Tag Archives: Internet & Networking Technology

Proton launches ‘Data Breach Observatory’ to track personal info leaks

Posted on by

Proton, the company behind Proton VPN and other encrypted apps like Proton Mail and Proton Drive, just launched a new web page called the Data Breach Observatory that aims to make accurate cybercrime data more widely accessible. The Observatory is intended to be a continually updated report that records any data leak detected on the dark web, with information sourced from the underground data marketplaces themselves.

The reason for the Observatory, according to Proton, is that too many studies of cyberattacks depend on organizations reporting when they've been hacked. A company might not make a data breach public for fear of backlash from customers, regulators or stockholders. Although it's impossible to tell how many breaches aren't reported, Proton believes it's a significant portion.

Compounding the transparency problem, most stolen data is advertised and traded on dark web markets that are hard to trace without specialized knowledge, like how diamond thieves don't tend to fence their loot at above-board jewelry stores. In other words, while most people know that personal information is frequently stolen and leaked, it's very difficult to know how much data is getting stolen, how often breaches occur and who's buying and selling the goods.

Proton's solution is to monitor the dark web itself, watching locations where data thieves go to advertise stolen information. By keeping an eye on these exchanges, Proton believes the Data Breach Observatory will be able to warn victims as early as possible, including before the targets themselves are aware of the leak. Making breach reports available in one place is also meant to educate the public about the actual size and scope of cybercrime, while making it harder for companies to keep quiet about getting hacked.

Proton plans to update the Observatory in "near real time," working with a risk detection firm called Constella Intelligence. It remains to be seen whether they'll be able to keep up the workload — according to Proton's own research, around 1,571 data breaches have occurred in 2025 so far, compromising well over 100 billion records. A clearing house for reporting on all of those definitely sounds valuable, but at around five breaches a day, it'll be a busy page.

This article originally appeared on Engadget at https://www.engadget.com/cybersecurity/proton-launches-data-breach-observatory-to-track-personal-info-leaks-110047833.html?src=rss

Character.AI to ban teens from talking to its chatbots

Posted on by

Character.AI will no longer permit teenagers to interact with its chatbots, as AI companies face increasing pressure to better safeguard younger users from harm. In a statement, the company confirmed that it is removing the ability for users under 18 to engage in any open-ended chats with AI on its platform, which refers to back-and-forth conversations between a user and a chatbot.

The changes come into effect on November 25, and until that date, Character.AI will presents users with a new under-18 experience. It'll encourage its users to use chatbots for creative purposes that might include, for example, creating videos or streams, as opposed to seeking companionship. To manage the transition, under-18s can now only interact with bots for up to two hours per day, a time limit the company says it will reduce in the lead-up to the late November deadline.

Character.AI is also introducing a new age assurance tool it has developed internally, which it says will "ensure users receive the right experience for their age." Along with these new protections for younger users, the company has founded an "AI Safety Lab" that it hopes will allow other companies, researchers and academics to share insights and work collaboratively on improving AI safety measures.

Character.AI said it has listened to concerns from regulators, industry experts and concerned parents and responded with the new measures. They come after The Federal Trade Commission (FTC) recently launched a formal inquiry into AI companies that offer users access to chatbots as companions, with Character.AI named as one of seven companies that had been asked to participate. Meta, OpenAI and Snap were also included.

Both Meta AI and Character AI also faced scrutiny from Texas Attorney General Ken Paxton in the summer, who said chatbots on both platforms can "present themselves as professional therapeutic tools" without the requisite qualifications. Seemingly to put an end to such controversy, Character.AI CEO Karandeep Anand told TechCrunch that the company’s new strategic direction will see it pivot from AI companion to a "role-playing platform" focused on creation rather than mere engagement-farming conversation.

The dangers of young people relying on AI chatbots for guidance has been the subject of extensive reporting in recent months. Last week, the family of Adam Raine, who claim that ChatGPT enabled their 16-year-old son to take his own life, filed an amended lawsuit against OpenAI for allegedly weakening its self-harm safeguards in the lead-up to his death.

This article originally appeared on Engadget at https://www.engadget.com/ai/characterai-to-ban-teens-from-talking-to-its-chatbots-180027641.html?src=rss

Google is once again disputing Gmail was breached

Posted on by

Not for the first time this year, Google has been forced to reassure its users that it has not suffered a large-scale data breach that could affect their Gmail accounts. A few months ago the company released an unusual statement intended to put to bed allegations that its email service had been hit with a serious security issue. And it did so again this week, after numerous news outlets published stories suggesting that 183 million passwords may have been compromised in a new breach.

Google has since claimed that this isn’t true in posts on X. It says the listed accounts are likely not fresh victims of an attack, but instead recent additions to the Have I Been Pwned data breach search engine’s database. The website is a free resource that can quickly tell users if their personal data has been hacked. As noted by Bleeping Computer, HIBP’s creator, Troy Hunt, has said in a blog post that over 90 percent of the millions of stolen credentials have been seen before, so are in no way new (16.4 million of addresses were however showing up for the first time in a data breach, according to Hunt).

"Reports of a 'Gmail security breach impacting millions of users' are false," Google said in a statement. "Gmail’s defenses are strong, and users remain protected. The inaccurate reports are stemming from a misunderstanding of infostealer databases, which routinely compile various credential theft activity occurring across the web. It’s not reflective of a new attack aimed at any one person, tool, or platform."

Google does use compilations of open credentials like the one recently uploaded to HIBP to alert its users of possible breaches, and has advised users that turning on 2-step verification and adopting passkeys is more secure than relying on passwords alone, which it notes should always be reset immediately if compromised.

This article originally appeared on Engadget at https://www.engadget.com/cybersecurity/google-is-once-again-disputing-gmail-was-breached-180031380.html?src=rss

Google Chrome will finally default to secure HTTPS connections starting in April

Posted on by

The transition to the more-secure HTTPS web protocol has plateaued, according to Google. As of 2020, 95 to 99 percent of navigations in Chrome use HTTPS. To help make it safer for users to click on links, Chrome will enable a setting called Always Use Secure Connections for public sites for all users by default. This will happen in October 2026 with the release of Chrome 154. 

The change will happen earlier for those who have switched on Enhanced Safe Browsing protections in Chrome. Google will enable Always Use Secure Connections by default in April when Chrome 147 drops. When this setting is on, Chrome will ask for your permission before it first accesses a public website that doesn't use HTTPS. 

Google has been moving in this direction for some time. Chrome started alerting users to unsecure HTTP websites in 2018 and it began defaulting to HTTPS in April 2021. The following year, it started offering Always Use Secure Connections on an opt-in basis. 

When HTTPS isn't used, an attacker can reroute the connection with relative ease and target a user with malware, social engineering attacks or other exploits. "Attacks like this are not hypothetical — software to hijack navigations is readily available and attackers have previously used insecure HTTP to compromise user devices in a targeted attack," the Chrome team wrote in a blog post. "Since attackers only need a single insecure navigation, they don't need to worry that many sites have adopted HTTPS — any single HTTP navigation may offer a foothold. What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites." Always Use Secure Connections is one of the Chrome team's attempts to mitigate such risks.

HTTP connections still persist in navigations to private sites, such as local IP addresses and company intranets. It's complicated for a private site to obtain an HTTPS certificate (something Engadget has had since 2016, fact fans), because the same private name can point to different hosts on multiple networks. For instance, many router manufacturers use "192.168.0.1" as a local IP address for accessing the hardware's admin panel. Still, HTTP navigations to private sites are inherently less risky than on the public web. They aren't entirely safe, but the only vector of attack for HTTP on private sites is from within the local network.

This article originally appeared on Engadget at https://www.engadget.com/cybersecurity/google-chrome-will-finally-default-to-secure-https-connections-starting-in-april-170000603.html?src=rss

Department of Justice confirms that it wants Google to sell off Chrome

Posted on by

The US Department of Justice (DoJ) has released a 23-page document calling for the breakup of Google, including a sale of the Chrome web browser and restrictions on Android, confirming previous reports. Selling Chrome "will permanently stop Google’s control of this critical search access point and allow rival search engines the ability to access the browser that for many users is a gateway to the internet," DoJ lawyers argued in the filing. 

The regulator said that Google must also stop favoring its own search engine in Android. If the company fails to do that, DoJ lawyers argued that it should also be required to divest its mobile device operating system. They also proposed that Google syndicate search results separately and sell its click and query data to aid rival search engines and AI startups.

In a response on its Keyword blog, Google said the DoJ's "staggering proposal" would harm consumers and affect US tech leadership. "[The] DoJ chose to push a radical interventionist agenda that would harm Americans and America's global leadership," wrote Global Affairs president and chief legal officer, Kent Walker. "DoJ’s wildly overbroad proposal goes miles beyond the Court’s decision. It would break a range of Google products — even beyond Search — that people love and find helpful in their everyday lives."

All of this started back in 2020, when the DoJ and multiple states filed a lawsuit arguing that Google paid billions to device manufacturers to secure default status for its search engine. Then in August this year, federal judge Amit Mehta ruled that Google "is a monopolist" in the industry and used its power to charge "supracompetitive prices for general search text ads." (As of last year, Google controlled around 90 percent of the search engine market, processing nearly 9 billion searches per day.)

The DoJ's proposals to breakup Google are based on that ruling, but the makeup and philosophy of the department is likely to change drastically in a Trump administration. Indeed, Google's Keyword blog seems to be aimed directly at the incoming president, invoking dangers to security, required disclosure to foreign companies and the mandating of "government micromanagement." Recently, Trump himself weighed in on the matter, suggesting a breakup might be too drastic. "What you can do without breaking it up is make sure it’s more fair," he said last month. 

All of this is still at an early stage, with many court cases and appeals likely to come. Still, it would represent a seismic shift in how Google, a company with 182,500 employees, does business. More importantly, it could drastically affect how the internet works, as over 60 percent of web interactions start with a search query — and most of those are done using Google search. 

This article originally appeared on Engadget at https://www.engadget.com/big-tech/department-of-justice-confirms-that-it-wants-google-to-sell-off-chrome-094929822.html?src=rss

Meta wants its Llama AI in Britain’s public healthcare system

Posted on by

Meta is making a pitch to get its AI into the UK’s public health system. The Guardian reported on Tuesday that the company held a hackathon in Europe, tasking over 200 developers to use its Llama AI to improve the country’s health services. The company awarded funds for developing AI that shortens wait times in Britain’s A&E rooms (ERs in the US).

The UK’s AI minister, Feryal Clark, told The Guardian that the “government can adopt AI, such as Meta’s open-source model, to support our key missions.” Earlier this month, Meta CEO Mark Zuckerberg gave the green light for Llama to work with the US government. Bloomberg reported on the same day that the company was also working with governments and contractors in Canada, Australia, New Zealand and — as we can see movement toward now — the UK.

Given that Britain’s use of the open-source AI model wouldn’t provide a direct or immediate financial pipeline back to the company, The Guardian asked Meta’s president of global affairs, Nick Clegg, what was in it for Meta. “It is in the long run indirectly in our interest to see this ecosystem of Llama-based innovation because it then makes it much easier for us to reincorporate innovations that are out there into our own products,” Clegg, a former UK deputy prime minister, said.

Mark Zuckerberg said in August that Llama was approaching 350 million downloads, which he credited to the AI model’s open-source nature.

Clegg sounded dismissive — perhaps mockingly so — of fears surrounding AI infiltrating governments. “Who knows, maybe AI will start developing a mind of its own and will start wanting to turn us into paper clips by next Tuesday,” he told The Guardian. “But I think that right now, the technology is way more primitive than a lot of the fears suggest.”

To be fair to critics, “right now” is less of a concern than later.

The UK AI minister Clark told The Guardian that the government wouldn’t shy away from the significant risk AI represents. Instead, it would “make sure that any regulation we introduce is proportionate, supports innovation and does not place undue burden on business.”

This article originally appeared on Engadget at https://www.engadget.com/ai/meta-wants-its-llama-ai-in-britains-public-healthcare-system-174119281.html?src=rss

The EU publishes the first draft of regulatory guidance for general purpose AI models

Posted on by

On Thursday, the European Union published its first draft of a Code of Practice for general purpose AI (GPAI) models. The document, which won’t be finalized until May, lays out guidelines for managing risks — and giving companies a blueprint to comply and avoid hefty penalties. The EU’s AI Act came into force on August 1, but it left room to nail down the specifics of GPAI regulations down the road. This draft (via TechCrunch) is the first attempt to clarify what’s expected of those more advanced models, giving stakeholders time to submit feedback and refine them before they kick in.

GPAIs are those trained with a total computing power of over 10²⁵ FLOPs. Companies expected to fall under the EU’s guidelines include OpenAI, Google, Meta, Anthropic and Mistral. But that list could grow.

The document addresses several core areas for GPAI makers: transparency, copyright compliance, risk assessment and technical / governance risk mitigation. This 36-page draft covers a lot of ground (and will likely balloon much more before it’s finalized), but several highlights stand out.

The code emphasizes transparency in AI development and requires AI companies to provide information about the web crawlers they used to train their models — a key concern for copyright holders and creators. The risk assessment section aims to prevent cyber offenses, widespread discrimination and loss of control over AI (the “it’s gone rogue” sentient moment in a million bad sci-fi movies).

AI makers are expected to adopt a Safety and Security Framework (SSF) to break down their risk management policies and mitigate them proportionately to their systemic risks. The rules also cover technical areas like protecting model data, providing failsafe access controls and continually reassessing their effectiveness. Finally, the governance section strives for accountability within the companies themselves, requiring ongoing risk assessment and bringing in outside experts where needed.

Like the EU’s other tech-related regulations, companies that run afoul of the AI Act can expect steep penalties. They can be fined up to €35 million (currently $36.8 million) or up to seven percent of their global annual profits, whichever is higher.

Stakeholders are invited to submit feedback through the dedicated Futurium platform by November 28 to help refine the next draft. The rules are expected to be finalized by May 1, 2025.

This article originally appeared on Engadget at https://www.engadget.com/ai/the-eu-publishes-the-first-draft-of-regulatory-guidance-for-general-purpose-ai-models-223447394.html?src=rss

A Google ‘test’ will omit EU publishers from news links

Posted on by

Google is conducting a “test” that will omit results from EU-based news publishers. The company says the time-limited trial will only affect a small portion of users in nine EU countries and will help “assess how results from EU news publishers impact the search experience for our users and traffic to publishers.” But given the fragile state of the news media — and the company’s history of threatening to pull its services in the face of news-related regulations — it’s tempting to view it as the equivalent of a mob boss conducting a “little test” to see how the corner laundromat fares without its protection.

Google describes the experiment (via The Verge) as a “small, time-limited test” to omit EU results from search, Google News and the personalized Discover feed. It will only affect one percent of users in Belgium, Croatia, Denmark, France, Greece, Italy, the Netherlands, Poland and Spain. Those users will still see results from other websites, including non-EU news publications.

The company says news results will reappear as usual once the test concludes. (It didn’t list a specific timeframe.) Google stresses that the experiment won’t impact the publisher payments it makes under the European Copyright Directive (EUCD), under which the company has inked deals with over 4,000 EU publishers.

Google does have a history of using the potential withdrawal of its visibility as a negotiating stick in similar situations. In some cases, the tactic has helped it draw concessions.

Last year, Google pulled its news links from Canada in response to Bill C-18 (the Online News Act), which required tech companies to negotiate compensation with online publishers for linked content. After months of negotiations, Google said Canada had addressed its concerns and given it a path to an exemption. Canada said it granted one to Google last month, with the company agreeing to pay $100 million annually to news organizations.

In April of this year, Google briefly removed links to California news outlets in response to the proposed California Journalism Preservation Act (CJPA), which would require Google to pay news publishers in exchange for continuing to link to their websites. Although the bill’s fate is still up in the air, Google struck a deal with state lawmakers this summer, committing tens of millions of dollars to a fund supporting local news.

In 2021, the company threatened to remove its entire search engine from Australia in response to a then-proposed law requiring tech companies to share royalties with news publishers. The nation’s then-Prime Minister stood firm. “Let me be clear. Australia makes our rules for things you can do in Australia,” Scott Morrison said. After the bill was passed and enacted, Google struck deals with Australian media companies to license content.

Google says it hopes the data analysis tools it provides publishers will help them use the EU test to “understand traffic patterns.”

This article originally appeared on Engadget at https://www.engadget.com/big-tech/a-google-test-will-omit-eu-publishers-from-news-links-184536615.html?src=rss

Meta cuts the price of its ad-free plan by 40 percent in a bid to sate EU regulators

Posted on by

Meta has long been at loggerheads with European Union officials over its approach to targeted Facebook and Instagram ads. The company is hoping to placate regulators with some changes to its ad model in the bloc, which includes lowering the price of its ad-free subscription. Starting November 13, the plan will cost 40 percent less — €6 ($6.36) per month for signups via the web and €8 ($8.48) for those who subscribe on an iOS or Android device. The fee for each additional Facebook and Instagram account is €4 per month on the web and €5 via mobile.

The company will automatically drop current subscribers down to the lower pricing. It says that it will once again ask users in the bloc if they'd like to sign up.

When they see this prompt (which can only be ignored for a certain period of time), there will be a third option for EU Facebook and Instagram users to choose from. Those who don't want to pay for a subscription can instead opt to only view ads that are based on what they see in a given session in the apps. Meta will also factor in a few key data markers such as "a person’s age, location, gender and how a person engages with ads."

These less-personalized ads naturally won't be as tailored to a given user's interests, the company notes. As such, people are perhaps less likely to click on such ads. To make up for that (and make sure this option doesn't hit Meta in the pocket too hard), folks who choose the less-personalized ads option will sometimes encounter unskippable ads. According to The Wall Street Journal, these will be displayed full screen.

"Such ad breaks are common across other services, and are already offered by many of our competitors," Meta argues. "This change will help us continue to provide value to advertisers which ensures we can offer people a less personalized ads experience at no charge."

Targeted ads are Meta's biggest revenue driver, but EU officials have reportedly been pressuring the company to offer a free, less-personalized option in its apps. Meta has argued that would negatively impact its bottom line. Although it has seemingly caved to officials' requests, the unskippable ad aspect may be construed as malicious compliance, as it worsens the user experience.

Meta claims that these changes to its ad model "meet EU regulator demands and go beyond what’s required" by the bloc's laws. The company introduced its ad-free subscription a year ago to comply with laws such as the Digital Markets Act (DMA), as well as stricter interpretations of the General Data Protection Regulation. It was previously ordered to seek permission from users in the bloc before showing them personalized ads.

The EU didn't take too kindly to the paid ad-free approach, however. An investigation into the "consent or pay" model is ongoing. In July, the EU said that in its preliminary findings, Meta was violating the DMA with this plan.

These latest changes are said to be Meta's attempt to settle the case, but according to the Journal, the EU's discussions with the company haven't concluded. The bloc's regulatory body has until late March to finish its investigation and make a final decision. If it determines that Meta has indeed violated the DMA, the company could be on the hook for a fine of up to 10 percent of its annual global revenue. Based on its total revenue for 2023, it could have to pay up as much as $13 billion or so.

This article originally appeared on Engadget at https://www.engadget.com/big-tech/meta-cuts-the-price-of-its-ad-free-plan-by-40-percent-in-a-bid-to-sate-eu-regulators-174926790.html?src=rss

Google’s Nest Wi-Fi Pro 6E is cheaper than ever in this early Black Friday deal

Posted on by

For many homes, a single router just won't cut it. Unless the device is in a prime position at the center of your home and there are few walls and other obstacles for the signal to deal with, your Wi-Fi network may not reach the outer limits of your house or property. As such, a mesh network might be what you need. A three-pack of Google's Nest Wi-Fi Pro 6E is worth considering, especially because it has dropped to its lowest price to date.

You can pick up this bundle for $279 at both Amazon and the Google Store. The three-pack normally retails for $400.

This is our pick for the best mesh Wi-Fi system for folks who are using the tech for the first time. There isn't a great deal of customization here and there are more powerful options out there. But the Nest mesh system is easy to set up and then just let it do its thing.

Together, these three nodes provide up to 6,600 sq. ft. of Wi-Fi coverage and speeds of up to 2,402 Mbps. That's more than enough for most people. Though if you're gaming, you'll probably want to connect to Ethernet if possible to minimize lag.

As you might expect, the Wi-Fi Pro 6E integrates with other Google services. It's compatible with the Matter and Thread smart home standards too.

Check out all of the latest Black Friday and Cyber Monday deals here.

This article originally appeared on Engadget at https://www.engadget.com/deals/googles-nest-wi-fi-pro-6e-is-cheaper-than-ever-in-this-early-black-friday-deal-191945827.html?src=rss