Andrew Orr's photo

Andrew Orr

Since 2015 Andrew has been writing about Apple, privacy, security, and at one point even Android. You can find him most places online under the username @andrewornot.

Get In Touch:

Jack Dorsey's Company 'Square' Could Make Hardware Crypto Wallet

In a 13-part series on Twitter, Jack Dorsey announced that Square is considering making a hardware wallet for bitcoin.

11/Layer 2 is essential for growth. The orders-of-magnitude growth we imagine requires a mix of custodial, off-chain, and second layer solutions that allow people to ‘get off of 0.’ What tech investments can enable seamless, scalable, L2 native support for a hardware wallet?

TikTok Will Collect Biometric Data From US Users

TikTok updated its privacy policy on Wednesday, adding a new section about collecting biometric data from users. This data includes “faceprints and voiceprints.”

The statement itself is vague, as it doesn’t specify whether it’s considering federal law, states laws, or both. It also doesn’t explain, as the other part did, why TikTok needs this data. It doesn’t define the terms “faceprints” or “voiceprints.” Nor does it explain how it would go about seeking the “required permissions” from users, or if it would look to either state or federal laws to guide that process of gaining consent.

How to Get Around macOS Security Using App Installers

Tenable Research found security issues related to macOS app installers, and they can be used to bypass default Mac security protections. So far, Apple hasn’t fixed it (emphasis mine).

Frustrated by the prevalence of these issues, we decided to write them up and make separate reports to both Apple and Microsoft. We wrote to Apple to recommend implementing a fix similar to what they did for CVE-2020–9817 and explained the additional LPE mechanism discovered.

We wrote to Microsoft to recommend a fix for the flaw in their installer. Both companies have rejected these submissions and suggestions.

Firefox 89 Gets Design Overhaul and ‘Total Cookie Protection’ Feature

Mozilla has released Firefox version 89 on Tuesday, bringing a new design for desktop users and a privacy feature called Total Cookie Protection added to private browsing.

We’ve enhanced the privacy of the Firefox Browser’s Private Browsing mode with Total Cookie Protection, which confines cookies to the site where they were created, preventing companies from using cookies to track your browsing across sites. This feature was originally launched in Firefox’s ETP Strict mode.

More information on Total Cookie Protection can be found on Mozilla’s blog.

You Have One Week to Opt Out of Amazon’s ‘Sidewalk’ Network Service

Amazon Sidewalk is the company’s network mesh service that shares your internet bandwidth with Amazon devices. You must opt out by June 8 if you don’t want this because the setting is turned on by default.

The new wireless mesh service will share a small slice of your Internet bandwidth with nearby neighbors who don’t have connectivity and help you to their bandwidth when you don’t have a connection.

By default, Amazon devices including Alexa, Echo, Ring, security cams, outdoor lights, motion sensors, and Tile trackers will enroll in the system.

Postal Workers Targeted With Phishing Campaign

Postal workers returning to the office after COVID-19 restrictions may find themselves targeted by a new phishing campaign.

The email-based campaign, observed by Cofense, is targeting employees with emails purporting to come from their CIO welcoming them back into offices.

The email looks legitimate enough, sporting the company’s official logo in the header, as well as being signed spoofing the CIO. The bulk of the message outlines the new precautions and changes to business operations the company is taking relative to the pandemic.

Meat Supplier JBS Hit With Cyber Attack, Data Not Affected

JBS SA shut down its computer networks for its operations in Australia and North America due to a cyberattack.

Backup servers were not affected, and the company is actively working to restore systems as soon as possible, according to a statement from JBS USA Monday. The processor said it’s not aware of any customer, supplier or employee data being compromised or misused.

How Does a Blockchain Work? Here is a Simple Explanation

I’ve been slowly learning about all things cryptocurrency, or rather all things related to the blockchain. But what is a blockchain, anyway? I came across this video today, and the channel—Simply Explained—features more related videos, like explaining smart contracts, Cardano, and how a proof-of-stake system works as opposed to proof-of-work.

‘Have I Been Pwned’ Open Sourced, Partners With FBI

The popular service Have I Been Pwned has made its code open source, and it’s also partnering with the FBI. The agency will send compromised passwords discovered during investigations.

Why is the FBI getting involved? Because Bryan A. Vorndran, the FBI’s Assistant Director, Cyber Division, said, “We are excited to be partnering with HIBP on this important project to protect victims of online credential theft. It is another example of how important public/private partnerships are in the fight against cybercrime.”

DHS Releases Cybersecurity Rules for Pipeline Operators

Today, the Department of Homeland Security’s Transportation Security Administration (TSA) announced a Security Directive for critical pipeline companies.

The Security Directive will require critical pipeline owners and operators to report confirmed and potential cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency (CISA) and to designate a Cybersecurity Coordinator, to be available 24 hours a day, seven days a week.

It will also require critical pipeline owners and operators to review their current practices as well as to identify any gaps and related remediation measures to address cyber-related risks and report the results to TSA and CISA within 30 days.