Tech Brew Ride Home - Tue. 03/16 – The 2nd Gen Nest Hub Gets Sleep Tracking

Episode Date: March 16, 2021

Google’s 2nd gen Nest Hub gets sleep tracking thanks to the Soli chip. Intel’s 11th Gen desktop chips launch. Xi brings the hammer down on Chinese tech. And the craziest cellphone hack I’ve ever heard isn’t a hack at all, since it’s in a nutso-buttso unregulated grey area.  Sponsors: Fundrise.com/techmeme Tovala.com/ride Links: Google announces 2nd-gen Nest Hub with Soli-powered ‘Sleep Sensing’ for $99 (9to5Google) Intel’s 11th Gen desktop chips are here with faster speeds but fewer cores (The Verge) Dropbox will have a free password manager in April — if you’ve got 50 or fewer passwords (The Verge) Xi Warns Against Tech Excess in Sign Crackdown Will Widen (Bloomberg) Alibaba browser pulled from Chinese app stores (FT) Exclusive: Investors value China's Ant Group at over $200 billion after IPO halt - sources (Reuters) A Hacker Got All My Texts for $16 (Motherboard) Learn more about your ad choices. Visit megaphone.fm/adchoices

On April 4th, 2023, around 2 in the morning, a man was found stabbed multiple times on a sidewalk in downtown San Francisco. Hey, who did this to you? What happened next turned the story into a political firestorm. Reports have identified the victim as Bob Lee, the founder of Cash App. From Bloomberg Podcasts, this is Foundering, the Killing of Bob Lee, beginning April 16. Welcome to the TechMeme right home for Tuesday, March 16th, 2021. I'm Brian McCullough today. Google's second-gen nest hub gets sleep tracking thanks to the Soli chip. Intel's 11th gen desktop chip launches. Xi brings the hammer down on Chinese tech and the craziest cell phone hack I've ever heard

isn't a hack at all since it's in a nutso-but-so unregulated gray area. Here's what you miss today in the world of tech. Google today announced its second generation Nest Hub, and the big new feature is sleep tracking. The price tag on the new Nest Hub is $100. There's one of those new Sully radar chips inside it, so you can do things like playing and pausing media by just tapping in the air, and it's shipping March 30th. With that Sully chip, you can also just wave your hand in the air if you want to snooze an alarm that's going off, which is useful because, quoting 9 to 5 Google, the second-gen NEST hub has sleep sensing, powered by the Sully technology that first debuted on the Pixel 4

and was later used in the new Ness thermostat for screen wake. Google set out to make sleep tracking, which is opt-in more effortless and help people make nightly improvements. Sensors analyze your sleep based on movement and breathing, while also identifying disturbances, coughing, snoring, light fluctuations, and temperature changes that make an impact. Sully is an ideal technology for this purpose because it precisely tracks movement at both macro, limbs flailing, and micro, chest moving up and down as you breathe levels.

Sully is not a camera that can see or identify you with the Nesthub only generating movement graphs that, along with audio data, are processed locally and do not leave your device. Only high-level sleep occurrences slash events such as number of coughs and snore minutes are sent to Google, and the night's results can be easily deleted in the morning. Meanwhile, you can disable cough and snore detection but retain sleep tracking. To use solely for this purpose, Google had thousands of people submit over 100,000 nights to create the sensing algorithms. Results were validated against sleep studies, as well as consumer and clinical grade sleep trackers. Nesthub's performance matched or surpassed those existing offerings.

When you wake up in the morning, you can say, hey Google, how did I sleep? or tap the sleep summary button on screen. A graphic that uses overlapping circles will note duration, schedule, consistency, and the number of disturbances slash rest quality. The three-page sleep details view provides a granular breakdown. Quality uses timelines to note how much light was in your room and the temperature, which the Nest Hub now has a sensor for. At the moment, it's just for sleep tracking.

Google will also identify snoring, coughing, and changes in light. The sleep bar notes when you're asleep, and restless periods. There are weekly summaries to quickly see breaths per minute, RPM, the number of minutes you snored, the cough count, etc. All this data syncs with Google Fit, as we reported, and can be seen on your Android or iOS device. The company worked with the American Academy of Sleep Medicine to provide sleep science and guidance to users. That said, it's, quote, not intended to diagnose, cure, mitigate, prevent, or treat any disease or condition, end quote. Besides showing your sleep stats, Google will analyze them to find

issues and suggest actionable recommendations that are personalized to you. This might include setting up a relaxation routine and setting reminders. Over time, 14 or more days, the Nest Hub will understand your sleep patterns and recommend an ideal schedule. Sleep sensing will be available as a free preview until next year. Google has not yet determined how it will charge users since Fitbit, which offers a premium subscription, was only recently acquired. It's exploring how best to integrate with the existing sleep tracking features. Plenty of warning will be given if there are changes. end quote. Intel's 11th gen desktop chips, better known as Rocket Lake S, have launched with the flagship Core I-9, 11,900K, sporting eight cores, two less than the last gen, boosted clock speeds

of up to 5.3 gigahertz, support for DDR4 RAM at 3,200 megahertz, a total of 20 PCIE 4.0 lanes, and backwards compatibility with Intel's 400 series chipsets. So, basically, faster speeds, but fewer cores, quoting the verge. Eagle-eyed Intel fans might notice that the new chip is on paper actually a downgrade from last year's top model, the Core I-9-10-900K, which offered 10 cores and 20 threads, and a similar boosted clock speed of 5.3 gigahertz. That's because Intel is debuting a new desktop core architecture for the first time

in over half a decade with its 11th-gen Rocket Lake S-chips called Cypress Cove. Cypress Cove finally replaces the Sky Lake micro-architecture, which the company has been using since its 6th-gen chips in 2015. But the Cypress Cove design isn't actually a whole new micro-architecture. It's actually Intel's Willow Cove chip designs and technologies that the company has been using on its 11th-gen-10-nometer Tiger Lake chips, which Intel is backporting to its 14 nanometer production process. Since those designs were meant for 10 nanometer chips, though, Intel is limited in the number of cores it can fit when scaling them up to a 14 nanometer

size, hence the reduction in core count year over year. But Intel still says that the new chips will offer better performance, at least in some cases, than the 10th gen, with the core architecture enabling up to 19% IPC instructions per cycle than the previous generation. Intel's argument here is effectively that sheer core count isn't enough on its own. Frequency speed and performance matters too. And thanks to the maturity of the 14 nanometer production process, Intel is very good at cranking out every last drop of performance from these chips, end quote. In other words, paraphrasing Hyam Gartenberg, who I was just

quoting from, the best parts of Intel's 14 nanometer process with its 10 nanometer designs. Dropbox says Dropbox passwords, a password management tool introduced for businesses last year, will now be free for basic Dropbox accounts starting in April. There is a catch, however, you'd better not have more than 50 passwords. As The Verge says, that arbitrary password limit seems suspiciously like a brute force way to upsell you to becoming a paid member, quoting the Verge. Now that last pass is putting a device limit on its free plans, many are looking for a free alternative, and Dropbox passwords will indeed allow you to sync your passwords across three

devices for free. Like other password managers, it exists as a web browser extension, a mobile app on iOS and Android, and desktop applications on MacOS, Windows, and Linux. But other free password managers like Bitwarden offer unlimited passwords for free. The 50 password limit might only make sense if you don't have a lot of online accounts. Grandparents come to mind. I think it would be very hard to find someone who uses both Dropbox and doesn't have a stack of passwords numbering in the hundreds, and it's not like it costs Dropbox more money to store double, triple, or quadruple the number of passwords. We're talking about text, not multi-gigabyte videos. If you're already using a free Dropbox account for other files,

you're probably storing things that are already far larger than all the passwords you'll ever use in your lifetime. Still, it might be a worthy introduction to better password security for existing Dropbox users, and if you're already paying Dropbox 11.99 per month for a plus account or 1999 per month for a professional account, though here's a good reminder that Dropbox passwords exist and you can easily give it a try. Dropbox plans to allow users to securely share passwords to other accounts at some point in the future too, end quote. Chinese state broadcasters have announced that that country's top leader Xi Jinping has officially ordered regulators to increase oversight of internet companies to crack down on monopolies, enhance data security,

and promote fair competition. Quoting Bloomberg. China's top leader warned that Beijing will go after so-called platform companies that have amassed data and market power, a sign that the months-long crackdown on the country's internet sector is only just beginning. President Xi Jinping on Monday chaired a meeting of the Communist Party's top financial advisory and coordination committee, ordering regulators to step up oversight of internet companies. The unusually strongly worded comments from Xi and his lieutenant suggests Beijing is preparing to amplify a campaign to curb the influence of its largest and most powerful private corporations, which has so far centered mainly on Jack Ma's

Alibaba group holding and its affiliate ant group. The term platform economies could apply to a plethora of mobile and internet giants that offer services to hundreds of millions, from ride-hailing behemoth Didi Tchao-Shing to food delivery giant, Maituan, and e-commerce leaders like JD.com and Pindu-Duo, end quote. Meanwhile, the Financial Times is reporting that Huawei, Xiaomi, Tencent, and other Chinese internet companies are removing Alibaba's popular UC browser from their app stores following Xi's warning of a crackdown.

The effort against UC browser came after a program on state-owned broadcaster CCTV targeted the tech industry on China's Consumer Rights Day, an annual event when the channel investigates alleged malpractice and documents the findings on a primetime show. This year's program included a segment on misleading online medical advertising. UC browser was shown to allow private hospitals to bid for the names of China's large, well-known hospitals in keyword searches, leading potential patients to their websites instead of the public hospitals they intended to visit.

Most of China's Android app stores, including those operated by Chinese technology groups, Huawei, Zhaomi, and Tencent have blocked downloads or removed the browser. Having an app taken down for a period of time is a common punishment in China for companies deemed to have broken the rules. UC Webb, the Alibaba unit that operates the browser, apologize for the illegal adverts and pledge to strengthen oversight of the app, end quote. And finally, what of the company that was first in the crossfire when all of this started to go down? Remember when we said yesterday that Stripe was maybe the most successful Silicon Valley startup ever, with a private valuation nearing $100 billion?

Well, remember that before the plug was pulled, Ant Group had been slated to have the largest IPO of all time anywhere, with an expected valuation in the $315 billion range. Now sources are telling writers that investors in a chastened ant group have cut their private valuations of the company to just the $200 billion range. The number is about a third above Ant's valuation after its last fundraising in 2018 when it emerged as the world's most valuable unlisted tech firm, yet is far below the $315 billion it touted for what was set to be the world's largest IPO. Ant is changing its corporate structure to that of a financial holding firm, following regulatory

pressure to subject it to rules similar to those for banks. The financial technology giant was regarded as a tech firm in 2018 when it raised $14 billion at a valuation of about $150 billion in the world's largest single fundraising. With the earnings impact of the revamp unknown, one investor said it valued Ant at about the same as the 2018 fundraising. Another said it marked its ant investment at cost, meaning it does not see any return for the time being, end quote. A hacker apparently paid a company called Sakari $16 to reroute a reporter's text messages and then use SMS two-factor authentication to break into that reporter's various accounts. Let me be clear, this is not sim jacking.

Today I learned you can just pay a company to reroute someone. else's texts, quoting motherboard. This overlooked attack vector shows not only how unregulated commercial SMS tools are, but also how there are gaping holes in our telecommunications infrastructure with a hacker sometimes just having to pinky swear they have the consent of the target. Quote, welcome to create an account if you want to mess with it. Literally anyone can sign up. Lucky 225, the suit anonymous hacker who carried out the attack told motherboard,

describing how easy it is to gain access to the tools necessary to seize phone numbers. Fortunately, Lucky 225 was taking over my number and breaking into the connected accounts with my permission to demonstrate the flaw. This also doesn't rely on SS7 exploitation, where more sophisticated attackers tap into the telecom industry's backbone to intercept messages on the fly. What Lucky 225 did with Sakari is easier to pull off and requires less technical skill or knowledge. Unlike Simjacking, where a victim loses cell service entirely, my phone seemed normal, except I never received the messages intended for me, but he did. Once the hacker is able to reroute a target's text messages, it can be trivial to hack into other accounts associated with

that phone number. In this case, the hacker sent login requests to Bumble, WhatsApp, and postmates, and easily access the accounts, end quote. How is this possible, you might ask? I encourage you to read the entire piece for a first-person account of how this went down, but in a world where SMS sign-up or authentication or login is more common than ever. This seems especially problematic, quoting again. As for how Sakari has this capability to transfer phone numbers, Noel from Security Research Labs said, quote, there is no standard global protocol for forwarding text messages to third parties. So these attacks would rely on individual agreements with telcos or SMS hubs, end quote. In Sakari's case, it receives the capability to control.

the rerouting of text messages from another firm called bandwidth, according to a copy of Sakari's LOA obtained by motherboard. Bandwidth told motherboard that it helps manage number assignment and traffic routing through its relationship with another company called Net Number. Net Number owns and operates the proprietary centralized database that the industry uses for text message routing, the override service registry OSR, bandwidth said. The flow of the capability to reroute text messages is similar in some ways to the cell phone location data market where telecommunications giants such as T-Mobile, AT&T, and Sprint, sold access to their customers' location data to a series of aggregators who then in turn resold that access to other companies. And along with that transfer

of the location data access, each company also pushed the need to obtain consent down to the company below it, resulting in wide room for abuse. In 2019, Motherboard reported on how we paid a bounty hunter source $300 to gain the location of a phone to demonstrate the issue, with the target phone not receiving any sort of text message or voice call to confirm they had provided consent to be tracked. Verizon introduced its own consent mechanism, where it forced at the carrier level a targeted phone to receive a text message to confirm the owner consented to sharing their location data. That practice of delegating the need to obtain consent to other companies also applies to this latest issue of text messaging routing. In this case, Sakari asked Lucky

225 to sign an LOA to confirm they had the authority to take control of motherboard's phone number, but at the time, Sakari did not send any sort of message to the target number to confirm whether the user consented to the transfer. Bandwidth said it was the responsibility of the retail service provider, which in this case was Sakari to obtain consent. Quote, while text message forwarding might have legitimate applications for business, the particular implementation underpinning this attack is appallingly weak in security and data privacy. Telecos have different ways of authenticating their customers, obviously including text messaging. The fact that none of these authentication methods are used in this case to get consent from

the owner of a forwarded phone number is shocking, Noel added, end quote. Yeah, again, to sum up what happened here, just to underline how insane this is, you can right now pay a company less than 20 bucks, have someone else's text messages forwarded to you, and all you have to do is sign a letter, basically Pinky swear, saying you have consent to receive these messages, and these companies don't do anything to verify that consent with the original end user. That seems pretty, pretty terrible to me. Thanks to all those who participated in our Twitter spaces experiment last night. Unfortunately, my attempt to screen record the proceedings was a fail. If anyone managed to record it, please reach out.

and get me the file? Also, did anyone have trouble seeing or getting into the space? Because the number of people in the space seemed to hold pretty steady the whole two hours we were live, but I saw a ton of folks come and go without the overall numbers fluctuating, suggesting that Twitter might have set a number for the room and kept it at that number. The only way to know for sure is if any of you didn't see the room, though you were looking for it or tried to get into the room but couldn't, or I'm sorry, space.

So if that is you, get in touch and let me know. Clubhouse caps their rooms at 5 to 7,000 people. And this felt like it was always around, I don't know, 70 to 90, but much more people than that came through the room over the time it was open. Again, space, sorry. Anyway, thanks to those of you that participated. Talk to you tomorrow.