MacRumors

A warning has been issued by European security researchers about critical vulnerabilities discovered in PGP/GPG and S/MIME email encryption software that could reveal the plaintext of encrypted emails, including encrypted messages sent in the past.

The alert was put out late on Sunday night by professor of computer security Sebastian Schinzel. A joint research paper, due to be published tomorrow at 07:00 a.m. UTC (3:00 a.m. Eastern Time, 12:00 am Pacific) promises to offer a thorough explanation of the vulnerabilities, for which there are currently no reliable fixes.

Details remain vague about the so-called "Efail" exploit, but it appears to involve an attack vector on the encryption implementation in the client software as it processes HTML, rather than a vulnerability in the encryption method itself. A blog post published late Sunday night by the Electronic Frontier Foundation said:

"EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages."

In the meantime, users of PGP/GPG and S/MIME are being advised to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email, and seek alternative end-to-end encrypted channels such as Signal to send and receive sensitive content.

Update: The GPGTools/GPGMail team has posted a temporary workaround against the vulnerability, while MacRumors has compiled a separate guide to removing the popular open source plugin for Apple Mail until a fix for the vulnerability is released. Other popular affected clients include Mozilla Thunderbird with Enigmail and Microsoft Outlook with GPG4win. Click the links for EFF's uninstall steps.

Apple CEO Tim Cook today delivered the 2018 commencement address at his alma mater Duke University in Durham, North Carolina.

Cook challenged students to "think different" rather than accept the status quo, and to leave the world better than they found it, by following in the footsteps of leaders like Steve Jobs, Robert F. Kennedy, and Martin Luther King Jr.

He also reflected on Apple's commitment to the environment, privacy, immigration, and gun control, supporting the Me Too movement against sexual harassment and students involved in the Stoneman Douglas High School shooting.

An excerpt from his speech:

The pace at which progress is possible has accelerated dramatically. Aided by technology, every individual has the tools, potential, and reach to build a better world. That makes this the best time in history to be alive. Whatever you choose to do with your life, wherever your passion takes you, I urge you to take the power you have been given and use it for good. Aspire to leave this world better than you found it.

I didn't always see life as clearly as I do today. But I've learned that the greatest challenge of life is knowing when to break with conventional wisdom. Don't just accept the world you inherit today. Don't just accept the status quo. No big challenge has ever been solved, and no lasting improvement has ever been achieved, unless people dare to try something different. Dare to think different.

I was lucky to learn from someone who believed this deeply—someone who knew that changing the world starts with following a vision, not a path. He was my friend and mentor, Steve Jobs.

Steve's vision was that great ideas come from a restless refusal to accept things as they are, and those principles still guide us at Apple today. We reject the notion that global warming is inevitable—that's why we run Apple on 100 percent renewable energy. We reject the excuse that getting the most out of technology means trading away your right to privacy. So we choose a different path: collecting as little of your data as possible, and being thoughtful and respectful when it's in our care.

Cook's commencement address was similar to those he has delivered at a number of other universities in recent years, including at his undergraduate alma mater Auburn University in 2010, at George Washington University in 2015, and at the Massachusetts Institute of Technology last year.

Cook is a 1988 graduate of Duke's Fuqua School of Business and a member of the university's Board of Trustees.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Gaston D'Aquino says the Apple Watch saved his life. By sharing his story, he hopes it can help save the lives of others too.

According to the South China Morning Post, the 76-year-old was sitting at church when his Apple Watch alerted him to his elevated heart rate. Having read similar stories before, he went directly to a local hospital.

"I told the doctor I don't know why I'm here, but my watch tells me I have an elevated heart rate," said D'Aquino. "He says, 'Are you feeling anything?' I said no, I feel fine, I'm feeling all right, nothing's wrong."

After an electrocardiograph machine indicated something was wrong, doctors conducted tests and discovered that two out of his three main coronary arteries were completely blocked, with the third 90 percent blocked. Of course, that means he was at risk of suffering a potentially fatal heart attack.

D'Aquino said he had visited a cardiologist before, who had prescribed him daily medication for diabetes, high cholesterol, and high blood pressure, but there was never any indication that there were any deeper issues.

After the doctors shared the test results with him, D'Aquino quickly agreed to have an angioplasty, a procedure to restore blood flow to the heart by implanting tiny stents in clogged or blocked arteries. He was sent home the following day and said "it went well and I'm feeling much, much better."

"Having a new lease of life is a good thing," he said. "You wake up the next morning and you look around you, everything looks more beautiful. It's a great feeling; you're on a high for a few days. That feeling is something special."

As a self-professed Apple fan, D'Aquino sent an email to Apple CEO Tim Cook in early April. In recounting his story, he noted that "this was the first time that my watch alert had ever gone off, but I was not feeling anything, no dizziness or pain" and added that "in short, I was a walking time bomb."

"Please continue promoting the use of the Apple Watch for anyone with cardiac problems. I lost a cousin two weeks ago to a massive heart attack, and if he had an Apple Watch, he might have had the same opportunity I got – to live."

Cook said he was "so glad" to hear that D'Aquino is doing well now. "I appreciate you taking the time to share your story. It inspires us to keep pushing."

D'Aquino's situation might have been different had it not been for the Apple Watch's ability to detect an elevated heart rate, introduced in watchOS 4. When enabled, the feature notifies the wearer if their heart rate remains above a chosen beats per minute while they appear to have been inactive for a period of 10 minutes.

On all Apple Watch Series 1 or newer models, users can turn on heart rate notifications when they first open the Heart Rate app, or at any time later:

• Open the Apple Watch app on a paired iPhone.
  

• Tap the My Watch tab, then tap Heart Rate.
  

• Tap Elevated Heart Rate, then choose a BPM.

If you have any family, friends, or know of anyone else with an Apple Watch, remind them to enable this potentially life saving feature. For people like D'Aquino and Deanna Recktenwald, it has given them a new lease on life.

The aluminum used in Apple products ranging from iPhones to MacBooks could be more sustainably manufactured in as early as six years.

Apple today announced it has helped facilitate a collaboration between two of the world's largest aluminum producers, Alcoa and Rio Tinto, on a new carbon-free aluminum smelting process. Together, the companies have formed a joint venture called Elysis, which will work to develop the patented technology further.

Alcoa and Rio Tinto aim to achieve larger-scale production and commercialization of the process, with plans to license the technologies beginning in 2024. If fully developed and implemented, it will eliminate direct greenhouse gas emissions from the traditional aluminum smelting process developed over 130 years ago.

Instead of carbon dioxide, the new process releases oxygen, per Apple's press release:

Aluminum has been mass produced the same way since 1886, when it was pioneered by Alcoa's founder, Charles Hall. The process involves applying a strong electrical current to alumina, which removes oxygen. Both Hall's original experiments and today’s largest smelters use a carbon material that burns during the process, producing greenhouse gases. […]

Alcoa has designed a completely new process that replaces that carbon with an advanced conductive material, and instead of carbon dioxide, it releases oxygen.

Alcoa said it has been producing aluminum at its facility near Pittsburgh, Pennsylvania with the new process, to varying degrees, since 2009. The process resulted from decades of research and is described as the most significant innovation in the aluminum industry in more than a century.

In Canada, for example, Alcoa and Rio Tinto said the new process could eliminate the equivalent of 6.5 million metric tonnes of greenhouse gas emissions, if fully implemented at existing smelters in the country. That is supposedly roughly equal to taking nearly 1.8 million light-duty vehicles off the road.

Apple said its involvement started in 2015, when three of its engineers went in search of a better way of mass producing aluminum. Apple ultimately helped bring Alcoa and Rio Tinto together, and has now pledged an investment of $13 million CAD to the joint venture, along with continued technical support.

Apple CEO Tim Cook:

Apple is committed to advancing technologies that are good for the planet and help protect it for generations to come. We are proud to be part of this ambitious new project, and look forward to one day being able to use aluminum produced without direct greenhouse gas emissions in the manufacturing of our products.

Elysis will be headquartered in Montréal, Québec, with the Governments of Canada and Québec each investing $60 million CAD. Alcoa and Rio Tinto will invest $55 million CAD cash over the next three years.

Prime Minister of Canada, Justin Trudeau, and Premier of Québec, Philippe Couillard, were on hand for today's announcement.

Trudeau's statement:

Today's announcement will create and maintain thousands of jobs for Canadians, significantly reduce Canada's carbon footprint, and further strengthen the aluminum industry in North America. It is a truly historic day for the aluminum industry – and for all Canadian aluminum workers – who play such an important role in our economy and our country's future.

Today's news follows Apple's announcement last month that all of its facilities are now powered with 100 percent clean energy and 23 of its suppliers have committed to do the same. Apple also introduced Daisy, a robot that can more efficiently disassemble iPhones to recover valuable parts for recycling.

This initiative is a testament to Apple's commitment to reducing the environmental impact of its products through continued innovation.

Researchers in the United States and China have been performing tests in an effort to demonstrate that "hidden" commands, or those undetectable to human ears, can reach AI assistants like Siri and force them to perform actions their owners never intended. The research was highlighted in a piece today by The New York Times, suggesting that these subliminal commands can dial phone numbers, open websites, and more potentially malicious actions if placed in the wrong hands.

A group of students from the University of California, Berkeley and Georgetown University published a research paper this month, stating that they could embed commands into music recordings or spoken text. When played near an Amazon Echo or Apple iPhone, a person would just hear the song or someone speaking, while Siri and Alexa "might hear an instruction to add something to your shopping list." Or, more dangerous, unlock doors, wire money from your bank, and purchase items online.

The method by which the students were able to accomplish the hidden commands shouldn't be a concern for the public at large, but one of the paper's authors, Nicholas Carlini, believes malicious parties could already be making inroads with similar technology.

“We wanted to see if we could make it even more stealthy,” said Nicholas Carlini, a fifth-year Ph.D. student in computer security at U.C. Berkeley and one of the paper’s authors.

Mr. Carlini added that while there was no evidence that these techniques have left the lab, it may only be a matter of time before someone starts exploiting them. “My assumption is that the malicious people already employ people to do what I do,” he said.

Last year, researchers based at Princeton University and Zheijiang University in China performed similar tests, demonstrating that AI assistants could be activated through frequencies not heard by humans. In a technique dubbed "DolphinAttack," the researchers built a transmitter to send the hidden command that dialed a specific phone number, while other tests took pictures and sent text messages. DolphinAttack is said to be limited in terms of range, however, since it "must be close to the receiving device."

DolphinAttack could inject covert voice commands at 7 state-of-the-art speech recognition systems (e.g., Siri, Alexa) to activate always-on system and achieve various attacks, which include activating Siri to initiate a FaceTime call on iPhone, activating Google Now to switch the phone to the airplane mode, and even manipulating the navigation system in an Audi automobile.

In yet another set of research, a group at the University of Illinois at Urbana-Champaign proved this range limitation could be increased, showing off commands received from 25 feet away. For the most recent group of researchers from Berkeley, Carlini told The New York Times that he was "confident" his team would soon be able to deliver successful commands "against any smart device system on the market." He said the group wants to prove to companies that this flaw is a potential problem, "and then hope that other people will say, 'O.K. this is possible, now let's try and fix it.'"

For security purposes, Apple is stringent with certain HomeKit-related Siri commands, locking them behind device passcodes whenever users have passcodes enabled. For example, if you want to unlock your front door with a connected smart lock, you can ask Siri to do so, but you'll have to enter your passcode on an iPhone or iPad after issuing the command. The HomePod, on the other hand, purposefully lacks this functionality.

Apple's second-generation iPhone SE could feature an iPhone X-esque design with a notch, if a sketchy rumor is to be believed, but Face ID is unlikely.

MacRumors has obtained renders and alleged dimensions of the new iPhone SE from case maker Olixar, via online accessories store Mobile Fun, that suggest the device's notch will be approximately half as wide as the one on the iPhone X, almost certainly making it too slim to house facial recognition sensors.

It's hard to imagine that Apple would include Face ID on the iPhone SE in the first place, without significantly raising the price. Including the feature on an iPhone that starts at just $349 would reduce Apple's gross margins and almost certainly cannibalize sales of the iPhone X at $999 and up.

Olixar's renders, which we're told were "obtained from a reliable source" in China, also suggest the new iPhone SE will feature an iPhone X-esque display that stretches nearly edge to edge, surrounded by an aluminum shell with flat sides and chamfered edges, akin to the current model and iPhone 5s.

With an alleged length of 4.7 inches and width of 2.1 inches, the new iPhone SE would be slightly smaller than the current model, remaining suitable for one-handed usage but with a larger display thanks to the fuller-screen design.

The renders do not depict the bottom or back of the device, so it's unclear if there will be a headphone jack or a glass rear shell for wireless charging. As expected, the device does appear to retain physical volume buttons and a mute switch on the side, and a physical power button on the top-right corner.

The biggest question mark is how authentication would work, given the lack of a home button and the unlikeliness of Face ID. Chinese company Vivo's new X20 Plus UD became the first smartphone with an in-display fingerprint sensor early this year, but Apple seems to have elected against that approach.

Overall, this rumor is a sketchy one, but Olixar is confident enough in its Chinese sources to already be accepting pre-orders for iPhone SE 2 screen protectors on Mobile Fun, so we are sharing in the interest of discussion.

Apple hasn't truly updated the iPhone SE since it launched in March 2016, beyond doubling its available storage capacities, but rumors about an updated model have been contradictory in recent months. There are essentially two camps: one expecting a more iPhone X-like design, and another expecting a minor refresh.

Last month, for example, a video shared on Chinese social media website Sina Weibo showed what appears to be an unreleased iPhone SE with an iPhone 5s-like design, glass back, top and bottom bezels, Touch ID, and a headphone jack. However, it's quite possible the device was a knockoff, as are common in China.

If there is a new iPhone SE, a few reports and regulatory filings suggest the device could be announced by WWDC 2018 in June.

Apple is teaming up with investment bank Goldman Sachs for the launch of a new joint credit card that would be placed under the Apple Pay branding. The card could launch as soon as early 2019, according to The Wall Street Journal.

At the same time, Apple would end its partnership with Barclays, which offered customers an Apple rewards program and financing deals through a Barclaycard Apple Rewards Visa. For the new Goldman partnership, which will replace the Barclaycard, the bank is set to offer in-store loans to Apple customers buying iPhones and other Apple products.

Other specifics of the deal are still being decided upon, people familiar with the matter said, mainly including the terms and benefits of the planned credit card, "including the perks for customers." The Barclays/Apple card currently offers interest-free financing on Apple devices and points toward Apple gift cards.

Apple Inc. and Goldman Sachs Group Inc. are preparing to launch a new joint credit card, a move that would deepen the technology giant’s push into its customers’ wallets and mark the Wall Street firm’s first foray into plastic.

The planned card would carry the Apple Pay brand and could launch early next year, people familiar with the matter said.

Apple is believed to be adding more focus onto its growing services business, which Apple Pay is part of, and the Goldman Sachs partnership could be a way for the company to spread even more awareness of the digital wallet. In a report on Apple Pay adoption by Loup Ventures earlier this year, 16 percent of global iPhone owners were said to have activated Apple Pay. The researchers estimated widespread adoption for the service at 3-5 years from now, "given integration OS and iOS makes it the easiest to use digital wallet."

Apple first debuted Apple Pay in the fall of 2014, and although many retailers joined in support of the platform it has faced push back from companies like Target and Walmart as each try to develop their own digital wallet service. Last spring, Apple said it wasn't worried about the slow adoption of Apple Pay because it saw the mobile wallet as on track to soon become its customers' "primary payment system."

The Federal Communications Commission gave a notice today that states Net Neutrality rules will officially end in the United States on June 11, 2018 (via Reuters). The FCC voted 3-2 in favor of repealing the rules last December, a repeal that was then made official with an entry into the Federal Register in February.

Multi-state lawsuits soon popped up in efforts to block the rollback of Net Neutrality, and now more than a dozen Democratic senators have moved to force a vote on a proposal that would reinstate Net Neutrality protections. According to CNN, the vote is expected to pass the Senate, but will face an "uphill battle" in the Republican-majority House of Representatives, and "would likely be vetoed" by President Trump if it got that far.

Still, Democratic senator Ed Markey cited building momentum for the proposal, with the Senate's vote expected to happen in the middle of next week.

"Our intent is to have it pass in the Senate, the momentum is building," he said. "We expect there to be some considerable momentum coming out of the Senate and 160 will quickly grow towards the 218 that we need to have a vote over there as well."

"When we pass this in the Senate, when we pass it in the House of Representatives, when it's clear the electorate is at 86% favorable for this issue, that we would have a political firestorm throughout this country if President Trump announced that he was going to veto that said protections, replacing it with exactly nothing," he said.

The repeal of Net Neutrality rules will allow internet service providers to block or slow down any website, service, or app they want to as long as they disclose any act of internet throttling to their customers. Those in favor of the repeal say the decision was made to restore broadband internet services as a "lightly-regulated" market.

On the other side, opponents argue that the repeal gives Verizon, Comcast, and other ISPs the free reign to essentially control the customer's internet by dividing users into so-called "fast lanes" and "slow lanes." Apple is one of the many companies against the repeal of Net Neutrality, stating last August that the ruling could "fundamentally alter the internet as we know it," and if it passed it would be put in place to the detriment of consumers, competition, and innovation.

Many websites are issuing alerts about the upcoming Net Neutrality Senate vote by joining the The Red Alert for Net Neutrality project. On sites like Reddit, Tumblr, Etsy, GitHub, and more, visitors will be presented with a large red screen that urges users to contact their local lawmakers and voice their support of Net Neutrality.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.