Month: May 2023

Enlarge (credit: Getty Images | Yuichiro Chino)

One of the biggest advances in Web security over the last decade or so is the proliferation of secure, encrypted HTTPS connections. Once the purview of shopping and banking sites, HTTPS connections have become the norm rather than the exception, keeping more of your credentials and data safe from being intercepted even when you're on public or insecure networks.

Browsers going all the way back to Internet Explorer have used a small padlock icon to denote that a connection is using HTTPS. But according to the team behind the Chromium browser engine, most people still don't know what that padlock icon actually means. Because of that confusion, and because HTTPS is now expected for most sites, Chromium will retire the padlock icon starting in Chrome 117, slated for release in September alongside a larger refresh of the Chrome interface.

"Replacing the lock icon with a neutral indicator prevents the misunderstanding that the lock icon is associated with the trustworthiness of a page, and emphasizes that security should be the default state in Chrome," reads a Chromium blog post from the Chrome security team.

Enlarge (credit: JOSH EDELSON / Contributor | AFP)

Facebook has not been doing enough to comply with a 2020 privacy order, the Federal Trade Commission (FTC) announced Wednesday. On top of "continuing to give app developers access to users’ private information" that Meta claimed had been cut off, the FTC alleges that Facebook has caused new harm. Perhaps most alarming, the FTC alleges that Facebook's Messenger Kids product misled parents on who could connect to chat with minors and misrepresented who had access to private youth data.

Now, the FTC has proposed changes to the 2020 order that would prohibit Facebook owner Meta from launching new products on any of its platforms without procuring written FTC compliance confirmation and prevent the company from monetizing any of the youth data it collects across Facebook, Instagram, WhatsApp, and Oculus.

“Facebook has repeatedly violated its privacy promises,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a press release.

Enlarge / Mammoth tusks collected at Wrangel Island, where some of the samples tested for hormones originated. (credit: Alexei Tikhonov)

Musth, a time of heightened testosterone levels and aggression in male elephants related to reproduction, has now been identified in woolly mammoth tusks. Remarkably, this is the first time hormones have been seen in the extant or the extinct. And it opens up an exciting new field of paleontology that the team behind the discovery calls ‘palaeoendocrinology’—the study of hormones in ancient species.

A paper published on Wednesday in Nature describes that work, in which an international team of scientists studied African elephant and woolly mammoth tusks. Elephants and woolly mammoths are distantly related, and both belong to a group of animals known as proboscideans.

Testing tusks

Michael Cherney is the lead author and research affiliate at the University of Michigan Museum of Paleontology. He said his team started by testing elephant tusks. “We wanted to start with something that provided the best chance of recovering data, because we didn’t know that we’d see any,” Cherney told Ars in a video interview. Nobody knew for sure whether hormonal signatures existed in modern elephant tusks prior to this study, but the team was able to identify testosterone in the tusks.

Enlarge / Google says the login flow will go something like this, from left to right: type in your username, pick a passkey, scan a finger. Hopefully your device has biometrics. (credit: Google)

Google is taking a big step toward our supposedly passwordless future by enabling passkey-only Google accounts. In the blog post, titled "The beginning of the end of the password," Google says: "We’ve begun rolling out support for passkeys across Google Accounts on all major platforms. They’ll be an additional option that people can use to sign in, alongside passwords, 2-Step Verification (2SV), etc." Previously, you've been able to use a passkey with a Google account as part of two-factor authentication, but that was always in addition to a password. Now it's possible to use a Google account with a passkey instead of a password.

A passkey, if you haven't heard of the new authentication method, is a new way to log in to apps and websites and may someday replace a password. Password entry began as a simple text box for humans, and those text boxes slowly had automation and complication bolted onto them as the desire for higher security arrived. While you used to type a remembered word into a password field, today, the right way to use a password is to have a password manager paste a random string of characters into the password box. Since few of us physically type in our passwords, passkeys remove the password box.

Passkeys have your operating system directly swap public-private keypairs—the "WebAuthn" standard—with a website, and that's how you get authenticated. Google's demo of how this will work on a phone looks great—the usual box asks for your Google username, then instead of a password, it asks for a fingerprint, which unlocks the passkey system, and you're logged in.