News

Posted in Menacing Monopoly

The EU hits Google with another big, well-deserved fine

It serves them right.

European authorities on Wednesday fined Google 1.5 billion euros for antitrust violations in the online advertising market, continuing its efforts to rein in the world’s biggest technology companies.

The fine, worth about $1.7 billion, is the third against Google by the European Union since 2017, reinforcing the region’s position as the world’s most aggressive watchdog of an industry with an increasingly powerful role in society and the global economy. The regulators said Google had violated antitrust rules by imposing unfair terms on companies that used its search bar on their websites in Europe.

The EU’s Margrethe Vestager said it well when she declared:

“Google has cemented its dominance in online search adverts and shielded itself from competitive pressure by imposing anticompetitive contractual restrictions on third-party websites.”

It’s nice to hear somebody in a position of public responsibility saying this and then back it up with action.

What’s sad, though, is that the United States keeps letting Google skate when it can see the same thing that European Union regulators can see. The difference is that the EU cares about combating monopolistic behavior while the U.S. authorities don’t.

Posted in Menacing Monopoly

Google enters another market with Stadia, a big foray into gaming

We can only hope Stadia is as big of a failure as Google Plus was.

At the Game Developers Conference, Google announced its biggest play yet in the gaming space: a streaming game service named Google Stadia, designed to run on everything from PCs and Android phones to Google’s own Chromecast devices.

As of press time, the service’s release window is simply “2019.” No pricing information was announced at the event.

Google Stadia will run a selection of existing PC games on Google’s centralized servers, taking in controller inputs and sending back video and audio using Google’s network of low-latency data centers. The company revealed a new Google-produced controller, along with a game-streaming interface that revolves around a “play now” button. Press this on any Web browser and gameplay will begin “in as quick as five seconds… with no download, no patch, no update, and no install.”

Ars Technica commenters are skeptical about Stadia.

“Can’t wait for this to be killed off in a press release in 6 years! I really need more reliability from Google in supporting their platforms,” wrote one.

“Annnd will quickly forget about it in 1-2 years. Buyer beware,” said another.

“My past experience with Google products suddenly disappearing really discourages me from trying this, let alone sink money into it,” agreed a third.

Posted in Shoddy Security

New Android adware found in 200 apps on Google Play

These issues just keep recurring… and recurring… and recurring…

Security researchers have found a new kind of mobile adware hidden in hundreds of Android apps, and downloaded more than 150 million times from Google Play.

The malware masquerading as an ad-serving platform, dubbed SimBad by researchers at security firm Check Point, infected more than 200 apps which, likely unbeknownst to the app developer, would open a backdoor to install additional malware as a way to outsmart Google’s app store scanning. Once installed, the downloaded malware also removes the app icon and persists in the background, loading each time the device boots up.

A list of the bad apps is available here.

Google has been pulling down these bad apps, but unfortunately, they will remain on the devices of anyone who installed them unless the user takes action to get rid of them. That’s what is so distressing about all of this. Google has failed to create a system for effectively vetting and screening apps before they appear on Google Play. And it seems no matter how many times security researchers find problems, Google isn’t embarrassed enough to change its ways.

Posted in Poor Quality Assurance

Gmail, Google Drive hit with global outage

Ruh roh:

Gmail has been hit by an outage affecting users around the world, with outage reports spiking and Gmail users flooding social media to complain about problems sending emails.

Some users are also reporting issues with Google Drive, including spotty performance and certain file types not opening.

According to a message posted on Google’s GSuite Status Dashboard at 1:53 p.m. ET, both Gmail and Google Drive are experiencing what it describes as a “service disruption.”

People who have trusted Google with their data are naturally not happy that it’s inaccessible. There’s quite a bit of griping on Twitter, which is typical of a service outage.

The moral of the story? Don’t trust Google with your data. Keep a local copy that’s always accessible and choose providers that care about your privacy (unlike Google).

Posted in War on Privacy

Google in hot water after not revealing it had hidden a secret microphone in home alarm product

When you buy Google products, a major part of what you’re purchasing is unwelcome nasty surprises that greet you down the road.

As if some folks weren’t concerned enough about the infiltration of potentially privacy-busting devices into the home, Google has admitted it did not disclose that it hid a secret microphone inside one of its products.

Owners of the Nest Secure were surprised earlier this month to read an announcement from Google that it was adding a new voice control feature to its home alarm product:

“Starting today, we’re adding a feature to Nest Secure to do just that: the Google Assistant will be available on your Nest Guard, so you can ask it questions like, “Hey Google, do I need an umbrella today?” before you set your alarm and leave the house.* Nest Guard is the brains of your Nest Secure; it contains a keypad and all the smarts that power the system. It’s usually placed in a spot with lots of traffic (like the front doorway) making it useful as you come and go.”

This “announcement” is naturally coming as quite a shock to people who bought Nest Guard and didn’t fathom that there was a microphone inside of it. But it’s not surprising to us. Typical Google behavior.

Posted in Undependable Support

Google Fiber shutting down in Louisville

An awkward exit:

“We’re not living up to the high standards we set for ourselves, or the standards we’ve demonstrated in other Fiber cities,” the company writes today. “We would need to essentially rebuild our entire network in Louisville to provide the great service that Google Fiber is known for, and that’s just not the right business decision for us.”

It’s a rare admission of defeat for Google Fiber, though it’s no secret that the company isn’t exactly bullish on the prospect of the service anymore. Louisville was supposed to be somewhat of a comeback for Google Fiber, which like so many Google services is now under more pressure to generate a profit. Clearly, that didn’t work out. If this were still a major growth and focus area for Google, it would have done exactly what it isn’t doing in Louisville: rebuild the entire network.

Instead of a comeback, Google Fiber in Louisville was a flop.

Here’s a thought, Google (or as you’re now called, Alphabet): maybe instead of trying to conquer every product space in tech, just focus on a few things and do them well?

Posted in Legal Troubles, War on Privacy

Google fined for GDPR violations

Bring on the penalties!

Google has been fined 50 million euros (about $57 million) by a French regulator for not properly disclosing to users how their data is collected and used for targeted advertising.

The penalty is the biggest yet imposed under a new European privacy law that went into effect in 2018. The European Union’s General Data Protection Regulation gives Europeans more control over their information and how companies use it.

France’s National Data Protection Commission said on Monday that it imposed the fine after determining Google hadn’t met its obligation for transparency by making information about its data collection easily accessible to users. The commission found that Google didn’t present information about data-processing purposes and data-storage periods in the same place, sometimes requiring users to make five or six clicks to obtain the information.

The General Data Protection Regulation may not be perfect, but it’s already been a boon for users around the globe, including those outside Europe. Companies like Google will never care about user privacy on their own because their business model is monetizing people’s personal information. That’s why it is so important that laws like the GDPR exist… and that they be vigorously enforced.

Posted in Shoddy Security

Use Chromecast, get hacked

Another Google offering that is NOT secure.

Hackers have hijacked thousands of exposed Chromecast streaming devices to warn users of the latest security flaw to affect the device. But other security researchers say that the bug — if left unfixed — could be used for more disruptive attacks.

The culprits, known as Hacker Giraffe and J3ws3r, have become the latest person to figure out how to trick Google’s media streamer into playing any YouTube video they want — including videos that are custom-made. This time around, the hackers hijacked forced the affected Chromecasts to display a pop-up notice that’s viewable on the connected TV, warning the user that their misconfigured router is exposing their Chromecast and smart TV to hackers like themselves.

This is not the first Chromecast exploit, either.

Bishop Fox, a security consultancy firm, first found a hijack bug in 2014, not long after the Chromecast debuted. The researchers found that they could conduct a “deauth” attack that disconnects the Chromecast from the Wi-Fi network it was connected to, causing it to revert back to its out-of-the-box state, waiting for a device to tell it where to connect and what to stream. That’s when it can be hijacked and forced to stream whatever the hijacker wants. All of this can be done in an instant — as they did — with a touch of a button on a custom-built handheld remote.

Two years later, U.K. cybersecurity firm Pen Test Partners discovered that the Chromecast was still vulnerable to “deauth” attacks, making it easy to play content on a neighbor’s Chromecasts in just a few minutes.

Google claims it’s trying to fix the deauth bug. But it’s a four year old exploit. They have had years to fix it and they have failed.

The moral of the story: don’t use Chromecast and other woefully insecure Android products.

Posted in Shoddy Security

Google Plus suffers another security breach

Oops.

Google has now admitted that Google Plus has suffered another security failure, allowing the personal information of 52 million users to be accessed by third-party apps and developers without permission.

So, even if you had your profile information – such as your name, email addresss, occupation, etc etc – set as “not-public”, the information could be accessed by unauthorized parties.

According to Google, the flaw was introduced through a software update in November and was spotted less than a week later. The search giant says that it has seen no evidence that any app developers were aware of the flaw or misused it.

“With the discovery of this new bug, we have decided to expedite the shut-down of all Google+ APIs; this will occur within the next 90 days. In addition, we have also decided to accelerate the sunsetting of consumer Google+ from August 2019 to April 2019,” a contrite David Thacker wrote.

Posted in Menacing Monopoly

Boo! Microsoft’s Edge to become a clone of Google’s Chrome

A must-read post from Mozilla’s Chris Beard.

Microsoft is officially giving up on an independent shared platform for the internet. By adopting Chromium, Microsoft hands over control of even more of online life to Google.

This may sound melodramatic, but it’s not. The “browser engines” — Chromium from Google and Gecko Quantum from Mozilla — are “inside baseball” pieces of software that actually determine a great deal of what each of us can do online. They determine core capabilities such as which content we as consumers can see, how secure we are when we watch content, and how much control we have over what websites and services can do to us. Microsoft’s decision gives Google more ability to single-handedly decide what possibilities are available to each one of us.

From a business point of view Microsoft’s decision may well make sense. Google is so close to almost complete control of the infrastructure of our online lives that it may not be profitable to continue to fight this. The interests of Microsoft’s shareholders may well be served by giving up on the freedom and choice that the internet once offered us. Google is a fierce competitor with highly talented employees and a monopolistic hold on unique assets. Google’s dominance across search, advertising, smartphones, and data capture creates a vastly tilted playing field that works against the rest of us.

This is a worrying development indeed.

What would have made more sense is for Microsoft to embrace Gecko, and contribute to Firefox’s rendering engine. It would have allowed the software giant to reconcile with the successor (Mozilla) of its former opponent (Netscape) in the “browser wars”, and given a boost to the Firefox project.

Instead, Microsoft is moving to shore up Google’s dominance in the browser space.

It is worth noting here that Mozilla is financially dependent on Google — Google currently pays Mozilla to make its search engine the default in Firefox. (Defaults matter because most people don’t change them.) So even Mozilla hasn’t been able to chart a totally independent course from the Monster of Mountain View.

A Microsoft-Mozilla alliance makes so much sense: Firefox could help steer people to Bing, and Microsoft could help Gecko’s future development. It’s a shame it’s not happening.