Two-step verification added to Apple IDs

Two-step verification added to Apple IDs

A group of apps is shown on an Apple iPhone 4S.(Photo: By Justin Sullivan, Getty Images)

Apple has introduced two-step verification for Apple IDs, an option for users seeking to add extra layer of security when perusing the App Store or iTunes.

Two-step verification requires users to type in a special code, often sent via text message, to verify an account before making purchases or accessing services.

In the case of Apple ID, users start by registering a trusted device to receive the c ode. Whenever a purchase is made from a new device -- computer, smartphone or tablet -- using your Apple ID, the company sends a random four-digit code users must add to complete the transaction.

The codes are sent through the Find My iPhone app or text message.

Users also get a 14-digit recovery key in case their device is lost or they forget their password. Apple suggests printing multiple copies of the recovery key and keeping them in a safe place.

Apple joins several tech companies with two-step verification, including Google, Facebook and Dropbox. Whenever users log in from unknown browsers or devices, users can have a code sent to their phones to confirm their identity.

Apple Fixes iOS Lock Bypass

Apple Fixes iOS Lock Bypass

(click image for slideshow) Having recently updated its desktop operating system, OS X, Apple is doing the same for its iOS mobile operating system.

The company on Tuesday released iOS 6.1.3. The update weighs in at a mere 18.2 MB. It can be downloaded directly to an iOS device from the Settings/General/Software Update menu or through iTunes. It is mainly intended to fix a security flaw that made it possible to bypass the passcode screen.

Exploiting the flaw requires some manual dexterity and a call made to emergency services (911) that's immediately cancelled -- perhaps not the best number for a law breaker to call. Doing so provides access to the device's contacts, voicemail and photos, but not to the rest of the apps on the device. However, anyone able to try this exploit presumably has control of the device in question and could employ other tools that can access data on mobile devices, locked or not.

[ Apple has other problems. Read Is Apple Losing War Of Words?. ]

There may be other security fixes as well, but Apple has been slow to update its security updates page, through which it distributes security patch information.

Several hours after iOS 6.1.3 was released, while this story was being written, Apple finally published a link pointing to information about the security content of the update. But the link -- http://support.apple.com/kb/HT5701 -- did not point to any published content. Shortly thereafter, the broken link was removed. It's likely that by the time this article is published, Apple will have repaired the broken link.

The update also includes improvements to Apple's Maps app for Japan. Apple has been improving its cartographic data more broadly since it revised its Maps app (and was roundly criticized for it) last September. Last month, the company expanded its effort to hire engineers to improve Maps.

A link to a new Apple TV update, Apple TV 5.2.1, was also removed from Apple's security updates page, though the linked page continues to be accessible. It describes fixes for three security flaws affecting Apple TV units: CVE-2013-0977, CVE-2013-0978 and CVE-2013-0981.

The first involves a state management flaw that has to do with the way Mach-O executable files with overlapping segments are handled, a vulnerability that could be exploited to allow unsigned code. The second involves an information disclosure flaw in the ARM prefetch abort handler that could allow a local user to access the address of structures in the kernel. The third involves an IOUSBDeviceFamily driver that didn't adequately validate pipe object pointers, allowing the possibility of arbitrary code execution.

Attend Interop Las Vegas May 6-10 and learn the emerging trends in information risk management and security. Use Priority Code MPIWK by March 22 to save an additional $200 off the early bird discount on All Access and Conference Passes. Join us in Las Vegas for access to 125+ workshops and conference classes, 300+ exhibiting companies, and the latest technology. Register today!

Lawyer offers popefrancis.com to pope

Lawyer offers popefrancis.com to pope

He will surely be grateful.

(Credit: New York Times/YouTube; screenshot by Chris Matyszczyk/CNET)

If the media is to believed, the new Pope Francis is an extremely modest man.

Eschewing the life of palaces in Argentina, he lived modestly and even cooked for himself.

Such frugality, reticence, and identification with the poor of the world isn't often associated with lawyers.

Yet one member of Chicago's legal faith is offering up an act of generosity akin to just chatting with Mary Magdalene.

Chris Connors, spurred merely by religious whimsy, bought popefrancis.com in 2010.

He told the Chicago Tribune: "I thought that at some point in the near future that the names would get more relevant. Nobody names their kids Innocent anymore. And I thought it'd be great if a pope chose Francis after the great saint."

Actually, it would be a fine thing if "Innocent" made a comeback. I would feel so much more comfortable if the CEO of a new, secure social network was called "Innocent," rather than "Larry" or "Mark."

Still, Connors' gamble rather paid off.

Oddly, though, unlike all those faithful who rushed to the fleshpot of GoDaddy in order to buy up any domain that was pope-related last week, Connors is not looking for even an ounce of flesh from the Church.

He's offering to put the domain on the pope's collection plate -- free of charge, of course.

Indeed, Chicago's Cardinal George has already deemed the gesture "delightful."

Connors admits that other people have already been in touch, brandishing 30 pieces of silver and more before his face.

Yet he insists that he wants to "give Pope Francis dibs first."

I wonder if some tasteful speculator has already bought popefrancis.xxx.

Samsung unveils Galaxy S4 with novel camera design

Samsung unveils Galaxy S4 with novel camera design

IDG News Service - Samsung has taken the wraps off of its new Galaxy S4 smartphone, which will support global LTE roaming and has front- and rear-facing cameras that can be used simultaneously, the company said.

Samsung introduced the phone Thursday evening during a launch event at New York City's Radio City Music Hall. The event was also broadcast live to people watching in New York's Times Square.

One new feature is that the front- and rear-facing cameras can be used at the same time. This will allow a person to make a video call while simultaneously showing people on the other end of the line what they're looking at, Samsung says.

Two photos taken simultaneously can also be combined in various ways, by placing a small photo within a larger one, for instance. It remains to be seen if it will be a useful feature or only a novelty.

The S4 has a slightly bigger screen than the S III, at 5 in., and weighs a fraction less, at 130 grams. It's also slightly slimmer, at 7.9 millimeters thick.

It will be offered with a 1.9GHz quad-core processor or a 1.6GHz octa-core processor, depending on the market, Samsung said.

The phone will be available from 327 operators in 155 countries starting at the end of April, Samsung said. It didn't give much more shipping information than that, except to say it will be released in the U.S. in the second quarter. The operators it will be available from include ATT, Sprint, T-Mobile, Verizon Wireless, Deutsche Telecom, Orange and Vodafone. Samsung didn't provide any pricing information.

The Galaxy S4 supports HSPA+42 Mbps and 4G LTE, which Samsung said will provide connectivity anywhere in the world. The LTE version supports up to six different band sets, allowing for global LTE roaming, according to Samsung. A dual-mode TDD/FDD LTE version will be introduced later this year, Samsung said.

The networks supported will allow for download speeds of 100 megabits per second and upload speeds of 50 megabits per second, Samsung said.

The screen is a Super AMOLED display with 441 pixels per inch. It comes with 2GB of DDR3 memory and storage options of 16GB, 32GB and 64GB. A MicroSD card slot can expand that by an extra 64GB.

The phone will come in two colors at launch, black and white, or what Samsung calls "black mist" and "white frost." Other colors will follow later.

It has a 13-megapixel camera on the back and a 2-megapixel camera on the front.

Samsung executives also discussed a new "visual effects" engine used to spruce up the interface. The black bar across the top of the screen is gone, with information about battery life and signal strength displayed in a translucent bar that's supposed to blend in more with the rest of the screen.

The phone gets two new sensors over the existing Galaxy S III -- an infrared gesture sensor and a sensor for temperature and humidity. They should allow developers to build a wider range of apps.

The S4 can also be used as a TV remote, executives said. It will run Android 4.2.2, Jelly Bean. It has a removable, 2,600 mAh (milliAmphour) battery, up from 2100 mAh on the S III.

(Agam Shah in New York contributed to this report.)

More in Mobile Wireless

Germany wants Google to pay for news citations, passes re-printing bill

Germany wants Google to pay for news citations, passes re-printing bill

The lower house of the German parliament, known as the Bundestag, has approved a new bill that would require search engines to pay a license fee for re-publishing content longer than "individual words or short excerpts." The bill passed by a vote of 293 to 243, with three abstentions.

However, the law does not define exactly what such a “snippet” would entail. For the law to take effect, it would need to be ratified by the upper house of the German parliament, the Bundesrat. By all accounts, this bill is a watered-down version of what had originally been lobbied for by the German publishing and media industry.

Not surprisingly, Google has opposed this law and proposals like it in neighboring France.

“As a result of today’s vote, ancillary copyright in its most damaging form has been stopped,” Google said in a statement. “However, the best outcome for Germany would be no new legislation because it threatens innovation, particularly for start-ups. It’s also not necessary because publishers and Internet companies can innovate together, just as Google has done in many other countries.”

Still, the publishing industry seems to be fairly satisfied that they managed to get something passed through the Bundestag.

“With the right legal conditions and the technical tools provided by the Linked Content Coalition, it will be easy to access and use content legally,” the European Publishers Council said in a statement (PDF) on Friday. “This will mean that publishers will have the incentive to continue to populate the internet with high-quality, authoritative, diverse content and to support new, innovative business models for online content.”