioritize privacy.

Cameras that are turned off but inside the property will also be banned, as are indoor recording devices. Airbnb’s updated policy defines cameras and recording devices as “any device that records or transmits video, images, or audio, such as a baby monitor, doorbell camera, or other camera.”

Also starting April 30, Airbnb will require hosts to disclose the presence of noise decibel monitors. Airbnb said it will only allow noise-monitoring devices that “do not record or transmit sounds or conversations” and that these are also “only allowed in common spaces of listings.”

Room for interpretation

Airbnb’s old policy allowed hosts to have cameras inside the property as long as the cameras weren’t hidden. The policy stated that Airbnb allowed: “Devices that allow for viewing or monitoring of only a public space (ex: a front door or a driveway) or a common space that are clearly identified and disclosed ahead of a reservation,” per an archived version of the policy. The policy added that “common spaces do not include sleeping areas or bathrooms” and listed “bedrooms, bathrooms, or common areas that are being used as sleeping areas, like a living room with a sofa bed)” as examples of private spaces.

This policy dramatically differed from the rules of other hospitality businesses. Hotels typically don’t surveil guests after they’re in their room, for example.

Also alarming was the vagueness of Airbnb’s policy. What about rooms with a futon or a couch that isn’t literally listed as a “sofa bed” but is roomy enough for slumber? Could a policy-abiding camera be placed in that room? Airbnb’s updated policy for noise decibel monitors, which allows them inside but only “in a common space,” still doesn’t address the potential for broad interpretations of the phrase.

Renters can see if a listing has cameras or noise-monitoring devices under the “Home safety” section of a listing’s amenities section, but that could include dozens of so-called amenities.

Airbnb’s old policy didn’t force hosts to state cameras’ locations. A rental I currently have booked under the old policy, for example, merely states that it has “security cameras to ensure the safety of guests and property.” That doesn’t clearly specify where the cameras are and if they’re indoors or only outdoors.

Another example of gaps in Airbnb’s policy for unspecified surveillance comes from Jeffrey Bigham. In 2019, he detailed his experience when Airbnb originally told him that a photo in an Airbnb listing with a camera subtly sitting in the walls’ corner counted as disclosure of indoor camera usage (after the blog went viral, the user reported receiving a refund). Bigham noted that even though the camera was technically in a common area (the living room), it was “very likely that my 2-year-old ran in front of this camera naked (the field of view of the camera was close to the exit of the bathroom).”

Airbnb’s announcement today said those who break the new policies will be subject to investigation and disciplinary action, which may include the removal of a listing or account.

However, Airbnb has a spotted history of responding to renter surveillance complaints. For example, in 2019, Ars Technica reported on a family finding a hidden camera inside their Airbnb that was disguised as a smoke or carbon monoxide detector. Airbnb initially “exonerated” the host of wrongdoing but eventually refunded the family and banned the host. Other Airbnb hosts have also previously claimed to see lax response from Airbnb after upsetting renters with surveillance cameras.

Airbnb hosts have long relied on technology to help spot problems like unwarranted guests, messes, parties, and robberies. But even outdoor surveillance can perturb renters, as the use of outdoor cameras can be overbearing and uncomfortable.

Airbnb previously claimed that hidden cameras are an exception. The company said today that the majority of its listings “do not report having a security camera” but didn’t share specific numbers.

https://arstechnica.com/?p=2009366

Mar 04, 2024 Marina Londei Gestione dati, In evidenza, News, RSS 0

---

Qualche mese fa su Facebook e Instagram è comparso un avviso che chiedeva ai suoi utenti di scegliere se pagare per non avere più pubblicità sui social o continuare a usare il servizio in modo gratuito, acconsentendo alla raccolta e all’analisi dei propri dati. Questa scelta non è piaciuta a otto associazioni dei consumatori dell’UE che hanno presentato denunce contro Meta, accusandola di violare il GDPR.

Dietro la mossa della compagnia c’era l’intenzione di rispettare le leggi UE offrendo una scelta ai consumatori; scelta che, però, è stata giudicata “finta” dalle organizzazioni a protezione dei consumatori e non in linea col regolamento europeo.

Come riporta The Register, l’organizzazione no-profit austriaca NOYB (Non Of Your Business) ha sottolineato che le leggi europee sulla privacy impongono che la scelta sulla condivisione dei dati deve essere libera, e non, come in questo caso, un’alternativa quasi obbligata a una tassa.

Le associazioni dei consumatori affermano che il nuovo modello proposto da Meta per l’uso dei social viola i principi di data protection espressi nel GDPR, come il principio della limitazione delle finalità, dell’offuscamento dei dati, dell’elaborazione etica e trasparente delle informazioni. La scelta di inserire un abbonamento per usare i social senza annunci non offre una vera scelta agli utenti, ed è visto come un modo per costringere i consumatori a condividere i propri dati e continuare a proporre pubblicità.

Contattata da The Register, Meta ha affermato che è pronta a contrastare le accuse, sottolineando che “i nostri obblighi normativi sono estremamente seri e siamo fiduciosi che il nostro approccio sia conforme al GDPR”. La compagnia ha aggiunto che il nuovo modello introdotto per l’uso dei suoi social sia in linea con il regolamento dell’UE.

Le battaglie legali per Meta sembrano non finire mai: l’anno scorso la compagnia ha dovuto pagare una multa da più di un miliardo di euro per aver inviato i dati dei cittadini europei negli Stati Uniti, violando la legislazione UE.

Le organizzazioni dei consumatori hanno presentato le loro denunce lo scorso giovedì, e ora Meta è in attesa di sapere se dovrà imbarcarsi ancora una volta in una dura battaglia legale.

---

---

---

https://www.securityinfo.it/2024/03/04/meta-accusata-di-pratiche-illegali-che-violano-il-gdpr-di-nuovo/?utm_source=rss&utm_medium=rss&utm_campaign=meta-accusata-di-pratiche-illegali-che-violano-il-gdpr-di-nuovo

In 2021, a company specializing in collecting and selling location data called Near bragged that it was “The World’s Largest Dataset of People’s Behavior in the Real-World,” with data representing “1.6B people across 44 countries.” Last year the company went public with a valuation of $1 billion (via a SPAC). Seven months later it filed for bankruptcy and has agreed to sell the company.

But for the “1.6B people” that Near said its data represents, the important question is: What happens to Near’s mountain of location data? Any company could gain access to it through purchasing the company’s assets.

The prospect of this data, including Near’s collection of location data from sensitive locations such as abortion clinics, being sold off in bankruptcy has raised alarms in Congress. Last week, Sen. Ron Wyden (D-Ore.) wrote the Federal Trade Commission (FTC) urging the agency to “protect consumers and investors from the outrageous conduct” of Near, citing his office’s investigation into the India-based company.

Wyden’s letter also urged the FTC “to intervene in Near’s bankruptcy proceedings to ensure that all location and device data held by Near about Americans is promptly destroyed and is not sold off, including to another data broker.” The FTC took such an action in 2010 to block the use of 11 years worth of subscriber personal data during the bankruptcy proceedings of the XY Magazine, which was oriented to young gay men. The agency requested that the data be destroyed to prevent its misuse.

Wyden’s investigation was spurred by a May 2023 Wall Street Journal report that Near had licensed location data to the anti-abortion group Veritas Society so it could target ads to visitors of Planned Parenthood clinics and attempt to dissuade women from seeking abortions. Wyden’s investigation revealed that the group’s geofencing campaign focused on 600 Planned Parenthood clinics in 48 states. The Journal also revealed that Near had been selling its location data to the Department of Defense and intelligence agencies.

As of publication, Near has not responded to requests for comment.

According to Near’s privacy policy, all of the data they have collected can be transferred to the new owners. Under the heading of “Who do you share my personal data with?” It lists “Prospective buyers of our business.”

This type of clause is common in privacy policies, and is a regular part of businesses being bought and sold. Where it gets complicated is when the company being sold owns data containing sensitive information.

This week, a new bankruptcy court filing showed that Wyden’s requests were granted. The order placed restrictions on the use, sale, licensing, or transfer of location data collected from sensitive locations in the US and requires any company that purchases the data to establish a “sensitive location data program” with detailed policies for such data and ensure ongoing monitoring and compliance, including the creation of a list of sensitive locations such as reproductive health care facilities, doctor’s offices, houses of worship, mental health care providers, corrections facilities and shelters among others. The order demands that unless consumers have explicitly provided consent, the company must cease any collection, use, or transfer of location data.

In a statement emailed to The Markup, Wyden wrote, “I commend the FTC for stepping in—at my request—to ensure that this data broker’s stockpile of Americans’ sensitive location data isn’t abused, again.”

Wyden called for protecting sensitive location data from data brokers, citing the new legal threats to women since the Supreme Court’s June 2022 decision to overturn the abortion-rights ruling Roe v. Wade. Wyden wrote, “The threat posed by the sale of location data is clear, particularly to women who are seeking reproductive care.”

The bankruptcy order also provided a rare glimpse into how data brokers license data to one another. Near’s list of contracts included agreements with several location brokers, ad platforms, universities, retailers, and city governments.

It is not clear from the filing if the agreements covered Near data being licensed, Near licensing the data from the companies, or both.

This article was originally published on The Markup and was republished under the Creative Commons Attribution-NonCommercial-NoDerivatives license.

https://arstechnica.com/?p=2005720

Avast, a name known for its security research and antivirus apps, has long offered Chrome extensions, mobile apps, and other tools aimed at increasing privacy.

Avast’s apps would “block annoying tracking cookies that collect data on your browsing activities,” and prevent web services from “tracking your online activity.” Deep in its privacy policy, Avast said information that it collected would be “anonymous and aggregate.” In its fiercest rhetoric, Avast’s desktop software claimed it would stop “hackers making money off your searches.”

All of that language was offered up while Avast was collecting users’ browser information from 2014 to 2020, then selling it to more than 100 other companies through a since-shuttered entity known as Jumpshot, according to the Federal Trade Commission. Under a proposed recent FTC order (PDF), Avast must pay $16.5 million, which is “expected to be used to provide redress to consumers,” according to the FTC. Avast will also be prohibited from selling future browsing data, must obtain express consent on future data gathering, notify customers about prior data sales, and implement a “comprehensive privacy program” to address prior conduct.

Reached for comment, Avast provided a statement that noted the company’s closure of Jumpshot in early 2020. “We are committed to our mission of protecting and empowering people’s digital lives. While we disagree with the FTC’s allegations and characterization of the facts, we are pleased to resolve this matter and look forward to continuing to serve our millions of customers around the world,” the statement reads.

Data was far from anonymous

The FTC’s complaint (PDF) notes that after Avast acquired then-antivirus competitor Jumpshot in early 2014, it rebranded the company as an analytics seller. Jumpshot advertised that it offered “unique insights” into the habits of “[m]ore than 100 million online consumers worldwide.” That included the ability to “[s]ee where your audience is going before and after they visit your site or your competitors’ sites, and even track those who visit a specific URL.”

While Avast and Jumpshot claimed that the data had identifying information removed, the FTC argues this was “not sufficient.” Jumpshot offerings included a unique device identifier for each browser, included in data like an “All Clicks Feed,” “Search Plus Click Feed,” “Transaction Feed,” and more. The FTC’s complaint detailed how various companies would purchase these feeds, often with the express purpose of pairing them with a company’s own data, down to an individual user basis. Some Jumpshot contracts attempted to prohibit re-identifying Avast users, but “those prohibitions were limited,” the complaint notes.

The connection between Avast and Jumpshot became broadly known in January 2020, after reporting by Vice and PC Magazine revealed that clients, including Home Depot, Google, Microsoft, Pepsi, and McKinsey, were buying data from Jumpshot, as seen in confidential contracts. Data obtained by the publications showed that buyers could purchase data including Google Maps look-ups, individual LinkedIn and YouTube pages, porn sites, and more. “It’s very granular, and it’s great data for these companies, because it’s down to the device level with a timestamp,” one source told Vice.

The FTC’s complaint provides more detail on how Avast, on its own web forums, sought to downplay its Jumpshot presence. Avast suggested both that only non-aggregated data was provided to Jumpshot and that users were informed during product installation about collecting data to “better understand new and interesting trends.” Neither of these claims proved true, the FTC suggests. And the data collected was far from harmless, given its re-identifiable nature:

For example, a sample of just 100 entries out of trillions retained by Respondents
showed visits by consumers to the following pages: an academic paper on a study of symptoms
of breast cancer; Sen. Elizabeth Warren’s presidential candidacy announcement; a CLE course
on tax exemptions; government jobs in Fort Meade, Maryland with a salary greater than
$100,000; a link (then broken) to the mid-point of a FAFSA (financial aid) application;
directions on Google Maps from one location to another; a Spanish-language children’s
YouTube video; a link to a French dating website, including a unique member ID; and cosplay
erotica.

In a blog post accompanying its announcement, FTC Senior Attorney Lesley Fair writes that, in addition to the dual nature of Avast’s privacy products and Jumpshot’s extensive tracking, the FTC is increasingly viewing browsing data as “highly sensitive information that demands the utmost care.” “Data about the websites a person visits isn’t just another corporate asset open to unfettered commercial exploitation,” Fair writes.

FTC commissioners voted 3-0 to issue the complaint and accept the proposed consent agreement. Chair Lina Khan, along with commissioners Rebecca Slaughter and Alvaro Bedoya, issued a statement on their vote.

Since the time of the FTC’s complaint and its Jumpshot business, Avast has been acquired by Gen Digital, a firm that contains Norton, Avast, LifeLock, Avira, AVG, CCLeaner, and ReputationDefender, among other security businesses.

Disclosure: Condé Nast, Ars Technica’s parent company, received data from Jumpshot before its closure.

https://arstechnica.com/?p=2005605

DuckDuckGo keeps adding new features to its browser; and while these features are common in other browsers, DuckDuckGo is giving them a privacy-minded twist. The latest is a private, end-to-end encrypted syncing service. There’s no account needed, no sign-in, and the company says it never sees what you’re syncing.

Using QR codes and shortcodes, and a lengthy backup code you store somewhere safe, DuckDuckGo’s browser can keep your bookmarks, passwords, “favorites” (i.e., new tab page shortcuts), and settings for its email protection service synced between devices and browsers.

DuckDuckGo points to Google’s privacy policy for using its signed-in sync service on Chrome, which uses “aggregated and anonymized synchronized browsing data to improve other Google products and services.” DuckDuckGo states that the encryption key for browser sync is stored only locally on your devices and that it lacks any access to your passwords or other data.

Syncing might be enough to tempt people with established browser habits to switch to DuckDuckGo for regular use. Without the syncing feature, having to set up each browser with the same items or start over with new devices is a real pain point. Most alternatives, even Firefox, require signing in with a web-based account to keep things synced. End-to-end encrypted sync fits with DuckDuckGo’s ethos while also removing a hassle.

That makes for syncing, built-in tracker ad blocking, enforced encryption, cookie pop-up management, and email protection that DuckDuckGo has now built into its browser, along with easy history wipes and a different default search. Extensions are the next obvious point. Extensions are coming “in the future,” the company said during a previous release. A company representative confirmed to Ars that there are no updates to extension availability.

Chrome’s dominant position in the web browser ecosystem has given rise to alternatives aimed squarely at private, non-tracking search. Mozilla has recently focused on privacy and web safety, including offering VPNs, phone proxies, and tools that call out fake product reviews or spot data leaks and brokers. Meanwhile, Google will soon make changes that comply with the European Union’s Digital Markets Act, which mandates making it easier to switch browsers and search defaults.

This post was updated at 8:15 am ET on Feb. 14 to add a link to DuckDuckGo’s announcement blog post.

Listing image by DuckDuckGo

https://arstechnica.com/?p=2003169

“You may be shocked to find,” the people-search websites pitch, that you or the other person you’re searching for “has a criminal record.” Other sites offer “millions of records that expose” a person for who they “really are.”

These kinds of “people search” sites are myriad. They copy from one another, and removing your information from them, while technically possible in fine-print fashion, could take days or weeks. Mozilla, the Firefox maker expanding into a suite of privacy-minded tools, has an alternative to clicking and hoping.

Mozilla Monitor Plus, just launched today, pledges to automatically monitor such “people search” sites, along with known data breaches, for your information and then take care of the removal process. The “Plus” version costs $14 if you go month by month, or $108 for a year’s subscription (about $9 per month). You can still get a free scan on Monitor to see the data breaches and data brokers where Mozilla finds your information (used with Mozilla’s fairly human-readable privacy policy).

[embedded content]

There’s a bit of name and definition confusion in how Mozilla refers to background search or people-finding sites as “data brokers.” The term is also used to refer to companies that gather information not from public records and Internet history, but from the online traces left by account sign-ups, advertising, web browsing, and other things you do after clicking to agree to vague Terms of Service. Such data brokers—almost certainly working alongside the other “people search” variety—can have staggering amounts of data on nearly everybody and sell it to customers like the NSA and FBI.

Still, every bit helps. Monitor claims to have helped 10 million people be alerted when their data showed up in data breaches. Using Monitor Plus, removing your data from broker sites “typically takes 7 to 14 days,” according to Mozilla (though sometimes “within the hour”), with progress monitored and displayed. It’s a web-based product that doesn’t require Firefox to use, with a FAQ for more details.

Monitor Plus adds to Mozilla’s recent slate of privacy-focused offerings, including a VPN service (which we reviewed in 2020) and Relay, a phone and email masking service. You can bundle VPN and Relay for a notably discounted price, and we’d expect to see VPN, Relay, and Monitor Plus brought together in a privacy-focused bundle at some point.

https://arstechnica.com/?p=2001195

ChatGPT is leaking private conversations that include login credentials and other personal details of unrelated users, screenshots submitted by an Ars reader on Monday indicated.

Two of the seven screenshots the reader submitted stood out in particular. Both contained multiple pairs of usernames and passwords that appeared to be connected to a support system used by employees of a pharmacy prescription drug portal. An employee using the AI chatbot seemed to be troubleshooting problems that encountered while using the portal.

“Horrible, horrible, horrible”

“THIS is so f-ing insane, horrible, horrible, horrible, i cannot believe how poorly this was built in the first place, and the obstruction that is being put in front of me that prevents it from getting better,” the user wrote. “I would fire [redacted name of software] just for this absurdity if it was my choice. This is wrong.”

Besides the candid language and the credentials, the leaked conversation includes the name of the app the employee is troubleshooting and the store number where the problem occurred.

The entire conversation goes well beyond what’s shown in the redacted screenshot above. A link Ars reader Chase Whiteside included showed the chat conversation in its entirety. The URL disclosed additional credential pairs.

The results appeared Monday morning shortly after reader Whiteside had used ChatGPT for an unrelated query.

“I went to make a query (in this case, help coming up with clever names for colors in a palette) and when I returned to access moments later, I noticed the additional conversations,” Whiteside wrote in an email. “They weren’t there when I used ChatGPT just last night (I’m a pretty heavy user). No queries were made—they just appeared in my history, and most certainly aren’t from me (and I don’t think they’re from the same user either).”

Other conversations leaked to Whiteside include the name of a presentation someone was working on, details of an unpublished research proposal, and a script using the PHP programming language. The users for each leaked conversation appeared to be different and unrelated to each other. The conversation involving the prescription portal included the year 2020. Dates didn’t appear in the other conversations.

The episode, and others like it, underscore the wisdom of stripping out personal details from queries made to ChatGPT and other AI services whenever possible. Last March, ChatGPT maker OpenAI took the AI chatbot offline after a bug caused the site to show titles from one active user’s chat history to unrelated users.

In November, researchers published a paper reporting how they used queries to prompt ChatGPT into divulging email addresses, phone and fax numbers, physical addresses, and other private data that was included in material used to train the ChatGPT large language model.

Concerned about the possibility of proprietary or private data leakage, companies, including Apple, have restricted their employees’ use of ChatGPT and similar sites.

As mentioned in an article from December when multiple people found that Ubiquity’s UniFy devices broadcasted private video belonging to unrelated users, these sorts of experiences are as old as the Internet is. As explained in the article:

The precise root causes of this type of system error vary from incident to incident, but they often involve “middlebox” devices, which sit between the front- and back-end devices. To improve performance, middleboxes cache certain data, including the credentials of users who have recently logged in. When mismatches occur, credentials for one account can be mapped to a different account.

An OpenAI representative said the company was investigating the report.

https://arstechnica.com/?p=1999872

Chinese authorities recently said they’re using an advanced encryption attack to de-anonymize users of AirDrop in an effort to crack down on citizens who use the Apple file-sharing feature to mass-distribute content that’s outlawed in that country.

According to a 2022 report from The New York Times, activists have used AirDrop to distribute scathing critiques of the Communist Party of China to nearby iPhone users in subway trains and stations and other public venues. A document one protester sent in October of that year called General Secretary Xi Jinping a “despotic traitor.” A few months later, with the release of iOS 16.1.1, the AirDrop users in China found that the “everyone” configuration, the setting that makes files available to all other users nearby, automatically reset to the more limited contacts-only setting. Apple has yet to acknowledge the move. Critics continue to see it as a concession Apple CEO Tim Cook made to Chinese authorities.

The rainbow connection

On Monday, eight months after the half-measure was put in place, officials with the local government in Beijing said some people have continued mass-sending illegal content. As a result, the officials said, they were now using an advanced technique publicly disclosed in 2021 to fight back.

“Some people reported that their iPhones received a video with inappropriate remarks in the Beijing subway,” the officials wrote, according to translations. “After preliminary investigation, the police found that the suspect used the AirDrop function of the iPhone to anonymously spread the inappropriate information in public places. Due to the anonymity and difficulty of tracking AirDrop, some netizens have begun to imitate this behavior.”

In response, the authorities said they’ve implemented the technical measures to identify the people mass-distributing the content.

The scant details and the quality of Internet-based translations don’t explicitly describe the technique. All the translations, however, have said it involves the use of what are known as rainbow tables to defeat the technical measures AirDrop uses to obfuscate users’ phone numbers and email addresses.

Rainbow tables were first proposed in 1980 as a means for vastly reducing what at the time was the astronomical amount of computing resources required to crack at-scale hashes, the one-way cryptographic representations used to conceal passwords and other types of sensitive data. Additional refinements made in 2003 made rainbow tables more useful still.

When AirDrop is configured to distribute files only between people who know each other, Apple says, it relies heavily on hashes to conceal the real-world identities of each party until the service determines there’s a match. Specifically, AirDrop broadcasts Bluetooth advertisements that contain a partial cryptographic hash of the sender’s phone number and/or email address.

If any of the truncated hashes match any phone number or email address in the address book of the other device, or if the devices are set to send or receive from everyone, the two devices will engage in a mutual authentication handshake. When the hashes match, the devices exchange the full SHA-256 hashes of the owners’ phone numbers and email addresses. This technique falls under an umbrella term known as private set intersection, often abbreviated as PSI.

In 2021, researchers at Germany’s Technical University of Darmstadt reported that they had devised practical ways to crack what Apple calls the identity hashes used to conceal identities while AirDrop determines if a nearby person is in the contacts of another. One of the researchers’ attack methods relies on rainbow tables. https://arstechnica.com/?p=1995574