The Chat Control 1.0 law that enables warrantless mass scanning of digital communications has been voted against multiple times by the EU Parliament. And yet, just like a movie zombie, it keeps getting resurrected by various legal sleight-of-hand moves. Yesterday, one of those tricks worked, as Chat Control 1.0 passed (or rather, was not rejected) in a forced re-vote that required an absolute majority (50% + 1) for active refusal. This brings back the law until 2028, and sets a different stage for September's upcoming discussion on Chat Control 2.0.

After the impending publication in the EU Official Journal, online direct-communication platforms will be allowed to mass-scan their users' data without the need for a warrant, under the guise of looking for child sexual abuse material (CSAM).

The scanning is not mandatory, but big tech firms will have a legal mechanism to rifle through user data. EU firms have historically refrained from doing so, presenting privacy and data sovereignty as selling points, but the legal door is nevertheless now officially open.

The obvious platforms where monitoring can now take place will be e-mail and chat services. Immediate examples include Gmail, iCloud, Hotmail, Discord, Instagram, Slack, Teams, Snapchat, Xbox, and Google Chat.

Although the law's scope is for "interpersonal communications services," the legal mechanism might hypothetically extend to some gray areas like Google Drive, where sending someone a link to a cloud file could be within the scope of the law.

It's worth noting that "direct communication" isn't restricted to one-to-one chats, as it includes group chats; just not public or undirected communications. Additionally, EU law enforcement is still beholden to the same warrant requirement as before — Chat Control 1.0 does not grant a blank pass to authorities to mass-scan user data, or request companies to do so without a targeted warrant.

Thanks to two amendments in yesterday's vote, end-to-end-encrypted (E2EE) communications means (ex: WhatsApp) stay exempt. That means that for now, Chat Control 1.0 isn't a commandment to break encryption, something that has been regularly suggested by lawmakers around the world.

It's as good a time as any to remind people that Instagram messages are no longer E2EE as of May, and that although WhatsApp's messages are encrypted, the service leaks out every single bit of metadata about them — sender, recipient, time, size, etc. As always, Signal is recommended as a privacy-focused communications app.

This latest development in the EU parliament is eliciting widespread public outcry due to the nature of the law itself, but also due to the manner in which it happened. Critics and opponents of the rule are suggesting this move is unprecedented.

Chat Control 1.0 has already been shot down repeatedly, most recently in March. However, European Parliament President Roberta Metsola forced a second reading of the law, and invoked Rule 163's "urgent procedure" mechanism. This had many effects, including bringing up a law that was voted against for discussion yet again; turning the decision into a denial vote (vote-to-deny, not vote-to-pass); exploiting the second-reading requirement that demands an absolute majority vote (50% + 1); and letting the President herself set the schedule. Metsola scheduled the second reading to the very last day before the European Parliament summer recess.

The result was that out of 720 representatives, only 607 actually cast a vote. Of those, 315 (over half) voted against Chat Control 1.0. That figure did not meet the supermajority threshold of 361, which was calculated against a full chamber.

Opponents to Chat Control have posted resources at the Fight Chat Control website, including a breakdown of member-state and individual representative voting positions and contact information.

The Internet is buzzing over news that 19-year-old Estonian "hacker" Peter Stokes got nabbed by the authorities and extradited to the U.S. on digital crime charges, mostly thanks to Microsoft Windows' built-in telemetry. The FBI seemingly subpoenaed Microsoft, which coughed up telemetry logs that contained both Stokes' GDID (Global Device Identifier) and websites he visited using his main Windows machine.

The existence of GDID isn't new by itself, as Windows telemetry's data collection has been extensively analyzed and reported on. It's also been known, and publicly explained by Microsoft, that the extended telemetry modes (Full/Optional instead of Required/Basic) can upload lists of URLs analyzed by SmartScreen and Defender, together with the GDID. In fact, using the Edge browser in this setup can even send every visited URL. The court documents do not reveal which exact mechanism triggered the telemetry upload, though.

This data collection has long been the source of heated debate and general public disgust. Even though the data is genuinely useful and necessary for debugging (by Microsoft or systems administrators in enterprise environments), the fact that it comes enabled by default in Windows Home and Professional editions is questionable. The fact that those versions don't have a simple, user-facing "Off" switch to fully disable telemetry also adds insult to injury.

The Peter Stokes arrest appears to be the first public case where these Windows GDIDs were both used as a tracking identifier and contained telemetry data including some of the URLs the defendant visited. The case also prompted a renewed analysis of the GDID by a security researcher that you might want to look into. From what we can ascertain, it's likely Stokes had his Windows telemetry set to Optional/Full, as Required/Basic doesn't appear to transmit URLs by default.

Using the telemetry GDID, the FBI easily connected the dashing rogue to his ngrokaccount, because he used that tool in the same session in which he accessed his Facebook and Snapchat accounts. The agents also established a link between travel records, a New York IP address, and a rental at the Empire Hotel, likely facilitated by the photos Stokes posted of his hotel room. The criminal mastermind was equally sneaky (read: not) in his visit to Thailand.

As many hackers do, he enjoyed some time off playing an obscure game, in this case Ubisoft's Growtopia, shortly before accessing his Apple logins, as well as the aforementioned Facebook and Snapchat logins over the following weeks. Besides Microsoft, Google and Apple also collaborated on the hunting effort, with Google linking Stokes' phishing phone number to the same exact IP address and date where he created the ngrok account. Ever the stealthy craftsman, Stokes had created the ngrok account using the same GMail address connected to a second phone number where he made phishing calls from.

While it's easy and arguably quite necessary to hoist pitchforks at Microsoft for collecting detailed information about billions of computers by default, security professionals will be quick to remind users that Windows' telemetry is merely one of the many ways to track a user. Even if not by malice, a lot of software simply requires GDID-like identifiers for things like tracking usage, subscription and licensing limitations, activation requests, and hardware detection. And every company behind such software can be subpoenaed by authorities, as exemplified in Stokes' case by Microsoft, Google, Apple, ngrok, and others. Even privacy-oriented services like Proton are careful enough to describe what they can and cannot reveal to authorities under a court order.

If you're wondering the steps Stokes took to cover his tracks, though, you'd be looking at a small list. He did route his connections through a VPN hosted at servers from Tzulo along with the developer-oriented ngrok tunneling service and teleport.sh. Unfortunately, the modern digital world allows for many forms of identification, and hiding one's source IP address is merely one of them.

Using a VPN is recommended for digital anonymity, but it's merely the first of many necessary steps and can even backfire when not set up carefully. If misconfigured, a VPN may allow certain applications and operating system features to talk to the outside world using the original IP instead of the hidden one. Plus, the VPN will not stop the operating system or any application from sending out identifying information to begin with.

Perhaps more worryingly still, modern-day device and user fingerprinting is far more insidious and hard to counter. For example, plain web browsers are notorious leakers of personal information, as data-harvesting companies can weaponize features like TLS levels, HTML5 Canvas functionality, the fonts list, and even Widevine DRM in a combination that uniquely identifies a visitor. Stokes now has plenty of time to read up on the EFF's surveillance self-defense guides and get acquainted with the scripts at the Privacy Is Sexy website.

Takedowns of "bulletproof" VPNs allegedly used for cybercrime activities have become fairly common, and they often raise some interesting legal questions. First VPN is the latest such service to go down in virtual flames, thanks to a Europol-led initiative called Operation Saffron. The seizure caught 33 servers spread across 27 countries, reportedly identified 506 users, and led authorities to a Ukrainian residence.

According to the Europol report, Operation Saffron had the participation of 18 countries, with the main actors being France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the United Kingdom. First Net's regular and .onion domains were also seized, and they currently display a banner for the operation.

Besides the promise of anonymity, First VPN reportedly advertised itself as not cooperating with any judicial authority and that it would not be subject to any jurisdiction. Additionally, it apparently advertised exclusively in Russian-language cybercrime forums, and was predictably the source of extensive online criminal activity, with Europol stating the service came up in most every cybercrime investigation it was pursuing. The investigation was five years in the making, as it actually started back in 2021.

Although the definition is a little fuzzy, the key differences between bulletproof VPNs and privacy-minded services are in how they handle cooperation with authorities, how they deal with abuse reports, who they typically market their services to, what their terms of service are, and how deeply (if any) they are the source of cybercrime.

Whereas popular services like Mullvad or ProtonVPN offer a no-log, no-data-saved policy, they're designed and advertised in such a manner that ought to let them function normally in most jurisdictions. In fact, Mullvad graciously hosted six Swedish officers in 2023, who came away empty-handed as there was no data to hand over. Similarly, last year, a Greek court dismissed cybercrime-abetting charges against the CEO of Windscribe. Windscribe's servers only used RAM disks and had no permanent storage, and earlier this year, Dutch authorities amusingly shut them off and took them for inspection.

Online commentary generally expresses concern about the legal overreach of these takedowns. It's worth noting that while the investigations are coordinated between many authorities, the legal framework for seizures generally falls within the purview of local law. That means that, for example, the need for a warrant or supporting evidence for a seizure depends on which jurisdiction it takes place.

There's also some irony in the fact that the European Union's Charter of Fundamental Rights broadly states that keeping oneself's digital information private is a basic right, and the well-known GDPR has rather sizable teeth that chomp on data mishandling violations. Privacy-minded VPN services can arguably be interpreted as respecting not just the spirit but also the letter of the law, and yet they're subject to law enforcement activities under national-level rules.

Additionally, the long-standing concept of digital privacy in the EU is under fire, thanks to initiatives like ProtectEU that want data saved for law enforcement purposes, or the unpopular "Chat Control" framework that would allow for scanning private communications under the guise of protecting children. Chat Control almost became law but was shot down repeatedly... for now.

In this era of digitization, each device a person carries inevitably contains or can grant access to a substantial amount of personal information. This makes them prime targets for border authorities worldwide, who have been squeezing their controls ever tighter and demanding access to travelers' wares.

According to a BBC report, Hong Kong has now joined the trend, forcing anyone questioned by police to surrender their device passwords, under penalty of imprisonment and fines of up to HK$100,000, or around $12,700. All nationalities are covered by the updated law, which draws much of its framework from mainland China.

Techies may be considering one of many ways to encrypt data in funny schemes or adding a second password to apps. Still, even then, the updated law clearly states that device owners must assist with decryption. Even people just transiting through Hong Kong can be subject to device searches, and Reuters further adds that the law revision grants Hong Kong customs officers the power to seize any item deemed to have "seditious intent."

In addition, anyone offering "false or misleading information" can get three years of enjoying sunsets through bars. That definition is quite broad, so it's not unthinkable that it could cover situations like granting access to a device that has a second encrypted volume containing private data. Likewise, simply possessing an encrypted device makes the person liable for it, even if the device belongs to someone else. Furthermore, the legal obligations extend to anyone authorized to access the equipment or who has knowledge thereof.

The situation is quite unfortunate for prospective travelers, especially those with business intentions, but it's hardly unique worldwide. Contemporary revisions to U.S. border law essentially state that non-residents can be detained and their devices seized for a large number of reasons, with those who refuse to unlock their devices being denied entry.

The situation in Australia is also similar, with a device-unlocking requirement and the threat of detention and seizure. In the U.K., border officers can request that devices be unlocked, and a refusal can result in the device being seized for forensic inspection.

U.S.-based Almeida Law Group, which specializes in class-action litigation, has filed a lawsuit against Lenovo, alleging that Lenovo transferred large amounts of data to China. According to the lawsuit [PDF], the company’s actions violate the U.S. Department of Justice’s Data Security Program, which prevents the transfer of large amounts of sensitive personal data to “countries of concern” or “covered persons.” Lenovo has denied the allegations.

“The DOJ Rule was thus implemented to prevent adversarial countries from acquiring large quantities of behavioral data which could be used to surveil, analyze, or exploit American citizens’ behavior,” the lawsuit said. It also added, “In direct violation of the DOJ Rule, Lenovo—through its automated advertising infrastructure and associated databases—transmits Plaintiff’s and potentially millions of other American consumers’ data to China.”

The Plaintiff here refers to one Spencer Christy of San Francisco, California, and “all other similarly situated,” with the case alleging that Lenovo and its Chinese parent company linked his “browsing activity to his identity, track his behaviors, and build detailed profiles reflecting his interests, locations, habits and other private attributes.” It further said that the data is more than just an invasion of privacy, but “a direct threat to national security as it greatly increases the potential for coercion, reputational harm, and/or blackmail.”

Lenovo is far from the only company gathering such data, but the U.S. entity’s parent, Lenovo Group Limited, is incorporated in Hong Kong, with its headquarters located in Beijing, China. Furthermore, its largest shareholder is Legend Holdings Corporation, a Beijing-based investment firm established by the Chinese Academy of Sciences, a state institution of the People’s Republic of China.

So, aside from being based in one of the “countries of concern,” it also falls squarely under the “covered persons” provision of the DOJ regulation which include “individuals who either reside in ‘countries of concern’ or are controlled by entities in those countries or (ii) entities that are organized or chartered under the laws of, or have their principal place of business in, a country of concern, or are owned 50% or more by such entities.” More than that, the lawsuit asserts that Lenovo Group is subject to Chinese regulations like the National Intelligence Law, Cybersecurity Law, and Data Security Law, which compel individuals and institutions to cooperate with the authorities when asked for data.

When asked for comment, Lenovo told The Register, “Any suggestion that Lenovo improperly shares customer data is false. We take data privacy and security seriously and comply with all applicable data protection laws and regulations globally, including stringent U.S. requirements. Our data practices are transparent, lawful, and designed to protect our customers.”

When Sir Tim Berners-Lee first came up with the idea for the World Wide Web back in 1989, his vision for it could be likened to a digital Library of Alexandria, with all human knowledge centralized, a cooperative attitude, and most of all, free. Fast-forward about 37 years, and while the Web did indeed bring the world together, it's fair to say that it didn't do so quite in the manner that Berners-Lee hoped for.

In an interview with the Guardian, Berners-Lee discusses where exactly things went wrong, and how they can perhaps be fixed in what he describes as "a battle for the soul of the web," noting that "it's not too late." The Web had a fairly peaceful early start without ads, heavy commercialization, and cleanly served the purposes of information and some entertainment, but started shifting around the late '90s with the dot-com boom and "charlatans", in Berners-Lee's view.

It wasn't until the polarization of the 2016 U.S. election that he had enough with the Web's toxicity, something that reportedly left him "devastated." He acknowledges that social media does not represent the entire web, but that "the problem is that people spend a lot of time on [social media websites] because they’re addictive," having later described them as "optimized for nastiness".

Interestingly, Berners-Lee notes that while early viewpoints on the internet were neutral and moral judgments were about how people used it, nowadays "the way you design a website, like Reddit or Pinterest or Snapchat, can be explicitly good," with the opposite, as now proven, equally possible.

He's since created and is promoting the Solid project, that can very broadly be described as a user-controlled, decentralized API for personal data sharing, accessed via standard web protocols. Users create their own "pods" where all their personal info lies, along with everything they publish online, and data collected about them. They can then choose to grant entities specific control over what data is accessed.

Berners-Lee believes this can bring sovereignty of personal data back in people's hands, and even went as far as raising $30 million for Inrupt, a company with a mission to "provide commercial energy and an ecosystem to help protect the integrity and quality of the new web built on Solid". Notably, though, there's nothing forcing the current web's gatekeepers like Google and Meta to use the Solid protocol — much less to copy any data they may be granted access to.

Still, he think that "the existing systems will fade to a certain extent, because people will get more excited in new systems." In this case, he's referring to developers engaging with the Solid project, who "they start coding just because of what they can imagine."

You can click through to the Guardian to read the entire interview and read Berners-Lee's thoughts on social media ban laws, the AI takeover, and other topics.

An anonymous blog claims that the Steam client continues to broadcast your log-on and log-off times, even if you set your status as “Invisible” or “Offline.” According to the Xmrcat blog, “Setting yourself to ‘Offline’ is basically a UI illusion. You might appear offline to the world, but the backend Connection Manager (CM) continues broadcasting your live activity to the socket. This leak bypasses everything, even ‘Private Profile’ settings. It essentially hands your friends a real-time log of exactly when you sleep and wake up, making your privacy settings effectively useless.”

According to the report, the Steam client apparently broadcasts raw Unix timestamps to all the friends you added on the platform every time your status changes, even if you turned on your privacy settings to hide your information. The only difference with going “Invisible” or “Offline” is that the client on your friends’ PCs and devices will put your profile under the “Offline” list, so they cannot see you, but the client still knows when you last logged in or out.

This might not be an issue for the average user, but those who know their way around programming and development could potentially extract the information from Steam’s backend. It’s possible to intercept the ClientPersonaStaste protobuf message payload, which will potentially reveal your sleep cycle or gaming habits, allowing someone else to track your behavior without your knowledge.

The anonymous user said that they raised the issue, only to be brushed off by the company. “I sent this to Valve on HackerOne,” wrote Xmrcat. “I showed them how I could reconstruct a target’s daily sleep cycles despite them being ‘invisible’ for weeks.” Unfortunately, the ticket was closed as “Informative,” and they were told that the packets are only sent to your friends on Steam, so they’re presuming a pre-existing relationship of trust between the two parties.

However, many people add people they do not personally know on Steam as friends, which means this issue could concern some users.

It's a reasonably open industry secret that a great deal of home cameras, especially those from more affordable brands, are riddled with security holes and/or are suspect of leaking video to interested third parties like government agencies. Resideo is the latest smart home product company caught in the sights of U.S. law, more specifically by Nebraska Attorney General Mike Hilgers.

Hilgers is filing a lawsuit in the Nebraska state court, claiming that Resideo has broken the Nebraska Consumer Protection Act and the Uniform Deceptive Trade Practices Art. The company is accused of selling wares that are known to be insecure to unsuspecting consumers, and obscuring the OEMs for its cameras.

Resideo, a Honeywell spin-off with a market cap over $5 billion, apparently failed to properly disclose that the OEMs for its cameras are or were Hikvision and Dahua. The two Chinese companies are in several U.S. government restrictions, chiefly among them a ban by the FCC since November 2022 over concern of threats to national security. The lawsuit clams that Resideo sold Hikvision/Dahua cameras at least from 2021 to 2022 under its Capture brand, obscuring their origin.

Aside from governmental concerns, equipment from both brands has been under the scrutiny of security professionals for the better part of a decade, both for plain security issues and for intentional backdoors for remote access.

This latest lawsuit joins the ever-growing list of similar legal action against sellers of Chinese smart devices. In September, Hilgers himself sued Lorex, another camera maker that sells its gear in Costco and Best Buy, for similar reasons. Lorex reportedly sold its cameras as "private by design," once again forgetting to mention that the OEM for the cameras is sanctioned by the U.S.

The story isn't much different in other states. Over in Texas, Attorney General Ken Paxton is suing Sony, LG, Samsung, TCL, and HiSense over the firms' data collection practices with automated TV screenshot collection. And in Arizona, its AG Kris Mayes filed a lawsuit against Temu over data collection, privacy, and counterfeiting concerns. DJI drones just got an official ban from the FCC, as well. Given how prevalent Chinese OEMs are in everyday household electronics, this tale is probably just getting started.

An engineer got curious about how his iLife A11 smart vacuum worked and monitored the network traffic coming from the device. That’s when he noticed it was constantly sending logs and telemetry data to the manufacturer — something he hadn't consented to. The user, Harishankar, decided to block the telemetry servers' IP addresses on his network, while keeping the firmware and OTA servers open. While his smart gadget worked for a while, it just refused to turn on soon after. After a lengthy investigation, he discovered that a remote kill command had been issued to his device.

He sent it to the service center multiple times, wherein the technicians would turn it on and see nothing wrong with the vacuum. When they returned it to him, it would work for a few days and then fail to boot again. After several rounds of back-and-forth, the service center probably got tired and just stopped accepting it, saying it was out of warranty. Because of this, he decided to disassemble the thing to determine what killed it and to see if he could get it working again.

Since the A11 was a smart device, it had an AllWinner A33 SoC with a TinaLinux operating system, plus a GD32F103 microcontroller to manage its plethora of sensors, including Lidar, gyroscopes, and encoders. He created PCB connectors and wrote Python scripts to control them with a computer, presumably to test each piece individually and identify what went wrong. From there, he built a Raspberry Pi joystick to manually drive the vacuum, proving that there was nothing wrong with the hardware.

From this, he looked at its software and operating system, and that’s where he discovered the dark truth: his smart vacuum was a security nightmare and a black hole for his personal data. First of all, it's Android Debug Bridge, which gives him full root access to the vacuum, wasn't protected by any kind of password or encryption. The manufacturer added a makeshift security protocol by omitting a crucial file, which caused it to disconnect soon after booting, but Harishankar easily bypassed it. He then discovered that it used Google Cartographer to build a live 3D map of his home.

This isn’t unusual, by far. After all, it’s a smart vacuum, and it needs that data to navigate around his home. However, the concerning thing is that it was sending off all this data to the manufacturer’s server. It makes sense for the device to send this data to the manufacturer, as its onboard SoC is nowhere near powerful enough to process all that data. However, it seems that iLife did not clear this with its customers. Furthermore, the engineer made one disturbing discovery — deep in the logs of his non-functioning smart vacuum, he found a command with a timestamp that matched exactly the time the gadget stopped working. This was clearly a kill command, and after he reversed it and rebooted the appliance, it roared back to life.

So, why did the A11 work at the service center but refuse to run in his home? The technicians would reset the firmware on the smart vacuum, thus removing the kill code, and then connect it to an open network, making it run normally. But once it connected again to the network that had its telemetry servers blocked, it was bricked remotely because it couldn’t communicate with the manufacturer’s servers. Since he blocked the appliance’s data collection capabilities, its maker decided to just kill it altogether. "Someone—or something—had remotely issued a kill command,” says Harishankar. “Whether it was intentional punishment or automated enforcement of 'compliance,' the result was the same: a consumer device had turned on its owner.”

Unfortunately, many other smart vacuum brands use similar hardware, so it’s not far-fetched to think that they have the same setup. This is likely especially true for cheaper devices that have less capable hardware and aren’t capable of edge computing, meaning they’ll have to send the data to some faraway server for processing. But because your information is being offboarded to another device outside of your control, you really have no idea what’s happening to it, giving the manufacturer free rein to use it as it pleases.

In the end, the owner was able to run his vacuum fully locally without manufacturer control after all the tweaks he made. This helped him retake control of his data and make use of his $300 software-bricked smart device on his own terms. As for the rest of us who don’t have the technical knowledge and time to follow his accomplishments, his advice is to “Never use your primary WiFi network for IoT devices” and to “Treat them as strangers in your home.”

Microsoft’s Gaming Copilot feature recently hit Windows 11 as a public beta, with the company adding the feature to the operating system’s built-in Xbox Game Bar. However, one user complained on ResetEra forums, stating that their system’s network traffic showed the AI feature sending information about their actions to Microsoft’s servers, including private details on their screen. That set off a flurry of media coverage. We reached out to Microsoft for further details and the company sent over an official comment.

The controversy began with a forum post. “This installed automatically on my PC, and watching the network traffic, I realised (sic) it was automatically sending everything I was doing to Microsoft (including an NDA’d game I’m playing,” user RedbullCola said in the forums. “I checked the settings, and by default, it’s set to train on text seen on the screen — it screenshots everything, and OCRs text from in-game and sends it to MS. MS then uses what you’re doing to train their AI models.”

Tom’s Hardware reached out to Microsoft directly about the issue. “When you’re actively using Gaming Copilot in Game Bar, it can use screenshots of your gameplay to get a better understanding of what’s happening in your game and provide you with more helpful responses. These screenshots are not used to train AI models, and Gaming Copilot is an optional feature that only has access to gameplay when you’re playing a game and actively using it,” the representative said to Tom's Hardware.

“Separately, Gaming Copilot may use its text or voice conversations with players to help train and improve AI. Players can adjust Gaming Copilot’s privacy settings by visiting ‘Settings’ in [the] Game Bar, followed by ‘Privacy Settings," the statement concluded.

At the moment, it’s unclear if Gaming Copilot sends the screenshot data to an external server or limits it to the system’s built-in NPU, and we've sent follow-up questions to Microsoft.

Xbox Support does not list the required specifications to run the feature, but the company says it will “begin rolling to players aged 18 and older on PC Game Bar today.” We can assume it would work even on devices that aren’t Copilot+ certified (i.e., those without built-in NPUs). We even tested it on one of our staff members’ old gaming PC with a non-AI processor (who’s also enrolled in the Xbox Insider Program), and he confirmed that he has access to Gaming Copilot. The ‘Model training on text’ toggle does not provide clear information about the type of text it captures.

You do not have to turn on Gaming Copilot if you don’t want to use it, though. The company says that it only takes screenshots when you’re actively using it, and you can also turn off the AI training feature in the settings. Unfortunately, if you really don’t like it, there’s no easy way to uninstall it as it’s built into the Game Bar. You’ll have to remove the Xbox Game Bar if you really want it out of your system, but you’ll have to muck around in PowerShell with administrator privileges if you really want to go down that route.

Researchers at the Georgia Institute of Technology have identified several design flaws in Tile's location trackers that could be exploited to stalk the device's owner.

Wired reported that Georgia Tech's Akshaya Kumar, Anna Raymaker, and Michael Specter discovered problems affecting both individual Tile devices and the methods those devices use to communicate with infrastructure managed by Tile owner Life360.

The trio "found that each tag broadcasts an unencrypted MAC address and unique ID that can be picked up by other Bluetooth devices or radio-frequency antennas in a tag's vicinity to track the movements of the tag and its owner," Wired reported.

Gathering that information is trivial and common. The New York Times reported in 2019 that retailers were using Bluetooth beacons to track people's movement through their stores, for example, and so-called "sniffers" are readily available to individuals. Such devices are even somewhat common in smart-home setups.

Those methods of collecting data about location trackers would also circumvent the safeguards Tile added to its devices in 2023. Those protections, which the company introduced after several high-profile incidents of location trackers being used by thieves, stalkers, and other criminals, apply only to the misuse of its products.

But that isn't what's happening here. Those safeguards are supposed to make it more difficult for a Tile owner to stalk someone by slipping a tracker into their bag, for example. However, those same safeguards cannot determine if the Tile is communicating with a seemingly innocuous Bluetooth device while it's still in the owner's possession.

That wasn't the only issue. Wired reported "the location of a tag, its MAC address, and unique ID also get sent unencrypted to Tile's servers, where the researchers believe this information is stored in cleartext, giving Tile the ability to track the location of tags and their owners, even though the company claims it does not have this capability."

The problem, of course, is the difference between claiming not to currently have this capability and ensuring that this capability won't be developed later. Encrypting this data wouldn't just protect it now; it would also ensure that historical data can't be misused by Life360, cybercriminals, or even government agencies in the future.

A software engineer named Riley Walz has built a website that scrapes the data from the City of San Francisco website, allowing him to track issued parking tickets in real-time and the location where the officers wrote them. The information is readily available on the Find My Parking Cops web app, and uses an interface similar to Apple’s Find My app, making it quick and easy to use.

Overlaid on a top-down view of San Francisco, you get a list of active officers at the moment, plus a leaderboard showing the total value of the tickets a particular officer has issued for the current week. Walz shared his creation on X — A few hours later, the City took down the website date, briefly rendering his creation useless. Nevertheless, he was able to create a workaround, restoring the functionality of the tracking site, at least for now.

According to Walz, he was inspired to create the page after his roommate received a parking ticket. The website where you pay the penalty also shows a full copy of the citation, as long as you have its number. When you input the correct information, you’ll see all the details related to the parking offence, including the make, color, and license plate of the offending vehicle, the reason for the ticket, and the issuing officer’s initials.

One other roadblock that he encountered was the ticket number — at the moment, the system lists nearly a billion tickets, but he thinks that this is nowhere near the real number of parking violations in San Francisco. When he added one to the ticket that his friend had, the San Francisco website returned an error. But after some more experimentation and digging around, he discovered the tickets were numbered by increments of 11, except for when the last digit is 6, by which you add 4 to get the next ticket number. This pattern allowed him to predict the next parking citation to be issued, making for easier tracking. He was also able to figure out the claim ID, allowing him to pull out all the details of the ticket.

Armed with this information, he created a scraper that copied and stored all the parking tickets as soon as they were created. They then used a borrowed Apple Maps API key to put the data on a map, allowing anyone to see the locations, the number of tickets, as well as the total fines a particular parking cop has issued during their shift. Naturally, this information could be used to avoid parking fines, a benefit Walz himself touts, with users able to see a rough spread of where parking cops might be issuing tickets at any given time.

While not exactly illegal, this shows how easy it can be to gather data from the internet if you know what you’re doing. However, it can also raise some privacy issues, especially since the parking tickets often have personal data on them. The City of San Francisco definitely needs to secure its parking ticket system, but it also needs to ensure that citizens can retain easy access to the payment portal to settle their violations. In the meantime, this map is available for anyone to see, that is, until San Francisco fixes their system and makes it just a little bit more secure.

The plague of cookie consent alerts, banners, and pop-ups that have added a sliver of sandpaper to web surfing since 2009 might be eradicated in December. The European Commission (EC) intends to revise a law called the e-Privacy Directive, reports Politico. Specifically, new guidelines from the European Data Protection Board (EDPB) aim to eliminate manipulative consent banners and reduce consent fatigue.

Cookies are a necessary part of the World Wide Web, which seasoned surfers will have first become aware of in troubleshooting – fixing issues by clearing cookies and so on. However, after the e-Privacy Directive came into force in the late noughties, cookies soon became a source of persistent irritation. The directive required website holders to get consent from visitors unless the cookies were strictly necessary.

Now, in 2025, and if you refresh your browser or buy a new computer/device, you’ll face days and days of cookie clickspamageddon to return to smooth surfing on your familiar sites. We know there are browser extensions designed to ignore cookies, but they can have their own trade-offs with privacy, and/or compatibility wrinkles.

Politico shares a quote from Peter Craddock, a data lawyer with Keller and Heckman, which highlights the problem with the current state of cookie consent regulations. “Too much consent basically kills consent,” remarked Craddock. “People are used to giving consent for everything, so they might stop reading things in as much detail, and if consent is the default for everything, it’s no longer perceived in the same way by users.”

The momentum behind the eradication of cookie consent spam has built steadily this year:

• In May, Denmark suggested the dropping of consent banners for cookies that collected data for technically necessary functions or simple statistics purposes.
• On September 15, a note was sent to tech industry players about how the EC is considering changing cookie consent rules to allow for more exceptions.
• On September 22, there was a meeting between the EC and tech industry representatives to discuss cookies and consent banners.
• In December, officials want to present a rewritten directive “scrapping burdensome requirements on digital companies,” says Politico.

Windows 11 24H2 Preview Build 26120.3281 is now available on the Dev and Beta channels, and one of its biggest changes is the removal of Recent, Favorites, and Recommended content, alongside the Details Pane, in File Explorer. According to The Register, the Redmond software giant made this move to comply with the EU’s General Data Protection Regulation (GDPR) regulations, as these four features require account-based content.

Note that this move will only affect Entra ID (i.e., corporate) users in the European Economic Area, so you probably won’t have to explain to your mom why her Favorites folder is missing. While these shortcuts are quite useful in simplifying workflows, they could also reveal sensitive user data. So, Microsoft had to deprecate these features, at least in Europe, to comply with the GDPR.

Aside from this, the company is also removing the Location History API from this update, meaning your device’s location data will no longer be stored on it. This will also remove Location from Settings > Privacy & security, so you no longer have to worry about your PC keeping notes on the places where it’s been. The API was previously used by Cortana to determine your device’s location, but it’s no longer needed after the company the discontinuation of the assistant and its replacement by Copilot. However, even if the operating system no longer saves your location locally, Microsoft has yet to confirm if it saves your location data online.

These updates are still on the Dev and Beta channels, so the average Windows user should not expect to see the changes arrive soon. Furthermore, seeing these changes in Preview Releases does not mean that they will even make it to general release — there’s still a chance that Microsoft might find use for the Location API, or its users might complain about the missing File Explorer features.

We just hope that the changes that it’s making to Windows 11 will not introduce new problems for users. After all, Microsoft has a history of problematic updates, like a security update that broke the sound output of PCs using external DACs, and the latest one breaking the File Explorer app and preventing users from accessing their files and folders.

DeepSeek’s newest R1 large language model has already become notorious after its release cratered AI stocks, and revelations about its privacy policy might raise eyebrows even more — the company records extensive data from its online users, including keystrokes, passwords, and data entered in queries like images and text, and then stores it in China-based servers. 

Personal information, including date of birth, email addresses, phone numbers, and passwords, are all fair game, according to DeepSeek. Any content users give to the R1 LLM, from text and audio prompts to uploaded files, may also be collected by DeepSeek. And whenever someone contacts DeepSeek, it says it might keep users’ proof of identity, which presumably means documents like a driver’s license.

But that’s not all. DeepSeek records anything related to users’ hardware: IP addresses, phone models, language, etc. Its collection efforts are so thorough that the company notes “keystroke patterns or rhythms.” Cookies, a classic method of tracking users on the Internet, also contribute to user data collection.

Because R1 is 'open source,' it can be run anywhere on any hardware, which is generally good for privacy — running the model locally on your own hardware will presumably not lead to data collection. However, DeepSeek offers online access to R1 via its website and mobile app, which means the AI company handles and stores online users' data. Thankfully, DeepSeek is very transparent about what data it collects from online users, where it’s stored, and what it does with it. It details it all in its privacy policy webpage, which reveals that there’s almost nothing the company doesn’t collect.

While it’s common practice for companies with lots of user data to sell that data to interested companies such as advertising firms, something that DeepSeek says it might do, it also admits that “advertisers, measurement, and other partners share information with us about you and the actions you have taken outside of the Service, such as your activities on other websites and apps or in stores, including the products or services you purchased, online or in person.” With all this information at its disposal, it seems that DeepSeek has the potential to know its users very intimately.

DeepSeek’s “corporate group” also has access to the data it collects to provide “certain functions, such as storage, content delivery, security, research and development, analytics, customer and technical support, and content moderation.”

As for where all this information is stored, the privacy policy says it’s all kept inside servers located in China, a point that has the potential to spark serious controversy. Concerns about the personal details of Americans being in the hands of the Chinese government was a key factor in the Biden administration’s attempt to ban TikTok, raising the possibility that DeepSeek might come under similar scrutiny.

Of course, former President Biden tried to reverse the TikTok ban in his final days, and President Trump delayed the app’s fate almost as soon as he was sworn in for his second term. Thus, DeepSeek might also be shown some mercy under the right circumstances.

On the other hand, President Trump’s allies include Meta’s Mark Zuckerberg and OpenAI’s Sam Altman, and both of them are probably not very happy to see the R1 LLM run circles around their LLMs. Additionally, it’s hard to imagine that DeepSeek has made a good impression on the Republican President by inadvertently causing the stock prices of many American tech companies to fall significantly.

Developed by Chinese AI company DeepSeek, R1 is an open-source LLM that boasts cutting-edge performance at a fraction of the computing power. With 671 billion parameters, it’s one of the most significant AI models and only took 2.8 million GPU hours to train. Meta’s Llama 3 required 30.8 million GPU hours, or 11 times more.

DeepSeek boasted about these accomplishments over a month ago, but R1 launched on January 20, and the implications were fully appreciated by the stock market only yesterday. The market reacted by selling shares in AI companies like Nvidia. While the spotlight on DeepSeek has raised its profile, many have also reviewed how it handles user privacy, a particularly thorny issue for anything involving AI and software developed in China. 

Google has updated the disclaimer shown when users switch into Incognito Mode in its Chrome browser. MSPowerUser noticed a new and revised disclaimer in the latest Chrome Canary development build. The source site reckons this is the first reaction – in software – to the $5 billion settlement Google agreed to pay out to aggrieved plaintiffs who discovered the company still tracked them when switching to this ‘invisible’ mode.

The agreement by Google to settle this Chrome class action was inked just ahead of the New Year. That’s quite a long time, considering the lawsuit was filed in 2020, but of course, Google tried to wriggle off the hook as best it could. Its best argument was that its Incognito Mode disclaimer saying “downloads, bookmarks, and reading list items will be saved,” meant that users consented to some data collection. However, the judge disagreed that users would understand that from the existing disclaimer.

With the case behind it, it was inevitable that Google would need to be more explicit in its intentions regarding data collection in Chrome’s Incognito Mode, and therefore, we are now seeing the new wording in test versions of the software.

Above you can compare and contrast the Chrome browser Incognito Mode disclaimer in its before and after revisions. The new version makes it more obvious that Chrome Incognito Mode isn’t very private at all. It merely shields your Secret Santa purchases (etc.) from others using the same device – not from all the third-party digital eyeballs a browser has to cope with in 2024, and definitely not from Google.

The most significant changes are from: “Now you can browse privately” to “You can browse more privately.” Also, Google now makes it explicit that switching to Incognito Mode “won’t change how data is collected by websites you visit and the services they use, including Google.”

The changes to the Google Chrome Incognito Mode disclaimer are reportedly live in Canary builds across Windows, Android, and other platforms.

Google’s ugly pill

Google Chrome’s browser market share might look unassailable as we gain a march into 2024. However, Google and its signature browser have recently been hit for alleged anticompetitive behavior in the browser wars, thus abusing its dominant position. More recently, our Tom’s Hardware Editor-in-Chief revealed that he hates the newest Material You interface design for Chrome, which he called ugly and annoying. Luckily, there is a remedy for the Chrome Refresh 2023 ugly pill, which is relatively easy to implement if you follow that link.

A research team with the University of California, Berkeley, reconstructed Pink Floyd's iconic song "Another Brick in the Wall, Part 1" purely by decoding a listener's brainwaves. Led by Dr. Robert Knight et al. and published in the journal PLOS Biology, the feat showcases how good humanity has become at decoding information that should be the last bulwark of privacy. In the future, someone with access to this technology wouldn't even have to pay the proverbial penny for your thoughts: they'll just be able to read them as well as one of those NYU ad walls.

The research, which took place between 2012 and 2013, strapped the brains of 29 epilepsy-suffering patients to electrodes (unlike other approaches, these had to be directly connected to the patient's brain, meaning invasive surgery was required). The electrodes then captured the electrical activity of brain regions specifically responsible for music processing - areas that focus on pattern recognition and processing of tone, rhythm, harmony, and words.

The researchers then played a 3-minute clip from the original song, and the EEG proved to be accurate enough that they could decode the contents of the patients' brainwaves - and successfully reconstruct the song from the brain activity's electrical "echoes." They even got part of the reconstructed song - 22 seconds -  in a sound clip.

Brain-Computer Interfaces (BCI) are one of the most promising research areas for the bodily impaired (with specific applications even for the brain-function impaired segment of the population). But any great advancement presents itself as a double-edged sword. As Orwell's increasingly-relevant 1984 novel shows, Thinkpol (Newspeak for Thought Police) is one area that any authoritarian regime (or person, or company) would love to explore.

There's also the risk to the fabric of society. Interpersonal relationships happen in the space that lies between the thoughts we have in private ("Jesus, mom, I hate you for making me eat spinach") and those we choose to release onto the real world ("But mom, I had spinach yesterday!"). But when the frontier between private and public is blurred, it becomes difficult to understand precisely where chips might ultimately fall - and who might be most negatively impacted.

It's one thing to be able to reconstruct the outside world (and its stimuli) from a person's brainwaves, but it's also a typical truth that research tends to trickle down towards the consumer space (let alone the private and governmental branches of society). While it isn't in the same league as the research covered in this article, even gamers have taken advantage of brain waves to control their in-game characters. Just look at what Twitter user @perrykaryal managed to do on From Software's Elden Ring with a "simple" electroencephalogram machine (EEG). I couldn't beat Godrick with my thumbs; she managed to do it by just thinking about it.

The fact that these experiments required physical contact and invasive surgery precludes most of the "bad actor" threats that could emerge from it. But there shouldn't be any doubt that, given enough time, techniques that don't require much physical availability will be developed.

I, for one, would love to be able to simply think articles into existence. But questions must be asked whether the benefits of such a technology being generalized outweigh the risks. Then again, most of us are lucky not to have to deal with life-limiting illnesses such as the epilepsy patients that took voluntary part in the study - it's almost guaranteed they'd have a different outlook on all of this.

Members of European Parliament (MEPs) have approved their negotiating position on what’s been dubbed the Artificial Intelligence (AI) Act. This proposed set of regulations will determine how AI applications will be classified and what sort of activity would no longer be considered permissible.

According to the official press release regarding the matter, the new regulations are intended to help ensure the future of AI proceeds in accordance with EU rights. Areas of concern include safety, transparency, privacy and human oversight. The MEPs also aim to address social, environmental and discriminatory affairs with the new regulation.

MEPs provided a clear list of AI use cases that would be outright banned, including creating facial recognition databases by scraping images from CCTV footage or sources online. They also confirmed that biometric categorization systems using factors like gender and race would be prohibited. Other areas, like using AI to influence election outcomes, wouldn’t be banned but considered high risk. A complete list of the proposed categorizations is available in the press release.

In addition to banning practices, there are requirements for developers to follow to ensure their AI systems are developed in accordance with the new regulations. Foundation models must be registered before they can be released on the market. Generative AI applications, including ChatGPT, would need to disclose when content is AI-generated and have safeguards in place to prevent generating illegal material.

There are some exemptions in place for both developers and law enforcement. The MEPs also want to reform citizens’ ability to report their concerns to governing bodies should an AI system potentially violate one of the aforementioned rights. The negotiating position was voted on earlier today, with 499 voting in favor of the new regulations. Twenty-eight votes were against the reform and 93 abstentions were counted. You can read more about the proposed legislation on the European Parliament website before it moves forward.

Microsoft today announced the rollout of its latest update package for Windows 11 2H23. Dubbed the Moment 3 update, Microsoft says it packed in a number of quality-of-life and feature improvements to several areas within Windows, including security support via Microsoft's Pluton, networking, privacy, and audio processing. The Moment 3 build is available now, and is currently being rolled out to users via May 24th's optional preview update for Windows 11 22H2.

Most of Moment 3's updates seem to center or conveying more at-a-glance information to users. For example, the update introduces a glanceable VPN (Virtual Private Network) feature — essentially, Microsoft is adding a shield icon atop the user's active network connection (which is viewable in the taskbar by default). No shield means you're exposing certain identifiable elements from your system to the Internet. A widget overhaul will also provide a larger layout for user-pinned apps, add the option of displaying a personalized feed for easy access to news, as well as access to the users' pinned widget. Additionally, the Start menu will now show badge notifications when your account requires attention for some reason or another.

Security is meant to be improved too, with Microsoft further integrating cloud security features with its Pluton Security Processor. For the more cautious minded, new app privacy settings will also allow users to manage access to presence sensor information and adjust features such as 'wake on approach' and 'lock on leave.'

Perhaps the most intriguing bit with the Moment 3 update is that consumers will now have the option to isolate Win32 applications. Essentially, this means that any x32 app can be made to run on its own virtualized bubble, separate from your Operating System. Threats of any sort have trouble crossing those borders.

As to accessibility, Microsoft is making a big push with its Live Captions feature (a system-level feature that enables the display of subtitles of any video or call content that's being played). In all, Microsoft is adding support for 10 additional languages and offering the service in 21 extra regions. Starting with the June 2023 feature drop update, the Live Captions experience expands to Chinese (Simplified and Traditional), French (France, Canada), German, Italian, Japanese, Portuguese (Brazil, Portugal), Spanish, Danish, English (Ireland, other English dialects), and Korean.

The Moment 3 changes will be turned off by default; it's up to users to enable them via a toggle in Windows Update settings. These features will then be enabled by default in June's optional update and in July's mandatory Patch Tuesday updates.

Last but not least, native RAR support is finally being added to Windows. At the Microsoft Build developer conference the company announced that RAR support will be enabled in an upcoming update, along with other features such as native RGB lighting control. Microsoft says it will not only handle RAR files, but additional archive formats such as tar, 7-zip, GZ, and others, through the libarchive open-source project. 

We were hoping this feature would drop in the Moment 3 update, but that unfortunately doesn't seem to be the case. WinRAR lives on... for now. 

According to a report published by the Wall Street Journal (WSJ), Apple has implemented restrictions regarding how its employees use AI tools such as ChatGPT — not all that surprising given the Cupertino tech company is famously wary of leaks. The report from the WSJ suggests Apple’s employees won’t be disadvantaged by the lack of AI assistance forever, because Apple is busy creating “its own similar technology.” The report is based on an internal Apple document that appeared to back up these claims, as well as anonymous sources "familiar with the matter."

One of the issues with the use of AI based on large language models (LLMs) is that the tools usually use their interaction — inputs, questions, etc. — as training data. Samsung ran into this kind of problem back in April, when proprietary data was leaked from ChatGPT usage. The South Korean tech giant's fab engineers were using ChatGPT assistance for coding, note-taking, and data analysis about fab performance and yields, and three instances of data leaks were traced back to ChatGPT usage. 

ChatGPT isn’t only prone to leaking other users’ data through training — like all software, it also has vulnerabilities and bugs. Earlier in the week we saw its vulnerability to prompt injection via YouTube transcripts. In March, ChatGPT was taken offline for a short period after it was discovered some of its users could see the titles of other user chat histories.

After the growth in reports concerning data security, OpenAI has introduced new privacy controls as well as an ‘Incognito mode’ for AI assistance on sensitive documents. Perhaps, these steps haven’t gone far enough for Apple. Another AI tool mentioned specifically in the WSJ report is GitHub’s Copilot (Microsoft), which is used by developers to save time with its smart code autocomplete functionality.

Not a lot is known about Apple’s progress on its own alleged LLM AI. The firm has snapped up a variety of AI related companies over recent years, and hired people such as John Giannandrea, an exec who used to work with Google's search and AI teams. Microsoft and Google are firing on all cylinders in the AI race, and are even pitching their AI-driven apps and widgets into Apple’s iOS store, so Apple can't be too patient with its own solution.

Apple’s developer conference, the WWDC23, kicks off on June 23, so perhaps it will have some AI news for us soon. There may be an AI-enhanced Siri announced, as well as highly anticipated Reality Pro AR/VR headset, new Macs, and new desktop, mobile, and wearable operating systems.

Razer debuted its first webcam, the Razer Kiyo, in 2017, and followed it up with the Razer Kiyo Pro in 2021. And now, in 2023, Razer’s back with the newest iteration of its gamer-slash-streamer-oriented webcams: the Razer Kiyo Pro Ultra. (Let’s hope Razer comes up with a new product line name for the next one, and doesn’t call it the Razer Kiyo Pro Ultra Max, or something like that.)

The Kiyo Pro Ultra is Razer’s first 4K webcam, streaming in 4K/30fps (as well as 1440p/30fps, 1080p/60/30/24fps, and 720p/60/30fps), and it features the largest sensor ever put in webcam — a 1/1.2-inch Sony Starvis 2 sensor with a wide f1.7 aperture that allows for the artsy shallow depth of field you get with a DSLR where the subject is sharp and in focus but the background is blurred. (You can also do this with the “background blur” effect in various video conferencing apps, but... you shouldn’t.) It also has 4x digital zoom, an adjustable field of view of between 72 and 82 degrees, and an innovative integrated physical privacy shutter (as well as a separate lens cap to protect the glass from dust and scratches). 

There’s no question this is one of the best webcams we’ve tested, and it’s priced to match: the Kiyo Pro Ultra costs $299.99 (available exclusively at Razer.com), which is $100 more than the Kiyo Pro but in line with other premium 4K webcams such as the Insta360 Link and the Elgato Facecam Pro.  

Design of the Razer Kiyo Pro Ultra

The Razer Kiyo Pro Ultra has the same overall design as its predecessor, the Kiyo Pro — large, round, and all lens (well, all glass, at least). It looks a little like a detached camera lens, complete with a movable “focus ring” that twists to open and close the webcam’s new iris-like privacy shutter. The webcam’s properties are listed around the lens in white, and Razer’s logo is subtly embossed under the glass. A white LED indicator light at the top of the webcam tells you when it’s being used. 

 The Kiyo Pro Ultra has the same dimensions as the Kiyo Pro, measuring approximately 3.01 inches (76.5mm) in diameter and 2.36 inches (60mm) deep (not including the mount). Although it’s large, it’s not overly heavy — the webcam weighs 6.28 ounces (178g), and the mount adds another 5.61 ounces (159g). The Kiyo Pro Ultra is smaller and lighter than the Elgato Facecam Pro (4.6 x 3.1 x 1.5 inches / 116 x 79 x 38mm; 8.47oz / 240g), but is still quite a bit larger than the Insta360 Link (2.71 x 1.61 x 1.77 inches / 69 x 41 x 45mm, 3.73oz / 106g). 

The Kiyo Pro Ultra comes with an L-shaped, clamp-style monitor mount (already attached), a lens cover, and a 5-foot, braided USB-C to USB-C cable. The USB-C cable is a little stiff — a webcam cable doesn’t need to be as malleable as does a mouse cable, but positioning the webcam would have been a little easier with a more flexible cable (I ended up using one of Razer’s “Speedflex” mouse cables, for convenience).

The Kiyo Pro Ultra doesn’t necessarily need to be plugged into any specific USB port on your PC, but Razer does recommend plugging it directly into a USB 3.0 port for the best performance. The webcam still worked for me when plugged into other ports, but I did see some stuttering in higher-res video (both in preview mode and while streaming).

The monitor mount screws into the webcam’s universal tripod mounting point, and features rubberized, non-slip material for extra stability and grip when it’s sitting atop your monitor. Once attached, the mount allows the webcam to tilt a few degrees upward and 90 degrees downward. 

There’s no built-in swivel, but the screw mount makes it relatively easy to turn the webcam as needed. The webcam sits at the front of the mount, so the overall depth of the webcam and mount together is approximately 3.68 inches (93.5mm). The mount also has a universal tripod mounting point, in case you want to put the webcam on a tripod without removing the mount.

The Kiyo Pro Ultra comes with a soft, rubbery physical lens cap, as well as an internal privacy shutter that’s cleverly designed to mimic an iris. Twisting the webcam’s outer ring to the left closes the privacy shutter, while twisting it to the right opens it. I love this implementation: it’s smooth and easy to operate, and I was able to open and close the shutter without knocking the webcam off my monitor or even mildly displacing it.

For those of you keeping track, this webcam has not one but two physically-operated privacy controls, while other impressive 4K webcams such as the Insta360 Link and the Elgato Facecam Pro have none. Also — closing the privacy shutter does not turn off the camera.

Razer Kiyo Pro Ultra Specifications

Well-lit Performance of the Kiyo Pro Ultra

The Kiyo Pro Ultra is a 4K webcam with an extra-large, 1/1.2-inch image sensor with a f1.7 aperture, 4x digital zoom, and an adjustable field of view of between 72 and 82 degrees. It can stream video at 4K/30fps, 1440p/30fps, 1080p/60/30/24fps, and 720p/60/30fps.

I take all my webcam test photos in my home office, which is a very controlled setting as it gets almost no natural light. For my well-lit test scenario, I have a ring light, key light, and four desktop monitors (three 27” and one 34”) in front of me, and a desktop lamp and an arching floor lamp behind me. The ring light is set to 35% brightness at 3600K, and the key light is set to 15% brightness at 4100K. There’s also some ambient RGB lighting from my desk, desktop, and various peripherals. For consistency, I take all photos using Windows 11’s built-in camera app.

The Kiyo Pro Ultra looks great with its default, out-of-the-box settings. It does an excellent job with auto-exposure and auto-color balance, even better than the Insta360 Link. 

It has a nice, shallow depth of field, which gives you that blurred background effect without the use of software. It does have an overly-sensitive autofocus, as many webcams do, but you can turn this off in Razer’s Synapse 3 software (though you may have to do this several times before it saves — more on that later).

The Kiyo Pro Ultra’s autofocus is overly-sensitive but relatively quick, and the webcam does a pretty good job of on-the-fly light metering for those who move around a lot. I went into Synapse 3 and played with the image settings, but nothing I did dramatically improved the picture — the default settings are very good.

Like other 4K webcams, the Kiyo Pro Ultra’s extremely high resolution is absolutely overkill for most users — the majority of video conferencing platforms, including Google Meet, Microsoft Teams, and Zoom, limit your outgoing video resolution to 1080p or 720p, and Twitch also limits your streaming output to 1080p/60fps.

Low-light Performance of the Kiyo Pro Ultra

To test the Kiyo Pro Ultra’s performance in a low-light scenario, I turned off all of my lights, as well as three of my four monitors, leaving just one monitor as a light source. I took this photo with the Windows 11 camera app taking up around half of my screen and my desktop wallpaper on the other half.

The Kiyo Pro Ultra performed well enough in this scenario. It did a very good job of evenly lighting both me and my background — it lit my background so well that I had to double-check to make sure there was no light leaking in from outside my office (there wasn’t). In fact, this scene is almost too well-lit and could probably use a little more contrast. 

Also, this kind of lighting boost doesn’t come without a price — there’s a lot of noise in the image, though there’s still plenty of detail. This photo was taken without any of the low-light processing effects toggled on, however, so I went ahead and turned on 2D and 3D noise processing:

As you can see, both images are still noticeably noisy, though less so over the subject (me), and the last image managed to do a better job of color balancing.

Overexposed Performance of the Kiyo Pro Ultra

To test how the Kiyo Pro Ultra performed in an overexposed lighting scenario, I turned off all of the lights in front of me as well as three of my four monitors. (This isn’t the most extreme overexposed lighting scenario, but it’s probably the most common overexposed scenario.) 

The Kiyo Pro Ultra didn’t do quite as well in this scenario, lighting my background but leaving me somewhat dark and grainy (and pink). The Insta360 Link and the Elgato Facecam Pro did better in this situation, but the difference isn’t too significant — none of them are great.

I turned on several of the webcam’s processing features, including HDR, low light compensation, and 2D and 3D dynamic noise reduction, and the picture was a little better and more subject-focused (though it seems the HDR managed to make the brightly-lit areas even brighter, somehow). The Insta360 Link produced a similar image with better color balancing after a reset, but with less graininess.

Microphone of the Kiyo Pro Ultra

The Kiyo Pro Ultra has a built-in omnidirectional microphone, which is... not the best. No built-in webcam mic has ever come close to the mics you’ll find on the best gaming headsets, let alone a standalone USB gaming microphone, and the mic on the Kiyo Pro Ultra was solidly average among webcam mics. It picked up my voice fairly well (albeit a little on the quiet side), and my voice sounded a little thin but not too echo-y. 

Unfortunately the omnidirectional nature of the mic means it also picked up everything else in the area — most notably, the sound of my PC fans (which are, admittedly, pretty loud). The mic isn’t bad, it’s just not particularly good, and I wouldn’t recommend using it if you don’t need to.

Features and Software of the Kiyo Pro Ultra

The Kiyo Pro Ultra is configurable through Razer’s Synapse 3 software, which as you may know by now is my favorite gaming peripheral software. Wait, did I say favorite? Sorry, I meant to say least favorite. Synapse 3 is the bane of my existence. Why is it never running when I’m trying to use it? Why does it update 17 times a week? I’m not kidding when I say that it feels like I’m getting punk’d with this software.

Anyway.

The good news is that Synapse 3 does offer some pretty detailed control over the webcam, letting you manually adjust focus, exposure, and image settings, as well as resolution and processing effects. The bad news is that you must be in Synapse 3 with the in-app preview open in order to change any of these settings (turning off the in-app preview locks all of the settings), and Windows only lets you use your webcam with one app at any time. Plus, while Synapse 3’s settings are supposed to save to the webcam when you hit “save,” they don’t... always manage to do that.

So, if you’re trying to set up an image in a program other than Synapse 3, and I assume you are, you will probably find yourself going back and forth between the two programs... constantly. And since Synapse 3’s settings only save to the webcam about half the time, this is, needless to say, a very frustrating experience.

There are three sections in the Kiyo Pro Ultra’s menu: camera, processing, and image. The camera section lets you control focus and exposure (and turn off auto-focus and auto-exposure), and lets you zoom, pan, and tilt to crop your scene. Once you’ve zoomed, panned, and tilted perfectly, you can save that setting to one of five presets, which can be tied to any shortcut key you choose.

In the processing section, you can set the Kiyo Pro Ultra’s preview resolution and MJPEG quality, as well as turn on HDR, lens distortion compensation, low light compensation, and 2D or 3D dynamic noise reduction. For the most part, these processing tweaks are pretty subtle (some are too subtle). Turning on HDR did improve the image slightly in lower lighting conditions, but it wasn’t able to tame overly bright areas (it has “dark room” and “bright room” options, but the difference between the two isn’t noticeable). 

The low light compensation also didn’t seem to do much, even as I moved between a light and dark room on camera. The dynamic noise reduction worked okay, but images were still noisy in darker settings.

The image section gives you manual control over brightness, contrast, saturation, and white balance (which can also be automatic), as well as anti-flicker adjustment. There’s a toggle for a watermark, in case you’re a Razer brand ambassador (or you just want everyone to know you’re using a $300 webcam), as well as a toggle to mirror your video stream, which you should never do, especially if you have words in the background or on your clothing (as you can see, my entire life is words). Razer does include a handful of image presets, but none of them are particularly good — in fact, the “cool” preset looked incredibly warm until I tried the “warm” preset, which made me look orange.

Synapse 3’s camera, processing, and image controls are actually pretty impressive and refined, and they fix most of the minor issues I had with the webcam’s performance (such as the trigger-happy auto-focus). But trying to get Synapse 3’s settings to save to the webcam and work in other programs is so frustrating — and all I was doing was taking photos for this review. I can’t imagine being a content creator and wanting to wrangle Synapse 3 every other time I try to hop on and stream or record.

Bottom Line

The Razer Kiyo Pro Ultra is one of the best webcams we’ve tested. It delivers incredible image quality straight out of the box, with a beautiful depth of field and excellent auto-exposure and white balancing. Razer wasn’t kidding when it said “DSLR-like quality.” Plus, it’s well-built, relatively lightweight, has a nicely integrated privacy shutter, and it looks cool perched atop your monitor.

That said, Razer really needs to do something about Synapse 3, because it is possibly the most frustrating piece of software I’ve ever had to deal with. The good news is that the webcam works very well out of the box, so if you’re just looking for a webcam that will make you look great in work calls and while you’re chatting with your friends, the Kiyo Pro Ultra is an excellent option (assuming you have $300 burning a hole in your pocket).

But serious streamers and content creators will be better off with the Insta360 Link or the Elgato Facecam Pro, which are both similarly-priced 4K webcams with top-notch image quality and well-made, detailed, usable software. Unless you’re already so deep into the Razer ecosystem that you have to wrestle with Synapse 3 on a daily basis anyway, I can honestly say I do not think it’s worth the frustration. But hey — maybe this won’t always be the case. Maybe one day Razer will fix its peripheral software and then this webcam will be perfect.

It's easy to build your own desktop PC but, if you want a phone, you usually have to settle for a sealed box that's made by one of a handful of large corporations. Maker Evan Robison wants to change all that as he posted instructions for an open-source, Raspberry Pi-powered called OURPhone with the acronym OURS standing for Open-source, Upgradable, Repairable Smartphone. 

According to Robinson, the idea was to create a smartphone alternative for people looking to control their privacy. He also wanted to make a smartphone that could be easily modified and repaired, so an open-source solution was the perfect fit. The OURphone project has quite a few specs that you’ll find on many smartphones including 4G LTE internet support, GPS support, Bluetooth and WiFi capability, as well as basic phone operations like the ability to call, text and save contacts in an address book.

However, instead of running on Android or iOS, the phone uses Raspberry Pi OS, the Linux-based native operating system for Raspberry Pis. This means that you have very fine control over what software you run on it, but the UI (as pictured) is not particularly touch or phone friendly. You can find all of the code used in the project (as well as detailed instructions) at GitHub.

In his build guide, Robinson is using a Raspberry Pi 3 B+ but there’s no reason you couldn’t upgrade it to a Pi 4. It’s accompanied by a 4G HAT with GSM and GPS antennas. It has a Waveshare touchscreen for video output and user input. A camera can be attached but it isn’t necessary for the build. A pair of headphones with a built-in microphone is used for call support. To keep the unit mobile, it operates off of a couple of 18650 batteries. 

The housing, ade out of 3mm MDF board, is a bit bulky but necessary to contain all of the hardware. It’s laser cut with port access made available all around the edges.

There are already plans in the works to add more features like a Pi upgrade, a capacitive touch screen, and a monitoring system to check the battery level. Robinson asks that anyone interested feel free to improve upon the design and share any changes they implement. He’s also made himself available at LinkedIn for anyone that has questions along the way.

If you want to get a closer look at this Raspberry Pi project, check out the official project page over at GitHub and be sure to follow Evan Robinson for future projects as well as any updates on this one.

Gaming hardware manufacturer MSI confirmed today that it was the victim of a cyberattack. In a brief statement on its website, the company said that the attack hit "part of its information systems," which have since returned to regular operations.

The company advises its customers only to get BIOS and firmware updates from the MSI website and no other sources. It's light on details, saying that after "detecting network anomalies," MSI implemented "defense mechanisms and carried out recovery measures," and then informed the the government and law enforcement.

"MSI is committed to protecting the data security and privacy of consumers, employees, and partners, and will continue to strengthen its cybersecurity architecture and management to maintain business continuity and network security in the future," the unsigned blog post reads.

The post doesn't mention if customer data was stolen or affected. Tom's Hardware reached out to MSI but did not hear back in time for publication. In addition, emails to official spokesperson addresses listed on the company's website bounced.

The first signs of the cyberattack surfaced yesterday in a report from BleepingComputer, which showed that a ransomware group called Money Message had claimed to have stolen source code, a "framework to develop bios [sic]" and private keys. In addition, the site saw chats that suggested the group claimed to have stolen 1.5TB of data and asked for a ransom payment of over four million dollars. It's unclear if these are related or if MSI paid a ransom.

This isn't the first hardware manufacturer to see this kind of attack in recent memory. Just last month, a hacker stole 160GB of data from Acer off of a document server meant for repair technicians. (Acer also had 60GB of data stolen in October 2021.)

In recent years, we've seen Quanta, Nvidia, and other major hardware manufacturers investigate potential cyberattacks. Clearly, the desire for bad actors to access data from major hardware vendors, which could then potentially spread into client computers, isn't going away anytime soon.

If you’ve been sharing screenshots that were cropped or edited with the Snipping Tool in Windows 11, your privacy may be at risk. 

It looks like Windows’ built-in screenshot editing tools are also part of “aCropalypse” — a recently-discovered security flaw in Google Pixel’s Markup image editing tool that allows for the partial recovery of original images from cropped or edited versions. 

The original vulnerability was discovered by security researchers Simon Aarons and David Buchanan and reported to Google in January 2023. Google issued a fix for the Pixel 4A, 5A, 7 and 7 Pro in its March 2023 security patch. 

However, because the vulnerability existed for five years before it was discovered, cropped/edited images shared within the last five years are potentially at risk, depending on the platform they were shared to. 

According to a FAQ page (unavailable at the time of this writing) shared with 9to5Google, the vulnerability existed because Markup saves edited image files in the same location as the original file, without first erasing the original file. If the edited file is smaller than the original file, a trailing portion of the original file remains in the save location, and that part of the original file is recoverable using a reverse-engineered exploit. The full technical details of the vulnerability and exploit are detailed on Buchanan’s blog, and the researchers have also created a demo tool for recovering affected Pixel photos. 

But it looks like the Google team isn’t the only team to have missed this vulnerability in their code, because Windows 11’s Snipping Tool and Windows 10’s Snip & Sketch (but not Windows 10’s Snipping Tool) appear to have the same vulnerability — despite being, as Buchanan points out, part of an entirely unrelated codebase. Buchanan tested a modified version of the exploit on Windows 11 and was able to recover most of the original image: 

Needless to say, this is not great, considering people typically crop and edit images to protect information, identities, etc. And while some platforms, such as Twitter, strip images of that trailing data when they’re uploaded, others, such as Discord, do not (or, well, did not until an update on January 17, 2023).

Aarons demonstrated the original flaw with a cropped image of a credit card with its number blacked out that was uploaded to Discord. Using the exploit on the downloaded image managed to recover about 80% of the original image, including the “redacted” numbers.

Buchanan says that Snipping Tool version 11.2302.20.0, which is not currently available to regular users but can be manually installed, appears to fix the problem. But at this point I’m not sure I’d trust any built-in screenshot editing tools (not that I ever did, once I realized Apple’s Markup tool has an undo feature) — better to just crop using a third-party tool.

Many programs collect user data and send it back to their developers to improve software or provide more targeted services. But according to the PC Security Channel (via Neowin) Microsoft's Windows 11 sends data not only to the Redmond, Washington-based software giant, but also to multiple third parties.  

To analyze DNS traffic generated by a freshly installed copy of Windows 11 on a brand-new notebook, the PC Security Channel used the Wireshark network protocol analyzer that reveals precisely what is happening on a network. The results were astounding enough for the YouTube channel to call Microsoft's Windows 11 "spyware."

As it turned out, an all-new Windows 11 PC that was never used to browse the Internet contacted not only Windows Update, MSN and Bing servers, but also Steam, McAfee, geo.prod.do, and Comscore ScorecardResearch.com. Apparently, the latest operating system from Microsoft collected and sent telemetry data to various market research companies, advertising services, and the like.

To prove the point, the PC Security Channel tried to find out what Windows XP contacted after a fresh install using the same tool and it turned out that the only things that the 20+ years old operating system contacted were Windows Update and Microsoft Update servers. 

“As with any modern operating system, users can expect to see data flowing to help them remain secure, up to date, and keep the system working as anticipated," a Microsoft spokesperson told Tom's Hardware. "We are committed to transparency and regularly publish information about the data we collect to empower customers to be more informed about their privacy.”

Some of the claims may be, technically, overblown. Telemetry data is mentioned in Windows' terms of service, which many people skip over to use the operating system. And you can choose not to enable at least some of this by turning off settings the first time to boot into the OS.

"By accepting this agreement and using the software you agree that Microsoft may collect, use, and disclose the information as described in the Microsoft Privacy Statement (aka.ms/privacy), and as may be described in the user interface associated with the software features," the terms of service read. It also points out that some data-sharing settings can be turned off.

Obviously, a lot has changed in 20 years and we now use more online services than back in the early 2000s. As a result, various telemetry data has to be sent online to keep certain features running. But at the very least, Microsoft should do a better job of expressly asking for consent and stating what will be sent and where, because you can't opt out of all of the data-sharing "features." The PC Security Channel warns that even when telemetry tracking is disabled by third-party utilities, Windows 11 still sends certain data.

Updated Feb 10, 9:29 a.m. ET with comment from Microsoft.

Researchers at Carnegie Mellon University have been testing a system which uses Wi-Fi signals to determine the position and pose of humans in a room. In the tests, ordinary Wi-Fi routers, specifically TP-Link Archer A7 AC1750 devices, were positioned at either end of the room, along with various numbers of people in the room. AI-powered algorithms analyzed the Wi-Fi signal interference generated by the people.

Wireframe images generated from the Wi-Fi monitoring looked pretty accurate in most cases, with the researchers asserting that the estimates are as good as some “image-based approaches.” There are some advantages and attractions for using Wi-Fi over cameras, too. Firstly, the wireframe estimations of human pose are more respectful of human privacy. Secondly, Wi-Fi based perception doesn’t require light, and is capable of detecting body poses even when there are objects in the way which would obscure a traditional camera view. Another major attraction of this discovery is that the Wi-Fi routers used were cheap at just $30 each, and thus much more accessible than expensive and power hungry solutions such as radar and LiDAR.

Above you can see a set of synchronized images, with the video stills on the left, and the AI-generated Wi-Fi sensed wireframes on the right. The detection of the number of people, locations and poses looks very accurate. The paper published by the Carnegie Mellon researchers provides some detailed background on how this is done. In brief, the Wi-Fi based perception technology demonstrated here is based on Wi-Fi signal channel-state-information (CSI), which represents the ratio between the transmitted signal wave and the received signal wave. This data is processed using a computer vision savvy  neural network architecture that can perform dense pose estimation. To simplify and thus speed the generation of the wireframe style human representations, the researchers broke the human form into 24 segments.

The researchers admit that the above outlined method of detecting humans and their positioning / poses is not without issues, and they still see some obvious errors in test scenarios. They graciously provided some comparison images which show “failure cases,” which they attribute to issues such as humans making unusual poses and there being too many subjects in the room at once (the engine optimally supports three or fewer individuals).

There is still plenty of work to be done, with the researchers suggesting the outlined technique could be improved in a number of ways but mainly from better public training data for Wi-Fi based perception, especially in different room layouts. While touted as a privacy sensitive way to monitor the safety of old people living alone, and being a very affordable solution for this purpose, some will undoubtedly be concerned about the new threat of their Wi-Fi router spying on them.

Electronic Arts (EA) has announced the launch of EA AntiCheat (EAAC), a kernel-level system that it says is “absolutely vital” to take on the cheaters who have increasingly sought to utilize this deep computer access mode. To try and nip security and privacy worries in the bud, EA’s Elise Murphy, Senior Director, Game Security & Anti-Cheat, has given various assurances about the scope of EAAC’s operations and published a blog with a lengthy FAQ about the technology. EEAC will make its debut with the release of FIFA 23 at the end of the month.

The introduction of EAAC is concerned with “creating a safe and fair experience for all of our players,” assures EA’s Murphy. Sadly, the PC gaming environment in 2022 means that it is essential to implement kernel-level protections to create a level playing field in competitive games, according to EA. Cheat developers have moved into the kernel to avoid detection by traditional anti-cheat and anti-tampering technologies, so like in a military arms race, EA must change its tactics.

Having gone down this kernel-level path, EA says it is coding its new anti-cheat solution with “full stack ownership of the security & privacy posture, so we can fix security issues as soon as they may arise.” The new anti-cheating system “will only look at what it needs to for anti-cheat purposes,” explains EA, allaying some fears that it might snoop at your PC browsing history, personal files or similar. However, EA admits that if a process on your PC seeks to interact with an EAAC game, it “could see that and respond.”

Other key assurances EA’s FAQ provides, are that EAAC:

• Only runs when an EAAC game runs,
• Won’t degrade game stability or performance,
• Will not be in every game, as it will be implemented on a case-by-case basis as required for fair competitive multiplayer gameplay,
• If you have multiple EAAC games installed, EAAC will be uninstalled when/if you uninstall the last of these games,
• Will be continually tested by EA and independent 3rd party security and privacy advisors for bugs and vulnerabilities.

EA isn’t the first and probably won’t be the last PC games publisher to implement kernel-level anti-cheat and anti-tamper technology into its games. Last year Activision revealed its Ricochet anti-cheating system, which was custom made for one of its biggest online multiplayer games; Call of Duty, and in June this year it published an interesting blog describing the progress made by Ricochet on this iconic-franchise.

It’s been...quite a while since Logitech released a webcam for non-creators — the Logitech Brio 4K was released in 2017, while the company’s ride-or-die C920 first hit shelves in 2012. 

So, after only a decade, Logitech is finally releasing a new 1080p full HD webcam aimed at personal and professional users: the Logitech Brio 500. While a 1080p webcam might not sound that exciting, especially when Dell’s new similarly-priced webcam is 2K and especially when the 10-year-old C920s is...also a 1080p full HD webcam, there’s more to webcams than just resolution! (Plus, it’s not like most video conferencing apps will let you stream at more than 1080p, anyway.)

In addition to its 1080p/30fps; 720p/60fps resolution, the Brio 500 also has a 90-degree field of view (configurable  to 78º or 65º), dual microphones, a built-in privacy shutter, and both Logitech’s RightLight 4 image adjustment technology and an experimental “RightSight” AI auto-framing feature. 

The Brio 500 comes in three colors, including off-white and rose (pink), and costs $129. That’s not quite budget-priced, and is approaching some 4K webcams on sale (including Logitech’s own Brio 4K), but the webcam market is still a little skewed from the pandemic. 

That said, you can find many 1080p/30fps webcams for less than $100, and the Brio 500 doesn’t have any specs that particularly stand out. But while its main selling point may be the internal improvements Logitech has made, remember that, pre-pandemic, Logitech was practically the only webcam game in town. The company has a lot of experience here, and while the specs may not show it, the Brio 500’s performance does.

Design of the Brio 500

The Logitech Brio 500 has a different, more modern design than its predecessors — not that that’s saying much, considering its predecessors are between 5 and 10 years old.

The Brio 500 is housed in a wide, cylinder-shaped plastic chassis, which comes in three colors: graphite, off-white, and rose (my review unit was rose). The webcam is certified carbon neutral, and the chassis is made with post-consumer recycled plastic (68% for graphite, 54% for off-white and rose). It’s not the sleekest or smallest webcam (it’s actually bigger than the C920s, C930e, and Brio 4K), but it’s low-profile and lightweight (2.8oz, not including stand), so I have no complaints.

It’s not a wildly innovative design, but it does (finally) include a built-in privacy shutter, which slides upward to reveal the camera when you twist the right end-cap. I dislike having to touch my webcam once I have it perfectly positioned on my monitor, but I am also paranoid enough to not trust non-physical privacy shutters; the Brio 500’s privacy shutter hits the right balance of being a physical shutter that’s easy to maneuver without disturbing the camera’s position.

The Brio 500 has a 5-foot, non-detachable USB-C cable, so you’ll need to plug it into a USB-C port or find a USB-C to USB-A adapter (not included). The webcam also comes with a magnetic monitor mount, which clamps onto your monitor and has an adjustable “foot” lined with microsuction tape — while I don’t love adhesive, removable or not, on monitor mounts, it’s relatively easy to remove/move and it does make the mount extremely stable.

The webcam attaches to the mount magnetically; the attachment point is round, which allows the camera to rotate while it’s on the mount, and the mount also has built-in tilt adjustment. The magnet unscrews to reveal a standard tripod mounting point.

Adjusting the webcam on the mount is pretty easy, the only minor hiccup is that the magnet is a tiny bit too weak to effortlessly lift the tilt adjustment; I kept accidentally pulling the webcam off of the mount if I tried to tilt it too quickly. It’s not impossible; it’s just not totally seamless — which is too bad, because the webcam’s “Show Mode” feature is designed to show off what’s on your desk, and presumably involves a lot of tilting.

Specs

Well-lit Performance of the Brio 500

My home office is extremely well lit, thanks to my four monitors (three 27-inch and one 24-inch), as well as actual lighting (Elgato Ring Light, Elgato Key Light Air, Logitech Litra Glow), plus an overhead lamp and a desk lamp. While most webcams read this as overexposed, the Brio 500 did a good job of adjusting exposure and white balance to produce a nicely-lit, balanced image out of the box.

I was especially impressed with the Brio 500’s auto-white balance, which is almost always a struggle. While the Brio 500 could still use some tweaking, in my opinion, its auto-white balance and auto exposure are very impressive, especially for a webcam that isn’t $200 or $300.

The Brio 500 does produce a flatter, less-dynamic overall image than other webcams we’ve tested, such as the Insta360 Link. This isn’t really an issue that will concern most people — a flat, evenly-lit image is, for the most part, a best-case scenario when it comes to webcam performance.

One of the features Logitech is touting with the Brio 500 is RightLight 4 — the most recent evolution of Logitech’s RightLight technology – which uses face-tracking and other factors to make sure the subject is evenly-lit in less-than-ideal lighting situations.

Unfortunately, RightLight 4 is still trying to do this even in very ideal lighting situations, which is why my well-lit setting looks kind of flat. I tried playing around with my lighting to see if I could create a more dynamic picture, but RightLight 4 thwarted me at every turn, evenly-lighting me no matter how dramatic I tried to make my lighting. Again, this isn’t really an issue considering it’s a webcam — but it might not be the best webcam for creating dramatic YouTube shorts.

Low-Light Performance of the Brio 500

To test the Brio 500’s low-light performance, I turned off all of my lights and three of my monitors, leaving just one 27-inch monitor as my only light source. The Brio performed pretty well — it’s clear that I’m sitting in a dark room, but you can see both me and my background. This is probably partly due, once again, to RightLight 4.

Also, while the Brio 500 definitely had to pump up the gain to compensate for the lack of light in this setting — you can see this in the lack of detail in my facial features — it still managed to produce a decent-looking overall image. The Brio 4K’s low-light image is pretty similar to the Brio 500’s, but displays less detail and has a grainier texture.

Overexposed Performance of the Brio 500

To test the Brio 500’s performance in an overexposed setting, I turned off all of the lights in front of me, as well as three of my four monitors, leaving my background lights and one 27-inch monitor on. The Brio 500 did an excellent job of keeping me well-lit, though my background still looks pretty over-exposed. It’s not perfect — if you look closely, you can see that there’s still a lot of detail lost in my facial features as compared to the well-lit setting — but the overall image looks very good, and I’m especially impressed with how evenly-lit and un-grainy my skin looks.

Microphone of the Brio 500

The Brio 500 has built-in dual microphones with beamforming noise-reducing technology designed to pick up your voice even if you move around in front of the camera. While most webcam mics are...kind of terrible, the Brio 500’s mics are not bad — they were able to easily pick up my voice, even from a few feet away, so long as I was facing the webcam.

My voice also sounded fuller and richer than it does on most webcam mics (which tend to make you sound hollow and distant). When I was close to the Brio 500 and speaking directly at it, the mic quality was — dare I say — comparable to a basic headset mic: not incredible, but definitely usable.

Features and Software of the Brio 500

The Logitech Brio 500 works with Logitech’s Logi Tune software, which is Logitech’s ... non-creator webcam software for newer peripherals, I guess (Logitech has a lot of different peripheral apps). You can use Logi Tune to update the Brio 500’s firmware, turn on features such as “RightSight” (AI auto-framing, still in beta) and “Show Mode” (makes things on your desk more easily readable/visible), and change the field of view. Logi Tune is also designed to be a productivity app, and integrates with calendar and video conferencing apps to (sort of ) streamline your schedule.

Logi Tune also has an image adjustments section, with toggles for autofocus, auto-exposure, auto-white balance, and HDR, as well as brightness, contrast, saturation, and sharpness sliders. If you turn off autofocus, auto-exposure, or auto-white balance, manual sliders will appear. Logi Tune isn’t the most precise or detailed webcam app — it gives you slightly more control than Logitech’s Camera Settings app, but I still miss Logitech’s old Webcam Software.

Bottom Line

The Logitech Brio 500 is actually a pretty impressive webcam that not only does a very good job of keeping you evenly-lit (too good of a job, arguably), but also manages to make you look...really good in less-than-ideal settings. It’s got a cute, lightweight, carbon neutral design, an easy-to-use built-in privacy shutter, and a microphone that doesn’t make you sound like you’re talking over a walkie-talkie in an underwater tunnel — what more could you want? Better peripheral software and a lower price point, perhaps.

The Brio 500 is $129, which isn’t insane, but the C920s, which has the same 1080p/30fps resolution, can often be found for less than half that. The C930e, which has the same resolution and the same 90-degree field of view, can often be found for around $80, and even the Brio 4K will often go on sale for around $150, which is just $20 more. There’s more to the Brio 500 than just resolution, but if $129 still seems too pricey for 1080p, the Dell Pro Webcam WB5023 is worth a look — it also has excellent auto-exposure and auto-white balance, and adds a little extra with 2K 1440p/30fps as well as 1080p/60fps streaming. Whichever model you eventually settle on though, it'll always be worth checking to see if there's a Logitech promo code available.

Kingston's IronKey Vault Privacy 80 External SSD is a portable SSD with an attractive full-featured touchscreen that controls many customizable options that keep your data safe. The drive comes with up to 1.92TB of QLC flash storage backed by hardware encryption, conveniently includes Type-A and Type-C cables, and like the drives on our list of best external SSDs, is compatible with most operating systems and devices. However, because this is a specialized device that's focused on data security, these advantages come at the cost of performance and a thick price tag.

The IronKey may be up your alley if you want secure storage in your pocket that’s faster than a hard drive or slower forms of flash storage, such as SD cards and USB flash drives. It’s certainly attractive, and the built-in touchscreen makes the drive’s security functions easy to use. However, such convenience comes at a price, as the drive will run you several hundred dollars at any capacity. Kingston also made some compromises in the performance department.

Most other portable SSDs don’t offer built-in security functions, aside from perhaps Samsung’s T7 Touch, and software-based solutions remain a viable option. Of course, the whole idea is to have reliable and portable storage, but performance can vary widely depending on the interface.

The IronKey relies on the slowest USB 3.2 Gen 1x1 connection, but just how far does it fall behind the competition? Encryption comes with a performance cost, but ultimately Kingston made design decisions that may have you reconsider the value of the added security.

Specifications

The Kingston IronKey Vault Privacy 80 External SSD is available at 480GB, 960GB, and 1.92TB. These capacities suggest additional over-provisioning, reducing available user space to leave extra for the controller to improve write performance and flash endurance. This makes sense given the purpose and characteristics of the drive. The IronKey is a bit heftier than many portable SSDs, in part because it has an embedded touchscreen for its security functions. Kingston backs this unit with a three-year warranty, which is a bit anemic given the price.

Speaking of price, you'll pay significantly more for the security options, like the FIPS 197-compliant 256-bit XTS-AES encryption. This encryption meets the Common Criteria EAL5+ standard (Evaluation Assurance Level 5 with one or more additions to the base rating). The randomizable, color touchscreen has a multi-password option with PIN or passphrase, from 6-64 alphanumeric characters, with a configurable amount of access attempts and an auto-timeout. The drive also supports a dual read-only mode for write protection to protect against compromised systems and malware, plus the ability to Secure Erase the drive by wiping the encryption key.

You might be dismayed to see the performance limitations — the drive offers up to
250 MBps for sequential reads and writes. This makes sense for a variety of reasons. One is that on-the-fly hardware encryption does have some overhead and performance limitations, even with the dedicated encryption microcontroller. Because performance is already limited, Kingston can save cost when selecting the SATA-to-USB bridge chip, which in this case has a hard limit of 3Gbps SATA. We’ll look at these respective components a bit below. Due to these limitations, the USB interface is USB 3.2 Gen 1, or 5Gbps.

Given all these considerations, the price-per-GB is best at 1.92TB and worst at 480GB. Based on this ratio, we would recommend the 960GB and 1.92TB SKUs.

Software and Accessories

The IronKey comes with both Type-C to Type-C and Type-C to Type-A USB cables. The drive comes with a nice carrying pouch made of neoprene, which does offer some protection. The drive has built-in software, accessible through the touchscreen, for its various functions and settings. Unfortunately, while Kingston does offer downloadable SSD Manager software on its website, it doesn't support USB enclosures/devices.

A Closer Look

The front of the IronKey has a nice color touchscreen. The blue case color is attractive. The USB-C port resides on the bottom, which is convenient. On the backside, a label lists pertinent specifications about the drive: model, capacity, power draw, etc. There’s also a screw that allows for opening of the enclosure, covered by a “warranty void if removed” sticker.

Inside we have what appears to be a Kingston A400 SATA SSD attached to a SATA-to-USB adapter, with a USB-C output and PCB beneath the drive. There are four screws to hold the bay in place and another four for the drive cover — including another warranty warning sticker. The touchscreen has a ribbon connecting the screen to the board, and we can see a few prominent integrated circuits (IC) on the PCB.

The first chip is labeled MB86C311A, which is a Fujitsu MB86C31 USB 3.0-SATA Bridge IC. This bridge chip is USB 3.2 Gen 1, or 5Gbps, on one side and SATA 2.0, or 3Gbps, on the other. Actual throughput on the SATA side is significantly lower than 3Gbps due to encoding and transfer overhead, with an approximate maximum of 270MBps. This chip does support the USB-attached SCSI Protocol (UASP) for better performance and other functions. The chip is based on an ARM Cortex-M processor, specifically the M3, a processor that's also used for offloaded functions in Crucial’s custom SSD controllers, like the Crucial P5 and P5 Plus SSDs. The -1A model of this chip has integrated AES encryption hardware.

The other IC is an STM32L, or STMicroelectronics STM32 microcontroller. The STM32 is based on Arm’s Cortex-M series of processors, designed to be low-cost and low-power for various applications. In this case, it’s likely used to manage the integrated touchscreen. 

Self-Encrypting Drives (SED) have an encryption module as part of the controller ASIC while the IronKey has a separate chip for AES - a chip that also acts as a SATA-USB bridge. Unfortunately, this chip introduces a performance bottleneck in the drive.

The flash is labeled FB51208UCN1, indicating these are 8-bit, 512GB NAND modules (two for a total of 1TB). We recognize this designation as similar to the flash used in Kingston’s NV1, which used 64-layer Intel/Micron QLC. We suspect that Kingston uses QLC here as well, which is not egregious as the drive is bandwidth-limited from the get-go. Verifying this flash with a utility is possible, but looking at the sustained write response can also be informative. This and other drives may utilize the 96-layer variety depending on supply.

The DRAM-less Silicon Motion SM2259XT SATA controller manages the flash. This SSD controller is found in many popular drives, like Crucial’s BX500, as an update to the original SM2258XT. The primary difference is improved LDPC error correction, which improves performance and endurance. This first showed up when Crucial added QLC SKUs to its BX500 lineup as it’s a good pairing to get more out of 4-bit flash.

This four-channel controller is best with at least two dies per channel, so we recommend the 960GB or 1.92TB SKUs. This is especially true given the pricing we covered earlier. 

MORE: Best External SSDs and Hard Drives

MORE: How We Test HDDs And SSDs

MORE: All SSD Content

Comparison Products

We compared the 960GB Kingston IronKey to other popular portable drives at the same relative capacity. This includes drives with QLC flash, like the Inland Platinum External SSD and the Crucial X8. Samsung has its own security-focused portable SSD in the T7 Touch, but we’ve also included the newer T7 Shield. We also use the Kingston XS2000 to show what a hybrid controller with a 20Gbps interface can do. Finally, we also included the WD My Passport SSD and the SanDisk Extreme v2.

Game Scene Loading - Final Fantasy XIV

Final Fantasy XIV Shadowbringers is a free real-world game benchmark that easily and accurately compares game load times without the inaccuracy of using a stopwatch.

Unsurprisingly, the IronKey doesn't do too well in this test, although it still manages to beat the Inland Platinum External. The Platinum External uses a hybrid controller (flash controller and bridge, all in one), which is intended to be cheaper and more power-efficient. It also uses comparable QLC flash.

The drives with TLC and/or faster controllers do better in this test than both drives. This is one place where Kingston's XS2000 does quite well.

Trace Testing – PCMark 10 Storage Benchmark

PCMark 10 is a trace-based benchmark that uses a wide-ranging set of real-world traces from popular applications and everyday tasks to measure the performance of storage devices.

The IronKey does not do well in PCMark, limited by its lack of bandwidth, the use of QLC, and possibly encryption overhead. Its latency is even worse than the Platinum External’s, which scored poorly due to the embedded controller QLC flash. The X8, which uses a dedicated controller with DRAM, stands on top.

Transfer Rates – DiskBench

We use the DiskBench storage benchmarking tool to test file transfer performance with a custom, 50GB dataset. We copy 31,227 files of various types, such as pictures, PDFs, and videos to a new folder and then follow-up with a reading test of a newly-written 6.5GB zip file.

The IronKey is doomed to do poorly in DiskBench as it is bandwidth-limited by its bridge chip and USB interface. It finishes dead last, and not by a small amount.

Synthetic Testing - CrystalDiskMark

CrystalDiskMark (CDM) is a free and easy-to-use storage benchmarking tool that SSD vendors commonly use to assign performance specifications to their products. It gives us insight into how each device handles different file sizes.

The IronKey has no hope of keeping up in CrystalDiskMark’s sequential read and write tests as, again, it’s inherently limited by the 3Gbps SATA bottleneck. You probably aren’t purchasing this drive for speed, though. The IronKey's performance in random workloads is also poor due to overhead — encryption likely adds to the latency — although it's certainly better than lesser forms of storage such as USB flash drives. It’s good enough for occasional transfers where security is paramount.

Sustained Write Performance, Cache Recovery, and Temperature

Official write specifications are only part of the performance picture. Most SSDs implement a write cache, which is a fast area of (usually) pseudo-SLC programmed flash that absorbs incoming data. Sustained write speeds can suffer tremendously once the workload spills outside of the cache and into the "native" TLC or QLC flash. We use Iometer to hammer the SSD with sequential writes for 15 minutes to measure both the size of the write cache and performance after the cache is saturated. We also monitor cache recovery via multiple idle rounds.

The IronKey writes at its maximum possible speed, around 260 MB/s until it runs out of pSLC cache. This appears to be one-quarter of the drive, implying QLC, meaning that all of the flash can run in single-bit mode with a corresponding loss of capacity. After this, the drive performance declines to about 40MBps on average, which is certainly slow enough to suggest that the drive is folding data from pSLC to the native QLC. Considering the drive is slow to begin with, you really don’t want to hit this performance state. It’s the slowest drive in the round-up for sustained writes.

Drives with large SLC caches usually have fast cache recovery, particularly if the cache is hiding poor native performance, like when the drive uses QLC. A large, dynamic SLC cache with fast recovery can have additive wear as blocks are necessarily rewritten when moved from pSLC to QLC. The IronKey’s large cache should be enough to absorb typical write workloads, but you should be aware that it’s not made for constant writing at full capacity like the T7 Shield.

Temperatures were not something to be concerned with, as the drive proved to be too slow to generate sufficient heat to get anywhere near throttling limits.

Test Bench and Testing Notes

We use a Rocket Lake platform with most background applications such as indexing, windows updates, and anti-virus disabled in the OS to reduce run-to-run variability. Each SSD is prefilled to 50% capacity and tested as a secondary device. Unless noted, we use active cooling for all SSDs.

Conclusion

The Kingston IronKey Vault Privacy 80 External SSD has two things going for it: portability and security. The problem is that you'll pay a lot for those privileges, in money and other ways. The IronKey is very expensive when looking at its cost-per-GB, particularly at its lowest capacity; this is a drive you should only get at 960GB or 1.92TB. Even then, you’re making a lot of compromises for what is admittedly fairly robust and customizable data security.

These sacrifices come in the form of performance and, to some extent, endurance. Performance is hampered by the use of a DRAM-less controller, a SATA-USB bridge chip that's limited to 3Gbps, a 5Gbps USB interface, and the use of an older QLC flash. While all of these design decisions make sense given the bridge’s bottleneck, which may be due to encryption overhead, it’s a tough pill to swallow when you’re paying this much for the drive. Endurance is also likely hurt by using QLC and a DRAM-less controller, not to mention the massive SLC cache.

The IronKey is attractive with a nice touch-screen that is full of functionality. The drive has a carrying case and both types of USB cables, which is nice, and the on-drive controls improve compatibility. There are myriad security options and protections for you to dial in to your liking, and it’s all supported in hardware. This makes it a bit of a unique device, so you have to personally decide if it’s worth all the drawbacks of increased price and lacking performance. 

MORE: Best External SSDs and Hard Drives

MORE: How We Test HDDs And SSDs

MORE: All SSD Content

TL;DR How to Install and Log In to Windows 11 Without a Microsoft Account

• Microsoft wants users to sign in with a Microsoft account, for tracking and to synchronize user settings across multiple devices.
• You can bypass using a Microsoft account during the Windows 11 install process by opening a Command Prompt (Shift+F10) and typing ms-cxh:localonly
• Using Rufus you can create a Windows 11 install USB drive that will automatically bypass this and other requirements.

Windows 11 installation requires a Microsoft account, and Microsoft really wants you to log in to Windows 11 using its account system so that it can track you and for user benefits like synchronizing user preferences across many computers. But you can install Windows 11 using just a local account, for example when installing Windows on a child's PC.

There are many reasons why you would want to install Windows 11 using a local account only. Maybe you want to install Windows 11 with a local (non-Microsoft) account because you are installing the OS on a PC that you plan to sell, give to a friend or donate to a charity (without giving other people access to personal data). Or perhaps you just like your privacy and don't want to create an account with Microsoft in the first place.

Whatever your reason for doing so, it's easy to install or set up Windows 11 without using a Microsoft account. For better or worse, the method of bypassing Windows 11's Microsoft account requirement is changing and so the steps you follow may vary based on which build of Windows you use.

For the current release builds of Windows (as of April 2025), you may use the OOBE/BYPASSNRO method. However, for builds 26100 and 26200 and beyond (and eventually the next release build), you must use the start ms-cxh:localonly method, which is similar but requires a different command.

Below, we'll show two methods: the first involves issuing some commands during the install / OOBE process. The second, which only works for a clean install, requires you to create a modified USB install disk using a free tool called Rufus. We've tested these methods on the latest major Windows 11 version, 24H2, and they work.

How to Install Windows 11 Without a Microsoft Account (Current Method)

For current release builds of Windows 11 (24H2), there's a simple trick for setting up Windows 11 with a local account that involves issuing a command to keep the OOBE from requiring Internet and then cutting off Internet at just the right time in the setup process. This works the same way whether you are doing a clean install of Windows 11 or following the OOBE process on a store-bought computer.

1. Follow the Windows 11 install process until you get to the "choose a country" screen.

Now's the time to cut off the Internet. However, before you do, you need to issue a command that prevents Windows 11 from forcing you to have an Internet connection.

2. Hit Shift + F10. A command prompt appears.

3. Type OOBE\BYPASSNRO to disable the Internet connection requirement.

The computer will reboot and return you to this screen.

Note: if OOBE\BYPASSNRO returns a "command not found" error, skip ahead to the next method in this how-to.

4. Hit Shift + F10 again and this time Type ipconfig /release. Then hit Enter to disable the Internet. This effectively disconnects your computer from the Internet. If you're on Ethernet, you could just disconnect the plug, but this is just as easy if not easier.

5. Close the command prompt.

6. Continue with the installation, choosing the region. keyboard and second keyboard option.

A screen saying "Let's connect you to a network" appears, warning you that you need Internet.

7. Click "I don't have Internet" to continue.

8. Click Continue with limited setup if prompted. The OOBE may skip this screen and take you straight to the next step.

A new login screen appears asking "Who's going to use this device?"

9. Enter a username you want to use for your local Windows 11 account and click Next.

10. Enter a password you would like to use and click Next. You can also leave this field blank and have no password, but that's not recommended.

11. Complete the rest of the install process as you normally would.

How to install Windows 11 with a local account (Builds 26120 and beyond)

On new preview builds of Windows (and eventually the next release version), the OOBE/BYPASSNRO command has been erased and no longer works. Instead, there's a new command called start ms-chx:localonly that does something similar. Here's how you use it.

1. Follow the Windows 11 install process until you get to the Sign in screen.

2. Hit Shift + F10. A command prompt appears.

3. Enter start ms-cxh:localonly at the command prompt.

A "Create a user for this PC" dialog window appears.

4. Enter a local username and password. If you enter no password, you'll have no password.

5. Complete the installation process and you'll be using the local account you created.

How to Create a Windows 11 Install Disk that Allows Bypassing Microsoft Accounts 

You can also create an install disk that has the "no Internet required" setting built into the setup process.

Here's how to make a Windows 11 install disk that will let you disconnect from the Internet during setup so you can create a local account instead of using a Microsoft one.

1. Download the Windows 11 ISO file for Windows 11 from Microsoft. For more detail, see our how to download a Windows 11 ISO file article.

2. Insert a USB Flash drive you want to use as an install disk if one is not already inserted. Note that this drive will be completely erased during the process and it must be at least 8GB. If you are just installing Windows in a virtual machine, you can create an ISO file instead of writing directly to a Flash drive, but we'll assume you're not doing that here.

3. Download and launch Rufus version 4.4 or higher. There is no installation process, but you may be asked to confirm permissions by Windows User Account control.

4. Select the USB drive from the menu in Rufus if it's not already selected.

5. Click Select and choose the ISO file.

6. Click Start at the bottom of the Rufus window.

A dialog box appears with a few options for bypassing Windows 11 install requirements.

7. Toggle "Remove requirement for an online Microsoft account" to on and click OK. You may also want to toggle on the other options, which include Removing the Secure Boot / TPM 2.0 and RAM requirements (disabling these hardware requirements may not work on the latest versions of Windows 11). You can also toggle on "Create a local account with username" and enter your username here and it won't need to prompt you during installation. You can also toggle on "Set regional options to the same values as this user's" and it won't prompt you for the country or keyboard.

8. Click OK if warned that Rufus will destroy all data on the USB Flash drive. It is expected to overwrite all contents of the drive.

Rufus will take a few minutes to copy files to the USB Flash drive. When it's done, you will have a bootable Flash drive. However, you still need to disable the Internet on your computer.

9. Go through setup until you reach the "choose a country" screen.

10. Hit Shift + F10 to enter the command prompt.

11. Type ipconfig /release to kill the Internet connection.

12. Close the command prompt.

13. Click "I don't have Internet" when prompted.

14. Enter your username and password when prompted. Note that you can leave the password field blank if you want to boot directly to the desktop with no password required.

RansomHouse, a relatively new extortion group, claims to have "more than 450Gb" of hacked data from AMD, according to a report from Restore Privacy. @campuscody has also independently posted information about the stolen data. The RansomHouse extortion group claims to not use ransomware or conduct breeches itself — instead, it claims to serve as "professional mediators" for negotiations between attackers and victims to secure payments for stolen data. We reached out to the company, and AMD issued the following statement to Tom's Hardware:

"AMD is aware of a bad actor claiming to be in possession of stolen data from AMD. An investigation is currently underway." AMD representative to Tom's Hardware.

Restore Privacy says it has reviewed data posted by RansomHouse that appears to include "network files, system information, as well as AMD passwords." However, it isn't clear yet if that data is genuine, or whether it comes directly from an attack on AMD or one of its subcontractors. As such, the attack remains unverified. 

Expanding the above tweet, you can see the group's posting on its website. RansomHouse has added AMD to a list of companies that it says "have either considered their financial gain to be above the interests of their partners/individuals who have entrusted their data to them or have chosen to conceal the fact they have been compromised," implying that AMD hasn't paid a ransom. 

The group claims that AMD used simple passwords like 'password' to protect its networks, leading to the breach. RansomHouse's posting says that AMD's network was breached on January 5, 2022, and that it is in possession of 450Gb of stolen data. Notably, the "Gb" used by the group means 450 gigabits of data, or 56.25 gigabytes (GB). We're not yet sure if the group has merely misused Gb or if this is the correct value. 

RansomHouse emerged in December 2021 and established an extortion market in May 2022. The group claims the Saskatchewan Liquor and Gaming Authority (SLGA) as its first victim, with other purported victims, like ShopRite, added later. 

News of the attack comes in the wake of the famed 'Gigabyte Hack' that found 112GB of data stolen from AMD partner Gigabyte. That information was later posted by the RansomEXX hacking group after Gigabyte/AMD apparently refused to pay a ransom. As a result, information about AMD's forthcoming Zen 4 processors was divulged prior to launch, and it later proved to be genuine information. We'll update as we learn more about this recent event. 

Windows 11 22H2 is the first feature update to the OS and is due to be released this fall. Some will be looking forward to the added finesse coming to the Task Manager, File Explorer, Start Menu, Task Bar and other key aspects of using Windows 11. However, the Insider versions indicate that a Microsoft Account (MSA) will be mandatory, except for some business/education users. But the latest beta edition of the bootable OS media tool Rufus can fix the mandatory MSA push, as well as a host of other things.

Rufus 3.19 beta was shared by the development team on GitHub this past weekend. A popular open-source tool for admins and tweakers, Rufus is self-described as "a utility that helps format and create bootable USB flash drives, such as USB keys/pendrives, memory sticks, etc." It does its stuff for both Windows and Linux users.

In the release notes for Rufus 3.19 beta you can see that it allows a user to "bypass the mandatory requirement for a Microsoft account with Windows 11 22H2." You must select an appropriate disc image in the Rufus UI to get access to the Windows 11 install options listed above and below.

Note that if you go ahead with Rufus's MSA patching, you must disconnect from the internet to be given the option to create a local account when you use the modified disc image to install Windows 11 22H2.

Other niceties of Rufus that are handy if you are considering building a custom Win 11 boot image are options to:

• Implement a Secure Boot and TPM bypass
• Ignore minimum RAM and storage requirements
• Check an option to skip all collection questions (Sets all answers to "Don't allow"/"Refuse")
• And add an option for setting internal drives offline with Windows To Go

It seems like for those looking to streamline Windows 11 installs while subverting many of its setup annoyances, the tool strives to live up to its most excellent namesake. Rufus 3.19 beta has several other changes and improvements implemented since the last release in March. You can check the readme files and even the source code at GitHub, and read more about the app via its homepage, both linked above. 

A U.S. district judge dismissed a proposed class-action lawsuit against Apple that accused it of concealing Meltdown and Spectre security flaws and reducing performance of its devices by mitigating the vulnerabilities, which reduced value of their devices. The plaintiffs demanded a compensation to themselves as well as other owners of Apple devices affected by Apple's actions. 

Accusers stated that Apple misrepresented the privacy and security of iPhones and iPads as well as performance of its custom SoCs on which Apple argued that plaintiffs' alleged misrepresentations are too general to be actionable and they have failed to allege that any specific representation was false. 

"Plaintiffs have failed to allege an affirmative misrepresentation, an actionable omission, and actual reliance on misstatements by Apple," U.S. District Judge Edward Davila in San Jose, California, wrote in his ruling, reports Reuters. 

Meltdown and Spectre security vulnerabilities were discovered in mid-2017 and then made public in early 2018. While Meltdown affected chips from Intel, Spectre hit virtually all modern high-performance processors with speculative and out-of-order execution. Affected chips included those from AMD and Intel as well as custom system-on-chips based on various Arm architectures, including those from Apple, Qualcomm, MediaTek and Samsung. 

Mitigation of Meltdown and Spectre leads to degraded performance. Since Apple knew about vulnerabilities before they were made public and mitigated them before they were revealed, plaintiffs alleged that it deceived its customers by advertising security advantages of its iOS platform as well as performance advantages of its then latest system-on-chips compared to its previous generation SoCs. The accusers called Apple's actions fraudulent.  

"Plaintiffs allege that Apple was notified of the defects in June 2017 but did not publicly disclose them until January 4, 2018, after a New York Times article leaked the vulnerabilities," the complaint reads. "Apple addressed speculative execution and Meltdown, disclosing that its December 2, 2017, iOS 11.2 update included a software update to address the vulnerability. On January 8, 2018, Apple separately released iOS 11.2.2, a software update to address Spectre." 

The plaintiffs stated that if they had known about potential security vulnerabilities of Apple's hardware and software, they would not buy the company's products or would not pay the prices they did. Furthermore, after Apple made appropriate announcements, their devices declined in value. 

"Plaintiffs assert that these vulnerabilities are material because, 'had they known data stored on their systems would be compromised and made available to unauthorized third parties,' they would not have purchased their iDevices or paid the price they did," the lawsuit reads. "After Apple made the announcements, the iDevices allegedly declined in value." 

The court sided with Apple as all security and performance-related claims were correct at the time they were made.  

"Because plaintiffs are unable to identify any statement from Apple that is both sufficiently specific to be actionable and was false when made, plaintiffs have failed to state a claim for fraud under an affirmative misrepresentation theory," the ruling reads. 

Furthermore, since Apple's mitigations affected all its SoCs, performance comparisons between subsequent generations continued to be accurate even after mitigations were implemented as generation-to-generation performance advantages are not only conditioned by improved speculative or out-of-order execution advantages.

While the class-action lawsuit looks to be blown out of proportion, the ruling is an example of a case that exonerates companies from liability when they make certain claims about performance before other information comes to light that may change it.

An Intel-developed software solution aims to apply the power of artificial intelligence to the faces and body language of digital students. According to Protocol, the solution is being distributed as part of the "Class" software product and aims to aid in teachers' education techniques by allowing them to see the AI-inferred mental states (such as boredom, distraction, or confusion) of each student. Intel aims to expand the program into broader markets eventually. However, the technology has been met with pushbacks that bring debates on AI, science, ethics and privacy to the forefront.

The AI-based feature, which was developed in partnership with Classroom Technologies, is integrated with Zoom via the former's "Class" software product. It can be used to classify students' body language and facial expressions whenever digital classes are held through the videoconferencing application. Citing teachers' own experiences following remote lessons taken during the COVID-19 pandemic, Michael Chasen, co-founder and CEO of Classroom Technologies, hopes its software gives teachers additional insights, ultimately bettering remote learning experiences.

The software makes use of students' video streams, which it feeds into the AI engine alongside contextual, real-time information that allows it to classify students' understanding of the subject matter. Sinem Aslan, a research scientist at Intel who helped develop the technology, says that the main objective is to improve one-on-one teaching sessions by allowing the teacher to react in real-time to each student's state of mind (nudging them in whatever direction is deemed necessary).

But while Intel and Classroom Technologies' aim may be well-intentioned, the basic scientific premise behind the AI solution - that body language and other external signals can be accurately used to infer a person's mental state - is far from being a closed debate.

For one, research has shown the dangers of labeling: the act of fitting information - sometimes even shoehorning it - into easy to perceive (but ultimately and frequently too simplistic) categories.

We don't yet fully understand the external dimensions through which people express their internal states. For example, the average human being expresses themselves through dozens (some say even hundreds) of micro expressions (dilating pupils, for instance), macro expressions (smiling or frowning), bodily gestures, or physiological signals (such as perspiration, increased heart rate, and so on). 

It's interesting to ponder the AI technology's model - and its accuracy - when the scientific community itself hasn't been able to reach a definite conclusion on translating external action toward internal states. Building houses on quicksand rarely works out.

Another noteworthy and potential caveat for the AI engine is that expressing emotions also vary between cultures. While most cultures would equate smiling with an expression of internal happiness, Russian culture, for instance, reserves smiles for close friends and family - being overly smiley in the wrong context is construed as a lack of intelligence or honesty. Expand this towards the myriad of cultures, ethnicities, and individual variations, and you can imagine the implications of these personal and cultural "quirks" on the AI model's accuracy.

According to Nese Alyuz Civitci, a machine-learning researcher at Intel, the company's model was built with the insight and expertise of a team of psychologists, who analyzed the ground truth data captured in real-life classes using laptops with 3D cameras. The team of psychologists then proceeded to examine the videos, labeling the emotions they detected throughout the feeds. For the data to be valid and integrated into the model, at least two out of three psychologists had to agree on how to label it. 

Intel's Civitci himself found it exceedingly hard to identify the subtle physical differences between possible labels. Interestingly, Aslan says Intel's emotion-analysis AI wasn't assessed on whether it accurately reflected students' actual emotions, but rather on its results being instrumental or trustable by teachers.

There are endless questions that can be posed regarding AI systems, their training data (which has severe consequences, for instance, on facial recognition tech used by law enforcement) and whether its results can be trusted. Systems such as these can either prove beneficial, leading teachers to ask the right question, at the right time, to a currently troubled student. But it can also be detrimental to student performance, well-being, and even their academic success, depending on its accuracy and how teachers use it to inform their opinions on students.

Questions surrounding long-term analysis of students' emotional states also arise - could a report from systems such as these be used by a company hiring students straight out of university, with labels such as "depressed" or "attentive" being thrown around? To what measure of this data should the affected individuals have access? And what about students' emotional privacy - their capacity to keep their emotional states internalized? Are we comfortable with our emotions being labeled and accessible to anyone - especially if there's someone in a position of power on the other side of the AI?

The line between surveillance and AI-driven, assistive technologies seems to be thinning, and the classroom is but one of the environments at stake. That brings an entirely new interpretation for wearing our hearts on our sleeves.

AMD briefly mentioned Privacy View for Radeon graphics cards at CES 2022. Now it has released a fuller exposé of the technology, which is designed to minimize the opportunities for shoulder surfers or other office snoops to check what's on your screen. AMD Privacy View has been designed in partnership with Eyeware of Switzerland.

If you've looked into eye tracking previously, some use cases and applications have required expensive dedicated or higher-end hardware for this kind of technology to be effective. AMD has partnered with Eyeware of Switzerland for its Radeon Software Privacy View, as it only requires a standard webcam — and a Radeon GPU, naturally.

In the video above you can see a laptop user in a busy public place toggle on the AMD Privacy View feature. The brief clip shows that, once enabled, the section of the screen central to your gaze remains clear, while the rest of the monitor is cast into darkness. This obscuring of the screen contents could be pretty effective against a casual snooper.

Privacy View isn't a simple on or off choice, a pop-up control panel offers controls over variables like blur type and visible gaze area/shape. Furthermore, users can use the eye tracking tech for user presence detection, window focus switching, and using a gaze pointer when screen sharing. Last but not least, AMD and Eyeware have all-important calibration tools available via the control panel.

If you are curious about the technology behind AMD's Privacy View, dev partner Eyeware says that it uses "patent-pending computer vision algorithms and machine perception AI to enable remote head pose and gaze tracking for consumer device integrations." The tech is platform independent, but as an AMD driver feature, it will be restricted to Radeon GPU use. The first driver featuring Privacy View is slated to arrive sometime in H1 2022.

Technology Potential Beyond Privacy

Last but not least, this might be only the beginning of AMD and Eyeware collaborations in adding features to the Radeon driver. Interestingly, Eyeware's pages suggest this same tech can be a big positive for immersive gaming. It already has an Android/iOS app where you can purpose your smart device as an eye and head motion tracker for PC gaming. This could be folded into Radeon Drivers to use a PC / laptop webcam as a neater solution.

There's also the potential (not discussed yet) to use the technology for something akin to foveated rendering, where the area of the screen you're looking at gets rendered at a higher resolution than the rest of the display. We're speculating here, and integrating that sort of thing — and integrating it well — would prove difficult, but there are plenty of future use cases for this type of technology.

Since they plug into a computer, even the best webcams don’t think to include a hefty processor of their own onboard. Not so with the Opal C1. Armed with the Intel Myriad X, a VPU specializing in on-device neural networks, the Opal C1 aims to help webcams catch up to the quality you might find on an iPhone or a Google Pixel. 

The Opal C1 uses computational photography, a fairly common smartphone camera technique where the device combines developer tricks with details it’s learned about your face from past photos to touch up and adjust your video feed in real-time. This data doesn’t go into the cloud, so there are no privacy concerns (although there are ongoing debates about what it means to take photos or videos that “enhance” reality rather than reflect it), but that doesn’t mean the device doesn’t come without trade-offs.

Essentially, while it’s pretty hard to deny that the Opal C1 takes a great picture, it also costs $300. Of course, it’s targeted mainly at Mac users, coming with a robust software suite that doesn’t work on Windows. Sure, you can use the device on Windows, but it’s meant to work in tandem with its software. In other words, it’s intended to slot into the Apple ecosystem as a high-end lifestyle accessory for other high-end lifestyle products. There, it makes sense, but otherwise, it’s still not the DSLR replacement its advertising claims it to be. Video professionals will want to look elsewhere, while Windows users or casual video conferencers probably won’t need to shell out $300 for quality on this level.

At the same time, I shouldn’t undersell what having a smartphone-level camera experience on a webcam could mean for the future of the field. The Opal C1 sets a very exciting precedent.

Design of Opal C1

The Opal C1 unit I reviewed was technically still in beta, so while there were minor scuffs and black marks on my device, we shouldn’t expect those to be in the final version. However, what we should expect to see in the final version is the same textured, all-metal exterior, magnetic lens cover, miniature smartphone-style look, and heatsink on the back. That heatsink reminds us that this device is essentially a small computer, and its presence is necessary— the camera did get noticeably warm while I was testing.

You’ll notice that the Opal C1’s lens is off-center on the module’s body, and that’s because the right side of the device is dedicated to something called the “MicMesh.” This is an array of 3 omnidirectional beamforming microphones, and while you shouldn’t expect it to serve as a replacement for the best desktop microphones, these are the types of mics you find in the best gaming headsets. 

Aside from the Opal C1’s main body, the device comes with a footless monitor mount that nonetheless gave me a sturdy connection to both curved and flat back monitors. The part of the mount that the camera screws into can also tilt 180 degrees downwards, although my unit needed a good amount of force to adjust it. Unfortunately, it can’t tilt upwards, although you can fake a swivel effect on the Opal C1 itself by adjusting the tightness of the screw that connects it to the mount. That screw-based connection also means you can mount the Opal C1 on a tripod if you prefer.

The Opal C1 also has a single USB-C connection on the back, and the cable included with the device is USB-C to USB-C. I confirmed with one of the camera’s designers, Veeraj Chugh, that you can use a USB-C to USB-A cable with the device, but it must be USB 3.0. According to Chugh, the device comes with a C-to-C cable because it’s intended for use with current-generation MacBooks, which prioritize Type-C ports. 

Speaking of MacBooks, the Opal C1 unit I reviewed has a white, black, and gray color scheme reminiscent of what you’ll find on Apple products. White is, of course, the primary color, with black and gray getting about equal levels of play across the device. If you prefer all-black devices, the device is also available with that color scheme. 

Well-Lit Room

Because this is a $300 webcam, it wasn't easy to find many cameras in my collection that I could reasonably test against the Opal C1. I ultimately decided on the Dell Ultrasharp Webcam, a $200 webcam that's one of our favorites and one I have been using as a daily driver since June. It's less expensive but still costly enough to land in the premium range. Both cameras can also do 4K photos and 1080p @ 60 fps video.

Before I get into image quality, I should mention that the test photos I took for this review, except for those in the software section, were all captured using the standard Windows camera app. This usually wouldn't be worth mentioning, but the Opal C1 is intended for use with Macs and in tandem with its proprietary software. Still, it's essential to test it across both operating systems and with its out-of-the-box performance.

I should also mention that, while I took my Dell Ultrasharp photos at my desktop, I used a Windows laptop for the Opal C1. That's because the Opal C1 only has a USB-C to USB-C cable included with it, and my desktop currently can't accommodate that cable (yes, I'm looking into a new build). As such, the angles might be slightly different across shots.

Disclaimers aside, it's still pretty clear from the above photos that the Opal C1 boasts tremendous fidelity in what I would consider ideal light. I took these photos during mid-afternoon in my home office with most light sources activated. But even taking into account the slightly different angles of the shots I took, the Opal C1's photos show significantly fewer artifacts or distracting shadows. At the same time, the camera also makes my hair and skin look brighter without making them look uncanny.

Low Light Room

The Opal C1 and the Dell Ultrasharp Webcam performed more evenly in a lower light environment, where I closed my curtain and turned off all light sources aside from my screen. However, while the Opal C1 generally boasted higher quality, it compensated for the lower light by giving my hair and skin a somewhat upsetting pale, ghostly sheen. Photos taken in low light also have noticeable, dot-like artifacts throughout. Meanwhile, the Dell Ultrasharp photos have a smoother, less artifacted look, but conversely, they make my face look a little unnaturally warm and flushed.

Overexposed Room

When I saturated both the Opal C1 and the Dell Ultrasharp Webcam by pointing them at my window, the Opal C1 could not keep up. Although it portrayed the world outside my window with near-perfect accuracy, my face was covered in shadow, making it unusable under these conditions.

The Dell Ultrasharp Webcam, by contrast, put the focus on my face. While the world outside my window was blurred and the fidelity on my face was less than ideal, shots taken under these conditions were at least usable. If your desk is in front of a window, you could conceivably use the Dell Ultrasharp Webcam to take a call from it without too much issue.

Software on the Opal C1

Much of the Opal C1’s functionality is hidden behind its software suite, which includes features like bokeh (blurring the background— there’s more to it than that, but that’s what you’ll experience here), touch up and an Nvidia Broadcast-style camera lock that keeps you in the frame as you move. There’s a slider for each, so you can control the intensity of the effect, and they all work quite well, but there’s a catch.

The Opal C1 software only works with Mac, and requires a $4 per month subscription. The Opal C1 website does say that the software is “free for early customers,” although it’s unclear if it’s free for life. I’ve reached out to Opal for clarification and will update the review when I hear back.

Before I get into the UI and the specifics of using the different features, I want to briefly touch on the ideal light, low-light and overexposed photos I took using the software. Since the camera isn’t technically meant for Windows, I needed to rerun my typical tests on a Mac. What I experienced wasn’t too different, aside from software additions like Touch Up. However, the camera held up to high light levels much better on Mac, with its software, than on Windows. My face is fully visible in shots I took in front of a window, as is the world outside the window behind me. From the right angle, I even got a pleasant lens flare effect. 

Bokeh is probably the least impressive effect the software offers. Using it in my company’s office, I couldn’t tell much of a difference between the effect being on and off. If you sit on the software and A/B test for a while, you’ll eventually notice the slight fuzzing of the background, but even with the slider pushed relatively high, it’s a subtle difference.

Face Lock is more impressive, as it’s pretty responsive and the slider makes it very configurable. You can easily control the zoom on your face through slider intensity, and the camera follows you around about as well as Nvidia Broadcast and other options do. It never came across as wobbly or distracting, but if it did, it’s reassuring to know I could adjust its intensity through the slider.

Also, if Opal’s lifestyle brand ambitions weren’t clear enough, you can turn on a watermark with its logo in the C1’s software suite as well. Thankfully, this is easy enough to ignore. Also easy to ignore is the cute but very aggressive pixel filter you can apply to your footage.

Easily the most impressive feature in the Opal C1 software suite is its touch-up option. This uses an on-device neural network to edit your footage in real-time to remove blemishes, wrinkles and the like. The effect isn’t too dissimilar to what you might find naturally baked into a smartphone like the Google Pixel or iPhone, although it can slightly blur photos and create a little bit of an unnatural halo effect at higher intensities. Here are a few photos with it off, at default settings (around 19%) and nearly maxed out.

You’ll notice that my skin looks clearer and more blemish-free the higher the intensity, although the photo at 88% does have an uncanny, almost airbrushed quality to it. This brings to mind concerns about photos that don’t accurately reflect reality, although you can always turn off the Touch Up feature. Bokeh is such a mild effect that it and Face Lock alone might not be worth the subscription fee if you plan to ignore Touch Up.

It’s worth pointing out that smart Touch Up features often don’t handle darker skin well. While my complexion is very light, I video chatted with another Opal C1 user who has darker skin, and Touch Up did not negatively affect his experience with the camera.

Videos on the Opal C1

As a webcam, the Opal C1 is, of course, best viewed in motion. While photos make for great A/B comparison shots, I’ve also recorded a demonstration video showing how the camera fares in motion. The result? I really wish I bothered with makeup for this video because the Opal C1 does not lose any fidelity in motion. 

The footage looks crisp and clear, even in my somewhat shadowy shooting environment, and it’s easy to make out even minute details on my face (much to my chagrin). The ability to record in 1080p @ 60 fps also adds great versatility to the camera. However, the Mac-oriented ecosystem means this camera isn’t likely to attract gaming livestreamers, who would be the most likely to get use out of such a feature.

That said, I did record this video on a Windows machine and still walked away impressed, even if I was missing the Touch Up feature.

A test video also makes for a great demonstration of what Opal is calling this webcam’s “MicMesh.” In reality, it’s just an array of three omnidirectional beamforming microphones. The signal-to-noise ratio here is 59 dba, and the effect is something like what you might find on the best gaming headsets. While headsets usually come with one microphone as opposed to three, the reason the end result here is still similar is likely distance. On a gaming headset, that one microphone is usually placed next to your mouth, whereas the Opal C1 needs to capture audio from a few feet away.

It’s not a replacement for a dedicated desktop microphone, but if you’re planning to take casual calls, you won’t need to buy a separate microphone for use with the Opal C1. That’s a big plus over competitors like the Dell Ultrasharp Webcam, which doesn’t have any microphone, as well as over other webcams in general, which typically have microphones that aren’t worth using. That latter point is why I didn’t mind too much when Dell’s webcam nixed microphones, but the Opal C1 is starting to make that decision seem like poor futureproofing.

Also, if used in tandem with the Opal C1 software, the MicMesh features noise cancellation, which further improves the professional applications of this webcam.

Build Quality of the Opal C1

I covered most of the Opal C1’s physical qualities, from its sturdy metal exterior to the minor scuffs that are likely just a result of me using a beta unit, when talking about its design. Still, I want to briefly touch on the webcam’s somewhat stingy cord length. While the USB-C to USB-C cable included with the webcam is conveniently pre-coiled on one end, the overall cord only extended to about 58 inches when I pulled it taut. That’s not horrible but doesn’t touch the 78 inches I got on the Dell Ultrasharp Webcam. On the bright side, the cable is removable, so you can substitute your own. 

Bottom Line

The Opal C1 webcam is undoubtedly a niche, expensive product, but it represents a bright new future for webcams. While many webcams are just pitched as sensors that you attach to a computer, the C1 is a device in its own right. That means it has a smartly-considered build, a robust and easy-to-use software suite, and most importantly, its own processor.

The result is something more akin to what you might find on a higher-end smartphone, which is encouraging to see. Despite being smaller than computers, smartphones have been boasting better cameras than laptops and desktops for far too long.

Much of what makes the Opal C1 look so good are the little calculations it performs to enhance your footage on the fly. Most of these end up improving the final result, but photos can sometimes veer into the uncanny, especially in unusual lighting conditions.

Using computational photography means that your footage might not fully reflect reality, which is why I’m hesitant to parrot the marketing claims that the C1 is like a DSLR, a type of camera that lives and dies on accuracy. Photographers and other video professionals will probably want something that produces a more neutral look. Still, the end result for more casual users means you’ll look “touched up” in calls, and if you don’t mind a bit of digital airbrushing, it is a relieving feeling to know that your camera is helping you not look like you just crawled out of bed when you log into your morning standup.

Ethics and usefulness of reflecting an “enhanced” reality that might not exist aside, that lack of appeal to video professionals does mean that the Opal C1 is a bit hard to recommend, given its $300 price point. It’s primarily intended for video calls, but unless you’re a CEO or in the middle of a particularly grueling job interview cycle, I don’t think most people on video calls will expect you to have quality on par with what you’ll find on the Opal C1.

In that case, you can probably get away with something less expensive. The Opal C1 is also meant mainly for Macs, limiting its appeal to game streamers, who would otherwise fill a happy niche between casual video callers and full-on film directors.

Still, Mac users often pride themselves on having sleek, expensive gadgets that feel like the best-of-the-best, even if there’s technically better but more complicated and expensive enthusiast gear (like DSLRs) out there. If that sounds like you, the Opal C1 would make a great get.

If you’re a bit more wallet-conscious or use Windows, go for the Dell Ultrasharp Webcam instead because it’s $100 cheaper and offers excellent 4K image quality without any platform limitations. The Opal C1 represents a reality where webcams have finally caught up to smartphones, and hopefully means we’ll see similar technology in less expensive products in the future. 

An Amazon Web Services (AWS) customer had a really bad day when they received an unsolicited $45,000 bill for renting computing power from Amazon's cloud based servers. Further investigation showed that the customer's account was hacked, allowing the bad actors to spin up AWS servers around the globe while running a cryptocurrency mining software for privacy-focused coin Monero.

On-demand, distributed computing services such as Microsoft's Azure or Amazon's Web Services are common, used by organizations and individuals for multiple purposes. However, the advent of cryptocurrencies brought about the possibility to directly exchange computing power for cryptocurrency tokens. That, in turn, has turned users' cloud computing accounts into gold. Even if in this case, the amount of cryptocurrency actually earned was comparably pitiful compared to the costs it generated with it: 6 Monero coins worth approximately $800 were minted for a $45,000 cost.

The hack in question simply installed a known Monero mining program in each of the AWS computing resources. Every three minutes it repeated the install operation in an instance, and then kept the miner working for the maximum 15 minutes at a time that AWS allows "Lambda" functions to run. Amazon describes its support for Lambda functions as enabling users to "perform big data analysis, bulk data transformation, batch event processing, and statistical computations using longer running functions." But clearly it can also be used for cryptocurrency mining.

The AWS customer finally received a response from the company regarding his exorbitant $45,000 bill; after 27 hours of waiting, they informed him that his case would require a further 24 hours of "monitoring" before it was sent to the billing department for a proper review - which can then take days. It's not unheard of for AWS or other cloud service companies to waive their fees as these cases emerge; if that's the case here, then the user might just have to suffer the weight of that amount for a few more days. As more and more businesses and customers will start looking to offload their computational works to the cloud, though, perhaps further thought is required regarding cost control for these services.

It's not an unheard of occurrence: developers using AWS sometimes wrongly submit their keys to GitHub - a costly mistake that enables hackers to freely reign over the account, accruing costs. There are at least four such accounts on this comment thread relating to the AWS hack.

But a hacker doesn't need root access to an AWS account to do some damage. Not all cloud-provided services actually provide the option of setting a spending limit. Their argument isn't wrong: should they limit activity on a pure cost basis, AWS could be cutting off a legitimate surge in demand for whatever service it's providing for. But then, AWS sells a Machine Learning-enhanced add-on service, "Cost Anomaly Detection", exactly to "identify anomalous spend and root causes," so users can "quickly take action" whenever those situations arise. It somehow feels like that should be included in any customer-friendly environment.

If you aren't already using a VPN, you should be. 

Between ad networks keen on tracking our every move, traffic-snooping Internet Service Providers, and unsecured wireless networks, the state of digital privacy has never been more dire. A VPN doesn't prevent all forms of tracking, mind you. You'll need to pair it with an ad blocker and tweak your settings on social media for that. 

But it does still make you significantly harder to track. 

Let's say, for the sake of argument, that you don't really care about your digital privacy. It doesn't bother you that people can see what you're doing online. You've got nothing to hide, so why should you care about using a VPN? 

Three words: region locked content. 

If you're paying the same amount of money as everyone else for a Netflix subscription, you should have access to the same content as everyone else. Unfortunately, this is not the case. This is largely because, to be blunt, international copyright law is an unmitigated disaster. 

Every country has its own rules and regulations, and streaming services must strike a delicate balance between all of them. Frequently, this means a series of intricate contracts and agreements with content providers. As you might expect, said providers are the real beneficiaries here — and it's the end user that suffers. 

A VPN provides you with a means of getting around these region locks, much to the chagrin of both content providers and streaming platforms. Typically, this comes with a few trade-offs, like traffic slowdown and having your IP address flagged by certain sites. Ivacy suffers from neither of these issues. 

Consistently rated as the fastest VPN on the market, Ivacy is also a pioneer in Split Tunneling Technology. This innovation, exclusive to Ivacy, allows you to configure which traffic is routed through the VPN and which goes through your regular connection. Paired with Ivacy's P2P optimized secure downloading technology, this allows you to connect, download, and browse the way you want on up to ten devices.  

With over 3500 servers in more than one hundred locations, Ivacy also directly unblocks seven major Netflix regions:  

• France
• US
• Japan
• UK
• Australia
• Germany
• Canada

The best part, however, is the price. For a limited time only, Ivacy is on sale for 90% off. That means getting five years of service for just $0.99 a month. 

Get Ivacy VPN

Mozilla's Firefox browser just achieved a milestone today: It became the first "major" web browser to make its way to the Microsoft Store for both the Windows 10 and Windows 11 operating systems. Mozilla has played a sort of cat and mouse game with Microsoft in the past, particularly when it comes to default browser shenanigans in Windows 11. However, the two companies seem to have buried the hatchet with this latest move.

"Previously, if you were on Windows and wanted to use Firefox, you had to download it from the internet and go through a clunky process from Microsoft," said Mozilla in a statement. In addition, before July 2021, Microsoft prevented browsers using an independent engine from appearing in the Microsoft Store. With the July policy update, both Chromium and Gecko (Firefox's browser engine) are permitted within the Microsoft Store. Interestingly, Chromium also underpins the dominant Chrome browser, but Google has yet to bring its browser to the Microsoft Store.

"Now that Microsoft has changed its Store policies, choosing Firefox as your desktop browser is even more seamless — and it comes with all the latest Firefox features," Mozilla continued. "People deserve choice and we're glad there is an easier option to download Firefox on Windows."

Mozilla says that Windows users will now be able to easily see the benefits of Firefox and take advantage of the following features:

• Strong privacy protections with Total Cookie Protection, Enhanced Tracking Protection, and DNS over HTTPS
• Lightning fast site loading and display using WebRender and Quantum CSS
• Discovering more of the web quicker and smarter with Firefox Suggest
• Taking control of your entertainment with Multi Picture-in-Picture
• Personalizing your experience with seasonal Colorways.

Firefox's new home in the Microsoft Store comes almost two months after Mozilla reverse-engineered Microsoft's "one-click" method for setting the default browser in Windows 11. Microsoft previously only gave its homegrown Edge browser the ability to take on default status with a single click. For users with third-party browsers, it was a more cumbersome process involving navigating to Settings and changing individual file associations (i.e., HTM, HTML, PDF, SHTML, SVG, WEBP, XHT, XHTML, FTP, HTTP, and HTTPS).

"People should have the ability to simply and easily set defaults, but they don't. All operating systems should offer official developer support for default status so people can easily set their apps as default," a Mozilla spokesperson told The Verge back in September. "Since that hasn't happened on Windows 10 and 11, Firefox relies on other aspects of the Windows environment to give people an experience similar to what Windows provides to Edge when users choose Firefox to be their default browser."

You can download Firefox for Windows 10 or Windows 11 by directly visiting the Microsoft Store.

Hacker group Desorden (Spanish for disorder) via a forum post claimed responsibility for a full-fledged hacking maneuver targeting Acer's server cluster in India. The hack, which took place on October 5th, led Desorden to claim it has obtained around 60 GB worth of sensitive data on millions of (mostly, but not exclusively) Indian citizens whose personal data was stored in Acer's servers.

The group has released a free "sneak peek" at part of the collected data, exposing customer information for ten thousand individuals. Personal data, corporate data, as well as sensitive accounts, financial and audit data have been compromised. Privacy Affairs, the source of the initial breach report dated October 13th, says that it has independently confirmed the data's accuracy for a number of affected customers, which includes login details of Acer retailers and distributors from India.

The breach was conducted on acer.co.in – the Indian subsidiary of the Taiwanese manufacturer. Speaking to Privacy Affairs, Acer spokesperson Steven Chung said that “We have recently detected an isolated attack on our local after-sales service system in India. Upon detection, we immediately initiated our security protocols and conducted a full scan of our systems. We are notifying all potentially affected customers in India. The incident has been reported to local law enforcement and the Indian Computer Emergency Response Team, and has no material impact to our operations and business continuity.”

As is usually the case in affairs such as this, Desorden is now selling the remaining data to the highest bidder. The 10,000 individuals whose personal data was exposed are only meant to serve as proof of the data's accuracy, with all the potential negative implications for each and every one of the affected users. The hacking group claims that it will be providing Acer management the rights to verify all of the siphoned data. 

This is the second such intrusion on Acer's systems in 2021 alone. The company already faced a similar situation in March of this year, when REvil placed a $50 million ransom on illegally obtained data on Acer's financial spreadsheets, bank balances, and bank communications.

As for Desorden, this is the second claimed attack from the group during this month of October alone; they've also hacked SkyNet.com.my Malaysia Logistics, releasing the personal data of millions of clients. Desorden described its operations with an emphasis on chaos rather than the more usual profit/risk ratio of bad hackers, saying that "Desorden attacks on supply chains create higher level of disorder & chaos affecting many parties rather than the victim itself. If victim fails to pay, Desorden sells the data on black market in a few days."

Toshiba today announced a breakthrough on the road towards the quantum internet. In partnership with the Tohoku University Hospital (Japan), the team of researchers demonstrated the transmission of the entire human genome over 600 km of fiber optics - while encoding the information with quantum cryptography for the ultimate data privacy protection. The result of the research was published on the Nature Photonics scientific journal.

The data was moved and stored through several locations, spanning a total travel distance of around 600 km via fiber optics cables. A new, world-first dual band stabilisation technique was employed (the company has named it Twin Field), which helps in cancelling the problem of temperature and strain fluctuations usually present in quantum communications. This is pure physics: as data flows through optical cables, the cables themselves show diminutive contractions and expansions, which if not accounted for, can destabilize the extremely sensitive qubits used to encode and transmit the information - introducing errors in the data or even rendering it unusable. Toshiba's deployed dual band technique, as described by the company, "(...) sends two optical reference signals, at different wavelengths, for minimising the phase fluctuations on long fibres. The first wavelength is used to cancel the rapidly varying fluctuations, while the second wavelength, at the same wavelength as the optical qubits, is used for fine adjustment of the phase." The data was repeatedly verified at various stages of its journey through the network - and due to the new technique, showed no signs of degradation.

The research finally opens the door to long distance Quantum Key Distribution (QKD). QKD is essentially a distribution protocol for encryption keys, albeit based on quantum physics - and is being hailed as the final frontier in encryption schemas. This "final frontier of security" is being touted on the basis of quantum physics, and the behavior of qubits, themselves: after data has been encrypted with a secure QKD key, it can then be sent over an insecure connection (such as the internet), where only the holders of the decryption key can access its contents. Certain characteristics of the quantum realm are especially useful in guaranteeing security: for one, the basic quantum observation principle, which underpins much of quantum-bound research, states that the mere act of observing a flowing system will change its final result. Based on this, should the secure, QKD-encrypted communication be intercepted by a third party, the interception itself will induce changes into the flow of information, which can serve as a warning for the information sender (or receiver) that someone has attempted to tamper with and intercept the flow of data.

Andrew Shields, Head of the Quantum Technology Division at Toshiba Europe remarks, “QKD has been used to secure metropolitan area networks in recent years. This latest advance extends the maximum span of a quantum link, so that it is possible to connect cities across countries and continents, without using trusted intermediate nodes. Implemented along with Satellite QKD, it will allow us to build a global network for quantum secured communications.”

Another piece of investigation conducted by Toshiba includes multiplexing compatibility: this essentially allows both the data and the quantum keys to be transmitted on the same fibre, thus eliminating the need for a costly, dedicated infrastructure for key distribution.

Helix CEO Larry Dean Harmon pleaded guilty to one count of conspiracy to launder monetary instruments today, CoinDesk reported, after the U.S. Department of the Treasury Financial Crimes Enforcement Network (FinCEN) accused him of helping criminals launder hundreds of millions of dollars via a process called Bitcoin mixing.

FinCEN said in October 2020 that Harmon "conducted over 1,225,000 transactions for customers and is associated with virtual currency wallet addresses that have sent or received over $311 million" via Helix between 2014 and 2017. But he never registered Helix or his other company, Coin Ninja, as money services businesses.

Helix also "advertised its services in the darkest spaces of the internet as a way for customers to anonymously pay for things like drugs, guns, and child pornography," according to FinCEN, which also said that Harmon "engaged in transactions with narcotics traffickers, counterfeiters and fraudsters, as well as other criminals."

All of those factors led to Harmon being the first person charged in the U.S. for offering a Bitcoin mixing service. But what exactly is Bitcoin mixing? It's essentially a cooperative effort to make Bitcoin more private by combining a bunch of people's funds into one transaction that is later split evenly among all the participants.

"Basically, if a hundred users all send exactly 0.1 BTC to a new address they control, and then merge these 100 transactions into one big transaction, everyone gets 0.1 bitcoin back, but no one can see where they got it from," Bitcoin Magazine explained, adding that these mixers "can be designed in such a way that not even the entity that 'merges' the transaction can figure out which coins went where."

Not everyone — and perhaps not even the majority — of Bitcoin owners who use mixers are looking to launder money. Some might simply be looking to increase the privacy of their transactions based on their principles rather than the practical desire to evade law enforcement agencies, financial regulators, and others.

But there's no denying that Bitcoin mixers, much like the dark web Antinalysis blockchain analysis service, do appeal to cybercriminals. The question now is if FinCEN and other financial regulators will target more Bitcoin mixing service providers now that the case against Harmon has set a precedent.

As for Harmon: FinCEN issued him a $60 million penalty in October 2020. The charge to which he pleaded guilty carries a maximum sentence of 20 years in a federal prison, and according to CoinDesk, his lawyer said that he will also be subject to "a large and lengthy forfeiture agreement."

While online advertising is a major revenue source that allows your favorite websites, including this one, to make money, sometimes people want to block it for various reasons such as performance or privacy concerns. You could install blocking software on each device you own, but the most efficient way is to create a server using Pi-hole that filters all your web traffic at the local network level.

Pi-hole is a Raspberry Pi based network wide ad blocker. We install the software to a Raspberry Pi running Raspberry Pi OS, run a short installation script and then point our machines to the Raspberry Pi’s IP address for instant ad blocking. We can also -- and we strongly encourage this -- add the sites you use frequently like tomshardware.com to a whitelist so you can help them keep the lights on.

In this tutorial we will turn a spare Raspberry Pi into an ad blocking machine, tucked safely away on our network. We used a Raspberry Pi 4, but given the low requirements for Pi-hole, this is an excellent chance to resurrect that old Raspberry Pi that you have lurking in a drawer.

For This Project You Will Need

• Any Raspberry Pi with Ethernet
• Power and Ethernet cable for your Raspberry Pi
• A Windows PC

Setting Up Your Raspberry Pi

1. Download and install Raspberry Pi Imager from the Raspberry Pi website.

2. Insert a spare microSD card into your computer. Note that this card will be erased.

3. Launch Raspberry Pi Imager and press SHIFT + CTRL + X to open a secret configuration menu. 

4. Scroll down and click on Enable SSH and then set a new SSH password. Click Save when done.

5. Under Operating System select Raspberry Pi OS (32-bit). 

6. Under Storage click on the button and select the microSD card. Double check that you have the right drive before proceeding. 

7. Click on Write to download and write Raspberry Pi OS to the microSD card. When done remove the card from your computer. 

8. Insert the Raspberry Pi OS microSD card into your Raspberry Pi. Then connect your Raspberry Pi to the network via an Ethernet cable and finally connect power to boot the Raspberry Pi. 

Installing Pi-hole Over SSH 

SSH, a secure connection to your Raspberry Pi, is the best way to install and setup Pi-hole. We can use an SSH client to connect. For Windows this is PuTTY, and Mac, Linux users can directly connect via the terminal. With SSH we can install software and administrate the Raspberry Pi as if we were sitting in front of it. 

1. Windows users, download and install PuTTY. Linux and Mac users can directly open a terminal.

2. Via PuTTY enter the hostname as raspberrypi.local (on some networks, this is just raspberrypi without the .local) and then click Open.  

3. Enter your username and password when prompted. Note that these are not printed to the screen for security purposes.

4. Update your software repositories and then download the latest updates for your Raspberry Pi. 

$ sudo apt update$ sudo apt upgrade -y

5. Install Pi-hole using this one line installation script. This command will download the script and then run the installer in the terminal. 

$ curl -sSL https://install.pi-hole.net | bash

6. The Pi-hole installer will start by updating the available software, and then a menu based installation wizard will start. Press Enter to progress through the installation.

7. Choose eth0 as the interface to use with Pi-hole. Press Tab to move the red highlight to Ok and then press Enter. This is our Gigabit Ethernet port which will provide the best possible connection. 

8. Select your upstream DNS provider. We chose Google, but there are many others to choose from. Press Tab and then Enter.

9. Accept the default list of blocked sites by pressing tab and enter. 

10. Accept the default IPv4 and IPv6 protocols by pressing tab and enter. 

11. Accept the current network settings, and set them as static. Do make a note of the details as we will need them later. 

12. Install the web admin interface by pressing tab and enter. 

13. Install the lightppd web server used to serve the web admin pages by pressing tab and enter. 

14. Accept the default log options. 

15. Accept the default privacy mode by pressing tab and enter.  

The installation is complete and the final page recaps the IP address of the Pi-hole device and provides an admin webpage login password. 

16. Change the web admin password in the terminal using the following command. You will be prompted to type in the password twice.

$ pihole -a -p

Setting Network Connections for Pi-hole 

With our Raspberry Pi running Pi-hole setup and running we now need to point our devices to it so that Pi-hole’s DNS servers can block unwanted advertisements. Here we are manually setting up a wired network connection with Windows 10. The steps will be similar for Wi-Fi.

1. Right click on the Windows logo and select Network Connections.

2. Click on Properties. 

3. Click on Edit to update the network configuration. 

4. Edit your IP address to your desired address. We chose to stick with what the router’s DHCP server issued. Set the Subnet prefix length to 24. The Gateway is the IP address of the router, in our case 192.168.0.1. Preferred DNS is our Pi-hole DNS server, 192.168.0.24. The Alternative DNS is used if our Pi-hole device goes offline, in this case it is Google’s DNS server. Click Save to write the changes and restart the network interface. 

How to Whitelist a Site in Pi-Hole 

Considering that many content sites, including ours, rely on advertising for a significant portion of their revenue, it makes sense to whitelist those you wish to support so they can serve you ads. Pi-hole has a whitelist menu where we can add specific domains and subdomains which will be added to Pi-hole’s lists.

1. Open a web browser to the IP address of your Raspberry Pi, and type /admin. For our setup we went to http://192.168.0.34/admin/ 

2. Log in to your Pi-Hole by entering the username and password. We earlier changed the admin login password. 

3. From the dashboard click Whitelist. 

4. Under Domain, add the URL of the site that you wish to whitelist, then click Add to Whitelist. This site will now be able to serve adverts. 

Domains can be enabled / disabled in the whitelist by clicking on the button under Status. Whitelisted domains can be deleted by clicking on the trashcan icon. 

5. Click logout to return to the default admin page. 

There you have it, your browser tabs are free of adverts and your browsing just got a lot faster, all thanks to that spare Raspberry Pi that was lurking in your drawer. 

China's decision to shut down Bitcoin mines throughout its provinces could make the U.S. the new leading contributor to the cryptocurrency's hash rate, CNBC said, especially if miners seeking cheap energy and privacy laws flock to the country.

The Cambridge Centre for Alternative Finance (CCAF) revealed earlier this month that "China’s share of total Bitcoin mining power declined from 75.5% in September 2019 to 46% in April 2021," which was before the country started to crack down on crypto, allowing the U.S. to rise to second place as its share increased from  4.1% to 16.8%.

CCAF said it wasn't sure where Bitcoin mining operations shut down by the Chinese government would go, but multiple executives at cryptocurrency-related companies told CNBC that it would make sense for miners to move to the U.S. because of the ready supply of cheap energy and the relative stability of the country's regulations.

CNBC said "the U.S. is also home to some of the cheapest sources of energy on the planet, many of which tend to be renewable." Data provided by Statista indicates that the U.S. electricity prices aren't the lowest in the world—that distinction appears to belong to Iran—but they're much lower than they are in other regions.

The push for renewable energy was also said to make the U.S. a compelling destination for China's outcast Bitcoin miners. Efforts to mine cryptocurrency using hydroelectric, nuclear, and other clean energy sources could help mitigate some of the criticism regarding the amount of power these operations rely upon.

But that's only part of what makes the U.S. a compelling destination for Bitcoin miners, CNBC reported. The freedoms and protections afforded by American regulations—such as they are—could also appeal to Chinese mining operators looking to relocate somewhere that probably won't just kick them out again.

“If you’re looking to relocate hundreds of millions of dollars of miners out of China, you want to make sure you have geographic, political, and jurisdictional stability," Blockcap founder Darin Feinstein told CNBC. "You also want to make sure there are private property right protections for the assets that you are relocating.”

There's already evidence that Chinese miners are moving to the U.S. Bit Digital announced on July 13 that it "accelerated its migration program to North America, and anticipates completing migration of its remaining China-based fleet during the third quarter of 2021," for example. (It also has some operations in Canada.)

The Washington Post reported that other Chinese mining operations are considering moves to the U.S. as well. Some, like BIT Mining, have raised funds to move outside China without specifying their destination. But so far the consensus seems to be that the U.S. will be the leading destination for these miners as they look for a new home.

Following in the footsteps of Apple and Google locking down their respective app stores, Oculus is finally taking the fear we all had when Facebook bought it and making it a reality. This October, the company will start ending support for Oculus accounts and replacing them with Facebook accounts. 

In a post on its website today, Oculus announced that starting this October, new Oculus users will have to log into their Oculus HMDs with a Facebook account. 

Those with an existing Oculus accounts have two years to merge it with a Facebook account. Beginning in 2023, Oculus will completely end support for Oculus accounts. At that point, if you don’t merge your account with a Facebook account, Oculus can’t promise full functionality for your device.

“We will take steps to allow you to keep using the content you have purchased,” the company said of users who don’t merge accounts, “though we expect some games and apps may no longer work.” 

Oculus explained that this might be because of features that will be shifted to requiring a Facebook account or because of developers choosing to no longer support an app or game.

The company claims that the change is due to the ease-of-use presented by a single log-in, as well as upcoming Social VR features, like Facebook Horizon. Still, it’s unclear why support for Oculus accounts needs to end to make these features accessible for Facebook users. 

Oculus noted that you can still maintain a separate VR profile even after merging accounts. You just need to ensure that your Facebook profile is set to only be visible to yourself after merging it with your Oculus account. Then, your Oculus friends won’t be able to find you by your Facebook name.

These privacy features are supposed works both ways, too. After you merge your accounts, you'll be able to use special settings to control how much of your VR activity shows up on your Facebook timeline, Oculus said.

If you’re like me, then your Facebook account sits mostly abandoned except for the occasional moment when someone needs to plan an event. If you’re like my editor, then you don’t even have a Facebook account. Whether this change stems from Facebook trying to use Oculus to revitalize its platform, or Oculus failing to stand on its own without the platform, we do not know. Regardless, it does point to a new and unfortunate deterrent to some of the best VR headsets on the market.

Lian Li silently listed its new DK-05F and DK-04F PC cases that double as desks. They're updates of the classic DK-04 and DK-05 desk cases, bringing the unique hardware up to today's standards. Changes include the addition of addressable-RGB, USB Type-C and a fan controller.

We first saw Lian Li's new desk cases at CES 2019. One of the things that caught our eyes the most was the 8mm thick tempered glass panel that sits on top of the desk. At the press of a button, it switched from being fully transparent to opaque, either exposing your PC hardware in all its glory or giving your computer's internals some much-needed privacy.

As someone who appreciates an uncluttered desk when I'm working, if I were in the market for a case like this, (which I'm not, but that's solely because of the price point), the addition of the switching glass would make it a much more tempting option.

Meanwhile, the DK-04F and DK-05F still come with electronic height adjustments and can handle up to 80kg (176.4 pounds) of added weight. The smaller of the two cases comes with room for a single ATX system, while the larger of the two can hold up to two full ATX systems. Both have room for ample (liquid) cooling, hard drives and other accessories, and installation is should be made easy with removable motherboard trays.

Lian Li hasn't announced pricing for the updated DK-04F and DK-05F cases yet, though they certainly won't come cheap. The previous versions started at around $1,000, with prices skyrocketing from there once you looked at bigger versions or additional features.

Here's a strange one: CyberNews reported Friday that a Google Cloud database exposed the personal information of roughly 200 million Americans. It's not clear who owned the database, however, and it appeared to have been wiped on March 3. But that wasn't actually the end of the saga; things only got weirder from there.

First things first. CyberNews said the database contained 800GB of data in three folders. The first had 200 million records about American individuals, the second had "emergency call logs of a fire department based in the U.S." and the third had "a list of some of the 74 bike share stations that used to belong to a bike share program."

CyberNews said the records collected the following information about their subjects:

• Full names and titles of the exposed individuals
• Email addresses
• Phone numbers
• Dates of birth
• Credit ratings
• Home and mortgaged real estate addresses, including their exact locations
• Demographics, including numbers of children and their genders
• Detailed mortgage and tax records
• Detailed data profiles, including information about the individuals’ personal interests, investments, as well as political, charitable, and religious donations

CyberNews guessed that some of the information was taken from the U.S. Census Bureau, but according to its analysts, the database itself was likely maintained by "a data marketing firm or a credit company." Unfortunately the unsecured database reportedly didn't include any information that revealed its owner's identity.

The database itself appeared to have been wiped on March 3. That could be a good thing, since it means that information's no longer publicly exposed, but it might also mean that a hacker wiped the database after copying the records with the intent of selling them to someone else. And that's where things get even weirder.

CyberNews said that "we did not manage to discover who [the database] belonged to before the unidentified party erased all the records and left a link to a website where a dancing pirate urges visitors to fix their security." Which is exactly the kind of thing one wants to hear when the information of 200 million people is at risk.

This is the kind of story that A) immediately makes one question how much information has been exposed in public databases like this and B) leads people to check their calendars to make sure the entire report wasn't an April Fools joke. Rest assured, even though the last few months have felt like decades, it's still March.

Microsoft published a blog post today explaining how it's defending Windows users against cyber attacks taking advantage of the novel coronavirus crisis.

This is a serious concern. Email spammers have used COVID-19 to convince people to download malicious attachments, malware distributors have co-opted an infection dashboard created by Johns Hopkins University and other scammers have set up tens of thousands of websites with domain names related to the pandemic.

But the problem shouldn't be blown out of proportion. "While phishing and other email attacks are indeed happening," Microsoft said, "the volume of malicious emails mentioning the coronavirus is very small." That might change as the pandemic continues, but at least for now there don't appear to be any large-scale attacks.

Microsoft said that 91% of cyber attacks start with email, which is why the company relies on "a multi-layered defense system that includes machine learning, detonation and signal-sharing" to "quickly find and shut down email attacks." That system analyzes messages, URLs and attachments to determine if they're a risk.

The company said it was able to shut down a spear-phishing campaign that took advantage of COVID-19 in less than 30 minutes by using this system. It successfully defended people using Microsoft email services via Office 365, Outlook and Exchange servers, as well as PCs running its Microsoft Defender security offering.

Automated systems can't always catch everything though, which is why Microsoft shared a list of "tell-tale signs" an email is part of a phishing campaign that includes:

• Spelling and bad grammar
• Suspicious links
• Suspicious attachments
• Threats
• Spoofing
• Altered web addresses
• Incorrect salutation of your name
• Mismatches

These "tell-tale signs" don't just apply to phishing attempts taking advantage of the COVID-19 pandemic; they can also help people avoid other types of malicious attacks against them. Hopefully, we can one day reach the point where nobody has to be reminded of these basic warning signs.

Johns Hopkins University has provided a valuable resource for tracking novel Coronavirus infections, deaths and recoveries across the world from a single dashboard. Unfortunately it's not just valuable for people monitoring the pandemic--KrebsOnSecurity reported that malware distributors are using it to find victims.

The report indicated that cyber criminals have started to sell infection kits featuring this Coronavirus-tracking dashboard for anywhere from $200 to $700. Buyers could use those kits in malicious websites and emails to infect systems with the AZORult malware. Tracking a physical infection could lead to contracting a digital one.

Cylance explained in June 2019 that AZORult can be used to "steal personal information such as passwords, cookies, browsing history, and more" from infected systems. That sensitive information could then be abused by the attackers or bundled with other stolen data so it can be sold on illicit marketplaces.

This isn't the first time the Coronavirus outbreak has been used to spread malware. Spammers actually started taking advantage of it in January by claiming to offer information about how to avoid contracting the novel Coronavirus (COVID-19). Those messages included attachments that spread the Emotet malware when opened.

Similar attacks will probably continue as long as COVID-19 remains in the news. (Which, if it continues to spread throughout pretty much the entire world, will be for a while.) The best way to defend against these efforts is to refrain from opening suspicious attachments or allowing websites to install anything on your system.