Google to pay security researchers who find Android apps and Chrome extensions misusing user data

Google said it will pay security researchers who find “verifiably and unambiguous evidence” of data abuse using its platforms.

It’s part of the company’s efforts to catch those who misuse user data collected through Android apps or Chrome extensions — and to avoid its own version of a scandal like Cambridge Analytica, which saw millions of Facebook profiles scraped and used to identify undecided voters during the U.S. presidential election in 2016.

Google said anyone who identifies “situations where user data is being used or sold unexpectedly, or repurposed in an illegitimate way without user consent” is eligible for its expanded data abuse bug bounty.

“If data abuse is identified related to an app or Chrome extension, that app or extension will accordingly be removed from Google Play or Google Chrome Web Store,” read a blog post. “In the case of an app developer abusing access to Gmail restricted scopes, their API access will be removed.” The company said abuse of its developer APIs would also fall under the scope of the bug bounty.

Google said it isn’t providing a reward table yet but a single report of data misuse could net $ 50,000 in bounties.

News of the expanded bounty comes in the wake of the DataSpii scandal, which saw browser extensions scrape and share data from millions of users. These Chrome extensions uploaded web addresses and webpage titles of every site a user visited, exposing sensitive data like tax returns, patient data, and travel itineraries.

Google was forced to step in and suspend the offending Chrome extensions.

Instagram recently expanded its own bug bounty to include misused user data following a spate of data incidents,


Android – TechCrunch

Juul introduces new POS standards to restrict sales to minors

Juul Labs, the e-cigarette behemoth partially owned by Altria, has today announced a new POS age-verification system that it will require all Juul retailers to comply with by May 2021.

The Retail Access Control Standards program, or RACS for short, raises the standard for age-restricted POS systems, automatically locking the POS each time a Juul product is scanned until a valid, adult ID is scanned. The system also looks for bulk purchases (four four-count packs of Juul Pods is the legal limit for a single transaction) and locks when the fifth Juul Pod pack is scanned, automatically removing the fifth pack from the customer’s cart.

Thus far, more than 50 retail chains, which represents 40,000 outlets, have committed to switching over to RACS, with 7,000 stores in the process of switching now and 15,000 to have implemented the technology by 2019’s end. The deadline for switching over to the RACS system is May 2021, at which point Juul will only sell its products to RACS-compliant retailers.

The company recognizes that overhauling a POS can be costly and difficult, and is offering $ 100 million+ in incentives to retailers who switch over. For retailers with newer POS systems, the switch might only require a software update, while others may need to update their hardware, as well.

Now, the system isn’t foolproof. After an ID is scanned, all personal information is automatically deleted from the system, which means that bad actors/unauthorized resellers could amass a bulk amount of Juul products by visiting various stores or returning to the same store multiple times.

However, this is likely just the beginning for the RACS program, which for the first time gives Juul much more control around how their products move through the market, ultimately limiting the opportunity for Juul products to end up in the hands of minors.

Alongside the introduction of RACS, Juul is also expanding the Track & Trace program it piloted in April in the Houston area.

Track and Trace allows teachers, parents, law enforcement and otherwise responsible adults to log the serial number of confiscated Juul devices, giving Juul the information it needs to track that device through the supply chain and identify the store where it was sold.

Using Juul’s 2,000 shopper-strong secret shopper program, the company can then specifically target those stores and shut down the illegal sale of Juul devices to minors.

Today, Track and Trace is expanding nationwide in the U.S.

While these are major steps in combating underage use of Juul products, the company itself admits that it believes youth vaping numbers will continue to rise.

From the release:

It is our expectation that this year’s survey, unfortunately, will likely show continued growth in youth use of vapor products in the U.S. If this turns out to be the case, it will be due in part to the fact that:

  • When this year’s NYTS data was collected, T21 laws were being passed in a dozen states but had not been implemented
  • Little to no category-wide actions have been taken as FDA is finalizing its guidance that, once implemented, should impose additional restrictions on the sale and marketing of certain flavored vapor products — actions that we voluntarily imposed on ourselves last November

In November 2018, Juul announced its Youth Prevention Plan ahead of the FDA’s crackdown on e-cig products. It included the ban of flavored Juul pod sales in convenience stores and other Juul-approved retailers, limiting the sale of non-tobacco and non-menthol flavored pods to its online storefront. Juul says this represented 50 percent of its revenue at the time. The company also took down its Facebook and Instagram pages, and revamped its Twitter to ditch any promotional or marketing content from the platform.

Still, even with the many steps the company has taken to limit youth use of the product, one of Juul’s biggest obstacles is the sale of counterfeit and infringing products, which may include dangerous and/or unknown chemicals. The company hired former Apple employee Adrian Punderson to help lead the fight against counterfeits in February.

As of December 2018, Juul was reportedly valued at $ 38 billion, estimated to own more than 70 percent of the e-cig market.

Gadgets – TechCrunch

Apple expands access to official repair parts for third-party shops

Apple just announced a new program to make it easier to repair out-of-warranty iPhones. In addition to Apple Authorized Service Providers, independent third-party repair shops will be able to access official repair parts and tools.

There are currently three options when you break your screen or other parts of your iPhone. You can go to an Apple store and give your iPhone to Apple employees. You can go to an authorized store (such as Best Buy stores in the U.S.), which means your iPhone will be repaired by Apple-certified technicians. Or you can go to a normal repair shop.

Authorized Service Providers already have access to official parts and tools. If your iPhone is under warranty, you can get a free repair and Apple pays back the authorized repair shop directly.

But until today, if you were a non-authorized repair shop, you couldn’t get official parts. It could result in mixed experiences with parts that don’t perform as well as official parts.

Starting today, any repair shop in the U.S. can get a free online certification in order to access the new repair program. After that, you can buy genuine parts and tools. You can also access the same repair manuals and diagnostics as authorized repair shops.

Apple says that it’ll expand the new program to more countries in the future. The company is already testing the program with 20 shops in North America, Europe and Asia.

This is great news for customers as it should improve the overall quality of repairs. Apple is essentially lowering the entry barrier to qualify to official parts.

If you want to make sure that your device is repaired using genuine parts or if your device is still under warranty, you should still go to an authorized repair shop or an official Apple store. It’s going to be hard to tell if third-party repair shops are using genuine parts as nobody is forcing them to switch to the new program.

Gadgets – TechCrunch