Technology

jeudi 22 décembre 2022

Hackers stole encrypted LastPass password vaults, and we’re just now hearing about it

A cartoon illustration shows a shadowy figure carrying off a red directory folder, which has a surprised-looking face on its side. — *Pictured: the encrypted vault with your passwords.* | Illustration by Beatrice Sala

LastPass has a doozy of an updated announcement about a recent data breach: the company — which promises to keep all your passwords in one, secure place — is now saying that hackers were able to “copy a backup of customer vault data,” meaning they theoretically now have access to all those passwords if they can crack the stolen vaults (via TechCrunch).

If you have an account you use to store passwords and login information on LastPass, or you used to have one and hadn’t deleted it before this fall, your password vault may be in hackers’ hands. Still, the company claims you might be safe if you have a strong master password and its most recent default settings. However, if you have a weak master password or less security, the company says that “as an extra security measure, you should consider minimizing risk by changing passwords of websites you have stored.”

That might mean changing the passwords for every website you trusted LastPass to store.

While LastPass insists passwords are still secured by the account’s master password, it’s hard to just take its word at this point, given how it’s handled these disclosures.

When the company announced it had been breached in August, it said it didn’t believe user data had been accessed. Then, in November, LastPass said it detected an intrusion, which apparently relied on information stolen in the August incident (it would’ve been nice to hear about that possibility sometime between August and November). That intrusion let someone “gain access to certain elements” of customer info. It turns out those “certain elements” were, you know, the most important and secret things that LastPass stores. The company says there’s “no evidence that any unencrypted credit card data was accessed,” but that would likely have been preferable to what the hackers actually got away with. At least it’s easy to cancel a card or two.

We’ll get to how this all went down in a bit, but here’s what LastPass CEO Karim Toubba is saying about the vaults being taken:

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.

Toubba says the only way a malicious actor would be able to get at that encrypted data, and therefore your passwords, would be with your master password. LastPass says it has never had access to master passwords.

That’s why he says, “it would be extremely difficult to attempt to brute force guess master passwords,” as long as you had a very good master password that you never reused (and as long as there wasn’t some technical flaw in the way LastPass encrypted the data — though the company has made some pretty basic security errors before). But whoever has this data could try to unlock it by guessing random passwords, AKA brute-forcing.

LastPass says that using its recommended defaults should protect you from that kind of attack, but it doesn’t mention any sort of feature that would prevent someone from repeatedly trying to unlock a vault for days, months, or years. There’s also the possibility that people’s master passwords are accessible in other ways — if someone re-uses their master password for other logins, it may have leaked out during other data breaches.

It’s also worth noting that if you have an older account (prior to a newer default setting introduced after 2018), a weaker password-strengthening process may have been used to protect your master password. According to LastPass, it currently uses “a stronger-than-typical implementation of 100,100 iterations of the Password-Based Key Derivation Function,” but when a Verge staff member checked their older account using a link the company includes in its blog, it told them their account was set to 5,000 iterations.

Perhaps the more concerning bit is the unencrypted data — given that it includes URLs, it could give hackers an idea of which websites you have accounts with. If they decided to target particular users, that could be powerful information when combined with phishing or other types of attacks.

While none of that is great news, it’s all something that could, in theory, happen to any company storing secrets in the cloud. In cybersecurity, the name of the game isn’t having a 100 percent perfect track record; it’s how you react to disasters when they happen.

And this is where LastPass has, in my opinion, absolutely failed.

Remember, it’s making this announcement today, on December 22nd — three days before Christmas, a time when many IT departments will largely be on vacation, and when people aren’t likely to be paying attention to updates from their password manager.

(Also, the announcement doesn’t get to the part about the vaults being copied until five paragraphs in. And while some of the information is bolded, I think it’s fair to expect that such a major announcement would be at the very top.)

LastPass says that the vault backup wasn’t initially compromised in August; instead, its story is that the threat actor used info from that breach to target an employee who had access to a third-party cloud storage service. The vaults were stored in and copied from one of the volumes accessed in that cloud storage, along with backups containing “basic customer account information and related metadata.” That includes things like “company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service,” according to LastPass.

Toubba says the company is taking all sorts of precautions as a result of the initial breach, and the secondary breach that exposed the backups, including adding more logging to detect suspicious activity in the future, rebuilding its development environment, rotating credentials, and more.

That’s all good, and it should do those things. But if I were a LastPass user, I’d be seriously considering moving away from the company at this point, because we’re looking at one of two scenarios here: either the company didn’t know that backups containing users’ vaults were on the cloud storage service when it announced that it had detected unusual activity there on November 30th, or it did know and chose not to tell customers about the possibility that hackers had gotten access to them. Neither of those is a good look.

TikTok’s parent company fires four workers for improper access of user data

ByteDance said four employees were fired for examining data of two journalists in attempt to find leak source

ByteDance, the Chinese parent company of popular video app TikTok, said on Thursday that some employees improperly accessed TikTok user data of two journalists and were no longer employed by the company, an email seen by Reuters shows.

ByteDance employees accessed the data as part of an unsuccessful effort to investigate leaks of company information earlier this year, and were aiming to identify potential connections between two journalists, a former BuzzFeed reporter and a Financial Times reporter, and company employees, the email from ByteDance general counsel Erich Andersen said.

Tesla’s Full Self-Driving is blamed for eight-car pileup in California

Illustration depicting multiple red Tesla sedans on a black background. — Illustration by Alex Castro / The Verge

A Tesla driver is blaming Full Self-Driving software for having caused an eight-car pileup in the Yerba Buena Tunnel in California last month, according to a police report obtained by CNN Business.

According to the December 7th report obtained by CNN Business, California Highway Patrol (CHP) reviewed tunnel footage and found that a Tesla made an unsafe lane change before abruptly slowing down from 55 mph to 20 mph — causing vehicles behind it to crash into one another.

In the report, the driver of the Tesla blamed the automaker’s Full Self-Driving software that allegedly malfunctioned and caused a sudden slowdown. The Thanksgiving incident left nine people with minor injuries, including one child that was hospitalized.

California Highway Patrol said in the Dec. 7 report that it could not confirm if “full self-driving” was active at the time of the crash. A highway patrol spokesperson told CNN Business on Wednesday that it would not determine if “full self-driving” was active, and Tesla would have that information.

The incident is being investigated by the National Highway Traffic Safety Administration (NHTSA), along with several other accidents, including ones in California and Florida that were fatal and another one in Utah that killed a motorcyclist.

Each of these incidents seems to implicate Tesla’s advanced driver-assistance system (ADAS), Autopilot, or the automaker’s $15,000 Full Self-Driving (FSD) software package that performs many of the same tasks as Autopilot on local and residential streets. The first reported crash to allege that FSD was in operation happened last year in a Model Y vehicle.

Earlier this year, an NHTSA report for crashes involving vehicles with ADAS showed Tesla topped the list. Tesla has said that the responsibility falls on the driver for the safe operation of the vehicle running on Autopilot or Full Self-Driving, but critics say the company is overstating the capability of its features.

Twitter Is Said to Have Struggled Over Revealing US Influence Campaign

Twitter Is Said to Have Struggled Over Revealing US Influence Campaign Internal emails showed the company’s communications with the Pentagon over a network of military-run accounts.

Twitter’s CEO post is a non-job if Elon Musk can’t vacate it | Nils Pratley

Tesla shareholders hoping for the full attention of their distracted CEO are likely to be disappointed

Management by Twitter poll is such a silly idea that it remains hard to believe Elon Musk was being sincere when he invited the site’s users to determine if he should continue as chief executive. One suspects he had already decided to hire an executive to front the business – which is what, note, he told a Delaware court he would do several weeks ago. The poll merely created a buzz.

In the unlikely event that users had voted to keep him as boss, Musk could have given roughly the same answer as the one he is giving now. In short, he will stay in charge for a while because a chief executive cannot be recruited overnight.

Two associates of Sam Bankman-Fried plead guilty to fraud charges in FTX fall

Carolyn Ellison, former CEO of Alameda Research, and Gary Wang, co-founder of FTX, pleaded guilty to criminal fraud charges

A federal prosecutor says two associates of Sam Bankman-Fried have pleaded guilty to criminal charges related to the collapse of the cryptocurrency exchange FTX.

Carolyn Ellison, the former CEO of Alameda Research, a trading firm started by Bankman-Fried, and Gary Wang, who co-founded FTX along with Bankman-Fried, pleaded guilty to charges “related to their roles in the fraud that contributed to FTX’s collapse”, US attorney Damian Williams said Wednesday night.

mercredi 21 décembre 2022

Twitter view counts start appearing prominently

Making it easier to quantify how much of a banger your tweet was. | Illustration by Alex Castro / The Verge

View counts for tweets are starting to show up for some Twitter users — at least for their own tweets. On December 1st, Musk promised the feature would be coming for “all tweets, just as view count is shown for all videos,” an announcement he reiterated a week later adding that it would be coming “in a few weeks.”

One Verge staff member has started to see a counter when he clicks into his posts. While a few other Twitter users have reported getting the feature as well, it doesn’t seem to be available to everyone yet (for example, at time of writing I’m currently not seeing view counts on any tweets besides videos). My coworker also says that he’s currently not able to see view counts on other users’ tweets.

Screenshot of a tweet displaying the view count. — *A view counter has joined the other markers of how popular your tweet was.*

Tweets will show view count in a few weeks, just like videos do. Twitter is much more alive than people think.
— Elon Musk (@elonmusk) December 9, 2022

In its current state, the feature isn’t providing any new information. You’ve long been able to turn on analytics for your account, and see how many “impressions” your tweets were getting. However, doing so does require clicking on an analytics button; the view counter puts it right in your face.

It’s unclear whether Musk intended for users to be able to see how many views other peoples’ tweets are getting. His comment about the feature being “just like videos,” whose view counts are public for other users, does make it seem like you should be able to see how many views other peoples’ tweets were getting. We’d ask Twitter for clarification on the matter, but it no longer has a communications department. Musk hasn’t recently tweeted about the feature.

Sam Bankman-Fried’s former friends pleaded guilty and are cooperating in the FTX fraud case

FTX Founder Sam Bankman-Fried Returns To Court In The Bahamas — Photo by Joe Raedle/Getty Images

Caroline Ellison and Gary Wang, two executives in Sam Bankman-Fried’s fallen crypto empire, have pleaded guilty to federal charges and are cooperating with prosecutors. The news was announced late Wednesday by Damian Williams, the US Attorney for the Southern District of New York.

Williams didn’t specify what charges the two pled to, but said the guilty pleas were in relation to their roles as insiders at FTX and its sister company Alameda Research. Wang was a co-founder of the FTX cryptocurrency exchange, and Ellison served as CEO of Bankman-Fried’s trading company Alameda Research.

Bankman-Fried and a select group of insiders, including Ellison and Wang, are alleged to be the only people who knew that FTX was engaging in fraud. The cases against Bankman-Fried are both criminal and civil, and have been brought by the SDNY, the CFTC, and the SEC. Allegedly, FTX customer funds were used for loans to executives, risky trading by Alameda Research, political donations, and lavish spending on everything from beachfront homes to private jet flights.

The SEC and CFTC have already filed updated civil suits including details on Wang and Ellison’s roles. “Wang, with Ellison’s knowledge and consent, exempted Alameda from the risk mitigation measures” FTX used, providing Alameda Research with a “virtually unlimited ‘line of credit,’” according to the updated SEC complaint.

The SEC complaint outlines how “Bankman-Fried and Wang thus gave Alameda and Ellison carte blanche to use FTX customer assets for Alameda’s trading operations and for whatever other purposes Bankman-Fried and Ellison saw fit.”

Ellison, acting on Bankman-Fried’s orders, borrowed billions of dollars from lenders, according to the SEC suit. Those loans were backed “in significant part” by the FTT token, which was issued by FTX and given to Alameda for free, the SEC wrote. Ellison’s job was to buy FTT tokens on various platforms in order to increase the price, thus making the FTT that was collateral against Alameda’s loans more valuable. That, in turn, made it possible for Alameda to borrow even more.

Earlier on Wednesday, the Bahamas extradited Sam Bankman-Fried and sent him on his way back to the US. Williams confirmed Bankman-Fried is now in FBI custody and said he would be transported directly to New York to appear before a judge “as soon as possible.”

The fraud came to light after a blockbuster CoinDesk article reported that Alameda Research’s balance sheet consisted mostly of the FTT token, which kicked off a series of events that ended in FTX’s bankruptcy. In the filing for bankruptcy, the new CEO of FTX, John J. Ray, said the company was worse than Enron — and he’d know, since he was charged with cleaning up after the fraud there.

In May, when the price of crypto began to crater, the lenders wanted their money back. To keep them happy, Bankman-Fried directed that customer deposits be sent to the lenders. Ellison used that money to pay Alameda’s debts. “Even in November 2022, faced with billions of dollars in customer withdrawal demands that FTX could not fulfill, Bankman-Fried and Ellison, with Wang’s knowledge, misled investors from whom they needed money to plug a multi-billion-dollar hole,” the SEC wrote in its suit.

But customer funds had also been diverted from the start, the SEC wrote in its suit. Alameda got ahold of FTX customer funds in two ways: first, by the “line of credit” but also by directing customers to deposit fiat currency into accounts controlled by Alameda. “As a result, there was no meaningful distinction between FTX customer funds and Alameda’s own funds,” the suit says. “Bankman-Fried and Wang thus gave Alameda and Ellison carte blanche to use FTX customer assets for Alameda’s trading operations and for whatever other purposes Bankman-Fried and Ellison saw fit.”

That made Alameda Bankman-Fried’s ”personal piggy bank to buy luxury condominiums, support political campaigns, and make private investments, among other uses. “

Developing...

Elon Musk Says He Will Resign as Twitter CEO When He Finds Successor

Elon Musk Says He Will Resign as Twitter CEO When He Finds Successor Mr. Musk, who asked his Twitter followers on Sunday if he should step down as head of the service, will remain the company’s owner.

Two Executives in Sam Bankman-Fried’s Crypto Empire Plead Guilty to Fraud

Two Executives in Sam Bankman-Fried’s Crypto Empire Plead Guilty to Fraud Caroline Ellison, the former chief executive of Alameda Research, and Gary Wang, a founder of FTX, are cooperating in the federal criminal case against Mr. Bankman-Fried.

Attorney says facial recognition got her kicked out of a Rockettes show

Illustration of several faces, with one highlighted. — Illustration by Alex Castro / The Verge

Kelly Conlon, an attorney from New Jersey, says she wasn’t allowed to see a Rockettes show at Radio City Music Hall after she was identified by a facial recognition system, according to a report from NBC New York. Conlon told the outlet that guards approached her while she was in the building’s lobby and said she wasn’t allowed to be there because of her connection to a legal case against the company that owns the hall.

“I believe they said that our recognition picked you up,” she told NBC, saying that she was asked to identify herself and that “they knew my name before I told them. They knew the firm I was associated with before I told them.” She says she ended up waiting outside while her daughter watched the show with other members of her Girl Scout troop.

Madison Square Garden Entertainment (or MSG), the owner of Radio City and many other venues, hasn’t confirmed whether it was facial recognition that alerted security to Conlon’s presence. However, it does make it clear that it uses the tech. “We have always made it clear to our guests and to the public that we use facial recognition as one of our tools to provide a safe and secure environment and we will continue to use it to protect against the entry of individuals who we have prohibited from entering our venues,” the company said in a statement sent to The Verge by Mikyl Cordova, a spokesperson for the company.

MSG refused to provide details about its system, such as whose facial recognition tech it uses. There are many companies that develop these kinds of systems, with some selling them to businesses and governments. However, the company has a long history with facial recognition systems — it was testing them by early 2018, according to a report from The New York Times. As NBC shows in its report, the company has signage posted at the venue to tell people that security uses facial recognition, as it’s legally required to do.

It’s possible there are other ways Conlon could have identified before the show; if she’d been asked to present her identification or tickets with her name on them at any point, it would’ve been an opportunity for other security systems to flag her. But she told NBC that she was picked out pretty much as soon as she went through the metal detector.

The incident stems from the fact that Conlon is a lawyer at a firm that’s involved in a lawsuit against MSG. While she told NBC that she hasn’t worked on the case, MSG’s policy “precludes attorneys from firms pursuing active litigation against the company from attending events at our venues until that litigation has been resolved,” according to Cordova. Its reasoning is that “litigation creates an inherently adversarial environment.” Cordova says that “all impacted attorneys were notified of the policy” and that Conlon’s firm was notified twice.

The policy has been controversial from a legal standpoint. When lawyers from another case brought it up, Judge Kathaleen McCormick — who presided over two different Elon Musk cases this year as he tried to get out out of buying Twitter and argued over his pay package with Tesla shareholders — called it “the stupidest thing I’ve ever read,” according to documents obtained by Reuters.

Another judge in a separate case ruled that “plaintiffs may not be denied entry into any shows where they possess a valid ticket” while noting that MSG did have the right not to sell them tickets in the first place. The company didn’t answer The Verge’s questions about whether it had systems in place that would’ve prevented Conlon from purchasing a ticket, either through its systems or from resellers.

Despite the ruling, MSG sent another letter to law firms saying that they weren’t allowed onto its premises and that it could revoke their tickets, according to Reuters. It seems likely that the question of whether MSG’s ban is allowed will be litigated in many courtrooms over the next who knows how long. That probably won’t be the case for its use of facial recognition itself — in New York, it’s legal for businesses to do so, and reports have shown that the NYC government has received millions in funding for its own surveillance systems. (It has curtailed facial recognition in at least a few instances, though; schools currently aren’t supposed to use it.)

Even as they become more commonplace, facial recognition systems aren’t accepted everywhere. While their ability to scan a large number of people quickly and attempt to match faces to an identity in a database makes them attractive to governments and businesses, there are members of the public and privacy advocates that have pushed back against their use.

Outside of the concerns around how they can be used to intensify policing or track people’s movements, facial recognition opponents often point to studies suggesting that many of the systems are less accurate when identifying people who aren’t white. There have been cases where people were arrested after facial recognition software identified them as someone that they didn’t actually look like.

Some states and cities have passed laws meant to curb police and other government agencies’ access to the tech, and massive tech companies like Google, Microsoft, IBM, and Amazon have weighed in on different sides of the debate. Even the controversial facial recognition firm Clearview AI has said that it’ll stop selling its systems to most private companies after it was accused of building its database with pictures taken from social networks without users’ knowledge.

mardi 20 décembre 2022

Twitter机器人帐号如何用成人内容淹没中国抗议推文

Twitter机器人帐号如何用成人内容淹没中国抗议推文时报调查发现，用户在Twitter上用中文搜索各地抗议内容时，成千上万的自动程序帐号向他们推送了应召服务和博彩广告等内容。这凸显了Twitter在监管垃圾推文方面的挑战。

Anker’s Eufy breaks its silence on security cam security

A Eufy camera underwater, air bubbles bubbling up — Image: Eufy

On the last episode of “Will Anker ever tell us what’s actually going on with its security cameras rather than lying and covering its tracks,” we told you how Eufy’s customer support team is now quietly providing some of the answers to the questions that the company had publicly ignored about its smart home camera security.

Now, Anker is finally taking a stab at a public explanation, in a new blog post titled “To our eufy Security Customers and Partners.” Unfortunately, it contains no apology, and doesn’t begin to address why anyone would be able to view an unencrypted stream in VLC Media Player on the other side of the country, from a supposedly always-local, always-end-to-end-encrypted camera.

What it does contain is a clear admission: “eufy Security ’s Live View Feature on its Web-Portal Feature Has a Security Flaw,” the company admits in bold letters.

But this is all Anker has to say about that very suspicious issue:

eufy Security ’s Live View Feature on its Web-Portal Feature Has a Security Flaw

First, no user data has been exposed, and the potential security flaws discussed online are speculative. However, we do agree there were some key areas for improvement. So we have made the following changes.

Today, users can still log in to our eufy.com Web portal to view live streams of their cameras. However, users can no longer view live streams (or share active links to these live streams with others) outside of eufy’s secure Web portal. Anyone wishing to view these links must first log in to the eufy.com Web portal.

We will continue to look for ways to enhance this feature.

While stopping short of an apology, the company does acknowledge that “we know the need for more straightforward and timely communications on these issues has frustrated many customers,” and says it has stayed silent because it’s “been using the last few weeks to research these possible threats and gather all the facts before publicly addressing these claims.”

“Moving forward, we will need to better balance our need to get ‘all the facts’ with our obligation to keep our customers more quickly informed,” promises Anker.

The post also addresses some other concerns that security researchers have raised, like how Eufy was uploading thumbnails from its cameras, including pictures of faces, to the cloud without making users aware, so that it can deliver push notifications. Anker says those images are protected with end-to-end encryption, and reiterates that it’s now making customers aware that they have a choice of local or cloud push notifications in an updated version of its app. Good!

Here is a list of questions that still need to be answered. I’m sending them to Anker/Eufy today:

Why do your supposedly end-to-end encrypted cameras produce unencrypted streams at all?

Under what circumstances is video actually encrypted?

Do any other parts of Eufy’s service rely on unencrypted streams, such as Eufy’s desktop web portal?

How long is an unencrypted stream accessible?

Are there any Eufy camera models that do *not* transmit unencrypted streams?

Will Eufy completely disable the transmission of unencrypted streams? When? How? If not, why not?

If not, will Eufy disclose to its customers that their streams are not actually always end to end encrypted? When and where?

Has Eufy changed the stream URLs to something more difficult to reverse engineer? If not, will Eufy do so? When?

Are unencrypted streams still accessible when cameras use HomeKit Secure Video?

Is it true that ”ZXSecurity17Cam@” is an actual encryption key? If not, why did that appear in your code labeled as an encryption key and appear in a GitHub repo from 2019?

Beyond the thumbnails and the unencrypted streams, are there any other private data or identifying elements that Eufy’s cameras allow access to via the cloud?

Beyond potentially tapping into an unencrypted stream, are there any other things that Eufy’s servers can remotely tell a camera to do?

What keeps Eufy and Anker employees from tapping into these streams?

Which other specific measures will Eufy take to address its security and reassure customers?

Has Anker retained any independent security firms to conduct an audit of its practices following these disclosures? Which?

Will Anker be offering refunds to those customers who bought cameras based on Eufy’s privacy commitment?

Why did Anker tell The Verge that it was not possible to view the unencrypted stream in an app like VLC?

Does eufy share video recordings with law enforcement agencies?

We will provide the company’s responses — or lack of responses — in a future story.

The EV tax credit rules are being delayed until March 2023 — here’s what that means for you

Chevy Bolt EUV — Photo by Andrew J. Hawkins / The Verge

Besides its more obvious stated goal of reducing inflation, the Biden administration’s Inflation Reduction Act (IRA) was designed to force profound changes in the electric vehicle market. The legislation revises EV tax credit rules as it seeks to build up domestic battery manufacturing so that the US doesn’t cede the supply chain to China.

It’s also profoundly confusing, hinging new EV tax credits not just on where the cars are built but also where batteries are assembled and where battery materials are sourced from. These rules were all supposed to take effect on January 1st, 2023 — that’s next weekend for anyone keeping track.

Now, however, it’s going to take a little longer for all of the new provisions to be in place. On Monday, the Department of the Treasury announced that decisions around some aspects of the EV tax credits will be delayed until March. By delaying rules around where battery minerals are sourced but allowing other rules to go into effect on January 1st, the Treasury Department has created an interesting situation for several North American-built EVs.

For anyone who doesn’t follow the thrilling world of Treasury Department guidance — and truly, you’re missing out if you don’t — what this means is several EVs will now remain eligible for the full EV tax credit of $7,500 for the first few months of 2023 and possibly longer. And this means you could score a good deal on one of these EVs in the next quarter, provided you can find one.

Under the IRA’s new rules, the full $7,500 EV tax credit that was due to take effect on January 1st is only available to cars assembled in North America. But according to Reuters, it’s also contingent on the batteries meeting two factors that are each good for $3,750.

One half is based on the EV battery having at least 40 percent of its critical minerals sourced in the US or one of its free trade partners; the other half is based on the EV battery having at least 50 percent of its components manufactured or assembled in North America. Those percentages are meant to scale up in the coming years as well. This is because the IRA seeks to make certain that batteries are sourced and built in North America, not just the cars themselves.

Some new effects of the IRA, such as caps on buyer income and vehicle prices, will still go into effect on January 1st. Those rules are meant to force the EV market in a more affordable direction.

But on Monday, the Treasury Department announced a delay in the guidance around the critical minerals rules, even as the other rules go into effect. This means certain vehicles will remain eligible for the full tax incentives for a while, even if they may not stay that way long-term. (Most automakers currently aren’t meeting that requirement and have warned they may not for years.)

The big winners (for now) are North American-built EV sedans and smaller cars that start under $55,000 and SUVs and trucks that start under $80,000.

Yahoo! Finance reports this is a big victory for Tesla and General Motors, specifically. Both had lost their EV tax credits entirely under the old rules because they had reached the 200,000-car sales threshold. Now GM and Tesla are back in the game, but not yet beholden to the difficult battery sourcing requirements. (The new IRA rules have no cap on the number of EVs sold.)

EV news site Electrek puts this directly: “The Chevy Bolt is about to be a screaming deal — at least until March.” Previously, GM CEO Mary Barra had said the company’s cars should be eligible for the full $7,500 tax credit in two to three years as it worked on the sourcing requirements. This decision keeps tax incentives in place for the Bolt and Bolt EUV, as well as the $62,990 Cadillac Lyriq crossover.

Ford, Nissan, Rivian, and Volkswagen’s North American-built EVs are also now eligible for the full tax credit come January 1st, regardless of where their batteries are sourced. Others aren’t so lucky here. Hyundai and Kia, for example, are excluded because their EVs are built in South Korea. Tesla’s Model S and Model X are also excluded because they’re too expensive to qualify under the new rules.

We may learn more soon about where this is all headed, but the Treasury Department delay gives the qualifying cars at least a three-month window that buyers might do well to take advantage of.

“Before year’s end, Treasury will also release information on the anticipated direction of the critical and battery component requirements that vehicles must meet to qualify for tax incentives in the Inflation Reduction Act,” the department said in a statement. “The information will help manufacturers prepare to be able to identify vehicles eligible for the tax credit when the new requirements go into effect… By statute, the critical mineral and battery component requirements take effect only after Treasury issues that proposed rule.”

Right now, the IRA’s manufacturing rules represent a pretty onerous task for many car companies. Under the current supply chain, most of them have batteries, minerals and components heavily sourced from other countries, China in particular. As CNBC reports, China alone accounts for some 70 percent of the global supply of battery cells. The IRA is designed to level the playing field, wean American battery dependency off China and create US jobs in the EV sector. Many car companies and their supplier partners are now working to beef up US battery plants as a result.

Not surprisingly, the new IRA rules have already been derided as disruptive by some automakers. Hyundai Motor Group, for example, is in a particularly tough spot; its brands Hyundai, Kia, and Genesis together make up some of the top EV sellers in the US, but its American factory plans put it years away from meeting the full tax incentive requirement.

The minerals requirement has proven to be especially difficult to parse, let alone institute, as Reuters reported last week, which is likely what led to Monday’s announcement. Additionally, sourcing battery minerals inside the US could have a detrimental effect on the areas near Indigenous reservations where many deposits are found.

The biggest roadblock to the positive developments in the Treasury Department’s news is still that new cars can be exceedingly difficult to find, especially without obscene markups. It hasn’t been a great year to buy new cars, and we can fully expect those headaches in 2023. As of this writing, a quick search of Cars.com reveals just 578 new Chevrolet Bolts and only 1,018 Bolt EUVs for sale nationwide. But if you can find one, Q1 2023 might be a very favorable time to pull the trigger.

Will these rules change again? That feels entirely possible; the IRA is a wide-scale shift in how we buy EVs and, eventually, how and where they’ll be built. In the meantime, it’s best to consult a list of which vehicles qualify for the tax breaks, like this one at Consumer Reports, and just keep an eye on the deals out there if you want to go electric.

The Verge Holiday Gift Guide 2022

Photography by Joel Goldberg for The Verge

Check out our top gift ideas for the tech-savvy and non-techies alike.

Do you stress yourself out looking for the perfect gift? Are any loved ones in your life hard to shop for because you have no idea what they’re into? Or worse, you know the geeky things they’re into, but you have no idea where to start? While you could just pluck something off their Amazon wish list — we’ve all been there — it’s much more fun to pick something out for them. Luckily, you’ve got backup in the form of The Verge.

Our editorial team has compiled an extensive list of techie, nerdy, clever, and even refined gift ideas for you to peruse. Some of them are the go-to devices that are popular every year with the gadget-obsessed, while others are quirky offbeat wonders that we’d wager you’d never think of. We’ve leaned on our expertise in the worlds of tech and culture to gather unique gifts for just about anyone — including creators, gamers, travelers, kids, moms, dads, and more — with a variety of budgets and price points in mind.

We’ve got a little bit of something for everyone, and we’re here to help you find the gifts that impress all your loved ones. If you can’t buy love, you can at least buy some cool stuff that people will love you for.

Art Director: Kristen Radtke
Prop Stylist: Maeve Sheridan
Food Stylist: Jesse Szewczyk
Photographer: Joel Goldberg
Photo Editor: Amelia Holowaty Krales

Two men indicted for hacking a dozen Ring cameras and livestreaming swatting attacks

Two men have been accused of hacking into Ring doorbells and using their cameras to livestream swatting attacks, according to the Department of Justice. Kya Christian Nelson, 21, James Thomas Andrew McCarty, 20, and unnamed others allegedly spent a week using stolen Yahoo email addresses and passwords to access video from a dozen security systems before calling the police to each residence, according to the indictment, which you can read below.

The DOJ says the scheme worked like this: the alleged perpetrators would get the info for the Yahoo accounts and then figure out if the owner also had a Ring account. If they did, Nelson, McCarty, and the others would allegedly “gather information” about the people before calling the police on them, telling dispatchers things like they were children whose drunk parents were shooting guns in the house or that someone was being held hostage.

According to the press release, the purported victims lived all over the US, in Michigan, California, Montana, Georgia, Texas, Illinois, Alabama, and Florida. Nelson, who is already in jail after pleading guilty to calling in shooting and bomb threats to a Kentucky high school, is being charged with aggravated identity theft as well as unauthorized access of a computer. Both he and McCarty, who the DOJ says was arrested last week, are also being charged with “conspiracy to intentionally access computers without authorization.”

The indictment doesn’t go into much detail about how the police responded in most cases, but it accuses the men of using the Rings to taunt police officers when they showed up. (Many Ring devices have speakers that are meant to let owners communicate with whoever’s at their door.) It also doesn’t mention which social media platforms Nelson and McCarty allegedly used to “transmit the audio and video” captured by Ring cams during the police responses.

It does, however, have details about a case in North Port, Florida. According to news reports from local outlets and Vice that appear to be about the incident mentioned in the indictment, the call led to a school being locked down. The indictment alleges that McCarty bragged about the swatting on unnamed social media platforms, saying “we bruteforce n****s ring doorbells and we swat them after ... Its f****g funny” and posting a link to articles about the police response, saying that he had “made the news.”

Ring and its parent company Amazon have a long history of providing data to the police, and it’s not necessarily surprising that they were targeted by criminals as well. While the doorbells weren’t absolutely necessary for the swatting, they gave the criminals a way to watch it happen in real time.

That’s part of the reason why streamers are frequent targets — the perpetrators can see police burst in with guns drawn. Of course, that last part is why swatting isn’t a harmless prank; police have killed innocent people while responding to those sorts of calls, and even nonfatal incidents can leave victims traumatized.

The Pixel 8 camera might adopt a new HDR technique

Photo of the Google Pixel 7 camera bump — *The Pixel 7 used the same camera sensor as the previous generation, but that might be changing.* | Photo by Amelia Holowaty Krales / The Verge

The Pixel 8 is a long ways off, but some snippets of camera app code identified by developer Kuba Wojciechowski are giving us an early glimpse into what Google might be planning. The code in question refers to “staggered HDR,” which isn’t a technique that Google’s Pixel camera currently uses. The company was one of the first to refine mobile HDR and computational photography, taking them mainstream. Now, it appears to be evolving its tech for the next generation in a significant way.

Staggered HDR is a method of capturing short and long exposures of scenes nearly simultaneously. Google currently employs HDR Plus Bracketing, which takes individual photos in rapid succession and uses them to create a final image with a wide dynamic range — meaning there’s detail in both shadows and in highlight areas.

Long story short, courtesy of Google we got a clean, unobfuscated version of Google Camera Go, that includes references that seemingly confirm that flagship Pixels in 2023 - Husky and Shiba - will support staggered HDR. pic.twitter.com/YdaWTlGznN
— Kuba Wojciechowski⚡ (@Za_Raczke) December 19, 2022

It works well, but it also means that the system has a harder time dealing with moving subjects since it’s using separate frames. With staggered HDR, a short exposure follows right on the heels of a long exposure — before the long exposure has even finished.

This rolling shutter effect scans the sensor from top to bottom and means that there’s no wait for one exposure to finish before starting another one. This means there are fewer motion artifacts to deal with, and less power is consumed in the process — Samsung says it reduces power consumption by 24 percent compared to a method using separate frames.

If Google does plan to add support for staggered HDR, then a new camera sensor is on the way, too. Kuba says that the Pixel 7 and 7 Pro use a Samsung Isocell GN1 for their main camera sensor, which doesn’t support staggered HDR. The Isocell GN2 does support the feature, so it seems to be a likely candidate for the Pixel 8. The GN2 would also provide some autofocus enhancements thanks to a tweaked phase-detection array that’s more sensitive to horizontal movement.

We’re a long way from finding out if any of this is in the cards for the Pixel 8 — Google hasn’t confirmed the device yet, and we expect to launch in the fall of 2023. But it seems likely that Google will keep iterating on the HDR feature it made popularly, and this early hint gives us a glimpse of what that might look like.

Twitter’s suspension of journalists sets ‘dangerous precedent’, UN warns

Pressure grows on Elon Musk as EU says social media platform could face sanctions over suspensions

The United Nations is “very disturbed” by Twitter’s abrupt suspension of a group of US journalists, a spokesperson has said, warning that the move sets a “dangerous precedent” – as the EU said the social media platform could fall foul of forthcoming digital regulations.

Stéphane Dujarric said on Friday the UN was “very disturbed” by the barring of prominent tech reporters at news organisations including CNN, the Washington Post and the New York Times who have written about Musk and the tech company he owns.

lundi 19 décembre 2022

I didn’t want an app to auto renew – why can’t I get a refund?

I forgot the Freeletics renewal date but £75 was taken from my account and I can’t get it back

Do I have any rights against an automatic subscription renewal?

A year ago I signed up to Freeletics, an exercise app. Since then I have stopped using it, and, unsurprisingly, forgot about the renewal date.

Elon Musk breaks silence after 10 million Twitter users vote for him to step down

The billionaire says only paid Twitter Blue subscribers will be able to vote in future policy-related polls on the platform

Elon Musk has tweeted for the first time since more than 10 million people voted in favour of him stepping down as Twitter’s chief executive, saying that only paid Twitter Blue subscribers will be able to vote in future policy-related polls.

On Sunday, Musk asked Twitter users whether he should step down as the head of the company, promising to abide by the results of his poll. When the poll closed on Monday, 57.5% said he should step down.

The Verge’s 2022 holiday gift guide for moms

Mom, mum, mammy, mother dearest. No mom is the same. Fortunately, we’ve compiled a list of gift ideas so that you’ll be able to find something awesome to give to the mother figure in your life — no matter what name she goes by.

Buying gifts for your mom — or any maternal figure in your life, for that matter — can be tough. It’s true for many of us that the closer you are to someone, the trickier it can be to whip up clever gift ideas without second-guessing yourself. Lucky for you, we tap the collective minds at The Verge for gift ideas every year, helping ensure you can gift mom something truly unique.

Like in previous years, our gift recs lean more on the tech-adjacent side, but what tech items are included are meant to make everyday life a little easier, more colorful, and a lot more fun. Fujifilm’s Instax Mini Evo ($190), for instance, is a forward-thinking instant camera with the utmost flexibility in mind, while budget-friendly gifts like the fifth-gen Echo Dot ($28) are designed to add smarts to any room. We even have a few more generalist picks, like Lego’s adorable Succulents set ($50), which can bring a bit of visual pizzazz to any room without the need for a watering can or any semblance of a green thumb.

You can find all that and more below, whether you intend to cross your mom off your list well ahead of the holiday season or just a few hours beforehand. Either way, we’re not here to judge.

Ex-Google Contractor Settles Lawsuit Over Fellowship of Friends Sect

Ex-Google Contractor Settles Lawsuit Over Fellowship of Friends Sect The suit claimed that the Fellowship of Friends, an obscure group based in the Sierra Nevada foothills, gained influence inside Google.

The Verge’s 2022 fitness and wellness gift guide

Keeping your mind and body in tip-top shape takes work, but these gift ideas should make things a bit easier for the fitness buff in your life.

Few things are more important in life than health and happiness. Fortunately, while neither can be bought, we can give our loved ones gifts that can help them improve both — which is why we’ve curated a guide to our favorite gadgets, services, books, and other items that focus on both mental and physical well-being.

Below, you’ll find items we’ve either tested or have personal experience with, so you can rest assured they live up to their promise. We’ve included highly capable watches like the Google Pixel Watch ($300) and fitness-forward Apple Watch Ultra ($749), but you’ll also find workout equipment like the Peloton Tread ($3,495). And if you don’t have a couple thousand lying around — or even $50 — we have a handful of budget-friendly suggestions, whether your giftee is into dancing, free weights, or just getting a better night’s sleep.

Take a look through our guide and decide for yourself which present the health-conscious giftee in your life will love.

Tumblr is launching a livestreaming feature

Illustration: The Verge

Tumblr is adding support for livestreaming via the video platform Livebox. The feature is being rolled out to US users on iOS and Android now, and a release for global users and the desktop site is planned for the future. More details are outlined in a blog post, which dubs the service Tumblr Live.

Tumblr has supported streaming in the past, but it did so by letting people share streams from other services like YouNow and YouTube. The new option is described as a native Tumblr streaming service powered by Livebox. (Livebox is operated by the Meet Group, a subsidiary of the dating app company ParshipMeet Group.) Livebox allows users to tip streamers, and by the same token, Tumblr will let you pay creators in a virtual currency called “Diamonds.” Livebox provides AI- and human-powered moderation for streams, according to a press release; the service also lets streamers designate trusted viewers as moderators. The streaming service is so far only supported for people’s primary Tumblr blog, not any side blogs under the same account.

The Tumblr Live home screen on iOS. — *The Tumblr Live homescreen on iOS.*

The new feature comes as Tumblr owner Automattic is trying to revitalize the blogging platform that it purchased from Verizon in 2019. Tumblr has reaped the benefits of recent chaos at Twitter, emerging as a potential alternative to new owner Elon Musk’s chaotic policies. (Apparently, it wasn’t quite enough of a threat to be named in Twitter’s short-lived ban on linking to competitors.) Its streaming feature isn’t likely to overtake Twitch or YouTube, but it adds another medium — and a new way to make money — for the artist-heavy community.

They Created a Drug for Susannah. What About Millions of Other Patients?

They Created a Drug for Susannah. What About Millions of Other Patients? Scientists have made rapid progress in customizing drugs for ultrarare diseases. The hard part now is making such treatments on a large scale.

Elon Musk sells new $3.6bn tranche of Tesla shares

Latest selloff takes total sale this year to $23bn and follows loss of world’s richest man title

Elon Musk has sold a further $3.6bn(£2.9bn) worth of shares in Tesla, in the same week that he lost the title of world’s richest man to France’s Bernard Arnault.

The disposal, revealed in a regulatory filing, takes the total amount raised by Musk from sales of his stock in the electric carmaker this year to more than $20bn.

Tesla’s Direct Sales Model Helps It Thwart Customer Lawsuits

Tesla’s Direct Sales Model Helps It Thwart Customer Lawsuits Sales contracts prevent buyers of the company’s electric cars from pursuing class-action suits if something goes wrong.

dimanche 18 décembre 2022

Musk Asks Twitter Users If He Should Step Down After Fury Over His Policies

Musk Asks Twitter Users If He Should Step Down After Fury Over His Policies Fury mounted over Mr. Musk’s moves to prevent Twitter users from sharing links to other social media platforms. The billionaire also asked whether he should remain as head of the service.

Elon Musk bought Twitter, and here’s everything that happened next

Elon Musk is now the owner, CEO, and sole director of Twitter. His “Twitter 2.0” era has so far included mass layoffs and rapidly changing policy decisions.

Elon Musk owns Twitter. How’d we get here? On April 4th, we learned that Elon Musk had purchased enough shares of Twitter to become its largest individual shareholder. Eventually, he followed up with an unsolicited offer to buy 100 percent of Twitter’s shares for $54.20 each, or about $44 billion. Twitter accepted Elon Musk’s offer, but then things got weird because he tried to cancel the deal.

There was a lot of back and forth about bots and text messages, but in the end, Musk settled on buying the company rather than facing a deposition or Chancery Court trial and eventually strode into Twitter HQ carrying a sink.

Elon Musk began Twitter’s new era of private ownership by firing several executives — including previous CEO Parag Agrawal, CFO Ned Segal, and policy chief Vijaya Gadde — and, a week later, initiated mass layoffs, drastically cutting its workforce.

The first few weeks of Elon Musk’s Twitter have so far included mass layoffs, the firing of employees who criticized Musk publicly or privately, and hundreds of employees voluntarily accepting Musk’s offer of three months severance instead of the option of joining a new “extremely hardcore” version of Twitter.

Musk has also flip-flopped on paid verification, launching it just over a week after he took over, then putting it on pause after some high-profile impersonations. He then announced it was coming back on November 29th, before telling employees that the company might or might not launch it on that date.

On November 19th, Elon Musk announced that based on the results of a poll posted to his personal account, he’s reinstating the Twitter account of former president Donald Trump. The @realDonaldTrump account was suspended by Twitter on January 8th, 2021, following the January 6th mob attack on the US capitol.

Read on for the latest updates about what’s going on inside Twitter right now.

Riot Games says Sam Bankman-Fried’s love of League of Legends hurts the brand

League of Legends developer Riot Games says Sam Bankman-Fried’s affiliation with the game is hurting the company’s image (via Molly White). In a filing in FTX’s bankruptcy case, Riot Games asks the court to terminate its League of Legends Championship Series (LCS) sponsorship deal with the collapsed crypto exchange, citing irreversible “reputational harm.”

Bankman-Fried’s love for gaming entered the spotlight following the fall of FTX, and he became notorious for playing League of Legends (and other games) during meetings. In a now-deleted profile of Bankman-Fried posted by venture capital firm Sequoia, co-founder Neeraj Arora says he was even playing League of Legends during their first meeting over Zoom.

8) On League of Legends:

I play a lot more than you'd expect from someone who routinely trades off sleep vs work.

Why?

Well, there's one answer, which is the obvious one. The single most universal thing about LoL is that everyone who plays it says they wish they didn't.
— SBF (@SBF_FTX) February 4, 2021

The former billionaire hasn’t been shy about his interest in League of Legends, either (even though he’s self-admittedly bad at the game). He wrote about playing League in a lengthy thread on Twitter posted last year, saying: “I play a lot more than you’d expect from someone who routinely trades off sleep vs work. Why? Well, there’s one answer, which is the obvious one. The single most universal thing about LoL is that everyone who plays it says they wish they didn’t.”

At the time, all this probably seemed like good publicity for Riot Games, which announced a seven-year deal with FTX to sponsor its LCS circuit. But now that FTX’s crypto empire has crumbled, and Bankman-Fried’s been charged with fraud and money laundering, Riot Games is looking to sever any remaining ties with the exchange, which it says its “image and reputation to its customer base” are “inextricably linked” to.

“Images of Mr. Bankman-Fried playing League of Legends were displayed alongside text describing his cavalier attitude towards investor meetings and irresponsibility with corporate funds,” the filing reads. “These images created a public narrative that Mr. Bankman-Fried’s interest in League of Legends, once relatable and human, was now reckless and juvenile.”

According to the filing, FTX still owes Riot Games $6.25 million for the time it spent as an LCS sponsor in 2022, but that will increase to $12.875 million next year. These payments will “escalate each year through 2028,” bringing the deal’s total value up to around $96 million. In addition to allegedly experiencing damage to its brand, Riot says it wants to end the deal now so it can replace FTX with yet another crypto sponsor for the 2023 season.

“The reputational harm inflicted upon Riot cannot be undone,” the filing reads. “FTX cannot go back in time and put in place corporate controls for the safekeeping of customer funds that have in the public eye now been absconded.”

Other organizations sponsored by FTX were quick to drop the exchange’s branding following its collapse. Professional esports group Team SoloMid (TSM), which once went by TSM FTX as part of a sponsorship deal, stripped “FTX” from its name last month, while the Miami Heat already started searching for a new sponsor for its FTX Arena. Even Mercedes’ Formula 1 team suspended its deal with the company and took FTX’s logo off of its vehicles.

Apple’s reportedly working on several monitors — including an updated Pro Display XDR

Mac Pro and Pro Display XDR — *The 2019 Pro Display XDR alongside the Mac Pro.* | Photo by Avery White for The Verge

Apple’s working on “multiple new” external monitors outfitted with the company’s in-house silicon, according to a report from Bloomberg’s Mark Gurman. This lineup’s expected to include an updated version of the Pro Display XDR, which was last released in 2019.

Gurman says the addition of Apple’s own chips should help the displays “rely less on resources from the attached computer.” Apple similarly incorporated the iPhone 11’s A13 Bionic chip into the Studio Display it launched back in March, allowing the monitor to support certain features like Center Stage, spatial audio, and “Hey Siri” voice commands.

Besides the rumored Pro Display XDR, it’s still not entirely clear what other kinds of monitors Apple has planned. Supply chain analyst Ross Young says Apple could release a 27-inch mini-LED display with ProMotion in the first quarter of 2023, a potential indicator that Apple’s working on an update to the 27-inch Studio Display.

Apple’s existing Pro Display XDR costs $4,999 (not including the optional $999 Pro stand) and comes with a 32-inch 6K LCD panel capable of reaching 1,600 nits of brightness. But unlike the previous Pro Display XDR, this new monitor might not ship until after the release of the upcoming Mac Pro, which Gurman says is further along in development.

Apple was supposed to have launched the Mac Pro by now to meet its goal of converting all its Macs to Apple silicon in the two years following the M1 chip’s release. However, Gurman says feature changes and a potential production relocation to Vietnam have caused delays in its development. While Mac Pro was initially rumored to come with the option for a high-powered “M2 Extreme” chip with 48 CPU cores and 152 GPU cores, Gurman says the chip’s complexity, as well as the cost and resources required to produce it, may have led Apple to scrap the idea.

The Mac Pro’s now expected to ship with the new M2 Ultra chip that should have up to 24 CPU cores and 76 graphics cores with the potential to support at least 192GB of memory. Gurman says the Mac Pro will also retain its expandability, allowing users to add more memory and storage. Meanwhile, the upcoming Mac mini could arrive in M2 and M2 Pro variations, while Apple could launch its M2 Pro and M2 Max-equipped MacBook Pros early next year. Gurman notes that Apple is also working on an iMac Pro with Apple silicon, but that machine has “suffered internal delays for similar reasons as the Mac Pro.”

Does a kettle use more electricity than a TV? How much power your gadgets use

We test what devices consume, with households increasingly worried about rising energy prices

How much does it cost to charge your phone or your toothbrush? Is it really cheaper to use the microwave to cook your food, as has been suggested? With the cost of electricity putting the squeeze on all our finances, and a house full of tech, I decided it was time to see how power-hungry everyday devices really are.

We are constantly told that all manner of appliances chew through electricity, and that you can make huge savings by switching off “vampire devices” at the wall. But is that really true? To cut through the fug and find out myself, I grabbed a power meter and spent the last two months testing everything I could.

‘Our weapons are computers’: Ukrainian coders aim to gain battlefield edge

Delta software developed to help collect and disseminate information about enemy’s movements

Russia-Ukraine war – latest updates

In a nondescript office building on the outskirts of Zaporizhzhia, Ukrainian soldiers have been honing what they believed will be a decisive weapon in their effort to repel the Russian invasion.

Inside, the weapon glows from a dozen computer screens – a constantly updated portrayal of the evolving battlefield to the south. With one click on a menu, the map is populated with hordes of orange diamonds, showing Russian deployments. They reveal where tanks and artillery have been hidden, and intimate details of the units and the soldiers in them, gleaned from social media. Choosing another option from the menu lights up red arrows across the southern Zaporizhzhia region, showing the progression of Russian columns. Zooming in shows satellite imagery of the terrain in sharp detail.