Yearly Archives: 2020

Google is making changes to their Terms Of Service, which become effective 31 March 2020. Within these changes, it has been stated that UK citizen data will be moved to the US – under the control of their US entity, Google LLC – moving it away from the Northern Ireland (ie UK-based) territory where it is currently stored.

This decision is in light of Brexit as the UK will no longer be part of the EU. User data will now be stored in the US, which has been criticised by privacy activists, querying the legal integrity,security, and safety of the data stored.

Google will be moving all account data over to the US, including paid G Suite accounts. However, higher tier G Suite paid Business and Enterprise plans can elect to choose where their data is stored – see here for more information. It is also announced that soon similar changes will be made to the Terms Of Service for YouTube, YouTube Paid Services and Google Play. Privacy settings can be reviewed and managed via Google Accounts at accounts.google.com.

Jumbo’s (a privacy settings management app) creator, Pierre Valade, stated “Privacy is something that people want, but at the same time it just takes too much time for you and me to act on it”. Jumbo limits the amount of time that Google stores your search results and other behavioural data, and also works on Twitter, Facebook and Amazon’s Alexa. However, this does not solve the issue of Google moving the data for their core services such as Gmail and Drive to the US.

Although not necessarily wanted, it is legal for Google to move such user data to the US. Google has responded to fears, claiming they (Google LLC) would be subject to the same restrictions under GDPR regardless of whether UK user data is in the UK or the US. And therefore there will be no changes in data protection standards.
You can read Google’s full documentation on the upcoming changes here: policies.google.com/terms/changes

Vaio laptops were locked into a Japanese-only market for four years. Now they are available in the European market again, with a range of business-focused devices.

Sony previously hit the market with Vaio laptops, which were considered fantastic high-end laptops, known for their quality, reliability and performance. Despite the success, in 2014 Sony decided to take Vaio devices off the market. However, Vaio had not been completely eliminated. After Sony took Vaio laptops off the shelves, the engineers and product managers, responsible for Vaio within Sony, purchased the brand rights and established it as an independent company separate to the Sony conglomerate. Vaio was then taken to Japan and sold off to Japan Industrial Partners.

A review has scored the new Vaio SX14 97% for performance, which is ahead of the Dell XPS 13, and the Microsoft’s Surface Book 2. Vaio laptops have an attractive and professional look, although a review of the SX14 claimed “the device felt too flimsy and flexible”. Another downfall is that the display is not up to scratch for any graphics professionals – the screen covers 86% of the sRGB colour gamut, which isn’t terrible but it is arguably not good enough for professional photo or video editing.

A positive is the portability of the new Vaio laptops, weighing just 1kg. A further upside is that the SX14 is fully accessible, meaning that all internal components can be easily accessed and thus arguably repaired and replaced. Adding to this, the new Vaio laptops come with good connectivity including three USB ports, a USB-C port and an HDMI port, (a very handy addition).

The new Vaio laptops have the option for Intel Core i7-8565U processors and a max 16GB of RAM, which is a very decent good spec for current-gen laptops. However, for this, there is a high price of over £2,000. Pricing for the new Vaio laptops are currently set between Read More

The internet security software provider, Avast!, sold hundreds of millions of people’s highly sensitive and personal web browsing data through a subsidiary company, Jumpshot.

Avast! has a huge number of 435 million active users per month, of which Jumpshot has data from 100 million devices. Avast! have free and paid products, which partly explains their large user base, and many free users have stated that they were unaware of their data being sold and had not agreed to this. It is likely that the Avast! free product was subsidised by or founded on (or both!) monetising user data in this way

An investigation by Motherboard and PCMag found that Avast! – via Jumpshot – sold personal data to many of the world’s biggest companies such as Google, Yelp, Microsoft, McKinsey, Pepsi and Home Depot. It was revealed that the Avast! software installed on users’ computers collects data, and that Jumpshot repackages it into various different products that are then sold on. It was shown that some clients paid millions of dollars for data that included a “All Clicks Feed,” which tracks user movement across all their browsing in precise detail.

In many cases, this data was to remain confidential between the company selling and the clients purchasing. Employees from companies including Expedia, IBM, Intuit, Loreal, and Home Depot, for example, were instructed not to talk publicly about their involvement. Microsoft declined to comment on the specifics of why it purchased such data, and stated that it doesn’t have a current relationship with Jumpshot.

The data obtained through the investigation shows that specific information, such as Google searches, lookups of locations, LinkedIn page visits, particular YouTube videos, and websites visited were shared. From the collected data, it is possible to determine what date and time a user visited sites, and in some cases what search term they entered into these sites.

Avast! first collected user data through a browser plugin which was they said was intended to “warn users of suspicious websites”. When this was previously exposed, browser makers Google, Mozilla and Opera removed Avast!’s browser extensions. After this, Avast! stopped collecting data through browser plugins but instead began to collect data through their core software itself.

Since this investigation was published, just last week, Avast! began asking its existing users to opt-in to data collection, despite most being completely unaware their data was being collected previously.

The investigation has had a significant impact, which Avast! seems to have recognised. Avast! has published that their relationship with Jumpshot and data collection will be terminated with immediate effect. However, it is clear Avast! was abusing customer data and privacy without their knowledge.

Despite their response, we recommend that you cease using all Avast! software, even if you have a paid license.

This is a good example of a company providing a seemingly beneficial service and/or piece of software that is in fact masquerading to do something else. As with many things online, if it seems too good to be true then it very likely is too good to be true!

Google has just made a significant change to the layout of Google Ads in their search results. It is now extremely difficult to differentiate between advertisements and organic results.

The only way now to distinguish between ads and search results is a small black-and-white “Ad” icon next to the former. This is a striking change, considering up until 2013 Google made a very clear distinction between ads and search results. Google initially showed its ads with an entirely different background color, and after this Google continued to use unique colors so that users could easily distinguish between the two.

Google has stated that the recent changes were in order to “better guide users through the information available on the web”. The changes were also reasoned to make their branding clearer and “help [users] better understand where the information is coming from”, which seems in contradiction to the changes that have been made.

Sundeep Jain, Director of Product Management for Search Ads, further justified these changes by saying that a simpler design “makes it easier for users to digest information”, according to Search Engine Land. He also added that the reduction of colours used brings more harmony to the layout.

It is difficult to reconcile these statements, considering the ease of viewing ads before, and given Digiday have revealed data showing that these changes may already be causing people to click on more ads. Which is arguably Google’s true intention. Another digital marketing agency also showed that click-through rates have since increased for some search ads on desktop, and mobile click-through rates increased from 17-18% in 2019, following similar changes to Google’s search layout on mobile.

These changes remind us that Google is fundamentally an ads business. Google’s parent company Alphabet made nearly $34 billion from Google advertising, out of a total revenue of $40 billion in the third quarter of 2019 alone. For businesses at that sort of scale, small changes in ad click-through rates could end up having a huge effect on their revenue – a micro increase at a macro level could be extremely profitable.

Web browsers make a huge difference to everyday surfing on the internet. Now there are more competing browsers than ever, which can make it difficult when choosing which is best to use for your needs and purposes. Below we have listed the main browsers and summarised their advantages and disadvantages – considering faster performance, better security, or more flexibility through downloadable extensions.

Chrome – Great for speed
Chrome is a cross-platform browser, which is incredibly stable and well presented to take up the minimum of screen space. There is a wide range of obtainable extensions to install, meaning it can be easily personalised. There is support for parental controls and a huge range of tweaks and settings to ensure maximum efficiency.

However, Chrome isn’t without its downsides. It’s one of the heaviest browsers in terms of resource use, therefore it isn’t brilliant on machines with limited memory. Another consideration is that with Google’s ownership running through, you may be uncomfortable with how your browsing data is used.

Edge – reborn as a Chromium-based browser
Microsoft has recently released their existing Edge browser in a new Chromium-based form, on January 15, 2020. The new Edge uses the same engine as Google’s Chrome browser and now runs faster and smoother, becoming a direct competitor. It is also compatible with all supported versions of Windows and macOS.

Edge features various options for protecting you from online trackers and support for extensions, both from the Chrome Web Store and Microsoft’s own extension repository. If the new Edge is downloaded on Windows 10 PCs, it will automatically replace the legacy version of Microsoft Edge.

Firefox – Great for security
Firefox has been known for its flexibility and support for extensions, however, it recently received its biggest update in 13 years, meaning previous problems with speed have now been turned around – with speeds comparable to Google Chrome thanks to Firefox Quantum, released last year. The new Firefox makes frugal use of memory, even with lots of tabs open.

Firefox is well prepared when it comes to privacy. It’s makers, Mozilla, is a non-profit organisation, which means it doesn’t have the same impetus to collect your data as some other browser developers. The organisation also makes regular updates to help protect its users’ privacy as internet companies come under increasing scrutiny over the way they treat people’s data.

Safari – macOS only
If you want to complete the Apple experience, then Safari may be the one for you. The browser has seen constant improvements over the years.

Safari 13 arrived on Macs in September 2019. It’s associated with macOS Catalina but can also be installed on older versions such as Mojave and High Sierra. There are also privacy and security improvements, including in-built alerts to weak passwords.

Privacy is an important part of Safari, with Intelligent Tracking Protection there to stop advertisers from watching what you do. This is accompanied by anti-fingerprinting settings, which is intended to prevent sites from looking at your hardware and software configuration to work out who you are online, plus security features that block sites that could contain malware.

With Apple optimising Safari for macOS, the company claims significant speed advantages over the likes of the cross platform browsers, such as Chrome and Firefox. For example, battery life is consumed at a lower rate when streaming web video.

Opera – a good choice for slow connections
Opera makes up only around 1% of the browser market but is a browser worth considering. Opera launches fast, the UI is clean, and it does everything its rivals can do with a couple of extras.

One of the main reasons to use Opera is its Opera Turbo feature. This compresses your web traffic, routing it through Opera’s servers, which makes a huge difference to browsing speed if you’re using a slow remote connection or your broadband connection is not good. It reduces the amount of data transferred too, which is great if you’re using a mobile connection, and this re-routing also avoids any content restrictions your ISP might place on your browsing.

Vivaldi – unique docking and tab-stacking
Vivaldi is a browser with a difference. Vivaldi allows you to personalise the whole style and structure of its interface. Vivaldi is built on Chromium, and can be seen as a combination of Chrome and Opera. You can expand it even further with extensions from the Chrome Web Store. Some extensions behave slightly differently in Vivaldi, but most work perfectly.

Brave – a new take on online advertising and privacy
Brave is Chromium-based, with a heavy focus on user privacy and comes with a radical reimagining of how online advertising ought to work. Brave was one of the first browsers to include built-in advertisement and tracker blockers.

It also comes with its own cryptocurrency, called BAT (or Basic Attention Token), allowing users to reimburse the sites and creators they like. If you decide to opt-in, users can purchase BAT through a cryptocurrency exchange, like Coinbase. Users can also earn more by viewing “privacy-respecting” ads. Unlike traditional advertising networks, the calculations determining what advertisements to show you are performed on your own device. This means advertisers aren’t able to build a profile of you and your interests. This is only available in some countries, mostly across Europe and the Americas, plus Israel, India, Australia, South Africa, the Philippines, Singapore, and New Zealand.

Summary
Whilst Chrome accounts for almost 70% of market share, depending on your requirements there are different browsers to consider to suit your needs. If you run on a slow broadband connection, Opera may be the best for you. If you want ultimate customisation, you may wish to try Vivaldi. Brave has the best features for the privacy conscious. For those who have low memory specifications, Firefox should be considered. For macOS users, Safari will optimise performance. Chrome is renowned for speed, however, the new Chromium-based Edge browser is claimed to surpass this.

Google will limit less secure apps (LSAs) accessing G Suite accounts

LSAs are non-Google apps that can access your Google account with the username and password. This makes accounts much more vulnerable to hijacking attempts. Instead of LSAs, apps that support OAuth— a modern and secure access method, should be used.

The securest way to protect against others hacking your accounts is to use a Multi Factor Authentication (MFA), which requires you to enter an additional code or a verification from another device to access your account. By implementing an authentication protocol users are 99.9% less likely to be compromised (source).

Using an authentication protocol will help to identify and prevent suspicious login attempts, preventing hijackers from accessing the account data even if they have the username and password. Such details are possible to find, as seen through Phishing and Credential Stuffing. By using an authentication protocol users can be verified with an extra level of protection. Authentication also helps Google enforce G Suite admin defined login policies, for example security controls such as whitelisting apps and offering scope-based account access.

Deadlines:

After June 15, 2020 –

• Users will not be allowed to connect to an LSA for the first time. This includes third-party apps that allow password-only access to Google calendars, contacts, and email via protocols such as CalDAV, CardDAV, IMAP, and Exchange ActiveSync (Google Sync).

Users who have connected to LSAs prior to this date will be able to continue using them until usage of all LSAs is turned off.

After February 15, 2021 –

• Access to LSAs will be turned off for all G Suite accounts.
• MDM configuration of CalDAV and CardDAV will no longer work for existing users. All existing users will be required to re-add their Google accounts if they wish to sync contacts, calendar, or email.

What to do:

Admins

If your organization uses a mobile device management (MDM) provider to configure CalDAV, CardDAV, and Exchange ActiveSync (Google Sync) profiles, admins will need to push the Google Account using their MDM provider, which will re-add their Google accounts to iOS devices using OAuth. See here for more information.

Devices

No change is required for scanners or other devices using simple mail transfer protocol (SMTP) or LSAs to send emails.

Email

• Outlook 2016 or earlier, use G Suite Sync for Microsoft Outlook. Alternatively, move to Office 365 (or Outlook 2019), which supports OAuth access.
• Thunderbird or another email client, re-add your Google Account and configure it to use IMAP with OAuth.
• Mail app on iOS or MacOS, or Outlook for Mac, and uses only a password to login, need to be removed and re-added. When adding it back, be sure to choose Google as the account type to automatically use OAuth.

Calendar

• If CalDAV is used to give an app or device access to a calendar, switch to a method that supports OAuth. The Google Calendar app is recommended by Google.
• If the G Suite account is linked to the calendar app in iOS or MacOS and uses only a password to login, the account will need to be removed and re-added. When adding it back, be sure to select “sign in with Google” to automatically use OAuth.

Contacts

• If the G Suite account is syncing contacts to iOS or MacOS via CardDAV and uses only a password to login, the account will need to be removed and re-added. When adding it back, be sure to select “sign in with Google” to automatically use OAuth.
• If the G Suite account is syncing contacts to any other platform or app via CardDAV and uses only a password to login, switch to a method that supports OAuth.

Please contact us if you require further information or advice in catering for this change, and moving to secure applications and apps to use with G Suite.

At the end of 2020, Adobe will stop providing Flash Player and will stop supporting Flash.

Flash was popular software (often seen by users as a plugin) which had a huge influence in the early 2000s on videos, games and applications being able to run across devices. Many of us may remember using Flash with early streaming video services, for example, in the UK, previous versions of BBC iPlayer and Channel 4’s 4 on Demand (now called All4).

However, with the increase of open web technologies, which can do the same thing without the additional Flash software – currently only 17% of desktop Chrome users visit a site with Flash daily – usage of Flash continues to decline. Trends indicate that most sites and services are migrating to alternate open web technologies.

In 2010, Steve Jobs publicly recommended that Adobe focus on open standards and move away from Flash. It was also claimed that Flash posed security risks, was unstable and drained batteries – which Adobe disputed. With this Apple refused to support Flash, which could have begun the decline of the usage of Flash.

Open web standards such as HTML5, WebGL and WebAssembly have grown over the past several years, and most can now provide the capabilities and functionalities that older plugins pioneered. This has resulted in open web technologies becoming faster and more power-efficient than Flash, they are also more secure and can be used across devices (both mobile and desktop). Using web standards, which are provided by the web browser itself, is also easier for end users as they do not need to install and manage/update plugins.

In Chrome, currently the most popular web browser globally, since version 76, Flash has been disabled by default, and users must manually re-enable it in order to see Flash based content.

Adobe will continue to support Flash through 2020, however, Adobe encourages users and partners to migrate to new open web technologies as soon as possible before its end-of-life. Adobe will continue to provide class animation and video tools, such as their Animate CC and Premiere Pro CC applications, but Flash itself will become obsolete.

The California Consumer Protection Act (CCPA) has gone into effect for residents in California in the United States, as of the 1st of January 2020. This statute is intended as further regulation and protection to customers which gives more visibility into how businesses collect, use and sell personal data. Businesses have until July 1st to become compliant, before enforcement of the statute begins.

The CCPA states that customers have the right to access all personal information held by businesses who meet the criteria below. Subscribers can find out what personal data of theirs is known, how it was obtained, how it is used, and who has access to it. Customers have the right to forbid the use and/or sale of their data. They can also request the deletion of all personal data, held by businesses.

Businesses the CCPA will affect
For-profit businesses, who have customers or subscribers in the state of California, and who meet at least one of the following conditions:

• Earns $25m+ in annual revenue.
• Receives 50,000+ device, household, or individuals’ information annually.
• Earns 50% or more of its annual revenue from the sale of personal data.

Businesses with more than 4 million customers will need to adhere to additional regulations.

CCPA and GDPR
The General Data Protection Regulation (GDPR) and the CCPA are both regulations that aim to give customers more control and transparency over the how their data is used. However, these are different regulations, and so it is important to note that a business that is GDPR compliant is not automatically CCPA compliant, and therefore must check the requirements to meet any additional compliance for the CCPA

Business responsibilities
Businesses that fit the CCPA criteria will need to ensure that they:

• Notify customers:
  Customers must be notified that their data is being collected beforehand, and the notice must be attention-grabbing and available for those with disabilities. There must be an option to opt-out, or to contact the source who collected the data and confirm if the data was gathered in accordance with the CCPA.
• Privacy policy:
  Businesses must state their privacy policy and acknowledge customer rights, which include:
  • A customer’s right to know what personal data is held, how it was obtained and how it is used.
  • Disclosure on what customer data the business has collected during the previous 12 months and whether or not they’ve disclosed or sold that information to other parties.
  • A customer’s right to have their data deleted at their own request.
  • Additional rights including opting out of the sale of their data and non-discrimination for privacy preferences.
• Handling of requests:
  There must be at least two methods of contact for customers to request their information. One method should be a free number to call and the other (if an online business) should be on the business’s main website.
• Training and request records:
  Businesses and their staff should have the necessary training in data handling and privacy policies. Records must be kept for two years of any related requests received.
• Incentives for data collection:
  Businesses can offer motivations to customers for sharing personal data, such as discounts for subscribing. However, this can’t negatively impact those who do not wish to share their data.

If the CCPA applies to your business you can contact us for advice on how to set up customer forms appropriately and adhere to the CCPA. New regulation can be an opportunity for businesses to consider new strategies and improve their messaging. Full information of the CCPA can be found at source here.