Google wants to make your digital life—in its ecosystem, anyway—passwordless and more secure.

Google recently announced that passkey support is coming to both the Android operating system and the Google Chrome web browser—and if you're wondering exactly what that means, you're in the right place. Passkeys are essentially a replacement for passwords that are designed to be more secure. You use them instead of traditional passwords to get into your various digital accounts, whether that's Google, Twitter, Dropbox, or anything else.

You don't get an _actual_ key. Instead, some kind of unlocking mechanism—typically facial recognition or fingerprint recognition, or just a PIN code—is used to prove you are who you say you are for the purposes of logging in.

However, it's not just a case of pressing a button and switching over. Developers need to also code passkey support into their apps and websites, which is why Google made the announcement on its Android Developers Blog.

The move is part of a broader industry push toward a passwordless future—you might have noticed that Microsoft is doing something similar. Users don't have to remember passwords, and there aren't any passwords for hackers to steal.

How Passkeys Work

You'll soon be able to create passkeys on your Android devices.

Google via David Nield

As Google puts it, a passkey “identifies a particular user account on some online service.” At its center is a cryptographic private key that gets stored on the devices you use. This is then matched against a public key held by the digital services you're signing into to confirm your identity.

To make sure it's really you, you'll need to unlock your phone or computer, which on a phone usually means entering a PIN code or letting your face or fingerprint get scanned. On computers, passwords may still be used to verify your identity, but the industry is moving toward biometric authentication all the time.

You don't actually see the passkey itself or need to know what it is—you just have to be you. Your face or fingerprint replaces that long list of passwords on a Post-it note that you might have, so it's much simpler and more convenient.

These passkeys use public-key cryptography, so if they're involved in a data breach, they're useless to bad actors without your face or your fingerprint. Similarly, if your laptop or phone gets stolen, your accounts can't be accessed because you're not going to be around to provide the necessary authentication.

This isn't just a Google initiative. Organizations such as the FIDO Alliance and the W3C Web Authentication group are busy working toward a passwordless future as well, so you'll be able to use these systems across any device, whether made by Google, Apple, Microsoft, or any other hardware maker.

Setting Up and Using Passkeys

Biometric authentication can be used in place of a password.

Google via David Nield

The good news is that using passkeys is as easy as unlocking your phone—it's intended to be as straightforward as possible. You'll be able to choose to move to a passkey system for your accounts, but only when the app you're logging in to and the device you're using have been upgraded with passkey support.

Let's say Google has finished rolling out passkey support to Android, you're logging in to an app that has been updated to use passkeys, and you've said yes when prompted to make the switch from a standard password. You'll then be asked to create a passkey, which will involve you having to do the same action you do to unlock your phone—show your face, press down your fingerprint, or enter a PIN. That creates the passkey and authenticates the link between the app in question and the device in your hand. Whenever you need to log in to that app in future, you'll need to go through the same unlock process. As with passwords, how long that authentication lasts will vary: With your banking app, you'll usually have to log in every time, whereas with a social media account one login per device is often enough.

You'll also be able to log in to sites on your computer through your phone via the magic of a QR code. The site will display a QR code that you scan with your phone—once you've gone through the unlock process on your mobile device, your identity will be confirmed and you'll be logged in to the site.

Encrypted synchronization across devices will also be handled—Google Password Manager is adding support for passkeys, for example, so should you lose access to one device, you can still get at your accounts from another one or from the cloud, assuming you're able to provide the necessary authentication (and you haven't changed your fingerprints or face in the meantime).

How to Use Passkeys in Google Chrome and Android

Plus: Hackers hit the Mormon Church, Signal plans to ditch SMS for Android, and a Fat Bear election erupts in scandal.

Users of the cryptocurrency exchange Celsius are in danger. Last week, as part of its bankruptcy proceedings, the company submitted a 14,500-page document that appears to contain the full names and recent transactions of its users. Typically private, this sensitive information ties people’s real-world identities to their once-anonymous cryptocurrency transactions, making them ripe targets for scammers and other criminals—and crypto-tracing investigators.

If you’re considering upgrading to the new Pixel 7 or Pixel 7 Pro, rest assured that Google put the phone’s security hardware through the wringer to make hacking the device as costly as possible. Not only that, the tech giant plans to roll out a built-in VPN for Android later this year.

For Windows 11 users, we walked through how to take advantage of Microsoft’s automatic phishing protection features. And for students and their parents, we explained exactly what to do to protect against school surveillance technology.

Finally, a Connecticut jury decided this week that Infowars host Alex Jones must pay nearly $1 billion in damages for defaming the families of victims of the 2012 mass shooting at Sandy Hook Elementary, as well as an FBI agent who responded to the horrific scene. The historic jury award doesn’t change what “free speech” means in the United States, but it might make social media platforms rethink their disinformation strategies.

But that’s not all! Each week, we round up the news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

SpaceX says it can no longer fund Starlink satellite internet service in war-torn Ukraine, according to documents obtained by CNN. More than 20,000 Starlink terminals have been donated to the country since Russia invaded in February, and the service has been a lifeline for Ukrainian military efforts. But the $120 million it will take to fund the service through the end of the year is too much for SpaceX, and the company has reportedly asked the Pentagon to pick up the bill going forward.

The move to pull funding comes at an inauspicious time for Elon Musk, SpaceX’s outspoken CEO. The leaked letter asking the Pentagon to pay for Ukraine’s Starlink terminals and service is dated September 8. Less than a month later, on October 3, Musk got into a fight on Twitter with Ukrainian officials after suggesting the country end the war by largely agreeing to Russia’s demands. While a report said that Musk had a call with Russian president Vladimir Putin prior to his tweet about Ukraine appeasing Russia, both the billionaire and the Kremlin deny the call took place.

The Church of Jesus Christ of Latter-Day Saints (often known as LDS or the Mormon Church) revealed this week that hackers breached its systems in late March. In a statement, the church said that it did not disclose the intrusion until now at the request of law enforcement. While LDS says that donation histories and payment card information were not accessed, the data may include “your username, membership record number, full name, gender, email address(es), birthdate, mailing address, phone number(s), and preferred language.” According to the church, federal authorities believe the breach was “part of a pattern of state-sponsored cyberattacks aimed at organizations and governments around the world that are not intended to cause harm to individuals.”

Signal users on Android collectively groaned this week after the Signal Foundation announced that it would no longer support SMS and MMS messaging in the app. The convenient feature allowed Android users to message anyone, regardless of whether they were on Signal, through the app. (Signal’s iOS version did not support this feature.) Signal said in its announcement that the move was due to the inherent insecurity of SMS and the potential for users to forget that they weren’t sending end-to–end encrypted messages to non-Signal contacts. Signal’s lead Android developer, Greyson Parrelli, added in a forum post that part of the reason Signal was ditching SMS and MMS was because Signal “doesn’t play well” with RCS, Google’s new messaging protocol.

Not even bear-based elections are safe these days. On Sunday, officials behind Katmai National Park’s annual Fat Bear Week contest discovered that someone had monkeyed with the vote by flooding it with some 9,000 fake ballots in favor of a bear named 435. Fat Bear election integrity officials soon discovered thousands of fake email addresses linked to the bogus ballots, corrected the tally, and added a captcha to the site to fend off the spammers. Ultimately, a 1,400-pound grizzly aptly named 747 overtook 435 by some 7,000 votes and won the competition. “Bears don’t actually get anything from competing in or winning Fat Bear Week,” Amber Kraft, who helps run the competition at the park, told _Bloomberg_. “Despite which bear wins the most votes in the Fat Bear Week competition, they are all winners.”

Elon Musk’s SpaceX Bails on Starlink Funding for Ukraine

The Infowars host now knows the cost of “free speech”—but does the landmark judgment signal a crackdown on disinformation?

Anyone could have seen the blow coming. What the world didn’t expect was quite how much Alex Jones would have to pay for weaponizing disinformation and piling misery onto the Sandy Hook families as they mourned their lost loved ones. 

Jones was found liable for defaming the parents of children killed at Sandy Hook Elementary almost a year ago, in November 2021, when Connecticut judge Barbara Bellis issued a default judgment against the world’s most notorious shock jock and conspiracy theorist. In reality, most knew Jones had crossed a line after he floated the idea that the 2012 mass murder of 20 children, six educators, and the attacker’s mother was a “government operation” while speaking on an Infowars broadcast in April 2013. It would be the first of many times he repeated the lie. Yesterday, the Connecticut jury decided it would cost him everything.

Decisions against Jones in Texas and Connecticut courts add up to $1.014 billion in damages to the families of Sandy Hook victims and an FBI agent who responded to the shooting at the elementary school in Newtown, Connecticut—with attorney fees to be added to that total in a month. Jones is rapidly learning the cost of “free speech” that allowed him to warp reality in a web of lies—and it’s a staggering sum. But there may also be lessons for the platforms that for years enabled Jones’ rise—and potential consequences for them too.

“By any standard, this is an enormous jury award in a defamation case,” says Lyrissa Lidsky, a US constitutional law scholar at the University of Florida Law School. “It seems to reflect the jury’s outrage over Jones’ behavior in profiting from lies about murdered children.”

The judgment also sends a message to anyone thinking of deliberately deploying disinformation to disrupt people’s lives for financial gain: Think twice—or risk being hit with a similarly large damages payment. “There has to be some message sent here to people like him that this is simply not acceptable in a civilized society,” says Stephen D. Solomon, a journalism professor at New York University and the founding editor of online news and educational resource site First Amendment Watch.

The jury that decided Jones’ level of financial punishment certainly seems to have taken to heart the words of Christopher Mattei, a lawyer representing the Sandy Hook families in Connecticut. “It is your job to make sure he understands the extent of the wreckage that he caused,” Mattei said in his closing argument, “because you know damn well he doesn’t get it.”

This decision could mark the end of a decade of users spreading disinformation on social media with few consequences, as platforms were reluctant to step in and censure them.

It took more than five years for Facebook, Twitter, YouTube, Apple, and Spotify to ban Jones for spreading wild conspiracy theories to his audience of millions. One report at the time covered social media’s inaction as “a timeline of vacillation.” By the time platforms acted, Jones had already built Infowars into an alternative media powerhouse, and his army of adherents was prepared to follow him to fringe social media platforms. Court documents surfaced in a concurrent trial in Texas showed that at his peak in 2018, Jones was making $800,000 a day from his Infowars acolytes, and at one point he paid himself $6 million a year. That cash was—of course—built on falsehoods and enabled by social media platforms that turned a blind eye because it brought them their most prized metric: attention. Jones put a particular focus on the families of Sandy Hook victims, claiming without any evidence or credibility that their children were crisis actors and the losses were not real. Jones turned his mass audience against them in perpetual campaigns of harassment that denied their children’s existence, even as they tried to grieve their losses.

The amount awarded to Sandy Hook families has already spooked those who see the decision as an attempt to silence someone simply because they disagree with the individual’s views. In the immediate aftermath of the decision, US representative Marjorie Taylor Greene warned that the ruling was “political persecution.” “Were his words wrong and did he apologize? Yes,” Greene tweeted. “That’s what freedom of speech is. Freedom to speak words.” Meanwhile, Jack Posobiec, an alt-right conspiracist, asked his followers on Truth Social: “How much money can we get awarded for suing every media figure who said the vaccine would stop transmission?” Underneath the bombast and false threat to weaponize the US legal system is a telling truth: Jones’ defenders recognize that such judgments can bring people to heel in a way platform bans can’t.

Those who fear the erosion of First Amendment rights may be misguided. “The United States provides robust protection for freedom of expression,” says Joseph A. Tomain, senior lecturer at the Maurer School of Law at Indiana University. “That robust protection is critical for a functional self-governing democracy. At the same time, that robust protection is not absolute, and this case demonstrates the limits of free speech under US law. For the vast majority of speakers, I do not see this case as a harbinger of things to come or something that is going to result in self-censorship to avoid legal risk.”

Ken Paulson, director of the Free Speech Center at Middle Tennessee State University, also believes that the decision won’t have the detrimental impact on free speech some fear, but he says the outsized value of the damages in the case is meant to make a point. “I’ve monitored libel cases for 40 years, and I’m not sure I’ve ever seen a less sympathetic defendant,” he says. “What he did was just despicable, and at a level that would be hard to rival. The jury is just conveying its utter disgust and anger and attaching a really big number like a billion dollars to their outrage.” Yet Paulson does believe something has changed post-judgment—not least because of the ongoing debate around the future of Section 230 of the Communications Decency Act, the shield that protects social media platforms from liability for content their users post. The Supreme Court is scheduled to hear two cases that could rewrite Section 230’s power, potentially leaving platforms liable for such content.

“If there were no Section 230, this would send a massive chill through every online organization in the US that hosts comments of any sort,” Paulson says. It would signal a huge shift in platforms’ approach to policing the content posted on their sites, in large part because they’d want to avoid a massive financial punishment of the type Jones has just been walloped with. “For various reasons, including legal risk and a platform’s own standards regardless of legal risk, companies will continue to engage in content moderation,” says Indiana University’s Tomain. “At the same time, individuals will continue to seek redress in courts when they believe that the law provides a remedy based on the speech of others.”

“Large platforms have an important role to play in not giving extra oxygen to false claims that cause concrete injuries,” says Mathias Vermeulen, a disinformation expert and director of AWO, a digital rights agency. “Some of them have taken good steps to prevent such claims from being monetized on their platforms. But that never has been a real deterrent for mass-disinformation producers like Jones, who continued to thrive financially even when they were banned from these platforms.”

Now the billion-dollar judgment sets a precedent that not only can cases be won, but those who are found liable could be on the hook for monumental damages. “The lesson that anyone should take away from this is that if you use your freedom of speech to defame or to engage in fraud, you will face consequences,” says Paulson.

This could mark a sea change in how people speak on social media. For decades, shock jocks and conspiracy quacks wanted to be the next Alex Jones, rich atop a sea of true believers. Now his name is permanently associated with that landmark financial figure—one that stands to ruin him. No one will aspire to that. “Some speakers seem to be under a false impression that defamation law doesn’t apply to social media and that they can say anything they want without consequence,” says the University of Florida’s Lidsky. “This damages award is a corrective to that false impression.”

The $1 Billion Alex Jones Effect

By releasing half a million users’ transactions in a bankruptcy court filing, the company has opened a vast breach in its users’ financial privacy.

The paradoxical nature of cryptocurrency's privacy is that the blockchain, that unchangeable ledger of all a cryptocurrency's transactions, serves as both a map and a mask: Bitcoin are easy enough to follow from one address to the next. But only a few entities, like the cryptocurrency exchanges that allow users to trade their crypto for traditional currency, are able to match the inscrutable strings of numbers and letters in those addresses to real-world identities. So when one of those exchanges suddenly dumps a massive internal user database online, they haven't just spilled their own data. They've offered a key to decipher a vastly larger set of financial secrets.

That's what happened last week when Celsius, a cryptocurrency exchange facing bankruptcy, leaked an enormous collection of its users' transaction data through an unusual sort of privacy breach: a court filing. As part of its bankruptcy proceedings—in which the company's owners are accused of pulling tens of millions of dollars worth of crypto out of the exchange before revealing its insolvency—the company's attorneys released a document that appears to include the transaction data of half a million of its users from April of this year until it ceased trading in June. That database was briefly posted as a 14,500-page PDF to the court records website PACER before being taken down—but not before Gizmodo copied it to the Internet Archive, where it was widely downloaded before being removed there, too.

The data dump includes the names and transaction details of Celsius' users along with the dates and amounts of each payment. The database doesn't include the cryptocurrency addresses that directly identify senders and recipients on cryptocurrencies' blockchains, but the unique payment amounts, detailed down to more than a dozen decimal places of precision in many cases, nonetheless make it possible to match the payments to blockchains' records.

All of that means that the Celsius leak offers a rare gift to both professional and amateur cryptocurrency tracers, allowing them to not only see Celsius users' transactions, but also identify and trace those users' funds across the blockchains. That could potentially open new possibilities to identify scammers, hackers, or any other illicit users who might have exploited Celsius as a cash-out service for ill-gotten coins. But it also opens Celsius' users to exploitation by any rip-off artist or thief who combs through the data, connects it to other accounts, and identifies their cryptocurrency holdings as a ripe target.

"This is really one of the worst exchange data breaches since Mt. Gox," says Nick Bax, head of research at security consultancy and asset recovery firm Convex Labs. But even as he compares the Celsius leak to the disastrous breach of the early Bitcoin exchange Mt. Gox, which was bankrupted by hackers in 2014 and had its transaction database leaked online, he also calls it a "dream come true for analysts" focused on cryptocurrency tracing.

“You can find someone’s balance, deposits, and withdrawals and then correlate all that to the blockchain,” Bax says. “We can use it for good, but it can absolutely be misused too. Criminals are going through this right now, looking for whoever has the biggest balances.” Once they’re identified, Bax warns, those wealthy crypto holders could be targeted with spear-phishing, scams, and even physical extortion.

Cryptocurrency tracers in law enforcement, government regulators, and private firms are no doubt already following flows of funds to and from Celsius, scouring it for leads in their own research. "This is data we'll ingest, analyze, and have available as part of our investigations, and I suspect others will too," says Matt Edman, cofounder of the security startup Naxo. Edman previously worked as an FBI contractor at the Mitre Corporation, where he helped trace cryptocurrency in the criminal case of Ross Ulbricht, the creator of the Silk Road dark web market.

"When it comes to cryptocurrency tracing, following the flow of funds is not really the hard part," Edman adds. "The tricky part in those investigations is the attribution—associating an address or transaction with an individual. That's where datasets like this are key."

Celsius didn't respond to WIRED's request for comment.

In just the days following Celsius' disclosure of the database in court records, internet sleuths have already begun posting findings from the data. One well-known independent cryptocurrency tracer, who goes by the Twitter handle ZachXBT, posted evidence from the leak that a Celsius user and influencer named Lark Davis had promoted Celsius after pulling his own $2.5 million worth of crypto out of the exchange. (Davis didn't immediately respond to WIRED's request for comment.) The website Celsiusnetworth.com already claims to allow anyone to search the data for individuals' holdings at the exchange.

Meanwhile, a cryptocurrency tracer and developer for decentralized finance firm Viper Labs, who goes by the name Federico Notte, converted the PDF from Celsius' court filing into a spreadsheet and posted a link to his public Twitter account. He tells WIRED he hopes to use the database in combination with blockchain analysis to figure out the transactions of major trading funds, in hopes of learning their tactics. "It's something you can definitely do," says Notte. "It's also a major privacy concern for these people, too."

But even as legitimate analysts and investigators dig into the data, some cryptocurrency tracers emphasize that it will be of far more value to criminals. "The amount of private information is quite scary, really," says Thibaud Madelin, who leads research at cryptocurrency-tracing firm Elliptic. "Scammers will be scouting this list, and they’ll know how much people have spent, how much they’ve lost, how much they hope to make back."

"They’re ruthless," Madelin adds, referring to scammers. "And this will give them thousands of opportunities."

Celsius Exchange Data Dump Is a Gift to Crypto Sleuths—and Thieves

The company says it hardened the security of its new flagship phones—and plans to release a built-in Android VPN.

When Google launched its flagship Pixel 6 and 6 Pro smartphones last year, the company touted its Tensor “system on a chip” and dedicated Titan M2 security chip as being designed to underpin a new generation of security and privacy features. Now, as it releases Pixel 7 and 7 Pro, the company said on Tuesday that it is building on that foundation with the new Tensor G2 processor, expanded independent security certifications for Titan M2, and software features like an upcoming built-in Android VPN to protect user privacy while maintaining performance.

Google spent three years subjecting Titan M2 to testing by the third-party lab SGS Brightsight. The chip now has an array of Common Criteria hardware security certifications, the same process that smartcards, SIM cards, and bank card chips go through. Titan M2 passed the highest hardware vulnerability assessment, meaning that it is highly resistant to physical attacks, an area that has been increasingly important to chip makers in recent years.

“This testing emulates the sophistication of state-sponsored attacks, someone who’s got almost unlimited resources and determination,” says Dave Kleidermacher, vice president of engineering for Android security and privacy. “At Google and for Pixel, we talk a lot about the exploit cost. Nothing is ever perfect—there are going to be vulnerabilities and exploits—but we want to always continually raise the cost to the attacker.”

With Pixel 7 and 7 Pro, Google is continuing to expand its efforts on what the company calls Protected Computing. The goal is to restrict how and when user data can be accessed, de-identify and anonymize data when it must be used, minimize the amount of identifying data that is generally produced about a user, and keep as much processing out of the cloud and on users’ devices as possible. On Pixel devices, Google has control of both hardware and software, which the company says allows it to plan strategically and maximize security and performance rather than having to make tradeoffs.

Though the privacy and security benefits of VPNs are somewhat debated for the average user, VPN by Google One will be released as a built-in service for Pixel 7 and 7 Pro by the end of this year for users who want to encrypt their network traffic and shield their IP address from mobile networks and internet providers. Google points out that, historically, users who wanted to add a VPN on mobile needed to download a third-party option instead of having an optimized and integrated service.

VPN by Google One is open source and aims to address some classic concerns about VPNs by separating authentication and key management for encryption onto distinct servers that can't access each other. In essence, the service is set up to blind itself such that even a rogue insider would not be able to determine who you are and what your browsing history is by compromising the service. Google also says that it does not log user browsing data, though the company says it does record some anonymized, aggregate metrics. In addition to publishing a breakdown of how the service works, Google also commissioned and published an independent audit from NCC Group on VPN by Google One’s security. 

“We’re investing quite a lot in making sure we have extensive first-party and third-party audits, reviews, certification, and analysis to see that we really are providing verifiable security and privacy guarantees,” says Jesse Seed, Google’s product manager lead for silicon security.

Just as Pixel 7 and 7 Pro have logged mostly incremental improvements in their feature sets, the security and privacy changes aren’t revolutionary. But Kleidermacher and Seed emphasize that the changes this year are hard-won—and with so many digital threats to contend with, both for high-risk targets and regular users, every little bit counts.

Google’s Pixel 7 and Pixel 7 Pro Pack New Android VPN and Tensor G2, Titan M2 Chips

The latest September 2022 version 22H2 update for Windows 11 includes a new feature designed to keep you even safer than before from phishing attacks: the practice of bad actors attempting to get you to reveal your usernames and passwords so they can log in rather than break in to your accounts.

These sneaky deceptions are usually carried out over email, but they don't always have to be. Requests for your login details—made up to look like they're from genuine, respected sources—can also arrive over instant messengers, social media platforms, and SMS texts (which is then known as smishing rather than phishing).

The new protections don't need much in the way of setup or configuration—the idea is they just work when required. It's still important to be aware of how they work, and how they keep you safe.

How Phishing Works

Phishing attacks often arrive over email.

Photograph: Silas Stein/Getty Images

Phishing has been going on for a long, long time and takes many different forms. What phishing scams all have in common, however, is that they try to get you to part with your username and password details for a particular account. This is typically done through some smart subterfuge to make it look as though you're dealing with someone credible (at your bank, on a social media platform, or at your work) rather than a hacker.

For example, you might get an email that looks as though it's from your credit card company and asks for changes to be made to your account: It would redirect you to a scam website mocked up to look authentic. Once you innocently log in with your normal details, they're then in the hands of the phishers.

Or you might get an email purporting to be from your boss in the office several floors above you. It could ask you to log in to a particular company website (which again would be a fraudulent copy of the actual site), for instance, or it might ask you to simply email over a list of usernames and passwords as a matter of urgency.

Phishing attacks shape-shift to maximize their chances of success: They typically contain warnings and often put a time limit on responses (giving you less time to think about what you're doing.) Recent scams focusing on the coronavirus pandemic involved emails that hid malevolent purposes behind health and safety information.

Many phishing attempts are cleverly done and difficult to spot, but by taking your time and being cautious about any kind of digital communication that comes your way, you can usually steer clear of them—if something seems suspect, then it probably is. We've written more about staying safe in our guide to avoiding phishing scams.

Enhanced Phishing Protection

You'll see warnings like this from the new enhanced phishing protection.

Screenshot: Microsoft

One way to stay safe against phishing attacks is to keep your computer's software—from the operating system to your web browser—up to date. Modern-day applications are built with security in mind and should throw up warnings when the majority of phishing attacks are detected.

This brings us to the enhanced phishing protection now available in Windows 11. As we mentioned above, a lot of it works in the background: Whenever you enter a password into any application or website, Windows will check whether or not there's a secure connection to a trusted place on the web receiving that information.

If not—if your username and password data have been sent somewhere unknown and potentially untrustworthy—you'll see a message onscreen advising you to change your password to something different. The idea is that you'll be able to modify your login credentials before anyone has been able to exploit them.

That's not all. The new enhanced phishing protection built into Windows will also keep an eye on passwords that you use for programs and websites and warn you if any of them match the password you also use to sign into Windows: Keeping each of your passwords separate and unique is important for keeping your accounts safe.

As you might already know, you can also ditch the password for your Microsoft and Windows accounts and use a prompt on your phone to log in instead. This is an option that's becoming increasingly popular—while it's not 100 percent perfect (no security solution is), it's theoretically harder for someone to physically steal your phone off you than it is to steal a password through phishing.

Windows 11 Now Offers Automatic Phishing Protection

Colleges and K-12 campuses increasingly monitor student emails, social media, and more. Here’s how to secure your (or your child’s) privacy.

There are more eyes on students today than just a teacher’s watchful gaze. Thousands of school districts use monitoring software that can track students’ online searches, scan their emails, and in some cases, send alerts of perceived threats to law enforcement. A recent investigation by _The Dallas Morning News_ revealed that colleges have been using an AI social-media-monitoring tool to surveil student protesters.

While technology companies claim to be able to prevent violence, there’s little proof that surveillance can actually protect students. Meanwhile, monitoring software has been used to eveal students' sexuality without their consent. Low-income, Black, and Hispanic students are also disproportionately exposed to surveillance and discipline.

If your school (or your child’s school) uses monitoring software, there are a couple of steps you can take to protect your privacy—and start a conversation with your school.

Ask Your School These Questions

It’s important first to understand why your school is using monitoring software in the first place. In the US, schools _are_ required by the Children’s Internet Protection Act to have some kind of web filtering in place to prevent students from accessing obscene or harmful material online. Schools are _not_ required to implement sophisticated technologies that can scan the content of students’ emails and send alerts to police.

Next, find out your specific school’s exact monitoring practices. “A lot of these student activity monitoring tools are different. You don’t actually know the full scope of what it is until you’re able to have a conversation with someone,” says Marika Pfefferkorn, cofounder of the Twin Cities Innovation Alliance and executive director of the Midwest Center for School Transformation. Pfefferkorn also helps to lead the No Data About Us Without Us Institute, where she works to educate parents and students about data, privacy, and equity issues in their school district.

She suggests starting with a trusted teacher or counselor. If they don’t know specifics, or don’t have any documentation to answer your questions, that can be a red flag—and an indication that you may need to approach school or district leadership.

Here are some questions you can ask:

*   What software is being used? Does it operate on school devices, over the school Wi-Fi network, or both?
*   If it’s student monitoring software, what kind of information does the algorithm scan for? If the algorithm detects a “threat” or “inappropriate content,” who does the alert go to? At what point does content get flagged to a third party, such as law enforcement?
*   How is student data secured?
*   Where can students and parents report violations of privacy in the district? What processes does the district have to repair harm?
*   How much of the budget is used for surveillance technology?

Pfefferkorn also encourages asking your school to perform an audit of its monitoring software, which could reveal what kind of content the algorithm is tracking and how. An audit might reveal whether the software is truly effective or is picking up on false alarms. Encourage your school to document and inform parents of exactly what they track, how they store, and when they delete student data. Ask if you can have your child’s data deleted, or at least see what has been collected.

Act Like You’re Being Watched, Even After School

Whether you’re using your phone on your school’s Wi-Fi, or you’re using a school laptop at home, assume that everything you do is being scanned and logged by monitoring software. Did you plug in your personal phone to your school laptop? The photos on your phone might be scanned too.  Nude photos sent from students’ personal phones, if plugged into school devices to charge, have triggered alerts to school administrators.

“You should assume that anything touching your school-issued device is going to be monitored in some way,” says Jason Kelley, associate director of digital strategy at the nonprofit Electronic Frontier Foundation. Monitoring doesn’t stop after school or off-campus either.

If you’re a student, practice the basics of digital privacy. Don’t use your school laptop or Wi-Fi to search for anything sensitive, such as medical information. Remember that any kind of data or content on a school communications platform can be scanned and flagged: your school email address, the documents you type into your school Google Drive, your online searches, the images you download, the videos you watch. Even content that is completely safe might be flagged by the algorithm: For example, the software Gaggle can flag keywords related to LGBTQ identity such as ”gay” and “queer” as instances of bullying.

Even if you trust a handful of teachers or counselors, remember that your activity could be seen by other adults in the school, or even law enforcement. Don’t do anything on your device that you wouldn’t want them to see as well.

Others might advise students to “just use your personal device, on your family’s personal network.” It’s important to note that this kind of guidance isn’t accessible to all students. For low-income students, who might rely more on school technology, it may be more difficult to sidestep a school’s surveillance structures.

Mind Your Social Media

Schools might also use AI tools to track social media posts. This is particularly relevant for college students. While colleges generally don’t use content monitoring software, it’s likely they’ll monitor students’ social media for potential risk of violence or protest.

Just as you would assume that anything you type on your school-issued device can be seen and scanned by an algorithm, assume that your public social profiles can be, too. Even private accounts aren’t completely safe, says Kelley. (Yes, even your super-locked-down Finsta.) If you comment on a public account, for example, that might be scanned and subjected to social-media-monitoring algorithms as well.

If you’re in doubt, send text messages rather than using a social media platform. You might consider using an encrypted messaging app like Signal. If you’re discussing topics that might be more sensitive (such as reproductive rights access), the safest way to communicate is with a trusted person, in person.

Team Up With Other Students and Parents

After gathering your research, you might feel that your school isn’t using monitoring software fairly or appropriately. Pfefferkorn recommends having conversations with other students and parents. Listen to what they’re experiencing and how they’re thinking through it, especially if you want to push back against your school’s use of monitoring software.

If you feel you need legal support, reach out to a local agency. Pfefferkorn recommends your local ACLU, NAACP, or Restore the Fourth as good options for advocacy assistance.

Your school’s response will depend on whether you go to a public or private school. For example, a public school might be required to disclose more information, for example, about how much it spends on monitoring software. A private school would not be obliged to give that same information. As another example, while public schools must abide by the recent ruling that room-scanning proctoring software is unconstitutional, private schools do not.

Now is a critical moment for students, parents, and communities to help shape the future of safety in schools, according to Pfefferkorn. Congress passed a law that directs $300 million for schools to strengthen security infrastructure, in addition to the funding to schools through the American Rescue Plan. She hopes that communities can be more involved in how schools invest that funding, and can help shape more proactive solutions. “It’s really critical right now for us to prioritize our values as a community of what safety means,” she says. “For me, safety is not being surveilled.”

How to Protect Yourself If Your School Uses Surveillance Tech

Plus: The US warns of a mysterious military contractor breach, a "poisoned" version of the Tor Browser is tracking Chinese users, and more.

As A Swatting spree spreads across the US, in which false reports of active shooters send police charging into schools, WIRED investigated more than 90 of the incidents and found potential connections between many of them. “In speaking to a number of people who experienced it, I can tell you that the anxiety and fear—it was real to them for 15 minutes,” Amanda Klinger, director of programs and cofounder of the Educator’s School Safety Network, told WIRED. “There’s a period of time in these incidents where people are literally running for their lives, law enforcement is responding with their weapons, and people think it's the real thing.”

Even after extensive sanctions meant to isolate Russia from the global economy amidst its ongoing war with Ukraine, investigators around the world are working to curb the ongoing influx of capital to Russian military and paramilitary groups. Former Uber executive Joe Sullivan was convicted this week of obstructing a Federal Trade Commission investigation and failure to report a felony, a development that is being watched closely by the tech industry because it is likely the first time a corporate executive has faced criminal charges related to a data breach. The Biden administration's new executive order addressing privacy seems like more of a Band-Aid than a panacea, as it attempts to reassure Europeans that their data is safe when stored in the US, despite government surveillance. 

Meanwhile, Meta released findings on more than 400 malicious Android and iOS apps that it says were harvesting Facebook credentials to take over users' accounts. And we took a look at the toll of living your life online, the potential erosion of privacy that comes with consistent social media posting, and the ways it can impact your sense of self. 

Plus, there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Another day, another massive hack in the cryptocurrency industry. But this one is strange.

Binance revealed Friday that unidentified hackers managed to exploit a flaw in the company's BNB Chain crypto token, allowing them to mint 2 million of the company’s decentralized tokens worth a total of $569 million. That money wasn’t actually stolen from Binance, in other words, but rather fabricated out of thin air thanks to a flaw in the security of Binance’s cryptocurrency. But the hack nonetheless seemed poised to flood the market with BNB and thus reduce its value for legitimate owners, while allowing the hackers to walk away with half a billion dollars.

Unfortunately for those hackers, even they didn’t seem prepared for their sudden windfall. Cryptocurrency-tracing firm Elliptic found that they quickly traded away some fraction of their tokens for a variety of other cryptocurrencies. That allowed them to obtain about $53 million in Ethereum-based tokens. But other cryptocurrencies that they traded their BNB for, like Tether and USDC, are more centrally controlled, allowing the funds to be frozen. Binance, meanwhile, managed to temporarily shut down its BNB blockchain to prevent the hackers’ newly mined currency from moving further. “So we have a very sophisticated exploit, managing to mint yourself $569 million,” says Elliptic research lead Thibaud Madelin. “But what followed was a complete shambles, to be honest.”

In the end, Elliptic believes the hackers kept hold of less than 10 percent of their loot—not bad for a day’s work but little more than a blip in the wild world of digital money.

A joint advisory from the Cybersecurity and Infrastructure Security Agency, the FBI, and the NSA warned that the network of an unnamed military agency or contractor had been breached by a so-called “advanced persistent threat” hacker group, an industry code phrase for state-sponsored hackers. According to the alert, the spies maintained their access inside the network for around 10 months, penetrating a Microsoft Exchange server where they installed a commonly used backdoor known as China Chopper. The hackers also used a tool called Impacket to move from machine to machine and another tool called CovalentStealer to siphon data from their targets. As is often the case with government alerts, the advisory didn't attribute the breach to any particular country's government, nor even a known hacker group. The eagle-eyed (or vulture-eyed) Register spotted that the advisory initially included a box at the top suggesting organizations “protect against Russian-state sponsored malicious cyber activity,” which was later deleted. But others, like cybersecurity firm AttackIQ, point to Chinese calling cards in the intrusion.

Since early this year, hackers have been distributing a tainted version of the Tor Browser that collects personal data about Chinese users including form data they submit, browsing history, location data, and computer name, according to security firm Kaspersky. The Tor Browser is meant to be an anonymity-focused tool that is often used in countries like China where users are seeking to circumvent government-imposed internet restrictions, tracking, and censorship. Kaspersky found that the attackers advertised the malicious app by including a link to download it in a video posted to a popular Chinese-language YouTube channel. The video has more than 64,000 views. The installer for the malicious browser includes a compromised version of Tor that siphons victim data and sends it to attackers.

Isabela Fernandes, executive director of the nonprofit Tor Project, told CyberScoop that there is now a patch available. “Basically this ‘poisoned’ Tor Browser modifies the update URL so it cannot be updated normally. What we did was to add a redirect so we are responding to the modified URL, this way people will update. Now their URL is a working update URL.”

As part of its push to crack down on robocalling, the US Federal Communications Commission said this week that it is taking seven voice over IP services off of its trusted carriers list unless they add legally required robocall protections. The move would essentially block the services from being able to complete calls in the US. “Fines alone aren’t enough,” the FCC wrote in its announcement. “Providers that don’t follow our rules and make it easy to scam consumers will now face swift consequences.”

Binance Hackers Minted $569M in Crypto—Then It Got Complicated

Former Uber security chief Joe Sullivan’s conviction is a rare criminal consequence for an executive’s handling of a hack.

Uber's Former chief security officer, Joe Sullivan, was found guilty this week of actively hiding a data breach from the US Federal Trade Commission (FTC) and concealing a felony. The case has reverberated through the security and tech worlds because it is seemingly the first time that an individual executive has faced criminal prosecution for charges related to a data breach against the executive's company. As alarming as Sullivan's conviction may be to some, gauging the fallout for security executives is anything but straightforward.

Chief security officers are sometimes wryly referred to as “chief scapegoat officers” or “chief sacrificial officers,” because the practical challenges of securing massive organizations are so great. It is all but inevitable that companies will suffer hacks and breaches, and CSOs preside over the aftermath. Many now worry that Sullivan's conviction will make the already daunting role even less appealing to top talent. But the United States Department of Justice is positioning the case as an opportunity to set guardrails around what behavior is—and isn't—acceptable in the fraught balancing act of corporate breach response.

“This definitely will have a chilling effect,” says Anthony Vance, a professor and researcher at Virginia Tech who focuses on how individuals and organizations can improve cybersecurity practices. “Most people aren’t clear about the nuance that is involved here, but more generally, it does show that someone could be held accountable and convicted for a data breach, which has never happened. It’s possible even if this is an extreme case.”

Sullivan’s trouble goes back to November 2016, when Uber suffered a data breach that compromised personal information of more than 57 million users, including drivers and passengers. The rideshare giant didn't disclose the breach until November 2017, when its current chief executive officer, Dara Khosrowshahi, took over and fired Sullivan along with a company lawyer, Craig Clark. In 2018, Uber paid $148 million to settle with attorneys general across the United States for violating state data breach disclosure laws.

The delayed notification in itself isn't what brought Sullivan into the Justice Department's crosshairs, though. When Sullivan learned about the 2016 hack, he was already working with the FTC on its ongoing investigation into another, unrelated 2014 Uber data breach. Among other things, Sullivan gave a sworn deposition to the FTC about the incident and steps Uber had since taken to improve its digital security practices. 10 days after providing this testimony, he learned of the new data breach. The hackers attempted to extort the company by threatening to publish the data they had stolen if they didn't receive payment. 

Sullivan is now convicted of spearheading the effort to cover up this breach by paying the hackers $100,000 through the company's bug bounty program. As part of the deal, authorities say, he required the hackers to delete the stolen data and sign a nondisclosure agreement about the incident. These actions amounted to a failure to report a felony, according to the DOJ, and resulted in a “misprision of felony” charge. He was also charged in 2020 and convicted this week of obstruction of proceedings of the FTC for failing to amend his testimony to the agency about Uber's security conditions once he learned of the 2016 breach.

“This is a unique case because there was that ongoing FTC investigation,” says Shawn Tuma, a partner in the law firm Spencer Fane who specializes in cybersecurity and data privacy issues. “He had just given sworn testimony and was most certainly under a duty to further supplement and provide relevant information to the FTC. That’s how it works.”

Tuma, who frequently works with companies responding to data breaches, says that the more concerning conviction in terms of future precedent is the misprision of felony charge. While the prosecution was seemingly motivated primarily by Sullivan's failure to notify the FTC of the 2016 breach during the agency's investigation, the misprision charge could create a public perception that it is never legal or acceptable to pay ransomware actors or hackers attempting to extort payment to keep stolen data private.

“These situations are highly charged and CSOs are under immense pressure,” Vance says. “What Sullivan did seems to have succeeded at keeping the data from coming out, so in their minds, they succeeded at protecting user data. But would I personally have done that? I hope not.”

Sullivan told _The New York Times_ in a 2018 statement, “I was surprised and disappointed when those who wanted to portray Uber in a negative light quickly suggested this was a cover-up.”

The facts of the case are somewhat specific in the sense that Sullivan didn't simply lead Uber to pay the criminals. His plan also involved presenting the transaction as a bug bounty payout and getting the hackers—who pleaded guilty to perpetrating the breach in October 2019—to sign an NDA. While the FBI has been clear that it doesn't condone paying hackers off, US law enforcement has generally sent a message that what it values most is being notified and brought into the process of breach response. Even the Treasury Department has said that it can be more flexible and lenient about payments to sanctioned entities if victims notify the government and cooperate with law enforcement. In some cases, as with the 2021 Colonial Pipeline ransomware attack, officials working with victims have been able to trace payments and attempt to recoup the money. 

“This is the one that gives me the most concern, because paying a ransomware attacker could be viewed out in the public as criminal wrongdoing, and then over time that could become a sort of default standard,” Tuma says. “On the other hand, the FBI highly encourages people to report these incidents, and I’ve never had an adverse experience with working with them personally. There’s a difference between making that payment to the bad guys to buy their cooperation and saying, ‘We’re going to try to make it look like a bug bounty and have you sign an NDA that’s false.’ If you have a duty to supplement to the FTC, you could give them relevant information, comply with breach notification laws, and take your licks.”

Tuma and Vance both note, though, that the climate in the US for handling data extortion situations and working with law enforcement on ransomware investigations has evolved significantly since 2016. For executives tasked with protecting the reputation and viability of their company—in addition to defending users—the options for how to respond a few years ago were much murkier than they are now. And this may be exactly the point of the Justice Department's effort to prosecute Sullivan.

“Technology companies in the Northern District of California collect and store vast amounts of data from users. We expect those companies to protect that data and to alert customers and appropriate authorities when such data is stolen by hackers,” US attorney Stephanie Hinds said in a statement about the conviction on Wednesday. “Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission and took steps to prevent the hackers from being caught. Where such conduct violates the federal law, it will be prosecuted.”

Sullivan has yet to be sentenced—another chapter in the saga that security executives will no doubt be watching extremely closely.

The Uber Data Breach Conviction Shows Security Execs What Not to Do

A new executive order tries to reassure Europeans that their data is safe on US soil, despite government surveillance.

The United States is not going to stop spying on Europeans’ data, but it is going to make sure that spying is “proportionate.” This was the reassurance that US President Joe Biden offered concerned citizens across the Atlantic today by signing an executive order designed to restart the easy flow of data between Europe and the US.

For years, companies have been shuttling customer information between the two regions. “Transatlantic data flows are critical to enabling the $7.1 trillion EU-US economic relationship,” the White House said today. But two years ago, the EU Court of Justice in Luxembourg ruled that Europeans’ data sent to the US risked being snooped on by intelligence agencies, such as the US National Security Agency. As a result, the agreement that allowed companies to easily transfer data between the US and Europe was ripped up. Businesses instead had to make do with a costly and complex temporary replacement.

Biden’s executive order brings a new EU-US data privacy agreement one step closer and aims to restore trust among Europeans’ concerned by US government surveillance. The order creates a new body within the US Department of Justice that will oversee how US national security agencies access both Europeans’ and Americans’ data. But privacy campaigners say the order simply copies the wording of European law (adding in terms like _proportionate_ and _necessary_) without making any real changes. “We do not see a ban on bulk surveillance and no actual limitations,” says Max Schrems, the Austrian privacy activist whose legal complaint against Facebook eventually dismantled the transatlantic data pact back in 2020.

Before then, around 5,000 businesses had been sending data back and forth across the Atlantic under a system called Privacy Shield. “The pre-Schrems system worked,” says Morgan Reed, president of the App Association, which represents small- and medium-size companies, mostly app developers. But the EU court ruling made the Privacy Shield system suddenly invalid, plunging thousands of companies into legal limbo.

Although the court decision did not stop transfers, it made them more complicated. “What the Schrems decision did was raise costs and concern for a lot of small companies that don't have giant compliance departments’ and fleets’ worth of lawyers to do what are called standard contractual clauses,” says Reed. Standard contractual clauses are time-consuming data transfer agreements that force companies to take steps to assess whether they are safely moving data around the world. 

Companies that have spent the past two years wrestling with these clauses are pleased by the order; they want to get back to business as usual. The executive order is the next step in the US and EU reaching a new privacy agreement. “We appreciate President Biden’s action to keep data flowing between the US and EU, underpinning one of our deepest and most mutually beneficial trading relationships,” says Matt Schruers, president of the Computer and Communications Industry Association (CCIA), a lobbying group that represents tech giants including Google, Amazon, and Apple.

At Workday, a California-based HR software provider with more than 2,000 customers headquartered in Europe, the mood is optimistic. Chandler Morse, vice president of corporate affairs, believes this is evidence that the US and EU can reach an agreement on more than just the privacy shield problem. “There's a number of other tech issues that are pending in the EU-US bilateral, so for many of us this is a positive sign that the EU and the US can work together,” he says, adding that the EU AI Act and Data Act could also be beneficiaries of this new cooperation.

Yet privacy campaigners are not impressed—either by greater collaboration or Biden’s offer of a so-called Data Protection Review Court, which will allow EU citizens to challenge how US security agencies use their data.

“However much the US authorities try to paper over the cracks of the original Privacy Shield, the reality is that the EU and US still have a different approach to data protection which cannot be canceled out by an executive order,” says Ursula Pachl, deputy director general of the European Consumer Organization (BEUC). “The moment EU citizens’ data travels across the Atlantic, it will not be afforded similar protections as in the EU.”

Biden’s executive order will now be sent to Brussels, where EU officials could spend up to six months scrutinizing the details. A new data agreement is expected to be ready around March 2023, although privacy activists are expected to challenge the ruling in court. “The order is never going to be enough for the privacy community in Europe,” says Tyson Barker, head of technology and global affairs at the German Council on Foreign Relations.

The European Commission believes the new agreement could survive a court challenge. But the US has been quietly hedging its bets, says Barker. At a conference in October 2021, Christopher Hoff, deputy assistant secretary for services in the Biden Administration, said he supported the global expansion of a rival privacy agreement—the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules system. “The United States wants to say, actually, we have an alternative and we'd like to set this as the global standard,” Barker adds.

Schrems, however, is not worried about another privacy agreement curbing the EU’s influence. “I don’t personally care what standards other countries prefer,” he says. “I know the law in the EU.”

Source

Wired