Five men have pleaded guilty to running laptop farms and providing other assistance to North Koreans to obtain remote IT work at US companies in violation of US law, federal prosecutors said.

The pleas come amid a rash of similar schemes orchestrated by hacking and threat groups backed by the North Korean government. The campaigns, which ramped up nearly five years ago, aim to steal millions of dollars in job revenue and cryptocurrencies to fund North Korean weapons programs. Another motive is to seed cyber attacks for espionage. In one such incident, a North Korean man who fraudulently obtained a job at US security company KnowBe4 installed malware immediately upon beginning his employment.

On Friday, the US Justice Department said that five men pleaded guilty to assisting North Koreans in obtaining jobs in a scheme orchestrated by APT38, also tracked under the name Lazarus. APT38 has targeted the US and other countries for more than a decade with a stream of attack campaigns that have grown ever bolder and more advanced. All five pleaded guilty to wire fraud, and one to aggravated identity theft, for a range of actions.

Read full article

Comments

On Friday, a US District Court issued a preliminary injunction blocking the United States government from halting federal funding at UCLA or any other school in the University of California system. The ruling came in response to a suit filed by groups representing the faculty at these schools challenging the Trump administration’s attempts to force UCLA into a deal that would substantially revise instruction and policy.

The court’s decision lays out how the Trump administration’s attacks on universities follow a standard plan: use accusations of antisemitism to justify an immediate cut to funding, then use the loss of money to compel an agreement that would result in revisions to university instruction and management. The court finds that this plan was deficient on multiple grounds, violating legal procedures for cutting funding to an illegal attempt and suppressing the First Amendment rights of faculty.

The result is a reprieve for the entire University of California system, as well as a clear pathway for any universities to fight back against the Trump administration’s attacks on research and education.

Read full article

Comments

An anonymous reader shares a report: When Nigel Morris tells you he’s worried about the economy, you listen. As industry observers know, Morris co-founded Capital One and pioneered lending to subprime borrowers, building an empire on understanding exactly how much financial stress the average American can handle. Now, as an early investor in Klarna and other buy-now-pay-later companies like Aplazo in Mexico, he’s watching something that makes him deeply uncomfortable.

“To see that people are using [BNPL services] to buy something as basic and fundamental as groceries,” Morris told me on stage at Web Summit in Lisbon this week, “I think is a pretty clear indication that a lot of people are struggling.” The statistics back up his unease. Buy-now-pay-later services have exploded to 91.5 million users in the United States, according to the financial services firm Empower, with 25% using the services to finance their groceries as of earlier this year, according to survey data released in late October by lending marketplace Lending Tree.

These aren’t discretionary purchases — the designer bags and latest Apple headphones that BNPL was marketed for originally. Borrowers aren’t paying it all back, either. According to Lending Tree, default rates are accelerating: 42% of BNPL users made at least one late payment in 2025, up from 39% in 2024 and 34% in 2023.

Read more of this story at Slashdot.

Game publisher Paradox Interactive has split with Colossal Order, the studio behind Cities: Skylines II. Colossal Order, which also made the original Cities: Skylines back in 2015, will move on to something new after completing a few last updates. The intellectual property will remain with Paradox, which said today that work on Cities: Skylines II will be moved to Iceflake Studios. The Finland-based internal team will be responsible for all development, including future content updates and the long-awaited console version, starting in 2026.

The move comes after about two years of trying to salvage the citybuilding sequel and the reputations of all parties. While the game was initially expected to debut in October 2023 on PC and consoles, the launch was limited to PC, with higher minimum specs than previously announced and with a lot of bugs. The ongoing issues caused tension and toxicity between Colossal Order and the Cities: Skylines audience. Although the game has reached a more stable state, new content has been slow to arrive and there is still no sign of a console launch as the studio exits their project.

This article originally appeared on Engadget at https://www.engadget.com/gaming/cities-skylines-ii-dev-parts-ways-with-publisher-paradox-210229692.html?src=rss

We’ve been using passwords to protect our various accounts for a few decades now, and, to be honest, we’re not very good at it. Many of us use the same simple, easy to remember passwords for all of our accounts—convenient for logging in, but horrible for security. Not only will a bad actor (or computer) be able to guess that password easily, they’ll try it against your other accounts. Before you know it, you have multiple breaches, some of which may involve financial or private information.

There are a number of steps you can take to beef up your password security, of course. First, you can use a complex and unique password for each of your accounts, making sure to never reuse a password. A well-made password can be impossible for a human to guess, and virtually impossible for a computer to guess. But even if a company loses your password in a data breach, using two-factor authentication (2FA) can protect you further. Without a trusted device that either generates or receives a 2FA code, your password becomes essentially useless to hackers. And since you didn’t repeat passwords, they can’t try it on your other accounts. That’s what makes this combo a winning strategy.

But many, if not most, of us aren’t using this winning strategy. Many are still at risk, or putting their organizations at risk, with insecure authentication measures. As such, there’s a push for consumers to adopt a new form of authentication, something that combines the convenience of passwords, with the security of 2FA, all without you needing to remember a thing: passkeys.

What are passkeys?

Passkeys are a (relatively) new authentication method that offer a similar experience to passwords without actually involving a password of any kind. The measure relies on something called public key cryptography: When you create a new account with a passkey, or you create a passkey for your existing account, a “key pair” is generated. One of these keys is public, and is stored by the company that runs the account in question. This key is not a secret, and, theoretically, could be stolen or lost in a breach. However, the other key is a secret. This private key is stored on your device–such as a smartphone, tablet, or computer—and is what is used to actually authenticate your identity.

To create the passkey, you simply need to use your device’s built-in authentication method. That might mean a face scan, a fingerprint scan, or a PIN. Once you successfully authenticate yourself, the passkey is established. To log in in the future, you simply authenticate with one of those same three methods. If it goes through, the system then checks with the account that holds the public key to confirm your identity, and you’re in—no password required.

Your passkeys are securely stored on your devices, typically in a “vault” such as a keychain or password manager. Apple generates and stores passkeys in iCloud Keychain, for example. If you use a password manager, like Bitwarden or 1Password, you can create and store passkeys there. Any device that has access to that password manager can then also access the passkey for authentication.

However, you don’t need to log into your accounts on the device that contains the passkey. If you’re using a different device, say a friend’s computer or a tablet that doesn’t contain the passkey, you will have the option to use your trusted device to authenticate. For example, say you want to check your bank account on your PC, but your account uses a passkey stored on your iPhone. You can choose to authenticate using the passkey device, which will trigger the account’s site to present a QR code. You can scan the QR code on your iPhone, authenticate using Face ID, Touch ID, or your PIN, and you’ll log in. This is also how the feature works when signing into accounts on devices that don’t store passkeys directly, like a PlayStation 5.

Are passkeys secure?

The short answer? Yes. Passkeys are an extremely secure authentication method. While they’re way more secure than passwords, they’re even more secure than 2FA. 2FA is great, and certainly better than using a password alone, but it is possible for attackers to steal the authentication codes—especially when these codes are SMS-based. This can be as sophisticated as hacking into the platforms that send your codes, or as simple as a phishing scheme: Scammers can pose as representatives of the account in question, and trick you into sharing your 2FA codes with them. As such, 2FA, while secure, has an inherent phishing flaw.

Passkeys don’t have this flaw. You can’t be tricked into giving over one of your passkeys, nor can a hacker steal it from your device. The system won’t prompt you to authenticate unless you are visiting the exact domain for the platform, which means scammers can’t create dummy sites that trick you into logging in: The passkey process will simply not start. Importantly, signing in via a passkey requires the trusted device to be physically close to the device you’re logging into. As such, a hacker can’t send you an image of a QR code, trick you into scanning it, and then convince you to authenticate to log in. Unless you’re in the same room as the hacker, they’re not getting your passkey.

What if I lose my device?

One of the most common concerns regarding passkeys is what happens when you lose the device the passkey is stored on. After all, if the secret key is kept only on your smartphone, what happens if it is lost, stolen, or breaks?

As it turns out, there are a few possibilities here. First, it is true there is a risk of losing the passkey for good should you lose access to the trusted device. If you choose to store your passkeys on a physical security key, like a YubiKey, losing or breaking the key will mean losing your passkey. However, depending on the account, you may have recovery options—such as answering security questions to prove your identity. This will be case-dependent, of course: If your account only has a passkey set up, and that passkey is only stored on one device, you may lose access to the account. Check if your accounts offer recovery options, or even backup authentication measures. Some accounts may still have you create a password, even if you opt into passkeys, because of this possibility.

But more importantly, you don’t need to keep your passkeys to just one device. There are secure protocols that allow you to sync your passkeys between different devices. For example, if you create a passkey on your iPhone, iCloud Keychain securely syncs that passkey to your other connected Apple devices as well, such as an iPad and Mac. That way, when you want to log into your account on any of these devices, the option to authenticate with your passkey will be available on any—you just need to use Face ID, Touch ID, or present your PIN, and you’re in.

Can you export passkeys?

At this time, no. This is probably passkeys’ biggest drawback. Unlike passwords, which you can export to other password managers, passkeys are stuck to the service they’re generated with. If you set up a passkey for your Google Account on your iPhone, you won’t be able to directly transfer it to, say, an Android device. If your passkey lives in Bitwarden, you can’t transfer it to Google Password Manager. As such, you should try to create passkeys on the platform you most widely use. If you’re fully in the Apple ecosystem, Apple’s iCloud Keychain will work well for you. But if you have a mix of devices from different manufacturers, you’d be better off creating passkeys on a cross-platform password manager. You can always authenticate with your iPhone, of course, but the true convenience of passkeys is quickly logging in on a device that already contains the passkey.

That doesn’t mean you need to keep this service forever, however: You can set up new passkeys for existing accounts on other services, so you can securely get rid of your old passkey devices. However, make sure to keep the old device until you have the passkey established on a new one. If something goes wrong, and you’re not able to set up a new passkey on another device, you’ll need the old device to confirm your identity—unless you have an alternative authentication option, like a password.

Passkeys aren’t perfect: In practice, they can be a bit complicated, especially when working across different devices. But at their best, they offer both convenience and security. If you aren’t particularly tech savvy, or if you’re not totally entrenched in one tech company’s ecosystem, it might be a bit too early to go all-in on passkeys. But passkeys can keep your accounts safe and secure, so long as you understand these other weaknesses.

An anonymous reader shares a report: Harvard is ramping up its holdings in cryptocurrency. The nation’s oldest university reported a $443 million investment in BlackRock’s iShares Bitcoin Trust in the third quarter. The school now holds 6.8 million shares of the exchange-traded fund, up from 1.9 million in the second quarter.

The digital currency amounts to a little less than 1% of the school’s $57 billion endowment. Other schools are bullish on crypto as well. Brown University reported holding $13 million of the BlackRock bitcoin ETF in the second quarter and Emory University reported holding $20 million of Grayscale’s Bitcoin Mini Trust ETF as of March.

Read more of this story at Slashdot.

Creators on Facebook and Instagram have long griped about accounts that lift their videos without permission. Now, Meta is rolling out a new tool that allows creators to more easily track when their videos have been reposted by others.

The company introduced a new tool for creators called “content protection,” which can automatically detect when a creator’s original reel is reposted, either fully or partially, on Facebook or Instagram. Creators who are enrolled will be able to see which accounts have shared their work and will be able to take a range of actions on the clip. 

Available actions include “track,” which allows the creator to add a label indicating the clip originally came from their account. In addition to the link back, creators will also be able to keep tabs on the number of views it’s getting. Creators can also opt to block a clip entirely, which will prevent anyone else from being able to view the reel. (Meta notes choosing this option won’t impose additional penalties on the account that lifted the original content.) Finally, creators can choose to “release” the video, which removes it from their dashboard so they will no longer have any visibility into how it’s performing.

Meta

The dashboard also provides some other details that could help creators decide how to respond. For example, they can see whether the video using their content is being monetized, which may influence their decision to track with attribution or block entirely. On the other hand, if a reel was lifted from an account with few followers, they may opt to simply keep an eye on it. 

Meta has already offered Facebook creators some of these abilities in the past through its rights manager platform, but the company says making the features available directly in the Facebook app will make it accessible to more people. Notably, the company is only offering content protection to creators who share reels on Facebook. So even though the feature will detect copycats on Instagram, it will only do so if the original video has been posted to Facebook. 

Meta says content protection is rolling out now to creators in its monetization program “who meet enhanced integrity and originality standards” as well as those already using rights manager. Creators can also apply for access directly.

This article originally appeared on Engadget at https://www.engadget.com/social-media/facebook-rolls-out-new-tools-for-creators-to-track-accounts-stealing-their-content-201020255.html?src=rss

Abstract of a paper on NBER: This paper documents video consumption among school-aged children in the U.S. and explores its impact on human capital development. Video watching is common across all segments of society, yet surprisingly little is known about its developmental consequences. With a bunching identification strategy, we find that an additional hour of daily video consumption has a negative impact on children’s noncognitive skills, with harmful effects on both internalizing behaviors (e.g., depression) and externalizing behaviors (e.g., social difficulties). We find a positive effect on math skills, though the effect on an aggregate measure of cognitive skills is smaller and not statistically significant. These findings are robust and largely stable across most demographics and different ways of measuring skills and video watching. We find evidence that for Hispanic children, video watching has positive effects on both cognitive and noncognitive skills — potentially reflecting its role in supporting cultural assimilation. Interestingly, the marginal effects of video watching remain relatively stable regardless of how much time children spend on the activity, with similar incremental impacts observed among those who watch very little and those who watch for many hours.

Read more of this story at Slashdot.

A Texas Judge has rejected a request from Texas Attorney General Ken Paxton to issue a temporary order barring Tylenol’s maker, Kenvue, from claiming amid litigation that the pain and fever medication is safe for pregnant women and children, according to court documents.

In records filed Friday, District Judge LeAnn Rafferty, in Panola County, also rejected Paxton’s unusual request to block Kenvue from distributing $400 million in dividends to shareholders later this month.

The denials are early losses for Paxton in a politically charged case that hinges on the unproven claim that Tylenol causes autism and other disorders—a claim first introduced by President Trump and his anti-vaccine health secretary, Robert F. Kennedy Jr.

Read full article

Comments

Walking is great exercise, but can be slow and a little boring, unless you’re truly captivated by the wonders of the natural world—though that won’t get you very far if your scenery is the walls around a treadmill, rather than a walking path. Whether you’re walking outdoors or indoors, you can benefit from using guided walks to spice up your ambling.

I love the walking video offered by Peloton, but I to access them, I pay $50 a month (though I get so much else as part of my subscription). But if you want a free option, there are some great ones on YouTube. They’re similar to the free guided runs on the platform, but here, you just walk. (In general, if you want to find guided walking workouts on YouTube on your own, make sure to add “outside” or “treadmill” so you get results that will serve your needs.)

Prowalk Tours (749,000 subscribers)

For “walks” around a specific location, Prowalk Tours might be the best out there. You can visit a variety of cities, markets, and locales from the comfort of your home or the gym. Running one of these on your phone or iPad while you use a treadmill is a great way to distract yourself and see what other parts of the world are like. There’s no guidance, necessarily—at least not in an audio sense. This channel does divvy up the videos, though, so along the slider bar at the bottom of the player, you can see descriptions of the different areas you’ll “pass” through. If there’s a building you love in Paris, you can skip right to it. There are also other kinds of tours, like ones taken by boat and bike, so you can follow along on a stationary cycle or just watch and enjoy.

Get Fit With Rick (843,000 subscribers)

I like this channel because it’s much more exercise-focused, but still pretty chill—sometimes, you don’t want to do Pilates or an all-out cardio session; you just want to walk. On the Get Fit With Rick channel, you can get motivation and pace cues, plus stretching and other movements (he might have you do some side-stepping or knee touches during a walk). Bear in mind he is stationary while he teaches, so you could actually just dance in place like he does, but you can—and should—walk around instead, hitting the beat of the music and keeping up with his pace cues.

The variety of modifications available make this channel suitable for all levels. It’s a great option if you’re a beginner, having an active rest day, or just checking it out. The audio and video quality is high, which I always appreciate. You don’t need incredible production values if the coaching is good, but it never hurts to actually be able to adequately hear and see the instructors.

Sunny Health and Fitness (194,000 subscribers)

You might be familiar with Sunny if you’ve ever been scouring Amazon for cheap, at-home workout equipment. That was my first experience with the brand: I bought a tiny, mechanical elliptical from them that I used until I was able to get my own Peloton Bike. Their videos are like their products, in that they’re straightforward and to the point, with no fuss or flare. They are geared specifically for walkers using treadmills, and offer pacing and form cues, plus motivation from a coach.

IBX Running (59,000 subscribers)

IBX appeared on my best YouTube running channels list too, because they offer so many options in terms of workout length and structure. One of the options? Just plain walking. The videos are abundant in volume, but more importantly, they’re clear and useful: Side bars show you what your incline and pace should be, which many of the other channels don’t do. This helps you stay motivated and work toward your fitness goals.

Headspace (1 million subscribers)

You might be surprised to see Headspace here, since it’s an app and platform dedicated to meditation and mental health, rather than exercise. But Headspace offers up some quality guided walking meditation videos I think are worth checking out. Exercise isn’t just good for the body, but good for the mind, and sometimes, it’s better to focus on that aspect, rather than just calorie burning. Think of them as guided walking meditations. If you want to take a stroll and be a little more mindful (while still reaping the physical benefits of moving around), start here.

Authorities in Iran have sprayed clouds with chemicals to induce rain, in an attempt to combat the country’s worst drought in decades. From a report: Known as cloud-seeding, the process was conducted over the Urmia lake basin on Saturday, Iran’s official news agency Irna reported. Urmia is Iran’s largest lake, but has largely dried out leaving a vast salt bed. Further operations will be carried out in east and west Azerbaijan, the agency said.

Rainfall is at record lows and reservoirs are nearly empty. Last week President Masoud Pezeshkian warned that if there is not enough rainfall soon, Tehran’s water supply could be rationed and people may be evacuated from the capital. Cloud seeding involves injecting chemical salts including silver or potassium iodide into clouds via aircraft or through generators on the ground. Water vapour can then condense more easily and turn into rain. The technique has been around for decades, and the UAE has used it in recent years to help address water shortages. Iran’s meteorological organisation said rainfall had decreased by about 89% this year compared with the long-term average, Irna reported.

Read more of this story at Slashdot.

For decades—yes, literally decades—it has been easy to dismiss Blue Origin as a company brimming with potential but rarely producing much of consequence.

But last week the company took a tremendous stride forward, not just launching its second orbital rocket, but subsequently landing the booster on a barge named Jacklyn. It now seems clear that Blue Origin is in the midst of a transition from sleeping giant to force to be reckoned with.

To get a sense of where the company goes from here, Ars spoke with the company’s chief executive, Dave Limp, on the eve of last week’s launch. The first thing he emphasized is how much the company learned about New Glenn, and the process of rolling the vehicle out and standing it up for launch, from the vehicle’s first attempt in January.

Read full article

Comments

Xbox is hosting a partner showcase event on November 20 at 1PM ET. It’ll be available for streaming on the platform’s official YouTube page and Twitch page.

We don’t know how long this stream will run for, but previous Partner Preview events have lasted around 25 to 30 minutes. As indicated by the name, this stream will highlight third-party publishers. Xbox called out companies like THQ Nordic, Tencent and IO Interactive in the press release that announced the event.

We do know some games that’ll be getting the spotlight this week. Xbox has stated that we’ll be seeing “an exciting first look” at content coming to the James Bond game, 007 First Light. IO Interactive is behind that one and it comes out on March 27. 

We got to watch this title in action at Gamescom and called it “Hitman meets action blockbuster.” This is appropriate given that developer IO Interactive was behind many of the Hitman games.

We’ll also be getting an “electrifying extended gameplay trailer” for Tides of Annihilation. This is an upcoming fantasy adventure game made by the Chinese studio Eclipse Glow Games. The platform also promises a “fresh look” at Reanimal, which is a horror adventure from the folks behind Little Nightmares.

Xbox has also promised some “brand-new reveals and Game Pass announcements.” Those Game Pass announcements had better be beefy, considering that recent price hike. We’ll find out on Thursday.

This article originally appeared on Engadget at https://www.engadget.com/gaming/xbox/xbox-is-hosting-a-partner-showcase-on-november-20-at-1pm-et-191537266.html?src=rss