Category Archives: Privacy

Tech Companies Urge Congress to Protect Search and Browsing Data



Several tech companies are asking the U.S. House of Representatives to pass legislation that would prevent the FBI from obtaining people’s browser history without a warrant. The tech companies include: Mozilla, Reddit, Twitter, and Patreon.

Mozilla Corporation, Engine, Reddit, Inc., Reform Government Surveillance, Twitter, i2Coalition, and Patreon sent a letter to Speaker Nancy Pelosi, Minority Leader Kevin McCarthy, Chairman of the U.S. House Committee on the Judiciary Jerry Nadler, and Ranking Member of the U.S. House Committee on the Judiciary. From the letter:

We urge you to explicitly prohibit the warrantless collection of internet search and browsing history when you consider the USA FREEDOM Reauthorization Act (H.R. 6172) next week. As leading internet businesses and organizations, we believe privacy and security are essential to our economy our businesses, and the continued growth of the free and open internet. By clearly reaffirming these protections, Congress can help preserve user trust and facilitate the continued use of the internet as a powerful contributing force for our recovery.

This comes after the U.S. Senate voted down an amendment to the USA Patriot Act that would create a tougher standard for government investigators to collect web search and browsing histories of people in the states.

It was a bipartisan amendment that would have required the Department of Justice to show probable cause when requesting approval from the Foreign Intelligence Surveillance Court to collect the data for counterterrorism or counterintelligence investigations.


Apple and Google Released a FAQ About their Coronavirus Tracker



Earlier this month, Google and Apple announced a joint effort to enable the use of Bluetooth technology to help governments and health agencies reduce the spread of the COVID-19 virus. As you may have expected, people had questions about how that contact tracing technology would work.

In response, Apple and Google released a Frequently Asked Questions PDF with more information. Some of it explains what contact tracing is, how it works, and how it can help slow the spread of COVID-19. It also covers how their contact tracing system will protect user privacy.

Here are some key points about user privacy:

  • Each user will have to make an explicit choice to turn on the technology. It can also be turned off by the user at any time by uninstalling the contract tracing application or turning off exposure notification in Settings.
  • This system does not collect location data from your device, and does not share the identities of other users to each other, Google or Apple. The user controls all data they want to share, and the decision to share it.
  • Bluetooth privacy-preserving beacons rotate every 10-20 minutes, to help prevent tracking.
  • Exposure notification is only done on device and under the user’s control. In addition people who test positive are not identified by the system to other users, or to Apple or Google.
  • The system is only used for contract tracing by public health authorities apps.
  • Google and Apple can disable the exposure notification system on a regional basis when it is no longer needed.

However, the FAQ also makes it clear that government health authorities will have access to the information facilitated by the app. “Access to the technology will be granted only to public health authorities. Their apps must meet specific criteria around privacy, security, and data control. The public health authority app will be able to access a list of beacons provided by users confirmed as positive for COVID-19 who have opted into sharing them. The system was also designed so that Apple and Google do not have access to information related to any specific individual.”

The FAQ states a user can choose to report a positive diagnosis of COVID-19 to their contact tracing app. The user’s most privacy-preserving beacons will be added to the positive diagnosis list shared by the public health authority so that others who came in contact with those beacons can be alerted. I don’t see how that can be done without the app being able to identify one individual user from another.

It comes down to how much you trust your government to use the information from the app to help people. This sort of heath information can be used to prevent people from being eligible for health insurance coverage, or to be discriminated against in other ways. Personally, I am not going to use this app.


Google, Mozilla, and Apple Block Kazakhstan’s Root Certificate



Three big browser makers are now blocking the use of a root certificate that Kazakhstan’s government had used to intercept internet traffic. According to Ars Technica, Khazakhstan reportedly said it halted the use of the certificate. Ars Technica reported that the actions taken by Google, Mozilla, and Apple could protect users who already installed it or prevent future use of the certificate by Kazakstan’s government.

Apple told Ars Technica that it is blocking the ability to use the certificate to intercept internet traffic.

Mozilla posted on The Mozilla Blog “Today, Mozilla and Google took action to protect the online security and privacy of individuals in Kazakhstan. Together, the companies deployed technical solutions within Firefox and Chrome to block the Kazakhstan government’s ability to intercept internet traffic within the country.”

The response comes after credible reports that internet service providers in Kazakhstan have required people in the country to download and install a government-issued certificate on all devices and in every browser in order to access the internet. This certificate is not trusted by either of the companies, and once installed, allowed the government to decrypt and read anything a user types or posts, including intercepting their account information and passwords. This targeted people visiting popular sites like Facebook, Twitter, and Google, among others.

Google posted information on its Google Security Blog. Part of that blog post says: “In response to recent actions by the Kazakhstan government, Chrome, along with other browsers, has taken steps to protect users from the interception or modification of TLS connections made to websites.”

It continues: “Chrome will be blocking the certificate the Kazakhstan government required users to install. The blog post has more specific details about that certificate.

It is good that these companies, all of whom make browsers, are taking a stand against government intrusion into people’s privacy. I hope that these companies will take the same action whenever another government chooses to spy on its own people in an effort to sneakily discover what those people do online.


Amazon Allows You to Disable Human Review of Recordings



Amazon is now allowing people who use Alexa to opt-out of human review of their voice recordings, Bloomberg has reported. This comes after a researcher revealed that some of Google’s Assistant recordings had been listened to by human contractors, and people started to become concerned about what other voice activated assistants do with recorded speech.

A new policy took effect Friday that allows customers, through an option in the settings menu of the Alexa smartphone app, to remove their recordings from a pool that could be analyzed by Amazon employees and contract workers, a spokesman for the Seattle company said. It follows similar moves by Apple, Inc., and Google.

According to Bloomberg, Amazon’s decision to let Alexa users opt-out of human review of their recordings follows criticism that the program violated customers’ privacy. Amazon says the Alexa app will now include a disclaimer in the settings menu that acknowledges that people might review recordings through Alexa. Bloomberg explains how to disable that and opt-out of human review.

The Guardian reported that Apple has suspended its practice of having human contractors listen to users’ Siri recordings to “grade” them. That decision came after a Guardian report that revealed that Apple’s contractors “regularly” hear confidential and private information while carrying out the grading process. The bulk of the confidential information was recorded through accidental triggers of the Siri assistant.

Google posted on The Keyword that it has provided tools for users to manage and control the data in their Google account. You can turn off storing audio data to your Google account completely, or choose to auto-delete data after every 3 months or 18 months.


Is FaceApp Storing Users’ Photos?



You’ve probably seen images of celebrities who have used FaceApp to see what they will look like when they are older. Before you give FaceApp a try, you should be aware of concerns about what the app could be doing with people’s photos.

The Guardian spoke with the FaceApp CEO, Yaroslav Goncharov, who said that only a single picture specifically chosen by the user would be uploaded from a phone and the app did not harvest a user’s entire photo library. The Guardian said this claim was backed by researchers.

Goncharov said the data was never transferred to Russia and was instead stored on US-controlled cloud computing services provided by Amazon and Google. The developer insisted that users had the right to request their photographs be removed from the server. Goncharov said his company does not share any user data with any third parties.

The Guardian rightly pointed out: “However, users ultimately have to rely on the word of the developer that the images are being removed from the system.”

CNN reported that the Democratic National Committee (DNC) sent a security alert to 2020 presidential campaigns not to use FaceApp. Bob Lord, the DNC’s chief security officer, recommended “campaign staff and people in the Democratic ecosystem” should not use the app. He added “If you or any of your staff have already used the app, we recommend that they delete the app immediately.”

The Independent reported part of FaceApp’s terms of service:

“You grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform, and display your User Content and any name, username, or likeness provided in connection with your User Contenting in all media formats and channels now known or later developed without compensation to you.”

In addition, the Independent reported that FaceApp’s privacy policy “makes it clear that it is able to collect and store information from your phone and that it might be used for ads or other forms or marketing.”

It does not appear that the photos you give it are being harvested by Russia. That said, I personally don’t feel like FaceApp is making it clear to users how their photos will be used, or what information it can glean from their phones. This bothers me enough to steer clear of the app.


Apple Removed the Zoom Vulnerability



Good news for Mac users who had Zoom installed on their computers! TechCrunch reported that Apple has released a silent update for Mac users that removes a vulnerable component in Zoom. The update does not require any user interaction and is deployed automatically.

Apple often pushes silent signature updates to Macs to thwart known malware – similar to an anti-malware service – but it’s rare for Apple to take action publicly against a known or popular app. The company said it pushed the update to protect users from the risks posed by the exposed web server.

TechCrunch quoted Zoom spokesperson Priscilla McCathy who said (in part): “We are happy to have worked with Apple on testing this update.”

Apple’s update comes after Zoom released a fix for the vulnerability that enabled nefarious people to put a link into a website that would automatically cause a Zoom user to connect to Zoom with their video running.

The patch does two things. It removes the local web server entirely, once the Zoom client has been updated. In other words, it completely removes the local web sever from a Mac. The patch also allows users to manually uninstall Zoom.

Mac users may see a pop-up in Zoom that tells them to update their Zoom client. There is a link on the Zoom blog where you can download the update. Or, you can check for updates by opening your Zoom app window.


Zoom Mac Client Vulnerability Enables Cameras Without Permission



Have you used Zoom for web conferencing, podcasting, or anything else? Be aware that there is a vulnerability in the Mac Zoom Client that can enable your camera without your permission. Uninstalling Zoom does not fix the problem.

Jonathan Leitschuh posted a very detailed article on Medium explaining the situation. In short, the vulnerability in the Mac Zoom Client allowed any malicious website to enable your camera without your permission. According to Jonathan Leitschuh, this issue potentially exposes up to 750,000 companies around the world that use Zoom to conduct day-to-day business.

Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day.

If I’m understanding this correctly, the vulnerability takes advantage of a Zoom feature that allows users to send anyone a link. When the person opens that link in their browser, the Zoom client opens on their machine. A mean-spirited person could embed a specific piece of code into a website. When a Zoom users visits that website, the user will be connected to Zoom with their video running.

Zoom posted a “Response to Video-On Concern” on the Zoom blog. In the blog, Zoom explains that “if the user has not configured their Zoom client to disable video upon joining meetings, the attacker may be able to view the user’s video feed.”

Zoom explains that the Zoom client runs in the foreground upon launch. It would be readily apparent to a user that they had unintentionally joined a meeting, and the user could change their video settings or leave the meeting immediately. According to Zoom, “we have no indication that this has ever happened.”

You can click on a link in the Zoom blog to connect with their support team. Zoom says it will go live with a public vulnerability disclosure program in the next several weeks. Until then, I recommend putting a sticker over your camera.