Norton 360 Now Comes With Crypto Mining Capabilities And Sketchy Removal Process

from the tales-from-the-crypto dept

If you're in the IT industry, as I am, and you come across someone talking about using Norton or Symantec antivirus software, as I occasionally do, it typically sends you diving for your calendar to check what year we're in. The a/v provider, once dominant in the space, has since built a reputation for itself as bloated software that is mostly effective at grinding your computer to a halt. Whether or not that reputation is deserved, the company has also had issues in the past with users claiming an inability to fully remove Norton software when attempting an uninstall. So, a checkered recent past is the point.

Which makes Norton the perfect antivirus company to rollout an update to its Norton 360 platform to allow customers to mine Ethereum with its software!

What is Norton Crypto?
Norton Crypto is a feature made available in Norton 360 which you can utilize for mining cryptocurrency when your PC is idle. Currently, Norton Crypto is limited to users with devices that meet the required system requirements.

Now, the FAQ has, as its second bullet point, a notification that this is all opt-in... but I am 99% sure that wasn't there when I first viewed it. (Editor's note: Sure enough, Wayback Machine shows that the page did not originally say that it was only opt-in -- though it also does not say that it's only opt-out). Shame on me for not grabbing a screenshot to be sure, but there were plenty of folks on Twitter who read through it and took this all as sneaky and opt-out.

Now, about that cut that Doctorow references. The FAQ notes that there is no software licensing fee needed to utilize this feature. It's included in your Norton 360 subscription. However, Norton also takes a 15% cut of all cryptocurrency that is mined by the user's computer. Twitter had much to say about this as well. Some see this as mostly a free money-grab by Norton, getting a 15% cut when nearly all the mining work is being done on its customers' computers. Others pointed out that, based on the price of Ethereum, current mining rate projections, and the cost of energy... using this software might actually be a net-negative revenue generator for anyone using it, due to the increase in energy consumption to keep an otherwise idle machine spending GPU cycles to mine crypto.

And still others have pointed out that there are already complaints from users of the platform over, you guessed it, a convoluted process for uninstalling the feature from their computers.

However, according to mAxius and other users, there is no way to fully opt out of the program, and you actually have to dig into NCrypt.exe in your computer’s directory to delete it.

That may not seem like a big deal, but Norton has a rocky relationship with its user base, and the company has seen controversy in the past for poor transparency and not entirely deleting files when uninstalled.

So, in summary, Norton proudly announced that it was adding a feature for users to repurpose antivirus software to mine cryptocurrency, which likely wasn't clearly labeled as an opt-in feature, in order to take a 15% cut from its own customer base when its used and which it made difficult to actually uninstall if a customer wants to be rid of it.

I'll give Norton this, at least: this is all very on-brand.

Filed Under: cryptomining, ethereum, minining, norton 260, norton crypto, opt-in, opt-out, skimming
Companies: norton

Apple's 'Do Not Track' Button Is Privacy Theater

from the privacy-theater-incorporated dept

Earlier this year Apple received ample coverage about how the company was making privacy easier for its customers by introducing a new, simple, tracking opt-out button for users as part of an iOS 14.5 update. Early press reports heavily hyped the concept, which purportedly gave consumers control of which apps were able to collect and monetize user data or track user behavior across the internet. Advertisers (most notably Facebook) cried like a disappointed toddler at Christmas, given the obvious fact that giving users more control over data collection and monetization, means less money for them.

By September researchers had begun to notice that Apple's opt-out system was somewhat performative anyway. The underlying system only really blocked app makers from accessing one bit of data: your phone's ID for Advertisers, or IDFA. There were numerous ways for app makers to track users anyway, so they quickly got to work doing exactly that, collecting information on everything from your IP address and battery charge and volume levels, to remaining device storage, metrics that can be helpful in building personalized profiles of each and every Apple user.

Privacy advocates and the press noted how this was all giving Apple users a false sense of security without really fixing much. Privacy experts and press outlets also repeatedly informed Apple this was happening, but nothing changed. In fact, the Financial Times notes that six months after the feature was introduced, Apple has further softened its stance on the whole effort:

"But seven months later, companies including Snap and Facebook have been allowed to keep sharing user-level signals from iPhones, as long as that data is anonymised and aggregated rather than tied to specific user profiles.

Here's the thing. There's been just an absolute torrent of studies showing how "anonymizing" data is a gibberish term. It only takes a few additional snippets of data to identify "anonymized" users, yet the term is still thrown around by companies as a sort of "get out of jail free" card when it comes to not respecting user privacy. There's an absolute ocean of data floating around the data broker space that comes from apps, OS makers, hardware vendors, and telecoms, and "anonymizing" data doesn't really stop any of them from building detailed profiles on you.

Apple's opt-out button is largely decorative, helping the company brand itself as hyper privacy conscious without actually doing the heavy lifting required of such a shift:

"Lockdown Privacy, an app that blocks ad trackers, has called Apple’s policy “functionally useless in stopping third-party tracking”. It performed a variety of tests on top apps and observed that personal data and device information is still “being sent to trackers in almost all cases."

A lot of folks spend a lot of time trying to tap dance around a fundamental truth: any effort to give consumers more control and clear insight over what's being collected or sold reduces revenues by billions of dollars annually, even if only a fraction of existing users take advantage. And nobody with their face buried deep in the data monetization trough wants that. It's why it's 2021 and the U.S. still doesn't even have a basic, clear privacy law for the internet era. Not even a super clean one mandating basic transparency requirements and working opt-out tools.

So what we get instead is a lot of gibberish and privacy theater by a lot of folks who don't want to take even a tiny hit in revenues in exchange for healthier markets and happier users.

We also get just an endless parade of semantics, like ISP claims they "don't sell access to your data" (no, they just give massive "anonymized" datasets away for free as part of a nebulous, broader arrangement they do get paid for). We get tracking opt-out tools that don't actually opt you out of tracking, or opt you back in any time changes are made. And we get endless proclamations about how everybody supports codifying federal privacy laws from companies that immediately turn around and spend millions of dollars lobbying to ensure even a basic privacy law never sees the light of day.

At some point this combination of feckless oversight, rampant overcollection of data, minimal transparency, and repeated failure to adhere to the basics on data security will result in a privacy scandal that makes the last fives years' worth of scandals look like a grade school picnic. When that happens, we might finally see some traction on at least a basic law that mandates transparency, opt-out tools that actually work, and penalties for lax security. Until that momentum shift happens, the majority of "privacy reform" efforts are going to have a high ratio of meaningless song and dance.

Filed Under: apps, data, do not track, ios, opt-in, opt-out, privacy
Companies: apple, facebook, snap

Verizon Once Again Expands Its Snoopvertising Ambitions

from the opt-in-to-adventure dept

Back in 2008, Verizon proclaimed that we didn't need additional consumer privacy protections (or opt in requirements, or net neutrality rules) because consumers would keep the company honest. "The extensive oversight provided by literally hundreds of thousands of sophisticated online users would help ensure effective enforcement of good practices and protect consumers," Verizon said at the time.

Six years later and Verizon found itself at the heart of a massive privacy scandal after it began covertly injecting unique user-tracking headers into wireless data packets. The technology allowed Verizon to track users all over the internet, and the company neither bothered to inform users it would happen, or gave users any way to opt out. It took security researchers two years before security researchers even realized what Verizon was doing. Verizon ultimately received a $1.35 million fine from the FCC (a tiny portion of what Verizon made off the program), but still uses the same tech (albeit with functioning opt-out) today.

A few years later and it's not clear Verizon has actually learned all that much. The company last week began expanding its data collection and monetization once again, this time via a new "Verizon Custom Experience" the company says will help it "personalize our communications with you, give you more relevant product and service recommendations, and develop plans, services and offers that are more appealing to you." In reality that means Verizon is expanding the collection of data on the websites you visit, the people you communicate with, and the apps you use.

Of course Verizon isn't asking user permission before enrolling them in this new exciting "experience," and while the company claims it emailed users to inform them they were being opted in, many customers (including myself) never received any such notification. So while users can opt out through a fairly simply opt-out process, most users aren't going to know they're enrolled in the first place. And Verizon being Verizon (where most of its apps and services are shoddy copies of better products), nobody really wants any of this stuff in the first place:

"Nothing I’ve read about the program would make me even consider staying in, especially since Verizon is sneakily signing people up without asking. In an example of how the program could benefit you, Verizon says it could present music listeners with a “Verizon offer that includes music content” or give you a “choice related to a concert in our Verizon Up reward program.” The company then tries to persuade you with “personalized content and marketing” when opting into Custom Experience Plus."

Of course Verizon has been caught up in more privacy scandals than I can remember, from its collection of user metadata to its role as one of the NSA's most trusted allies in domestic surveillance. And when Verizon gets too greedy, which it does a lot, it generally sees a wrist slap with a fine that's always a tiny, tiny fraction of the money made from the dodgy behavior. And the only demand placed on it is usually that it be transparent about whatever dodgy behavior it's doing, while providing working opt out tools.

So not only does Verizon never really face any meaningful accountability when it goes too far, any feckless regulatory enforcement that does happen generally puts the onus on the consumer to not only pay attention to what Verizon's doing, but to also take the time to understand it then opt out. Verizon being Verizon, it's going to always be financially incentivized to make that as convoluted and cumbersome as possible, assuming the opt out system works at all (telecom, like Facebook, has a nasty habit of re-enrolling users who've opted out of such programs).

Filed Under: advertising, custom experience, opt-out, privacy, super cookie, surveillance, telcos
Companies: verizon

Study Shows How Android Phones Still Track Users, Even When 'Opted Out'

from the words-mean-nothing dept

We've frequently noted that what's often presented as "improved privacy" is usually privacy theater. For example researchers just got done showing how Apple's heavily hyped "do not track" button doesn't actually do what it claims to do, and numerous apps can still collect an parade of different data points on users who believe they've opted out of such collection. And Apple's considered among the better companies when it comes to privacy promises.

Android is notably worse. One of my favorite privacy and adtech reporters is Shoshana Wodinsky, because she'll genuinely focus on the actual reality, not the promises. This week she wrote about how researchers at Trinity College in Dublin took a closer look at Android privacy, only to find that the term "opting out" often means absolutely nothing:

"According to the researchers, “with little configuration” right out of the box and when left sitting idle, these devices would incessantly ping back device data to the OS’s developers and a slew of selected third parties. And what’s worse is that there’s often no way to opt out of this data-pinging, even if users want to."

So called "system" apps in many Android variants by the likes of Samsung, Xiaomi, and Huawei often come pre-installed, and can't be removed without rooting your device (which the majority of users can't or won't do). These apps are pretty constantly hoovering up handset data and sending it back not only to the parent company, but to third party data brokers. So even when you think you're "opting out" of data collection and sales, you're not really:

"On their own, none of these data points can identify your phone as uniquely yours, but taken together, they form a unique “fingerprint” that can be used to track your device, even if you try to opt out. The researchers point out that while Android’s advertising ID is technically resettable, the fact that apps are usually getting it bundled with more permanent identifiers means that these apps—and whatever third parties they’re working with—will know who you are anyway. The researchers found this was the case with some of the other resettable IDs offered by Samsung, Xiaomi, Realme, and Huawei."

Some of Google's developer rules prohibit the worst sorts of behavior, but they often only restrict how the data can be sold, not what can be collected. And it's also hard to think they're being effectively policed at any scale. Meanwhile, Google tried to brush aside the researchers' concerns over at Bleeping Computer by claiming this is just how phones work now:

"While we appreciate the work of the researchers, we disagree that this behavior is unexpected – this is how modern smartphones work. As explained in our Google Play Services Help Center article, this data is essential for core device services such as push notifications and software updates across a diverse ecosystem of devices and software builds."

Except it's not how cell phones have to work. Case in point: phones using /e/OS, a privacy-focused open-source operating system that promises users a "de-Googled" device, don't mindlessly and endlessly chirp back to the monitor mothership. You can make devices that actually don't phone home constantly, and genuinely opt users out of all tracking when asked. Companies just don't want to do it. Most usually because apathy and tap dancing is more profitable.

Again, much of this occurs because the U.S. still lacks a real privacy law for the internet era. While people often talk about how passing a good privacy law is just too damn hard to get right, a good first step is requiring absolute transparency into what's being collected and sold, and providing working opt out tools. And also we could probably actually fund and staff U.S. privacy regulators while we're at it, so there's somebody competent actually watching the henhouse. Meanwhile, the full study can be found here (pdf) for those interested.

Filed Under: android, do not track, opt-out, privacy
Companies: google

Amazon's Idea For A Mesh Network Is Cool; Its Method Of Rolling It Out Is Not

from the c'mon-guys dept

Over the weekend there was a bit of a reasonable fuss raised after Ars Technica noted that all of the various Amazon connected devices (including Alexa, Echo, Ring, etc.) would become part of a mesh network called Amazon Sidewalk, in which the devices would be sharing a tiny tiny bit of bandwidth across the network of devices. The idea behind the mesh network is kind of cool, and there are some clear benefits to using it.

But, of course, this is Amazon we're talking about -- a giant company, and the method of rolling this out seems to have caught a ton of people by surprise: namely opting everyone into the program with a short timeline to opt-out. That seems less than ideal. Lots of privacy folks are concerned, in general, with two aspects of this: the fact that people may be suddenly sharing data with their neighbors without necessarily realizing it, and the tie-in to Amazon, which is (again) a large company that tends to collect quite a bit of data on people. To its credit, Amazon released a pretty comprehensive whitepaper exploring the privacy and security protections they've built in to Sidewalk, and my guess is that for many consumers the benefits of easier setup and better connectivity via Sidewalk will seem worth it to them.

The real issue, then, is forcing everyone into the network. Obviously, it's no surprise why this was done. A mesh network really only works if you have enough nodes on the network to make it useful. So it makes sense that Amazon would want as many of the devices to be on the network on day one as possible. However, given the company and the public scrutiny it has received of late, it seems like it should have anticipated these concerns a lot more, pushed for an opt-in setup (perhaps with incentives), rather than jumping to the "hey, we're adding this automatically" approach.

While it's possible that Amazon is betting that the concerns over this will blow over, and having so many nodes on the network will make it worthwhile to take the short-term heat, it still surprises me that the big internet companies don't take more steps to alleviate these kinds of concerns up front, including taking a more cautious approach. But, perhaps that's why I don't run a giant internet company.

Filed Under: alexa, amazon sidewalk, echo, iot, mesh network, opt-in, opt-out, privacy, ring, sharing
Companies: amazon

DHS Goes Biometric, Says Travelers Can Opt Out Of Face Scans By Not Traveling

from the driving:-dangerous-and-unpatriotic dept

The DHS has decided air travel is the unsafest thing of all. In the wake of multiple fear mongering presidential directives -- including a travel ban currently being contested in federal courts -- the DHS has introduced several measures meant to make flying safer, but in reality would only make flying more of a pain in the ass.

The government has argued in court that flying is a privilege, not a right, and the DHS seems hellbent on making fliers pay for every bit of that privilege. We've seen laptop bans introduced as a stick to push foreign airports to engage in more security theater and a threat to rifle through all travelers' books and papers to ensure nobody's reading explosive devices.

Now, the DHS is going to be scanning everyone's faces as they board/disembark international flights.

The Department of Homeland Security says it’s the only way to successfully expand a program that tracks nonimmigrant foreigners. They have been required by law since 2004 to submit to biometric identity scans — but to date have only had their fingerprints and photos collected prior to entry.

Now, DHS says it’s finally ready to implement face scans on departure — aimed mainly at better tracking visa overstays but also at tightening security.

The DHS swears it won't be retaining face scans of US persons, but apparently never considered limiting the collection to foreign travelers. Instead, the DHS will "collect them all" and supposedly toss out US citizens' scans later.

John Wagner, the Customs deputy executive assistant commissioner in charge of the program, confirmed in an interview that U.S. citizens departing on international flights will submit to face scans.

Wagner says the agency has no plans to retain the biometric data of U.S. citizens and will delete all scans of them within 14 days.

This sounds good (other than the collect-them-all approach) but Wagner's not done talking. The DHS is obviously hoping to make use of US persons' scans at some point.

However, [Wagner] doesn’t rule out CBP keeping them in the future after going “through the appropriate privacy reviews and approvals.”

This makes the promise of a 14-day deletion period dubious. The DHS would seemingly prefer to keep everything it collects, so this deletion promise may morph into data segregation, with the government keeping domestic scans in their own silo for possible use later.

The program is already being deployed at a handful of major airports. During the trial run, passengers will be able to opt out of the collection. But the DHS's own Privacy Impact Assessment [PDF] makes it clear it won't be optional for long.

Privacy Risk: There is a risk to individual participation because individuals may be denied boarding if they refuse to submit to biometric identity verification under the TVS.

Mitigation: This privacy risk is partially mitigated. Although the redress and access procedures above provide for an individual’s ability to correct his or her information, the only way for an individual to ensure he or she is not subject to collection of biometric information when traveling internationally is to refrain from traveling. [emphasis added] Individuals seeking to travel internationally are subject to the laws and rules enforced by CBP and are subject to inspection.

To opt-out is to not travel. Considering this affects international flights, the DHS has a very good chance of achieving 100% compliance.

But there are other percentages to be concerned about, like accuracy. The DHS has a 96% accuracy requirement for face scanning tech (but, oddly, not for its TSA employees...), but its Privacy Impact Awareness report doesn't actually say whether vendors have been able to hit that mark. In practical terms, what's being deployed could still be well under that percentage. Considering the number of things that need to go right to obtain a useful face scan, the error rate could be far above 4% once less-than-ideal capture conditions are factored in.

Whatever privacy assurances are being given now, expect them to be whittled down in the future, especially if the government continues to engage in reactionary, fear-based lawmaking. With the exception of some post-Snowden surveillance reforms, the government's desire to collect databases full of US persons' info has only steadily increased since September 11, 2001.

Filed Under: dhs, face scanning, facial recognition, homeland security, opt-out, privacy, tsa

Comcast Sued Over Router Update That Makes Your Wi-Fi Hotspot Public, Ignores Your Opt-Out Preferences

from the pay-us-to-pay-us dept

"Grear claims that Comcast does not request customers' authorization to use their residential equipment and networks for public use. "Indeed, Comcast's contract with its customers is so vague that it is unclear as to whether Comcast even addresses this practice at all," the lawsuit claims. In using its customers' home networks to build a national network, Comcast "has externalized the costs of its national wi-fi network onto its customers," Grear says in the complaint. He claims that the new routers use much more electricity than regular routers, and that this is "a cost borne by the unwitting customer."

Filed Under: hotspots, lawsuits, modem rentals, modems, opt-out, routers, terms of service, wifi
Companies: comcast

Canadian Cities Looking To Opt-Out Of CETA Rather Than Get Roped Into An ACTA-Like Situation

from the municipalities-fight-back dept

Though the specific process differs from country to country, international agreements are generally negotiated and signed at the highest levels of government, with input from everyone else filtering up (in theory) through the hierarchy—at least until you get something like ACTA, where the public rises up en masse and essentially overrides the whole system. One thing that you don't often see is municipal governments standing up to take a direct role in international negotiations—but that's exactly what's happening now in Canada, where cities are seeking to avoid an ACTA-like situation by asking to opt out of the Canada-EU Trade Agreement (CETA) at the municipal level.

The effort is being led by The Council of Canadians, a social justice group which is working to persuade cities, towns, and municipal authorities all over Canada to request exemption from CETA. Their core concern is about the agreement's procurement chapter, which sets down rules about how governments and other public bodies can spend money on goods and services, and which they fear will unduly restrict municipalities:

For example, new rules in CETA on how public bodies spend money would:

• Prohibit municipalities from putting buy local or buy Canadian preferences on contracts, or requiring that bidders use some portion of local or Canadian goods, services or labour. This would end the ability of municipalities to use procurement as a local economic or social development tool.
• Prohibit municipalities from using public spending to create or support a market for innovative goods and services, including green technologies, if the effect would favour Canadian producers or attract investment to Canada.
• Prohibit municipalities from spending public money in ways that support sustainability, for example through buy local food policies like the one Toronto passed to reduce emissions from food miles.

As long as municipal governments are part of the CETA deal, these prohibitions will apply to local purchases. We need to make sure cities, towns, school boards and hospitals are not bound by these unnecessary rules.

So far, over 30 local governments representing over 5.5 million people have joined the exemption campaign and another 30 to 40 municipal councils, school boards or associations have asked for more information and more input in the negotiations. Unfortunately, as is common with these situations, such concerns have been largely brushed off in a weak damage control effort by the federal government. Assurances from the Candian Foreign Affairs and International Trade Ministry on the Myths and Realities page are reminiscent of the EU's ACTA Facts, and the Council of Canadians have a page that debunks them. International trade strategist Peter Clark laughs off the fears Canadians have of corporate control of their water services.

CETA is not about diverting Canada’s lakes and rivers – which would not do Europeans much good in any event because we have no common borders... There is no requirement to privatize services which do not compete with private entities and do not operate on a commercial basis.

There are good reasons for the municipalities' concern about the investors' clauses, but Clark just tells them not to worry their pretty little heads about it and run along. Stonewalling and secrecy are not the way to build confidence in the benefits of CETA.

Filed Under: acta, canada, ceta, cities, opt-out

Yellow Pages Companies Team Up To Offer Opt-Out

from the save-some-yellow-trees dept

Filed Under: opt-out, yellow pages