Shortened URLs make it easy to spy on people

Alamy

Security researchers have discovered that short URLs are able to be brute-forced, potentially exposing personal data to anyone motivated to look. The issue was found by Martin Georgiev and Vitaly Shmatikov after looking at the abbreviated web addresses used by companies like Google, Microsoftand bit.ly. The standard Google Maps URL, for instance, takes up around 150 characters, but for ease of use, the product offered a six-character alternative. But a combination of six-characters is small enough that it's possible to break simply with trial and error, exposing your cloud storage files and mapping requests to the world.

Georgiev and Shmatikov were able to find Google Drive and Microsoft OneDrive files that were shared with short URLs. But some of those files were tied to folders that had write-access, enabling anyone in the world to drop malicious code into your cloud storage. Naturally, since anything stored online is automatically copied to your desktop, the duo claim that there is a very real risk of "large-scale malware injection." The pair claim that 7 percent of the OneDrive and Google Drive accounts they scanned were vulnerable in this way.

The researchers were also able to use the flaw to up their stalking game quite significantly. For instance, short Google Maps URLs often contained directions between two private addresses. It would be quite easy to infer relationships from that data that were otherwise intended to be private. Even worse is that some people's map links revealed highly personal information such as the medical facilities and places of worship that they visited. In addition, the pair were able to find and name people who visited juvenile detention facilities, pawn brokers and other such information that is ordinarily kept secret.

One of the reasons that people don't really think about short links is that they've been told to believe in "security from obscurity." It's the idea that if people don't know about a file that's on the internet, they won't be able to find it, but the pair have blown that out of the water. Early on in the paper, the duo say that people believe that the URLs are "safe because they are 'random looking' and not shared publicly." But, in fact, this simply isn't true anymore, and "each resource shared via short URL is thus effectively public, and can be accessed by anyone anywhere in the world." As far as the pair are concerned, "automatically generated short URLs are a terrible idea for cloud services."

At the end of the paper, the researchers reveal the differing ways in which Google and Microsoft handled the news of the hack. Google doubled the character length and subsequently told Wired that it "appreciate contributions to the safety of Google Maps and Google products." Microsoft, meanwhile, is quoted by the researchers as saying that the vulnerability "does not currently warrant an MRSC case," although did quietly remove the shorten link function within OneDrive -- although that's no comfort to existing users who still remain exposed.

Of course Huawei is making a Gear VR rival

Huawei may have just announced the fancy P9 and P9 Plus smartphones in London last week, but it actually saved a little surprise for its Shanghai launch today. Well, we say "surprise" but it's also very much a "me too" thing at this point. Simply dubbed Huawei VR, this headset series will initially come in three flavors to let you slot in the company's most recent flagship devices: the two P9 phones and the larger Mate 8. Given their mere 1080p screen resolution, don't expect any crisp video quality through those goggles, but Huawei claims its VR solution is the first to offer360-degree sound field on the go, as long as you have the right content loaded and your own headphones plugged in.

Gallery: Huawei VR hands-on | 17 Photos

• 
 
• 
 
• 
 
• 
  +13

The Huawei VR headsets work in a similar way as Samsung's counterparts: Just pop the front cover open, then secure the phone (with the VR app running, of course) using the clips inside, and then snap the cover back on. Likewise, they have a touch panel, a back button and volume keys on the right for interfacing with the app. You won't be able to wear your glasses underneath the goggles, but the adjustable lenses will accommodate myopia of down to -7.00.

In terms of specs, you get the usual 20ms low latency and 95-degree field of view (it's 96 degrees on Samsung's Gear VR and 110 on the HTC Vive plus the Oculus Rift), with the added benefit of an anti-blue light filter to protect your eyes.

The more exciting part here is obviously the content. At launch, Huawei VR will offer over 4,000 free movies (presumably only a fraction of these are VR videos) and over 40 free games, along with over 350 panoramic images and over 150 panoramic tours. It's obviously still early days as Huawei skipped the price and date, so we'll just have to keep an eye out for a future announcement.

8 coolest smartphones under Rs. 30,000 launched in 2016

View Slideshow»

While so much is happening in the low budget mobile phone space, high end flagship phones are also not far behind. The real question- is there a need for flagship phones? The answer is YES. Performance combined with high end features give the perfect product to this tech savvy world who also have transitioned their work from paper to devices. But not many can afford it.

Here comes the role of premium phones which are priced a level below flagship phones launched by premium brands but are at par with their performance. We bring to you 8 coolest smartphones under Rs. 30K range.

(Image credits: indiatimes)

Edward Snowden has too much free time, starts making music

When you almost-singlehandedly expose a vast, secretive spying network, you've every right to a little swagger. And Edward Snowden has frequently displayed that during his slow transition from whistleblower to privacy advocate. But there comes a time in every digital activist's life where they must choose a path: you either become a credible voice for good, or you become.. a voice. Presenting the new collaboration between electronic music legend Jean-Michel Jarre and Edward Snowden: "Exit."

Largely a pretty interesting piece of electronica, "Exit" takes a break from proceedings to allow Snowden to eulogize the need for privacy. Here are some choice quotes:

"Technology can actually increase privacy."

"Saying that you don't care about the right to privacy because you have nothing to hide is no different to saying you don't care about freedom of speech because you have nothing to say. It's a deeply anti-social principle, because rights are not just individual, they're collective."

"What may not have value to you today, may have value to an entire population, an entire people, or an entire way of life tomorrow. And if you don't stand up for it, then who will?"

Rock on. With this rousing call to action, Snowden feels like he's at the point where he'll either become another Jimmy Wales or another Julian Assange. By that I mean he'll be another generally respected voice that puts his name to some so-so projects. Or he'll be like Julian Assange.

The track is available now to stream and purchase digitally, and it'll also get a vinyl release next month. In a Guardian video discussing the track (embedded below) Snowden says "music is the thing that can humanize even the most abstract moment." We're expecting his guide to self-actualization through meditation any day now.

Yahoo Esports goes mobile with a dedicated Android app

Associated Press

If you thought Yahoo's push into esports would stop at a dedicated editorial team, guess again. Now the outfit is taking that expertise mobile with the launch of the Yahoo Esports app on Android. It's a bit sparse at the moment, though, only covering a quintet of games: Counter-Strike: Global Offensive, Dota 2, Heroes of the Storm, League of Legends and Street Fighter V.

The cool wrinkle is that you can set reminders for when matches start, check out real-time stats and even watch game streams from within the app. Each game has its own page, with access to news on a per-game basis and tons of video interviews with competitors. Yahoo says this is just the start and that an iOS version isn't far off. Now the countdown begins forESPN to launch a competitive gaming app of its own.

'Ghostbusters' game coming to PS4, Xbox One and PC this July

Early trailers for the new, somewhat divisive Ghostbusters movie has sparked a wave of renewed interest in the spooky franchise. Unsurprisingly, Activision is working on a new video game to coincide with the film's release, which will arrive on Xbox One, PlayStation 4 and PC (Steam) on July 15th. It's set after the events of the new movie, putting you in charge of some fresh Ghostbuster rookies as they try to capture spectres around New York City. Each character will have their own personality, strengths and play style, encouraging team-based strategies in up to four-player couch co-op. Just remember, don't cross the streams.

Hulu's recommendations feature starts rolling out to everyone

It's been over a year since Hulu introduced Watchlist, which puts your queue, favorites and watched content all in one place. Up until today, though, that feature was only available to users who wanted to try it early. But now Hulu's making Watchlist part of the main experience for every viewer, including those who watch on iOS, Android, PC, gaming consoles and set-top boxes like the Apple TV. Watchlist recommends movies or TV shows you should enjoy next, offering up suggestions based on your preferred and most recently viewed content. You can also find new series you might be interested in.

Sling TV tried something similar in its first major redesign since launch. And Hulu's on the same page, as it also wants to give people a more personalized UI -- one that's smart enough to know what episode ofScandal you're on. Hulu says Watchlist is rolling out now, but it could take a week or two before you see it show up on your account.

Amazon films make it to Cannes' 2016 lineup

Among all the titles that Cannes is screening at this year's film festival, five aren't like the rest. They're Amazon movies, see, and Cannes is known for refusing to showcase films made for screens smaller than a cinema's. According to The Hollywood Reporter, Amazon will release the festival's opener, Woody Allen's Cafe Society, in the US. It also has rights to three films vying for Palme d'Or, namely The Neon Demon by Nicolas Winding Refn, Paterson by Jim Jarmusch and The Handmaiden by Park Chan-wook, who also directed Oldboy. The fifth title is Jarmusch's Gimme Danger, which documents the life and music of Iggy Pop.

These moviemakers are festival regulars -- Allen's films, for instance, are typically reserved for opening night. They're not names you'd be surprised to see in the screening lineup. As The Hollywood Reporter noted, Cannes might merely be following their lead instead of truly opening its doors to streaming-service-backed titles. That's somehow supported by what festival director Thierry Fremaux pointed out to the publication: while it's true that Amazon has the rights to these films, they will be shown in theaters first.

Outlook arrives for Android Wear devices

Microsoft

Microsoft is putting Outlook on the wrists of Google fans. The email appnow has support for the Android Wear platform. With it, you can check any notifications that pop, pore over messages, and use pre-set responses or voice dictation to bang out a quick reply. Android Central notes that the app is rolling out to users, so not everyone might have access to the wrist-bound productivity app just yet. This is a welcome addition to the version of Android tailored to wearables to be sure, but a little bit late - - Outlook's had an Apple Watch app since last August.

Watson made a simple apple pie complicated

'Cognitive Cooking with Chef Watson' is a collaboration between IBM and the Institute of Culinary Education in New York City. As part of an ongoing series, we'll be preparing one recipe from the book until we've made all of them. Wish us luck.

When given the opportunity to prepare a recipe for our Cooking With Watson series, I picked Baltic apple pie because, hey, it's apple pie. You mix up some filling, dump it into a tin lined with dough, bake for 40 minutes and voila, you have a delicious dessert that you can even put ice cream on. Oh, the Baltic apple pie has pork in it? OK, forget the ice cream. But, a savory meat pie can't be that hard, right?

Gallery: Cooking With Watson: Baltic Apple Pie | 26 Photos

• 
 
• 
 
• 
 
• 
  +22

This is where I'm supposed to say "wrong," but to be fair, the Baltic apple pie isn't really that hard. But the recipe also includes two sauces and a garnish, requiring a total of 23 ingredients and hours to make. It wasn't even an entire meal. My colleague Terrence O'Brien has noted howCognitive Cooking With Chef Watson isn't really intended for home cooks, and with this project, I learned that the hard way.

The ingredients came from a variety of supermarkets, but it's not necessary to shop around so extensively; most of the ingredients for the Baltic apple pie and its accoutrements are common items such as milk, eggs and garlic. It does require three different sugars as well as two salts: fine sea and smoked. Smoked salt is one of the two hard-to-get ingredients on the list, along with agar. Agar can usually be bought at Asian grocers, but I went to Whole Foods only because there's one close to the Engadget office. I wouldn't recommend that due to cost: If you can't find them at your local market, buy the ingredients online instead.

The one thing I had trouble locating wasn't an ingredient, but a kitchen tool: tart rings. Any time I was in a store that offered household goods I looked for them to no avail. I could have gone to a kitchen supply store or ordered online, but ultimately decided not to given I had little use for them after this recipe.

I set aside an afternoon to get this done, thinking that a savory pork and apple pie would be lovely for dinner. First item on the to-do list was the "mayo," written in quotes because this mayo lacks oil, vinegar and lemon juice. Instead, it utilizes eggs, milk and cream with agar to set and is flavored with allspice and vanilla bean. I have learned that scraping out a vanilla bean is not fun and a bit anxiety-inducing: Given that they're so expensive, you want to make sure you use every last bit, and the process can be messy.

Everything was fine from there until I popped the mixture into the blender. It never thickened into a gel. The flavor was correct, at least. I left the "mayo" to chill and went to work on the apricot and blueberry preserves. It also failed to gel properly, but still made a fine tart compote.

At this point I decided to tackle the apple pie itself. The first step was to dice and brine the pork, but didn't specify which salt to use. I opted to use the fine sea salt, sprinkling in just a handful of the smoked version for flavor. I prepared the rest of the filling, throwing diced apples and onions along with chopped garlic into a pan to sauté with butter. "That smells divine," my roommate called out from the other room. The instructions then say to sprinkle brown sugar and salt on the filling... but again failed to specify which salt. I used the smoked one.

Next up were the puff pastry sheets. The recipe wanted me to cut them into 6- and 4-inch circles. However, when I unfolded the puff pastry sheet it quickly became apparent it wasn't enough for four full-size tarts. I checked to see if I had screwed up: The recipe says one to two pounds of puff pastry dough, which could be one or two boxes, and I had only purchased one box with roughly one pound.

Undeterred, I opted to cut the circles smaller. Remember how I didn't buy tart rings? I decided to use my muffin tin instead, and my reduced circles fit inside each slot perfectly. I put a spoonful of filling into each cup, used the remaining dough to cover each nascent pie, and popped it into the oven to bake.

While I waited, I worked on the garlic chips. The recipe called for sliced garlic to be blanched three times in milk. The process of blanching can remove intense or harsh flavors, but boiling a shallow pan of milk three times felt like such a waste of dairy it depressed me, especially for something as minor as a garnish.

I took the pies out of the oven and they actually looked appetizing. Unfortunately, they never properly browned up, even after I put them back in the oven sans pan.

I assembled a full plate with all the components and it all looked pretty good. I cut one open with a fork to discover the dough never got light and flaky because of how I cooked it. It was more like a pot pie, which was fine with me. The dough was moist and chewy and had absorbed flavor well. The pork was nice and juicy too, thanks to the brining.

Unfortunately, the pork was also really salty. Even after draining out the brine enough remained in the meat to throw off the flavor and overwhelm the taste of the Granny Smith apples. This is where the two sauces really shined here, with the mayo nullifying the salt while the intense flavor of the compote matched the brightness of the salt and accentuated the pork well. In that moment, the extra work made sense.

I had plenty of filling left over, so there was room to try again. And, since my editor Dana Wollman asked me to bring her one of the finished pies, I felt obligated to make more. But, as it's not a good idea to be overly salty with your boss, I needed to fix the brine problem first.

That was easy; I just sauteed more apple and onion and combined them with the existing pork mix. That went a long way toward dispersing the brine, and I even felt confident enough to add more smoked salt.

I also needed more puff pastry dough, but wasn't thrilled at the thought of having to cut more discs and stuff them in the muffin tin again. So I was absolutely delighted to find a box of Pepperidge Farm puff pastry cups at the supermarket. They're basically small hexagons of dough with a circle cut in the middle. After baking them 'til they're nice and fluffy you punch out the circle and then you have a small bowl for creating hors d'oeuvres.

To make a completely covered pastry I improvised, using a second disc of uncooked dough as a lid and gluing it on with some egg wash. After 20 to 30 minutes, I had a tray of 12 puffy, flaky pork apple pies. The bottom half was a little browner than the top, but it didn't matter: The insides were chewy and sweet, and the meat was cooked perfectly. They went over wellat the office.

I still have plenty of filling left, and even if I didn't, the Baltic apple pie is something I probably would make again. But in the future, I'd skip the mayo and compote and just be more careful with my brining. I wouldn't bother with the garlic chips either: The parsley, chives and apple were fine garnishes in their own right. There's no reason to spend so much time spent gussying up a pie that can be excellent by itself.

Genetically modified mushrooms cleared by the USDA

Maximilian Stock Ltd. via Getty Images

While the ethical debate rages on about genetically modified human embryos, the United States Department of Agriculture has cleared its firstCRISPR-modified organism. CRISPR, in case you've forgotten, is an editing technique that can alter the genome of almost any organism pretty easily. Penn State University's agriculture department used the method on white button mushrooms to include an anti-browning phenotype that reduced the polyphenol oxidase enzyme (turns produce brown when exposed to air) down to about 70 percent effectiveness. Popular Science notes that because CRISPR doesn't use bacteria or viruses to affect the DNA like previous methods have, these 'shrooms aren't considered "plant pests."

Before you see these longer-lasting mushrooms at the grocery store or on your next salad or steak, though, they'll have to pass through other regulatory bodies first. Meaning, the Food and Drug Administration or Environmental Protection Agency could still put the kibosh down. Even that could take awhile however because of how slow bureaucracy moves: Penn State's Yinong Yang submitted his work October 30th last year and was only given the USDA letter of approval (PDF) this week.