Many of the streaming media players on the market are built on Android—this includes Fire TV and, of course, Google TV. So, why can’t an Android phone be used as a streaming stick? They can, and that’s exactly what I did with an old Samsung Galaxy phone.
August brought with it a haul of new movies to Paramount+ that we’re currently enjoying, which is good because the streamer’s big draws this month so far seem to be aimed at a heavy-hitting new season of Taylor Sheridan’s Lioness and another monster UFC battle happening this weekend, with UFC 330: Makhachev vs. Machado Garry.
It may sound entirely bizarre but the prices you once paid for hotels, educational classes, or staplers could have all been higher because you used a Mac computer, lived in a certain zip code, or lacked an Office Depot in your neighborhood.
“type some zip codes into the company’s website, they are offered The Princeton Review’s premier course for as little as $6,600. For other zip codes, the same course cost as much as $8,400. One unexpected effect of the company’s geographic approach to pricing is that Asians are almost twice as likely to be offered a higher price than non-Asians.”
Under surveillance pricing, companies collect as much data as possible about consumers so that they can alter the literal prices those consumers pay for the exact same goods as everyone else. It is reportedly what caused some customers to see higher prices for televisions in the Target app when those customers were physically located in a Target parking lot. It is also allegedly why Home Depot customers in wealthy neighborhoods oddly paid less. And it is what Delta Airlines walked away from after public backlash.
The near-omnipresence of surveillance pricing is also why so many videos can be found online today that claim that minor alterations to a person’s data trail—like changing an IP address using a VPN or shopping for airline tickets on a public library’s computer—can lead to lower prices online.
The proof behind these claims, however, is harder to test.
Thankfully, one person has already tried.
Video journalist Chris Parr, known on YouTube as Chris the Producer, ran a wild experiment into whether he could “stress-test” surveillance pricing. Far beyond changing his IP address or making online purchases from different locations, Parr started from scratch. By first registering an LLC in the state of Wyoming, Parr granted that LLC both a credit card and a phone, effectively creating a brand new consumer persona to be tracked. But creating a realistic data trail for his LLC would require a little extra help—help that Parr received from an actor he hired for the part.
Today, on the Lock and Code podcast with host David Ruiz, we speak with Parr about his experiment into surveillance pricing, including a high-wire drone act to purchase a White Castle Crave Case in the air space above his home state’s wealthiest neighborhood:
“To the data collectors, they don’t know that this phone is floating in the air, like 200 feet in the air. They just see a geolocation on it.”
Buying a family SUV is about more than horsepower, screens, or how impressive it looks parked in the driveway. You want something that makes everyday life easier and doesn’t leave you second-guessing your choice.
The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. […]
Even as August’s newest movies and TV show titles trickle in on HBO Max, for documentary enthusiasts, one new series that’s been building some excitement has finally arrived, and I can confirm after watching the first episode that it’s been well worth the wait.
Documentary fans have been treated to some pretty great stuff on Netflix lately, with a couple of chilling true-crime titles burning up the Top 10 charts in the U.S. recently—The Idaho Murders: College Nightmare and A Toxic Love Story—both of which we’ve covered in this weekly recommendation list. With August now upon us, though, the streaming giant isn’t letting you off the hook just yet.
Three WebKit mechanisms have been discovered to bypass Apple’s iCloud Private Relay. In fact, the mechanisms can bypass any browser?level proxy configuration, including Psylo’s proxy, Tor-on-iOS proxy setups, and so on.
Private Relay is a VPN-like system for Safari on iOS which is meant to prevent websites from viewing the visitor’s IP address and location.
But because all three methods described by the researchers occur outside WebKit’s normal page loading path, Apple’s iCloud Private Relay never sees them and, as a result, means you can’t hide your IP address or Domain Name System (DNS) path in these cases.
The three features are:
DNS prefetching Modern browsers try to be faster by looking up the IP addresses of links on a page before you click them, a feature known as DNS prefetching. In WebKit, these DNS lookups can bypass the configured proxy/relay and go straight through the system’s normal DNS stack, exposing which DNS servers you are using and, indirectly, where you really are. Even if the actual page load goes through Private Relay, the prefetch DNS queries can still leak metadata about your network.
WebAuthn and passkeys WebAuthn (the standard behind passkeys) sometimes needs to fetch a small file from the website’s domain to verify that the credential is being used on the right site. The researchers found that, on Apple platforms, this fetch is performed outside the usual WebKit page?loading path, which means it is not sent through the Safari proxy or Private Relay. The result is that a site using passkeys can cause your device to contact it directly, revealing your true IP address even if the rest of your browsing is supposedly hidden behind a relay.
WebTransport and related technologies WebTransport is a newer API that gives websites a way to open low?latency, bidirectional connections to a server. In the scenarios the researchers tested, these WebTransport connections were also initiated outside the proxied WebKit code path, creating another route for sites to receive traffic straight from the device. That traffic again carries the device’s real IP, not the relay or proxy IP the user expects.
From a user?experience point of view, the problem is that all three mechanisms look like normal browser behavior and require no special tricks from a malicious site.
What’s affected
Affected are Safari on iOS and macOS when Private Relay is used, because Private Relay is implemented as a WebKit?level proxy that only applies to Safari traffic. Additionally, any iOS/macOS browser or app that relies on WebKit’s proxy configuration to hide the IP (e.g., Psylo, Onion Browser/Tor on iOS, and other proxy browsers), since they all hit the same WebKit behavior.
And that’s not necessarily all. For most of iOS’s history, any app that browsed the web had to use Apple’s WebKit framework and JavaScript engine. This meant that Chrome, Firefox, Edge, Brave, and other browsers on iPhone were effectively different shells around the same WebKit engine Safari uses. Under pressure from the EU’s Digital Markets Act (DMA), Japan’s Smartphone Act, and similar regulatory pushes, Apple introduced a mechanism for non?WebKit engines, but only in constrained ways.
Malwarebytes’ Senior manager for iOS software Roman Dvoinev commented:
“Basically the API has been “open” for a while, but no browser vendor has actually shipped a non-WebKit browser yet. Major players are still in prototype phase, as Apple’s bar for shipping a browser to iOS is very high.”
Malwarebytes VPN is not affected, since it tunnels the device’s entire network traffic at the system level.
Ford is finally ready to share tangible details of its affordable electric pickup truck. The automaker has revealed that the EV will carry the Fathom name and a starting price of $28,350 when equipped with a “standard-range” battery.