Month: January 2017

Enlarge / Account recovery programs like this one from United Airlines pose a significant threat to users. (credit: Dan Goodin)

Facebook is unveiling a new service that remedies one of the biggest headaches facing online users today—the forgotten password.

Starting Tuesday, Facebook will offer a service that allows users who lose their GitHub login credentials to securely regain access to their accounts. The process takes only seconds and uses a handful of clicks over encrypted HTTPS Web links. To set it up, Facebook users create a GitHub recovery token in advance and save it with their Facebook account. In the event they lose their GitHub login credentials, they can reauthenticate to Facebook and request the token be sent to GitHub with a time-stamped signature. The token is encrypted so Facebook can't read any of the personal information it stores. After the request is sent, the GitHub account is restored. With the exception of Facebook's assertion that the person recovering the GitHub account is the same person who saved the token, Facebook and GitHub don't share any personal information about the user.

The service is designed to eliminate the hassle and significant insecurity found in most account recovery systems that exist now. One common recovery method involves answering security questions. Many of the questions—for instance, "What is your favorite sport?" and "What is your favorite pizza topping?" asked by United Airlines—are easily guessed. That leaves people susceptible to account takeovers. Other methods, such as delivering security tokens by e-mail or SMS text message, lack the kind of end-to-end encryption that's increasingly expected for secure communications.

Enlarge / The Google Pixel and Pixel XL (credit: Ron Amadeo)

Google has announced a new Android beta release: Android 7.1.2. The update is the latest in Google's new "incremental maintenance release" strategy, which should see users get smaller builds of Android more frequently.

The rollout of the beta is for the Pixel, Pixel XL, and Pixel C, as well as the Nexus 5X and Nexus Player. The Nexus 6P isn't on the list for today, but Google says 6P will get the update "soon." Missing are the Nexus 6 and Nexus 9, which might be hitting end-of-life status with this release. Users of the eligible devices can head to android.com/beta and opt-in to the beta rollout. Alternatively, beta factory images are available here.

So what's new? Google promises "a number of bugfixes and optimizations, along with a small number of enhancements for carriers and users." A quick glance does not reveal a huge amount of changes. The dialer has references to a "multimedia call," Bluetooth was touched (bug fixes, I'm sure), there are a few Verizon-specific things like a demo mode (on the Pixels, at least), and a new "high temperature" warning probably has something to do with Daydream VR mode overheating the phone. If something amazing pops up once we get it flashed, we'll let you know.

Megan Geuss

HAWTHORNE, Calif.—On a hot, Southern California Sunday, 27 teams gathered to show off their model Hyperloop pods. But only three won a chance to load their pods into a low-pressure environment created in a 0.75 mile (1.25 km) Hyperloop test tube built by SpaceX next to the company’s headquarters. Those teams—from Massachusetts Institute of Technology, WARR (a student group within Munich Technical University), and Delft University of Technology—were determined to have some of the most sophisticated pods, capable of levitation, braking, and running on their own power.

Tesla and SpaceX CEO Elon Musk popularized the idea of the Hyperloop—a theoretical pod system that runs in low-pressure tubes, hovering along a track using magnetic skis to minimize friction. As Musk imagined it in 2013, the system would send pods up to 760 mph. But the CEO decided that he didn’t want to work on the project himself, so he made his ideas available to anyone interested in running with it. That spawned several startups as well as this competition for students and other private research teams.

Microsoft's own Surface: one of the few Windows RT devices that you could actually buy.

There are increasing signs that Microsoft is planning to release a new edition of Windows 10. Evidence from the Windows SDK and in product key configuration files points at something called "Windows Cloud" (and "Windows Cloud N," which is presumably the same thing with Media Player removed to make the EU happy). Amid speculation that this may be some kind of subscription edition of Windows, Mary Jo Foley reports that according to her sources, it is in fact a resurrection of Windows RT. Specifically, she writes that Windows Cloud is a version of Windows that can only install apps distributed through the Windows Store.

Windows RT, the version of Windows 8 that made its debut with Microsoft's ARM-powered Surface, was not merely a version of Windows compiled for ARM. It was Windows compiled for ARM with the addition of an important restriction: the only applications it could (officially) run were applications downloaded and installed through the Windows Store, apps digitally signed by Microsoft. Third-party desktop applications were not permitted.

The upside of this design was a certain amount of security and reliability. The Store apps are sandboxed and locked down, giving a PC-like device some semblance of smartphone-like robustness. But the downside was substantial. Most Windows applications are desktop applications written using the Win32 API, and without those applications, Windows becomes much less useful. With the Windows 8 Store offering few desirable applications, Windows RT was a market failure.

Enlarge (credit: Getty Images | RoyalFive)

Federal Communications Commission Chairman Ajit Pai has taken his predecessor's cable TV set-top box plan off the table.

The proposal from former Chairman Tom Wheeler was officially "on circulation," meaning that commissioners could vote on it at any time. That was the case until Friday, when Pai removed the set-top box proposal from the list of items on circulation, an FCC official confirmed. (Pai also removed a Wheeler proposal to lower the price caps for business data services.)

Republican members of Congress had previously asked Pai to close the set-top box proceeding entirely. But while Wheeler's proposal can no longer be voted upon, the proceeding is still open, and Pai could circulate an alternative proposal. There's no word on whether he has any plans to do so, though.

Enlarge / US President Donald Trump signs an executive order as Vice President Mike Pence looks on at the White House in Washington, DC on January 20, 2017. (credit: Jim Watson/AFP/Getty Images))

Last week was a busy one for controversial executive orders, and this week started with another.

On Monday, President Trump signed a far-reaching Executive Order directing federal agencies to get rid of two existing regulations for every new regulation added—regardless of almost any other consideration. Specifically, the order says that “unless prohibited by law," agencies “shall identify at least two existing regulations to be repealed." The EO also states that “the total incremental cost of all new regulations, including repealed regulations, to be finalized this year shall be no greater than zero.”

In other words, the costs imposed by repealed rules will have to, at a minimum, equal the costs imposed by any new rules.

Enlarge (credit: DON EMMERT/AFP/Getty Images + Aurich Lawson + Warren Davis and Jeff Lee)

In the wake of President Trump's sweeping order to severely limit immigration, visitation, and refugee status for people from seven Muslim-majority countries this weekend, game developers and trade groups are scrambling to respond in ways that protect their members and project a message of inclusiveness in the gaming community.

"We embrace the fact that the passion and skill for game development knows no boundaries—political, geographic, cultural, or demographic," the International Game Developers Association (IGDA) said in a statement. "Thus to restrict immigration on the basis of an individual's state of origin represents an ignorant knee-jerk [reaction] that assumes only the worst and wrongly stereotypes the people of an entire culture. We stand in absolute opposition to any policy in any government that would seek to unduly restrict an individual's ability to pursue their creative passion and chosen career path in game development."

The Entertainment Software Association, which represents most major game publishers in the United States, was a little more circumspect in its criticism of Trump's order, saying, "The Entertainment Software Association urges the White House to exercise caution with regard to vital immigration and foreign worker programs. As a leading force in technology and exporter of entertainment, the US video game industry thrives on the contributions of innovators and storytellers from around the world. While recognizing that enhancing national security and protecting our country’s citizens are critical goals, our companies rely on the skilled talent of US citizens, foreign nationals, and immigrants alike. Our nation’s actions and words should support their participation in the American economy."

Enlarge / The Apple Watch Series 2 and some of its bands. (credit: Valentina Palladino)

Every spring, Apple releases a last round of major updates to the current versions of its operating systems before starting work on the new versions it reveals at WWDC in the summer. Last week, Apple put out the first betas of iOS 10.3 and macOS 10.12.4. Today, the company is releasing the first beta of watchOS 3.2 for developers (unlike iOS and macOS, Apple typically doesn't issue public betas for watchOS).

The update introduces two new features, one familiar and one new. The familiar one is SiriKit, the same API that Apple introduced in iOS 10 (and is expanding ever-so-slightly in iOS 10.3). It lets specific kinds of third-party apps tie into Siri, letting you issue commands by voice. Since Siri is the primary input method in watchOS and messaging apps and workout apps are among SiriKit's supported apps, the API seems like a good fit.

The second feature is called "Theater Mode," and as the name implies it's meant to be used while you're out at the movies. Turn it on, and Theater Mode mutes the sound on your watch and keeps the screen from lighting up when you raise your wrist. The watch will continue to buzz as you receive notifications, but you've got to tap the screen or press the Digital Crown to actually use the screen.