Author: azeeadmin

Facebook and Google landed in hot water with Apple this week after two investigations by TechCrunch revealed the misuse of internal-only certificates — leading to their revocation, which led to a day of downtime at the two tech giants.

Confused about what happened? Here’s everything you need to know.

How did all this start, and what happened?

On Monday, we revealed that Facebook was misusing an Apple-issued certificate that is only meant for companies to use to distribute internal, employee-only apps without having to go through the Apple App Store. But the social media giant used that certificate to sign an app that Facebook distributed outside the company, violating Apple’s rules.

The app, known simply as “Research,” allowed Facebook unparalleled access to all of the data flowing out of the device. This included access to some of the user’s most sensitive network data. Facebook paid users — including teenagers — $20 per month to install the app. But it wasn’t clear exactly what kind of data was being vacuumed up, or for what reason.

It turns out that the app was a repackaged app that was effectively banned from Apple’s App Store last year for collecting too much data on users.

Apple was angry that Facebook was misusing its special-issue certificates to push an app it already banned, and revoked it — rendering the app useless. But Facebook was using that same certificate to sign its other employee-only apps, effectively knocking them offline until Apple re-issued the certificate.

Then, it turned out Google was doing almost exactly the same thing with its Screenwise app, and Apple’s ban-hammer fell again.

What’s the controversy over these certificates and what can they do?

If you want to develop Apple apps, you have to abide by its rules.

A key rule is that Apple doesn’t allow app developers to bypass the App Store, where every app is vetted to ensure it’s as secure as it can be. It does, however, grant exceptions for enterprise developers, such as to companies that want to build apps that are only used internally by employees. Facebook and Google in this case signed up to be enterprise developers and agreed to Apple’s developer terms.

Apple granted each a certificate that grants permission to distribute apps they develop internally — including pre-release versions of the apps they make, for testing purposes. But these certificates aren’t allowed to be used for ordinary consumers, as they have to download apps through the App Store.

Why is “root” certificate access a big deal?

Because Facebook’s Research and Google’s Screenwise apps were distributed outside of Apple’s App Store, it required users to manually install the app — known as sideloading. That requires users to go through a convoluted few steps of downloading the app itself, and opening and installing either Facebook or Google’s certificate.

Both apps then required users to open another certificate — known as a VPN configuration profile — allowing all of the data flowing out of that user’s phone to funnel down a special tunnel that directs it all to either Facebook or Google, depending on the app you installed.

This is where Facebook and Google’s cases differ.

Google’s app collected data and sent it off to Google for research purposes, but couldn’t access encrypted data — such as iMessages, or other end-to-end encrypted content.

Facebook, however, went far further. Its users were asked to go through an additional step to trust the certificate at the “root” level of the phone. Trusting this “root certificate” allowed Facebook to look at all of the encrypted traffic flowing out of the device — essentially what we call a “man-in-the-middle” attack. That allowed Facebook to sift through your messages, your emails, and any other bit of data that leaves your phone. Only apps that use certificate pinning — which reject any certificate that isn’t its own — were protected.

Google’s app might not have been able to look at encrypted traffic, but the company still flouted the rules and got its certificate revoked anyway.

What data did Facebook have access to on iOS?

It’s hard to know for sure, but it definitely had access to more data than Google.

Facebook said its app was to help it “understand how people use their mobile devices.” In reality, at root traffic level, Facebook could have accessed any kind of data that left your phone.

Will Strafach, a security expert who we spoke to for our story, said: “If Facebook makes full use of the level of access they are given by asking users to install the certificate, they will have the ability to continuously collect the following types of data: private messages in social media apps, chats from in instant messaging apps – including photos/videos sent to others, emails, web searches, web browsing activity, and even ongoing location information by tapping into the feeds of any location tracking apps you may have installed.”

Remember: this isn’t “root” access to your phone, like jailbreaking, but root access to the network traffic.

How does this compare to the technical ways other market research programs work?

In fairness, these aren’t market research apps unique to Facebook or Google. Several other companies, like Nielsen and comScore, run similar programs, but neither ask users to install a VPN or provide root access to the network.

In any case, Facebook already has a lot of your data — as does Google. Even if the companies only wanted to look at your data in aggregate with other people, it can still hone in on who you talk to, when, for how long, and in some cases what about. It might not have been such an explosive scandal had Facebook not spent the last year cleaning up after several security and privacy breaches.

Can they capture the data of people the phone owner interacts with?

In both cases, yes. In Google’s case, any unencrypted data that involves another person’s data could have been collected. In Facebook’s case, it goes far further — any data of yours that interacts with another person, such as an email or a message, could have been collected by Facebook’s app.

How many people did this affect?

It’s hard to know for sure. Neither Google nor Facebook have said how many users they have. Between them, it’s believed to be in the thousands. As for the employees affected by the app outages, Facebook has more than 35,000 employees and Google has more than 94,000 employees.

Why did internal apps at Facebook and Google break after Apple revoked the certificates?

You might own your Apple device, but Apple still gets to control what goes on it.

After Facebook was caught out, Apple said: “Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.” That meant any app that relied on the certificate — including inside the company — would fail to load. That’s not just pre-release builds of Facebook, Instagram and WhatsApp that staff were working on, but reportedly the company’s travel and collaboration apps were down. In Google’s case, even its catering and lunch menu apps were down.

Facebook’s internal apps were down for about a day, while Google’s internal apps were down for a few hours. None of Facebook or Google’s consumer services were affected, however.

How are people viewing Apple in all this?

Nobody seems thrilled with Facebook or Google at the moment, but not many are happy with Apple, either. Even though Apple sells hardware and doesn’t use your data to profile you or serve you ads — like Facebook and Google do — some are uncomfortable with how much power Apple has over the customers — and enterprises — that use its devices.

In revoking Facebook and Google’s enterprise certificates and causing downtime, it has a knock-on effect internally.

Is this legal in the U.S.? What about in Europe with GDPR?

Well, it’s not illegal — at least in the U.S. Facebook says it gained consent from its users. The company even said its teenage users must obtain parental consent, even though it was easily skippable and no verification checks were made. It wasn’t even explicitly clear that the children who “consented” really understood how much privacy they were really handing over.

That could lead to major regulatory headaches down the line. “If it turns out that European teens have been participating in the research effort Facebook could face another barrage of complaints under the bloc’s General Data Protection Regulation (GDPR) — and the prospect of substantial fines if any local agencies determine it failed to live up to consent and ‘privacy by design’ requirements baked into the bloc’s privacy regime,” wrote TechCrunch’s Natasha Lomas.

Who else have been misusing certificates?

Don’t think that Facebook and Google are alone in this. It turns out that a lot of companies might be flouting the rules, too.

According to many finding companies on social media, Sonos uses enterprise certificates for its beta program, as does finance app Binance, as well as DoorDash for its fleet of contractors. It’s not known if Apple will also revoke their certificates.

What next?

It’s anybody’s guess, but don’t expect this situation to die down any time soon.

Facebook may face repercussions with Europe, as well as at home. Two U.S. senators, Mark Warner and Richard Blumenthal, have already called for action, accusing Facebook of “wiretapping teens.” The Federal Trade Commission may also investigate, if Blumenthal gets his way.

Machine learning and all its related forms of “AI” are being used to work on just about every problem under the sun, but even so, stemming the alarming decline of the bee population still seems out of left field. In fact it’s a great application for the technology and may help both bees and beekeepers keep hives healthy.

The latest threat to our precious honeybees is the varroa mite, a parasite that infests hives and sucks the blood from both bees and their young. While it rarely kills a bee outright, it can weaken it and cause young to be born similarly weak or deformed. Over time this can lead to colony collapse.

The worst part is that unless you’re looking closely, you might not even see the mites — being mites, they’re tiny: a millimeter or so across. So infestations often go on for some time without being discovered.

Beekeepers, caring folk at heart obviously, want to avoid this. But the solution has been to put a flat surface beneath a hive and pull it out every few days, inspecting all the waste, dirt, and other hive junk for the tiny bodies of the mites. It’s painstaking and time-consuming work, and of course if you miss a few, you might think the infestation is getting better instead of worse.

Machine learning to the rescue!

As I’ve had occasion to mention about a billion times before this, one of the things machine learning models are really good at is sorting through noisy data, like a surface covered in random tiny shapes, and finding targets, like the shape of a dead varroa mite.

Students at the École Polytechnique Fédérale de Lausanne in Switzerland created an image recognition agent called ApiZoom trained on images of mites that can sort through a photo and identify any visible mite bodies in seconds. All the beekeeper needs to do is take a regular smartphone photo and upload it to the EPFL system.

The project started back in 2017, and since then the model has been trained with tens of thousands of images and achieved a success rate of detection of about 90 percent, which the project’s Alain Bugnon told me is about at parity with humans. The plan now is to distribute the app as widely as possible.

“We envisage two phases: a web solution, then a smartphone solution. These two solutions allow to estimate the rate of infestation of a hive, but if the application is used on a large scale, of a region,” Bugnon said. “By collecting automatic and comprehensive data, it is not impossible to make new findings about a region or atypical practices of a beekeeper, and also possible mutations of the Varroa mites.”

That kind of systematic data collection would be a major help for coordinating infestation response at a national level. ApiZoom is being spun out as a separate company by Bugnon; hopefully this will help get the software to beekeepers as soon as possible. The bees will thank them later.

While blockchain emerged first as a platform for currency and value, its employment in the tokenization of data and information has become recognized as being of at least, if not more, underlying value. You could perhaps even use it to track movements on a grid associated with mobility. That was the underlying idea behind the launch a couple of years ago of DOVU, a London-based startup which aims to become “the global marketplace for transport data.” DOVU is backed by seed funding from InMotion Ventures, Jaguar Land Rover’s investment arm, and Creative England, a fund backed by the UK Government.

Founder and CEO Irfon Watkins aims to use blockchain to provide trust for corporates or individuals in data sets for public and enterprise use. The DOVU system works by creating a distributed marketplace for transport data. That would mean vehicle hire, insurance companies, ride-sharing and others could be connected to create a network of transport-related data resources.

This shared data becomes more valuable because it’s shared, not because it’s locked into one platform.

The startup will now begin work with FTSE 250-listed rail company Go-Ahead, to improve the experience for their rail customers.

Go-Ahead will use DOVU’s blockchain-powered reward platform to learn more about its customers and to incentivize changes in passenger behavior.

The rail firm currently runs a more than a billion passenger journeys each year on their bus and rail services.

DOVU’s project will first be rolled out on Go-Ahead’s Thameslink and Southern Rail services.

Users will be able to ‘earn’ cryptocurrency when they share their travel data, this then will help Go-Ahead better understand travel habits and better communicate with customers. But of course, when I say earn, I mean they will earn tokens as a sort of loyalty points.

It’s essentially a loyalty scheme running on a blockchain platform, where the token becomes the loyalty tracking device.

If Data is “the oil of the new economy,” as the consultants like to call it, then it’s clear that transport users are poised to become the new oil miners.

The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 9am Pacific, you can subscribe here:

1. We dismantle Facebook’s memo defending its ‘Research’

The fallout continues following TechCrunch reporting about a Facebook app that was paying people to collect a huge swath of data from their phones. For one thing, a new memo from Facebook’s VP of production engineering and security provides more detail about exactly what data Facebook was trying to collect from teens and adults in the U.S. and India.

We also learned that like Facebook, Google was using Apple enterprise certificates to circulate a consumer-facing data collection app — leading Apple to shut down, then restore access to Google’s internal iOS apps.

2. Amazon and Flipkart pull 100,000s of products to comply with new Indian law

Amazon has been forced to pull an estimated 400,000 products in India after new regulation limiting e-commerce businesses went into force in the country. And Flipkart could pull as many as one-quarter of its products in order to comply with the rule, according to analysis from consulting firm Technopak.

3. Apple fixes FaceTime eavesdrop bug, with software update incoming

“We have fixed the Group FaceTime security bug on Apple’s servers and we will issue a software update to re-enable the feature for users next week,” the company said.

4. H-1B changes will simplify application process

Danny Crichton does some table-napkin math to conclude that the changes will likely benefit advanced degree holders, while diminishing the chances for regular applicants.

5. Kleiner Perkins gets back to early-stage with its $600M 18th fund

The firm, which was recently rocked by the departure of legendary investor Mary Meeker, says it’s going “back to the future” with a focus on early-stage deals.

6. Amazon reports better than expected Q4, but lowers Q1 guidance

The online retail giant reported $72.4 billion in Q4 revenue, topping last year’s $60.45 billion and besting the analysts’ forecast of $71.92 billion. Amazon Web Services also played a key role, with a massive $2.2 billion operating income.

7. Vice Media will lay off 10 percent of its staff

Vice is the latest digital media company to announce major cuts. The goal is to allow Vice to focus on growth areas like branded content and film and TV production.

While it appears that overall economic activity could be slowing down, one area that continues to soar is the cloud business. Just this week, Amazon and Microsoft reported their cloud numbers as part of their overall earnings reports.

While Microsoft’s cloud growth was flat from the previous quarter, it still grew a healthy 76 percent to $9.4 billion or a $37.6 billion run rate. Meanwhile AWS, Amazon’s cloud division, grew 46 percent to $7.4 billion or a $29.6 billion run rate. That’s up from $5.11 billion from a year ago. As always, it’s important to remember that it isn’t necessarily an apples to apples comparison as each company counts what they call cloud revenue a little differently, but it gives you a sense of where this market is going.

Both businesses also face the law of large numbers in terms of growth, that is, the bigger you get, the harder it is to keep growing at a substantial rate. The two companies are doing quite well though considering how mature their offerings are.

Last year Synergy Research reported the overall cloud market worldwide grew 32 percent to $250 billion. In Synergy’s last report on cloud market share in October, it had Amazon well in the lead with around 35 percent and Microsoft around 15 percent. A Canalys report from the same time period had AWS with 32 percent and Microsoft with 17 percent, so close you could call it a tie for statistical purposes.

Alibaba, which just reported earnings was up 84 percent, but only have a small worldwide market share. IBM, which bought Red Hat for $34 billion last year, hoping to grab a bigger piece of the hybrid cloud market, reported cloud revenue was up only 12 percent for 2018 in its earnings report last week, which seem pretty paltry compared to the rest of the market. It’s worth noting that the Red Hat sale won’t close until later this year. Google will be reporting at the beginning of next week, but has not been breaking out cloud revenue recently. It will be interesting to see if that changes.

Most experts agree that we are just beginning to scratch the surface of cloud adoption and that the vast majority of workloads are still locked in private data centers around the world. That means even if there is a broader economic downturn in the future, the cloud could be somewhat insulated because companies are already in process of moving parts of their businesses to the cloud.

As these companies grow, it requires increasing numbers of data centers to deal with all this new business, and a Canalys report found that Microsoft and Amazon have been busy in this regard. Amazon currently has 60 cloud locations worldwide with another 12 under construction. Canalys reports that the company’s CapEx spending (which includes non-data center spend) reached $26 billion, up a modest 7 percent. Meanwhile Microsoft, which is chasing AWS, had much more aggressive infrastructure spending with expenditures up 64 percent to $14 billion.

You can expect that unless something drastic happens, the market pie will continue to expand, but the numbers probably won’t change dramatically as these two market leaders have hardened their market positions and it will become increasingly difficult for competitors to catch them.

The sheer scale of global financial crime is not to be underestimated.

The UK’s National Crime Agency recently observed that it’s “in the hundreds of billions of pounds” annually, and that’s just in the UK. In the US, domestic financial crime, excluding tax evasion, generates approximately $300 billion of proceeds each year for potential laundering. This is a conservative estimate.

So with the rise of startup banks, it only makes sense that the next phase of this FinTech evolution will be detecting financial crime and fraud.

It’s, therefore, no surprise that Mimiro, which was previously known as ComplyAdvantage and was founded by the co-founder and former CEO of Marketinvoice, closed a $30m (£22.8m) funding round this week.

The raise was backed Index Ventures and Balderton Capital . And guess where they previously laid their fintech cards? Yes, in the fintech/banking-style startup Revolut .

The trick with Mimiro is that it uses AI to analyze the risk of financial crime for banks, building a database of risk profiles for both companies and individuals.

Mimiro is not the only startup making hay in this hot space of fraud and identity. Onfido, which started off checking the credentials of Uber drivers, was recently selected by PensionBee to streamline its KYC processes and add more customers without manual intervention.

It’s even moved into the area of identity verification services for crypto platforms. Onfido has already secured $60m worth of investment from the likes of Microsoft and Salesforce.

So it’s clear that in the age of greater liberalization of financial services, challenger banks and the rise of crypto platforms and services, tracking identity, fraud, and financial crime is going to be an extremely hot space for startups, and the attendant venture capital, to tackle.

Huawei mobile chief Richard Yu has already made mention of the company’s upcoming foldable phone amid talks of smartphone world domination. This morning, however, we caught our first glimpse of the handset in profile, along with the promise of more, arriving February 24, during Mobile World Congress in Barcelona.

Foldables are very much heating up to be the highlight of the 2019 smartphone race. Royole’s already shipping a handset to devs, and Samsung is set to give us a lot more info at an Unpacked event a mere days before MWC kicks off.

Xiaomi’s offering is merely a concept, but it’s the coolest of the bunch, and then there’s the return of the Motorola Razr, which seems, if nothing else, a solid play for smartphone nostable. Google, too, has been working hard at building in support for what’s sure to be a broad range of different foldable form factors, as hardware companies fumble to find the best design.

Also notable on the teaser is the Connecting the Future text, which appears to be a reference to the phone’s inclusion of 5G, which would really put the handset smack dab in the middle of the mobile zeitgeist. It would also likely further drive up an already pricey design.

Amazon had a record-breaking holiday quarter, with revenue of $72.4 billion and profits of $3 billion, but it’s not making much money off its top-selling item, the Alexa-powered Echo Dot. While the e-commerce giant said the device was its 2018 holidays best seller across all products, it also reminded investors on yesterday’s earnings call that Echo devices aren’t priced “to make money.”

Instead, Amazon sees Echos as another means of connecting with its customer base – its most avid, engaged customers, that is.

“There are a group of customers who use our devices and then we monetize that in different ways – commitment to Amazon and the video and everything else,” noted Amazon CFO Brian Olsavsky, speaking to investors on Thursday.

While some reports have dismissed Echo devices’ potential for online shopping, Amazon appears to be playing the long game with regard to voice computing. With an Echo in the home, consumers are more likely to remain a Prime subscriber, streaming Prime music or audiobooks, or – on its devices with a screen – watching Prime Video. As Amazon advances its e-commerce strategy with Whole Foods and Prime Now, it also sees Echo as a means of getting items to your door within an hour or two, simply by way of voice commands.

That means, for now, Amazon’s goal is to get an Echo into the home – even if it has to sell the gadgets at cost (or even less).

And the devices are selling. Amazon said the Echo Dot was the best-selling item across all of Amazon globally during the holiday quarter, and customers purchased “millions more devices from the Echo family” in 2018 than they did in 2017.

Amazon had also said last month that over 100 million Alexa devices had been sold to date, including the Echo Dot and other Echo-branded devices, along with those from third-parties.

As the company is usually cagey about sharing exact numbers when it comes to things like this, it was a notable milestone.

Google, of course, quickly responded with a note that its Assistant AI will be on a billion devices by the end of January. But it wasn’t a fair comparison, because Google was counting Android smartphones while Amazon’s number, we confirmed at the time, didn’t include smartphones – even though you can use Alexa from within the Alexa mobile app and even within the widely installed Amazon shopping app.

However, Echo devices aren’t Amazon’s only means of introducing Alexa to consumers.

The Echo Dot is the best seller in terms of Alexa-powered devices, due to its low price point and regular discounts during major shopping events like the 2018 holidays, Black Friday and Amazon’s own Prime Day, but it’s joined by a growing number of other Alexa products.

In 2018, the company saw over 100 new products with Alexa built-in launched from third-party manufacturers, bringing the total up to over 150. And Alexa works with over 28,000 devices, like smart home devices and other hardware, from across 4,500 brands.

Amazon, itself, is trying to figure out how to put Alexa into more things. It even jokes about this in its latest TV commercial, set to be aired during the Super Bowl.

The ad references a more offbeat device – the AmazonBasics Alexa-powered microwave – but then makes cracks about the Alexa devices that didn’t work – like an Alexa dog collar and hot tub, for example.

Alexa skills top 80,000

The growing Alex ecosystem means the number of things you can do using the voice assistant, by way of its voice apps called “skills,” is also increasing.

A new number Amazon shared yesterday was that the number of voice applications built for Alexa had now topped over 80,000 worldwide. That’s up from the 70,000 skills Amazon was touting back in December.

Amazon CEO Jeff Bezos mentioned this figure and other milestones related to Alexa’s improvements in a statement, on Thursday.

“The number of research scientists working on Alexa has more than doubled in the past year, and the results of the team’s hard work are clear. In 2018, we improved Alexa’s ability to understand requests and answer questions by more than 20 percent through advances in machine learning, we added billions of facts making Alexa more knowledgeable than ever, developers doubled the number of Alexa skills to over 80,000, and customers spoke to Alexa tens of billions more times in 2018 compared to 2017,” Bezos said.

The company said in November it now has over 10,000 employees working on Alexa, as a point of reference. But it’s challenged in building up a knowledge base of questions and answers – something Google has worked on since the launch of its Knowledge Graph in 2012.

At the end of the day, consumers may not pick a device only because of what facts it can spout off, but rather because of how well it fits into the home in other ways. Alexa can play your music and share the news like any voice assistant, but it also works with other Amazon devices, like Ring doorbells and Amazon security cameras, keyless entry systems, and more. And it can deliver your food and other items.

Google, meanwhile, doesn’t have a successful e-commerce business and just lost a key partner for its Google Express shopping service, with Walmart’s exit from the platform.

That leaves Google at something of a disadvantage as assistants cater more to our needs to not just answer questions or turn on the lights, but to make anything appear at our door. If Amazon has to give away a few million devices to stake out its place in the future of shopping, it believes that’s money worth losing.

 

Vice Media plans to cut 250 jobs — about 10 percent of its total workforce.

The Hollywood Reporter broke the news. When contacted by TechCrunch, a Vice spokesperson confirmed the story but declined to comment further.

This comes after a brutal couple of weeks in the media business, as companies began the year with major cuts. BuzzFeed is trimming its staff by 15 percent. Verizon Media Group (which owns TechCrunch) laid off 10 percent of its workforce. And traditional media wasn’t immune, with Gannett eliminating as many as 400 jobs.

Alongside the broader industry issues, Vice has had a tumultuous year of its own. Reporting by The New York Times at the end of 2017 led to the departure of multiple executives. Nancy Dubuc, previously the chief executive at A+E Networks, replaced co-founder Shane Smith as CEO in March. And in November, the company instituted a hiring freeze aimed at cutting the workforce by up to 15 percent.

According to the Hollywood Reporter, once Vice executives had created their strategic plan for 2019, they decided to complete those cuts with layoffs. Every department of the company will be affected, but the goal is to allow Vice to focus on growth areas like branded content and film and TV production.

“We will make Vice the best manifestation of itself and cement its place long into the future,” Dubuc said in a memo sent to Vice staff.

Sony posted record quarterly earnings this week on the strength of very strong music profits. Those numbers were catapulted thanks to the company’s $2.3 billion acquisition of EMI as part of an ever-consolidating music industry.

The electronics giant’s operating profit rose to $3.46 billion for the quarter — up from $3.21 billion a year prior, marking the highest single-quarter profit for the company. Things were less rosy on the gaming front, however, where the company was hit by declining hardware sales of its mature PS4 consoles for the holiday quarter.

The console sold 8.1 million units for the quarter — though the company says that’s roughly in line with its own expectations, as the latest PlayStation turns six. The long-awaited Marvel’s Spider-Man game was a hit for Sony, but not enough to make up for diminishing hardware sales. Profit for the gaming business dropped 14 percent, year over year.

The news comes as the younger (and cheaper) Switch continues to sell at a brisk pace — though Nintendo did notably trim expectations from 20 million to 17 million for the year. Sony was also hit by lowered demand for mobile imaging as the global smartphone market continues to struggle.