Secure Phones Keep Appearing
October 31, 2024
The KDE community has developed an open source interface for mobile devices called Plasma Mobile. It allegedly turns any phone into a virtual fortress, promising a “privacy-respecting, open source and secure phone ecosystem.” This project is based on the original Plasma for desktops, an environment focused on security and flexibility. As with many open-source projects, Plasma Mobile is an imperfect work in progress. We learn:
“A pragmatic approach is taken that is inclusive to software regardless of toolkit, giving users the power to choose whichever software they want to use on their device. … Plasma Mobile is packaged in multiple distribution repositories, and so it can be installed on regular x86 based devices for testing. Have an old Android device? postmarketOS, is a project aiming to bring Linux to phones and offers Plasma Mobile as an available interface for the devices it supports. You can see the list of supported devices here, but on any device outside the main and community categories your mileage may vary. Some supported devices include the OnePlus 6, Pixel 3a and PinePhone. The interface is using KWin over Wayland and is now mostly stable, albeit a little rough around the edges in some areas. A subset of the normal KDE Plasma features are available, including widgets and activities, both of which are integrated into the Plasma Mobile UI. This makes it possible to use and develop for Plasma Mobile on your desktop/laptop. We aim to provide an experience (with both the shell and apps) that can provide a basic smartphone experience. This has mostly been accomplished, but we continue to work on improving shell stability and telephony support. You can find a list of mobile friendly KDE applications here. Of course, any Linux-based applications can also be used in Plasma Mobile.
KDE states its software is “for everyone, from kids to grandparents and from professionals to hobbyists.” However, it is clear that being an IT professional would certainly help. Is Plasma Mobile as secure as they claim? Time will tell.
Cynthia Murrell, October 31, 2024
FOGINT: ANKR and TON Hook Up
October 30, 2024
A humanoid wrote this essay. I tried to get MSFT Copilot to work, but it remains dead. That makes four days with weird messages about a glitch. That’s the standard: Good enough.
The buzzwords “DePIN” and “SNAS” may not be familiar to some cyber investigators. The first refers to an innovation which ANKR embraces. A DePIN is a decentralized physical infrastructure or a network of nodes. The nodes can be geographically distributed. Instead of residing on a physical server, virtualization makes the statement “We don’t know what’s on the hardware a customer licenses and configures.” There is no there there becomes more than a quip about Oakland, California. The SNAS is a consequence of DePIN-type architecture. The SNAS is a super network as a service. A customer can rent big bang systems and leave the hands on work to the ANKR team.
Why am I mentioning a start up operating in Romania?
The answer is that ANKR has cut a deal with The One Network Foundation. This entity was created after Telegram had its crypto plans derailed by the US Securities & Exchange Commission several years ago. The TONcoin is now “open” and part of the “open” One Network Foundation entity. TON, as of October 24, 2024, is directly accessible through ANKR’s Web3 API (application programming interface).
Telegram organization allows TONcoin to “run” on the Telegram blockchain via the Open Network Foundation based in Zug, Switzerland. The plumbing is Telegram; the public face of the company is the Zug outfit. With Mr. Durov’s remarkable willingness to modify how the company responds to law enforcement, there is pressure on the Telegram leadership to make TONcoin the revenue winner.
ANKR is an important tie up. It may be worth watching.
Stephen E Arnold, October 30, 2024
Bookmark This: HathiTrust Digital Library
October 30, 2024
Concerned for the Internet Archive? So are we. (For multiple reasons.) But while that venerable site recovers from its recent cyberattacks, remember Hathi exists. Founded in 2008, the not-for-profit HathiTrust Digital Library is a collaborative of academic and research libraries. The site makes millions of digitized items available for study by humans as well as for data mining. The site shares the collection’s story:
“HathiTrust’s digital library came into being during the mid-2000s when companies such as Google began scanning print titles from the shelves of university and college campus libraries. When many of those same libraries created HathiTrust in 2008, they united library copies of those digitized books into a single, shared collection to make as much of the collection available for access as allowable by copyright law. Through HathiTrust, libraries collaborate on long-term management, preservation, and access of their collections. Book lovers and researchers like you can explore this huge collection of digitized materials! Today, HathiTrust Digital Library is the largest set of digitized books managed by academic and research libraries. The collection includes materials typically found on the shelves of North American university and college campuses with the benefit of being available online instead of scattered in buildings around the globe. Our enormous collection includes thousands of years of human knowledge and published materials from around the world, selected by librarians and preserved in the libraries of academic and research libraries. You can find all kinds of digitized books and primary source materials to suit a wide range of research needs.”
The collection contains books and “book-like” items—basically anything except audio/visual files. All Library of Congress subjects are represented, but the largest treasures lie in the Language & Literature, Philosophy, Religion, History, and Social Sciences chambers. All volumes not restricted by copyright are free for anyone to read. Just over half the works are in English, while the rest span over 400 languages, including some that are now extinct. Ninety-five percent were scanned from print by Google, but a few specialized collections were contributed by individuals or institutions. The Collection page offers several sample collections to get you started, or you can build your own. Have fun browsing their collections, and with luck the Internet Archive will be back up and running in no time.
Cynthia Murrell, October 30, 2024
PrivacyTools.io: A Good Resource for Privacy Tools and Services
October 30, 2024
Keeping up with the latest in global mass surveillance by private and state-sponsored groups can be a challenge. Here is a resource that can help: Privacy Tools evaluates the many tools designed to fight mass surveillance and highlights the best on its website. Its Home page lists its many clickable categories on the left and describes the criteria by which the site evaluates privacy tools and services. It also educates visitors on surveillance issues and why even those with “nothing to hide” should be concerned. It specifies:
“Many of the activities we carry out on the internet leave a trail of data that can be used to track our behavior and access some personal information. Some of the activities that collect data include credit card transactions, GPS, phone records, browsing history, instant messaging, watching videos, and searching for goods. Unfortunately, there are many companies and individuals on the internet that are looking for ways to collect and exploit your personal data to their own benefit for issues like marketing, research, and customer segmentation. Others have malicious intentions with your data and may use it for phishing, accessing your banking information or hacking into your online accounts. Businesses have similar privacy issues. Malicious entities could be looking for ways to access customer information, steal trade secrets, stop networks and platforms such as e-commerce sites from operating and disrupt your operations.”
The site’s list of solutions to these threats is long. Some are free and some are not. And which to choose will differ depending on one’s situation. One way to simplify the selection is with the group’s specific Privacy Guides—collections of tools for specific concerns. Categories currently include Android, Encryption, Network, Smartphones, Tor Browser, and Tracking, to name a few. This is a handy way to narrow down the many solutions featured on the site. A worthy undertaking since, as the site emphasizes, “You are being watched.”
Cynthia Murrell, October 30, 2024
FOGINT: Telegram Game Surfs on an Implied Link: Musk, X, Crypto Game
October 29, 2024
Written by a humanoid dinobaby. No AI except the illustration.
The FOGINT team spotted a report from Decrypt.com. The article is “Why ‘X Empire’ Telegram Players Are Complaining to Elon Musk About the Airdrop.” If you don’t recognize the Crypto and Telegram jargon, the information in the Decrypt article will not make much sense.
For crypto folks, the X Empire Telegram game is news. According to the cited article:
Telegram tap-to-earn game X Empire will launch its X token on The Open Network (TON) on Thursday, but its reveal of airdrop allocations has drawn complaints from players who say they were deemed ineligible for a share of the rewards. And some of them are telling Elon Musk about it.
From the point of view of Telegram, X Empire is another entrepreneur leveraging the Telegram platform. With each popular egame, Telegram edges closer to its objective of becoming a very important player in what may be viewed as a Web3 service provider. In fact, when the potential payoff from its crypto interests, the craziness of some of the Group and Channel controversies becomes less important to the company. In fact, the hope for a Telegram initial public offering pay day is more important than refusing to cooperate with law enforcement. Telegram is working to appease France. Pavel Durov wants to get back to the 2024 and beyond opportunity with the Telegram crypto activities.
What is interesting to the FOGINT team are these considerations:
- Telegram’s bots and crypto linkages provide an interesting way to move funds and befuddle investigators
- Telegram has traction among crypto entities in Southeast Asia, and innovators operating without minimal regulatory oversight can use Telegram to extend their often illegal interests quickly and in a novel way
- Telegram’s bots or automated software embody a form of workflow automation which does not require getting involved with high profile, closely monitored organizations.
FOGINT wants to point out that Elon Musk is not involved in the X Empire play. However, Decrypt’s article suggests that some game players are complaining directly to him about the “earned” token policy. This is not a deep fake play. X Empire is an example of identity or entity surfing.
Investigators can make sense of some blockchain centric criminal activities. But the emergence of in game tokens, Telegram’s own STAR token, and their integration within the Telegram platform creates a one-stop shop for online crypto activities. Cyber investigators face another challenge: The non-US, largely unregulated Telegram operating as a virtual company with an address in Dubai. France took a bold step in detaining Pavel Durov. How will he adapt? It is unlikely he will be able to resist the lure of a big payoff from the innovations embodied in the Telegram platform.
Stephen E Arnold, October 29, 2024
Surprise: Those Who Have Money Keep It and Work to Get More
October 29, 2024
Written by a humanoid dinobaby. No AI except the illustration.
The Economist (a newspaper, not a magazine) published “Have McKinsey and Its Consulting Rivals Got Too Big?” Big is where the money is. Small consultants can survive but a tight market, outfits like Gerson Lehrman, and AI outputters of baloney like ChatGPT mean trouble in service land.
A next generation blue chip consultant produces confidential and secret reports quickly and at a fraction of the cost of a blue chip firm’s team of highly motivated but mostly inexperienced college graduates. Thanks, OpenAI, close enough.
The write up says:
Clients grappling with inflation and economic uncertainty have cut back on splashy consulting projects. A dearth of mergers and acquisitions has led to a slump in demand for support with due diligence and company integrations.
Yikes. What outfits will employ MBAs expecting $180,000 per year to apply PowerPoint and Excel skills to organizations eager for charts, dot points, and the certainty only 24 year olds have? Apparently fewer than before Covid.
How does the Economist know that consulting outfits face headwinds? Here’s an example:
Bain and Deloitte have paid some graduates to delay their start dates. Newbie consultants at a number of firms complain that there is too little work to go around, stunting their career prospects. Lay-offs, typically rare in consulting, have become widespread.
Consulting firms have chased projects in China but that money machine is sputtering. The MBA crowd has found the Middle East a source of big money jobs. But the Economist points out:
In February the bosses of BCG, McKinsey and Teneo, a smaller consultancy, along with Michael Klein, a dealmaker, were hauled before a congressional committee in Washington after failing to hand over details of their work for Saudi Arabia’s Public Investment Fund.
The firm’s response was, “Staff clould be imprisoned…” (Too bad the opioid crisis folks’ admissions did not result in such harsh consequences.)
Outfits like Deloitte are now into cyber security with acquisitions like Terbium Labs. Others are in the “reskilling” game, teaching their consultants about AI. The idea is that those pollinated type A’s will teach the firms’ clients just what they need to know about smart software. Some MBAs have history majors and an MBA in social media. I wonder how that will work out.
The write up concludes:
The quicker corporate clients become comfortable with chatbots, the faster they may simply go directly to their makers in Silicon Valley. If that happens, the great eight’s short-term gains from AI could lead them towards irrelevance.
Wow, irrelevance. I disagree. I think that school relationships and the networks formed by young people in graduate school will produce service work. A young MBA who mother or father is wired in will be valuable to the blue chip outfits in the future.
My take on the next 24 months is:
- Clients will hire employees who use smart software and can output reports with the help of whatever AI tools get hyped on LinkedIn.
- The blue chip outfits will get smaller and go back to their carpeted havens and cook up some crises or trends that other companies with money absolutely have to know about.
- Consulting firms will do the start up play. The failure rate will be interesting to calculate. Consultants are not entrepreneurs, but with connections the advice givers can tap their contacts for some tailwind.
I have worked at a blue chip outfit. I have done some special projects for outfits trying to become blue chip outfits. My dinobaby point of view boils down to seeing the Great Eight becoming the Surviving Six and then the end game, the Tormenting Two.
What picks up the slack? Smart software. Today’s systems generate the same type of normalized pablum many consulting firms provide. Note to MBAs: There will be jobs available for individuals who know how to perform Search GEO (generated engine optimization).
Stephen E Arnold, October 29, 2024
That AI Technology Is Great for Some Teens
October 29, 2024
The New York Times ran and seemed to sensationalized a story about a young person who formed an emotional relationship with AI from Character.ai. I personally like the Independent’s story “The Disturbing Messages Shared between AI Chatbot and Teen Who Took His Own Life,” which was redisplayed on the estimable MSN.com. If the link is dead, please, don’t write Beyond Search. Contact those ever responsible folks at Microsoft. The British “real” news outfit said:
Sewell [the teen] had started using Character.AI in April 2023, shortly after he turned 14. In the months that followed, the teen became “noticeably withdrawn,” withdrew from school and extracurriculars, and started spending more and more time online. His time on Character.AI grew to a “harmful dependency,” the suit states.
Let’s shift gears. The larger issues is that social media has changed the way humans interact with each other and smart software. The British are concerned. For instance, the BBC delves into how social media has changed human interaction: “How Have Social Media Algorithms Changed The Way We Interact?”
Social media algorithms are fifteen years old. Facebook unleashed the first in 2009 and the world changed. The biggest problem associated with social media algorithms are the addiction and excess. Teenagers and kids are the populations most affected by social media and adults want to curb their screen time. Global governments are steeping up to enforce rules on social media.
The US could ban TikTok if the Chinese parent company doesn’t sell it. The UK implemented a new online safety act for content moderation, while the EU outlined new rules for tech companies. The rules will fine them 6% of turnover and suspend them if they don’t prevent election interference. Meanwhile Brazil banned X for a moment until the company agreed to have a legal representative in the country and blocked accounts that questioned the legitimacy of the country’s last election.
While the regulation laws pose logical arguments, they also limit free speech. Regulating the Internet could tip the scale from anarchy to authoritarianism:
“Adam Candeub is a law professor and a former advisor to President Trump, who describes himself as a free speech absolutist. Social media is ‘polarizing, it’s fractious, it’s rude, it’s not elevating – I think it’s a terrible way to have public discourse”, he tells the BBC. “But the alternative, which I think a lot of governments are pushing for, is to make it an instrument of social and political control and I find that horrible.’ Professor Candeub believes that, unless ‘there is a clear and present danger’ posed by the content, ‘the best approach is for a marketplace of ideas and openness towards different points of view.’”
When Musk purchased X, he compared it to a “digital town square.” Social media, however, isn’t like a town square because the algorithms rank and deliver content based what eyeballs want to see. There isn’t fair and free competition of ideas. The smart algorithms shape free speech based on what users want to see and what will make money.
So where are we? Headed to the grave yard?
Whitney Grace, October 29, 2024
Apple: Challenges Little and Bigly
October 28, 2024
Another post from a dinobaby. No smart software required except for the illustration.
At lunch yesterday (October 23, 2024), one of the people in the group had a text message with a long string of data. That person wanted to move the data from the text message into an email. The idea was copy a bit of ascii, put it in an email, and email the data to his office email account. Simple? He fiddled but could not get the iPhone to do the job. He showed me the sequence and when he went through the highlighting, the curly arrow, and the tap to copy, he was following the procedure. When he switched to email and pressed the text was not available. A couple of people tried to make this sequence of tapping and long pressing work. Someone handed the phone to me. I fooled around with it, asked the person to restart the phone, and went through the process. It took two tries but I got the snip of ASCII to appear in the email message. Yep, that’s the Apple iPhone. Everyone loves the way it works, except when it does not. The frustration the iPhone owner demonstrated illustrates the “good enough” approach to many functions in Apple’s and other firms’ software.
Will the normal course of events swamp this big time executive? Thanks, You.com. You were not creative, but you were good enough.
Why mention this?
Apple is a curious company. The firm has been a darling of cored fans, investors, and the MBA crowd. I have noted two actions related to Apple which suggest that the company may have a sleek exterior but the interior is different. Let’s look at these two recent developments.
The first item concerns what appear to be untoward behavior by Apple and those really good folks at Goldman Sachs. The Apple credit card received a statement showing that $89 million was due. The issue appears to be fumbling the ball with customers. For a well managed company, how does this happen? My view is that getting cute was not appreciated by some government authorities. A tiny mistake? Yes. The fine is miniscule compared to the revenue represented by the outstanding enterprises paying the fine. With small fines, have the Apple and Goldman Sachs professionals learned a lesson. Yes, get out of the credit card game. Other than that, I surmise that neither of the companies will veer from their game plans.
The second item is, from my point of view, a bit more interesting than credit cuteness. Apple, if the news report in the Washington Times, is close to the truth, is getting very comfortable with China. The basic idea is that Apple wants to invest in China. Is China the best friend forever of the US? I thought some American outfits were somewhat cautious with regard to their support of that nation state. Well, that does not appear to apply to China.
With the weird software, the credit card judgment, and the China love fest, we have three examples of a company operating in what I would describe as a fog of pragmatism. The copy paste issue makes clear that simplicity and attention to a common task on a widely used device is not important. The message for the iPhone is, “Figure out our way. Don’t even think about a meaningful, user centric change. Just upgrade and get the vapor of smart software.”
The message from the credit card judgment is, “Hey, we will do what we want. If there is a problem, send us a bill. We will continue to do what we want.” That shows me that Apple buys into the behavior pattern which makes Silicon Valley behavior the gold standard in management excellence.
My interpretation of the China-Apple BFF activity is that the policy of the US government is of little interest. Apple, like other large technology outfits, is effectively operating as a nation state. The company will do what it wants and let lawyer and PR people make the activity palatable.
I find it amusing that Apple appears to be reducing orders for its next big iPhone release. The market may be reaching a saturation point or the economic conditions in certain markets make lower cost devices more appealing. My own view is that the AI vapor spewed by Apple and other US companies is dissipating. Another utility function which does not work in a reliable way may not be enough.
Why not make copy paste more usable or is that a challenge beneath your vast aspirations?
Stephen E Arnold, October 28, 2024
Fake Defined? Next Up Trust, Ethics, and Truth
October 28, 2024
Another post from a dinobaby. No smart software required except for the illustration.
This is a snappy headline: “You Can Now Get Fined $51,744 for Writing a Fake Review Online.” The write up states:
This mandate includes AI-generated reviews (which have recently invaded Amazon) and also encompasses dishonest celebrity endorsements as well as testimonials posted by a company’s employees, relatives, or friends, unless they include an explicit disclaimer. The rule also prohibits brands from offering any sort of incentive to prompt such an action. Suppressing negative reviews is no longer allowed, nor is promoting reviews that a company knows or should know are fake.
So, what does “fake” mean? The word appears more than 160 times in the US government document.
My hunch is that the intrepid US Federal government does not want companies to hype their products with “fake” reviews. But I don’t see a definition of “fake.” On page 10 of the government document “Use of Consumer Reviews”, I noted:
“…the deceptive or unfair commercial acts or practices involving reviews or other endorsement.”
That’s a definition of sort. Other words getting at what I would call a definition are:
- buying reviews (these can be non fake or fake it seems)
- deceptive
- false
- manipulated
- misleading
- unfair
On page 23 of the government document, A. 465. – Definitions appears. Alas, the word “fake” is not defined.
The document is 163 pages long and strikes me as a summary of standard public relations, marketing, content marketing, and social media practices. Toss in smart software and Telegram-type BotFather capability and one has described the information environment which buzzes, zaps, and swirls 24×7 around anyone with access to any type of electronic communication / receiving device.
Look what You.com generated. A high school instructor teaching a debate class about a foundational principle.
On page 119, the authors of the government document arrive at a key question, apparently raised by some of the individuals sufficiently informed to ask “killer” questions; for example:
Several commenters raised concerns about the meaning of the term “fake” in the context of indicators of social media influence. A trade association asked, “Does ‘fake’ only mean that the likes and followers were created by bots or through fake accounts? If a social media influencer were to recommend that their followers also follow another business’ social media account, would that also be ‘procuring’ of ‘fake’ indicators of social media influence? . . . If the FTC means to capture a specific category of ‘likes,’ ‘follows,’ or other metrics that do not reflect any real opinions, findings, or experiences with the marketer or its products or services, it should make that intention more clear.”
Alas, no definition is provided. “Fake” exists in a cloud of unknowing.
What if the US government prosecutors find themselves in the position of a luminary who allegedly said: “Porn. I know it when I see it.” That posture might be more acceptable than trying to explain that an artificial intelligence content generator produced a generic negative review of an Italian restaurant. A competitor uses the output via a messaging service like Telegram Messenger and creates a script to plug in the name, location, and date for 1,000 Italian restaurants. The individual then lets the script rip. When investigators look into this defamation of Italian restaurants, the trail leads back to a virtual assert service provider crime as a service operation in Lao PDR. The owner of that enterprise resides in Cambodia and has multiple cyber operations supporting the industrialized crime as a service operation. Okay, then what?
In this example, “fake” becomes secondary to a problem as large or larger than bogus reviews on US social media sites.
What’s being done when actual criminal enterprises are involved in “fake” related work. According the the United Nations, in certain nation states, law enforcement is hampered and in some cases prevented from pursuing a bad actor.
Several observations:
- As most high school debaters learn on Day One of class: Define your terms. Present these in plain English, not a series of anecdotes and opinions.
- Keep the focus sharp. If reviews designed to damage something are the problem, focus on that. Avoid the hand waving.
- The issue exists due to a US government policy of looking the other way with regard to the large social media and online services companies. Why not become a bit more proactive? Decades of non-regulation cannot be buried under 160 page plus documents with footnotes.
Net net: “Fake,” like other glittering generalities cannot be defined. That’s why we have some interesting challenges in today’s world. Fuzzy is good enough.
PS. If you have money, the $50,000 fine won’t make any difference. Jail time will.
Stephen E Arnold, October 28, 2024
AI Has An Invisible Language. Bad Actors Will Learn It
October 28, 2024
Do you remember those Magic Eyes back from the 1990s? You needed to cross your eyes a certain way to see the pony or the dolphin. The Magic Eyes were a phenomenon of early computer graphics and it was like an exclusive club with a secret language. There’s a new secret language on the Internet generated by AI and it could potentially sneak in malicious acts says Ars Technica: “Invisible Text That AI Chatbots Understand And Humans Can’t? Yep, It’s A Thing.”
The secret text could potentially include harmful instructions into AI chatbots and other code. The purpose would be to steal confidential information and conduct other scams all without a user’s knowledge:
“The invisible characters, the result of a quirk in the Unicode text encoding standard, create an ideal covert channel that can make it easier for attackers to conceal malicious payloads fed into an LLM. The hidden text can similarly obfuscate the exfiltration of passwords, financial information, or other secrets out of the same AI-powered bots. Because the hidden text can be combined with normal text, users can unwittingly paste it into prompts. The secret content can also be appended to visible text in chatbot output.”
The steganographic framework is built into a text encoding network and LLMs and read it. Researcher Johann Rehberger ran two proof-of-concept attacks with the hidden language to discover potential risks. He ran the tests on Microsoft 365 Copilot to find sensitive information. It worked:
“When found, the attacks induced Copilot to express the secrets in invisible characters and append them to a URL, along with instructions for the user to visit the link. Because the confidential information isn’t visible, the link appeared benign, so many users would see little reason not to click on it as instructed by Copilot. And with that, the invisible string of non-renderable characters covertly conveyed the secret messages inside to Rehberger’s server.”
What is nefarious is that the links and other content generated by the steganographic code is literally invisible. Rehberger and his team used a tool to decode the attack. Regular users are won’t detect the attacks. As we rely more on AI chatbots, it will be easier to infiltrate a person’s system.
Thankfully the Big Tech companies are aware of the problem, but not before it will probably devastate some people and companies.
Whitney Grace, October 28, 2024
-
- Subscribe to Beyond Search
Feature archive
News archive
-
