Announced during Mobile World Congress, Google is expanding Assistant to more phones running Android Marshmallow or higher. This is a huge move on Google’s part as the virtual assistant was previously only running on the Pixel, Android Wear 2.0 watches, and the Home. The problem with the Google Assistant, though, is that it removes Now on Tap. Do you think that is for the better?
Google’s SVP of hardware, Rick Osterloh, said during a private meeting in Barcelona this week that there will indeed — unsurprisingly, considering its wild acclaim — be a second generation Pixel announced later this year. Further, Osterloh says that that the Pixel brand will “stay premium”…
Classic card games and fantasy card worlds on your Android phone? Yes, please!
For some, card games are the ultimate way to relax. Killing time on your morning commute or unwinding at the end of your day playing card games can happen on your phone now, which is fantastic. You can play solo or face opponents in virtual game rooms anytime, day or night, in casino-style games or fantasy card games of every kind.
We've collected the best of both worlds with our rundown of the best card games for Android.
At first glance, The Elders Scrolls: Legends looks to be following the steps of Blizzard and its wildly popular card-battling game Hearthstone — and that's great news. Hearthstone blew up fast, continually extending the already expansive universe of Warcraft while building up a fanbase of millions of players.
Bethesda is clearly looking to go after that Hearthstone market with The Elders Scroll: Legends, and they've come out of the gate strong. Legends is a really polished game that recently launched on Android. Having got into playing Hearthstone way late into the game's lifecycle, I enjoyed playing it but always felt like I'd never catch up with the best players who had been playing for years. If you've felt the same way, too, now's the time to get in on Legends at the ground floor.
Rather than being a Hearthstone clone, Legends does introduce some new mechanics — most notably the inclusion of lanes. It's a seemingly small change that really adds a whole layer of added strategy to how you play your cards.
TES: Legends gives you a few ways to play. Firstly, there's the story mode that initially teaches you the ropes and lets you earn new Legend cards, decks, and packs; draft mode lets you build a deck and take on computer opponents. If you think you're ready, test your decks against your friends or challenge online opponents in ranked battles. See you in the Arena!
Download: The Elders Scrolls: Legends — Heroes of Skyrim (Free w/IAPs)
Hearthstone is a card-based strategy game set in a fantasy world. Play cards to cast a spell and summon your minions as you fight to win battles. Rather than go through a tutorial, you're thrown right into introductory missions that teach you the ropes as you play. Additionally, before playing against other live players in the battle arena, you can engage in practice matches against computer-controlled heroes.
Your cards and points can be transferred from your phone to your tablet or computer, since your cards and awards are linked to your Battle.net account and will travel with you. The in-app purchases unlock new battles and give you access to rare, coveted cards.
Download Hearthstone Heroes of Warcraft (Free with in-app purchases)
Play Classic Solitaire and a number of its variations in this multi-game app. Additional games include Limit Texas Hold 'Em, Spades, Egyptian Ratscrew, Crazy Eights, Kings Corner, Concentration; a total of more than 40 games to choose from.
It has a good-looking 3D interface that's easy to use and figure out for each game. The app automatically saves your games and updates to new versions as you need or as you progress in skill.
In Gin Rummy Plus, you can play live against others from all over the world or invite your friends to play at your table. It features progressive jackpots and allows you to play at various skill levels; why not hop back onto a lower-level table to hone your skills before taking on a real card shark?
There's no need for in-app purchases in order to get more coins or progress through different games (but they're offered if you want). Every coin earned comes right from your own skill progression. The real-time leader boards keep things competitive and give you a heads-up when you're about to join a table of experts.
Download Gin Rummy Plus (Free with in-app purchases)
Sometimes you just want to play high stakes like you're in Las Vegas but not drop all that money. There's plenty of opportunities to improve your game, whether you're an old pro or brand new to the table. The live games against real players will teach you new strategies every time. You can opt to play live, or explore other tables to get an eye on the action.
If you play your best and crack the weekly top 10 leaderboard, you'll be eligible for fun in-app prizes! You also earn in-app Diamonds every time you play. Alternatively, you can opt to purchase them from the in-app store, but no purchase is necessary.
Download BlackJack 21 (Free with in-app purchases)
You've seen the commercials for PokerStars, and it actually lives up to the hype, which isn't always the case for such an advertised app. The poker tables are suitable for all levels, and the app features a built-in support site and forums so you can get tips and tricks from the experts. Play in tournaments or quick Sit and Go games when you have limited time. If poker is a new game for you, the app will be your teacher, and no real money will be on the line.
It's a free download that offers in-app purchases if you want to play more competitively. You can select bundles of chips at various price points, or earn chips as you play and improve at the tables.
Download PokerStars Poker Texas Holdem (Free with in-app purchases)
Euchre is a simple game to learn and it's played in quick rounds, called tricks. Four players play in teams of two, and the goal of the game is to play your highest cards one at a time to win all the cards on the table. You and your partner earn points by strategizing which cards are best to play and when to lay down your Trump cards.
A great feature in Euchre Free is the ability to choose who you partner with and who you play against. There are levels that range from beginner to expert, so you'll be well-matched at your table of choice. You can customize your backgrounds or use your own photos, which enhances the simple and smooth game interface. There are also hints and help available, as well as stats for every player at your table.
The new offering from Magic is a build on Magic: The Gathering, in which you hunt mystical creatures across the Multiverse and earn cards you will use later to win battles. It's a strategy-based trading card game with the goal of creating the ultimate deck.
You can buy booster packs via in-app purchases if you don't want to wait to earn the big cards. You'll have the option to play against friends or strangers to test the strength and ingenuity of your deck, so make sure you've stacked it well. It all might sound a bit complicated if you never played the traditional Magic card game, but the introductory tutorial lays out all the rules and goals quite well for beginners.
Download Magic:2015 (Free with in-app purchases)
Play in the world of Vigil, besieged by ancient monsters banished long ago and eager to return to terrorize your home. Build your arsenal of cards by earning Heroes and defeating Monster cards in every battle.
The game has an intricate backstory of characters and origins; you'll learn to manipulate the board with the help of The Enlightened and defeat your enemies with the knowledge of The Void. Your in-app purchases can be complex sets of cards or individual cards of high game value that are tough to earn.
Download Ascension: Chronicle of the Godslayer (Free with in-app purchases)
Card Crawl features solitaire-style gameplay served to you in four different game modes. Typical games last two to three minutes, so they're perfect for commutes or quickly passing some time when you're stuck standing in line.
As you play, you unlock ability cards and clear out dungeons to build your decks. You can check your progress against other players through an integrated leader board within Google Play.Try Card Crawl for free, and once you're hooked, you can continue via an in-app purchase
Download Card Crawl (Free with in-app purchases)
Exploding Kittens plays like Russian Roulette: players draw cards until someone unfortunately draws an Exploding Kitten, which ends their game. You'll play in groups of two to five people, and you can choose to play against your friends or strangers.
It's a deceivingly simple game and you need a solid strategy to stay alive. Hilarious cards like Nothing but cat butt keep you laughing while you try desperately not to be killed right out of the game.
Download Exploding Kittens ($1.99)
Cribbage is one of those timeless card games that has been passed down from generation to generation, and that is reflected perfectly in Cribbage With Grandpas. It's a beautifully designed game which is unlike any other on the list, because you actually get to create and customize your opponent.
Not only are you able fine tune the look of your grandpa — perhaps you'll model yours after your own family's patriarch — but you're also able to tweak their skill level and personality. Cribbage is a very social game, so you'll be on the receiving end of some light-hearted ribbing as you play. If you're new to cribbage, this is a great introduction that lets you practice strategies and play as many games as you'd like. There's no multiplayer, but that's what the physical card game is for! This is a paid app so it might be a hard sell to someone who's never played cribbage before, but there's a fine reason why this game is so popular.
Download: Cribbage With Grandpas ($2.99)
Got a favorite card game that you're hooked on? Shout it out in the comments below!
Updated August 2017: Added The Elders Scrolls: Legends to the list!
Sometimes when you’re chatting with friends, GIFs speak louder than words. A fast response is everything, so we wanted to create a smarter way to share content quickly with friends in Google Allo. Today we’re introducing new features that help you express exactly what you mean, whether that’s through a GIF or animated emoji, or by using the Google Assistant.
To roll the dice with GIFs, we also recently introduced Lucky. Tap on a Smart Reply with the Lucky icon or type “@lucky” followed by a phrase, and you can share a randomly selected GIF to your friends. So far, lmao, wow, and I love you are among the most used phrases with Lucky.
, 
, 
, 
, or 
).
The Google Assistant can help you share lots of information and content right in your chats, like movie showtimes, YouTube videos, or even pics of cats in hats (because why not?). So today we’re adding a shortcut to make it faster and easier to bring the Google Assistant into chats with friends. Just tap the Google Assistant icon in the compose box and your Assistant is ready to help.
These new features in Google Allo will be rolling out on Android starting today, and will come to iOS soon.
Many of us send dozens of emails on a daily basis, and many of those include attachments. With Gmail, there’s always been a very strict limit on file sizes for attachments at 25mb. That includes emails both incoming and outgoing. Today, though, Google is loosening that restriction a bit…
How adorable is this rescued earless seal hugging and playing with a seal plushy at the Okhotsk Tokkari Center in Monbetsu, Hokkaido, Japan!
"Tokkari" is the Ainu word for "azarashi" (earless seal), and as the center's name would imply, this facility specializes in sheltering and conservation of earless seals. Visitors can observe the natural ecology of these graceful seals, and even take part in close-up interactive activities. All the while, the center serves as a conservation facility, treating earless seals that have been injured or caught in fishing nets, and returning them home to the ocean. The Okhotsk Tokkari Center holds and extremely important role as Japan's one and only marine animal conservation facility.
(@mombetsu_land via Laughing Squid)
We’re helping readers save money all year long with the Lifehacker Ultimate Money Challenge. This month, we’re bringing back one of last year’s favorites: kick your spending weakness.
We all have problem spending areas, and while we don’t want to keep you from spending money on things you enjoy, we do want to help you spend more mindfully. This means cutting back on things you buy impulsively then later regret. Your spending weakness might be restaurants. Or it could be gadgets. Or it might just be random daily deals. If you’re not sure what your weakness is, take a moment to look at your budget and analyze your spending. Maybe your finances are already optimized, but if you’re like most people, you have a few areas you can work on.
For this month’s challenge, we want you to tell us your problem spending area and how you’ll try to tackle it. We have a few ideas and tools to help you get started:
At the end of the month, we’ll all report back and compare our spending. Ideally, you’ll kick the habit and make it a permanent thing. Of course, you want to actually save the money you save, too—there’s little point in cutting back on impulsive spending in one area just to blow it in another. You in? Sound off below!
We’re still a month away from Samsung’s Galaxy S8 launch event, but we’ve already seen a myriad of leaks on both it and the bigger Galaxy S8+. Just about everything has been revealed ahead of the device’s official announcement, from full specs to a new AI assistant (dubbed Bixby) and even some short hands-on clips of both models.
Tonight’s leak comes courtesy of Evleaks and offers a detailed (presumably official) render of the Galaxy S8.
Dyson will open a second campus focused on research and development in the U.K., close to its Malmesbury tech HQ in nearby Cotswolds. The planned expansion at home follows the recent announcement of a new Singapore tech center, which opened officially earlier this month. Read More
YouTube or Google offering traditional TV networks has been rumored for ages, and now it is finally official. Today Google unveiled 'YouTube TV,' a new subscription service offering dozens of TV networks, cloud DVR, and YouTube Red originals for just $35 a month.
Obviously the library of TV networks will make or break YouTube TV, but Google is off to a pretty good start. YouTube TV includes ABC, CBS, Fox, NBC, ESPN, and dozens of other local sports and cable networks (see the below picture for all of them).
Read MoreYouTube TV is official, includes 40+ networks for $35/month was written by the awesome team at Android Police.
Editor’s note: We’ve invited Christophe Bailhache of The Ocean Agency, a nonprofit working to preserve our oceans, to tell us about its collaboration with Google. Together, we’ve brought imagery of the waters around Okinawa, Japan online for the world to discover on Street View.
Google Street View doesn’t just offer a way to explore the world—it can also help conservation efforts by documenting landscapes threatened by environmental change. This is why The Ocean Agency is working with Google to capture underwater landscapes around Okinawa, making 360˚ panoramic imagery of the marine habitat in Japan’s southernmost region available on Street View.
The oceans off Okinawa are home to a stunning underwater world, with beautiful reefs, unique coral landscapes, and a rich variety of fish and other marine life.
While dive sites like the mysterious rock formations of Yonaguni have captured the imagination of divers and marine biologists for many years, part of the marine habitat has sadly come under stress of coral bleaching and terrestrial changes. And the 99% of people in the world who don’t dive will never get to know this environment first hand, which makes finding ways to show and explain what’s happening here even more important for ocean conservationists like us.
A rise in seawater temperatures is the main culprit behind the reefs’ deterioration. Okinawans have undertaken a number of initiatives to save the reefs. For example, the community in Onna has come together to transplant corals, creating the largest man-made coral field at over 2.5 hectares (that’s about the size of 4 football fields).
We built a series of unique underwater camera systems to document marine landscapes in 360° panoramic vision, and we’ve trained local divers to use one of these systems in order to monitor the changes to Okinawa’s marine environment. These divers will now be able to collect more imagery, expanding the Street View collection over time.
With this new Street View collection, we look forward to bringing the beauty of Okinawa’s oceans to many more people around the world, raising awareness of the challenges the reefs are facing, and creating a scientific record that helps marine biologists track the changes in these marine habitats.
Google Keep, a competitor to note-taking apps like Evernote and Microsoft’s OneNote, is today being integrated into Google’s suite of applications aimed at businesses, G Suite (previously, Google Apps for Your Domain). This allows Keep to become a part of users’ workflow for capturing ideas, jotting down quick reminders or to-dos, creating checklists, taking meeting notes… Read More
This week marks the 100th anniversary of the first jazz record ever released, or rather "jass" record. In a New York City recording studio, five white musicians called the Original Dixieland Jass Band recorded the "Livery Stable Blues" backed by the "Dixie Jass One-Step" on a 78 RPM disc. Of course, jazz music was actually "invented" primarily by black musicians in New Orleans as an evolution from ragtime in the 1910s. (But rather than recognize this long musical thread, Original Dixieland Jass Band leader/cornetist Nick LaRocca went on to make racist comments insisting he invented jazz.) At Smithsonian, John Edward Hasse looks at the history of this influential record:
Some scholars would prefer the honor of the first jazz recording to go to the African-American instrumental quartet the Versatile Four, which on February 3, 1916, recorded Wilbur Sweatman’s "Down Home Rag" (listen below) with swinging rhythms, a strong backbeat and a drive that implies improvisation. Or to Sweatman himself, who in December 1916 recorded his "Down Home Rag," (listen below) playing a solo with an improvisatory feel but a non-jazz accompaniment. Some experts simply say that it’s futile to acknowledge any actual first jazz recording, but rather point to a transition from ragtime to jazz in the years leading up to 1917. As critic Kevin Whitehead put it: “We might do better to think not of one first jazz record but of a few records and piano rolls that track how jazz broke free of its ancestors."
In New Orleans and a few other urban places, jazz was already in the air by the 1910s, and in late 1915 the record companies were starting to discover it. That’s when, according to legend, Freddie Keppard, a leading African-American cornetist from New Orleans, was playing in New York City and received an offer from the Victor Talking Machine Company to make a record.
Keppard turned Victor down, the story goes, either because he didn’t want others to “steal his stuff” or because he refused to perform an audition for Victor without compensation, thus losing the honor and distinction of leading the first jazz band to make a recording.
And so it fell to the Original Dixieland Jass Band.
https://www.youtube.com/watch?v=Um4xhfwYnvg
https://www.youtube.com/watch?v=GfDubf6TnHc
https://www.youtube.com/watch?v=JGFUYysOnlc
Nemo barely has to move to fend off Zuul's most powerful attacks.
Welcome to the roundup of the best new Android applications and live wallpapers that went live in the Play Store or were spotted by us in the previous 2 weeks or so.
Looking for the previous roundup editions? Find them here.
Android Police coverage: BatON is an app that tries to show the battery level of connected Bluetooth devices, despite Android's limitation in this area
Bluetooth, as a wireless standard, is working on its fifth major revision.
Read More17 new and notable Android apps from the last 2 weeks (2/14/17 - 2/27/17) was written by the awesome team at Android Police.
Since its launch in November of last year, Google Home has only been sold officially in the US. Sure, you can buy it there and bring it overseas or probably grab it from some black market reseller in other countries, but "officially," the device is only available in the US. That should change soon.
Rick Osterloh, SVP of Hardware at Google, revealed in an interview to the BBC at Mobile World Congress that Google Home will be launching in the UK before the end of June.
Read MoreGoogle Home might officially launch in the UK before the end of June was written by the awesome team at Android Police.
It’s not hard to spend hours upon hours reaching the deepest depths of videos over on YouTube, and I think we can all admit that we’ve found things on YouTube we could have never imagined even existed. Over the years, the amount of content people watch each day has grown more and more, and today YouTube has revealed that users are now watching over 1 billion hours of video each day…
You may have seen earlier this month that Google started testing a few new sale features on the Play Store. Select developers were able to set sale prices that showed up on the purchase button, and (finally) paid listings could be temporarily free. Now, that functionality is official. There's a support page with all the relevant details developers can check out.
There are a few important things to know before you go setting apps to free all willy-nilly.
Read MoreGoogle makes Play Store sales (including free offers) for paid apps and games official was written by the awesome team at Android Police.
The "Beat the Boss phone" is an £27 micro-telephone built into a Bluetooth headset with only trace amounts of metal in its construction; it is lozenge-shaped and is designed to be rectally smuggled into prisons, jails and courtrooms. (more…)
Mozilla bought content time-shifting app Pocket today for an undisclosed amount, the companies announced simultaneously on their blogs. What started as a handy Firefox plug-in for saving articles you didn’t have time for became more and more closely integrated with the browser, and today they’re making it official. Read More
Between all the “X” and “Z” phones released in the past year or so, we all got a little confused. Sony‘s strategy, in particular, seemed everything but clear in regards to its devices’ hierarchy. However, using Barcelona’s MWC as a platform, the Japanese firm announced what it explicitly labels as its “flagship”: the Xperia XZ Premium.
More info after the jump…
LG’s G6 went official this morning at MWC, and it seems that LG has absolutely nailed its flagship for the first time in a couple of years following the unimpressive LG G5 and LG G4. However, some of the features on the LG G6 will be exclusive to certain regions, so let’s take a closer look…
Huawei has today announced the Huawei Watch 2, its followup to the largely-successful Huawei Watch which originally launched in 2015. But the Chinese company is actually launching two successors to the Huatch today: a sportier model with silicone straps and LTE, and a “Classic” model that will serve the crowd looking for something more like its predecessor…
Say goodbye to Withings. It’s been less than a year since Nokia completed its acquisition of the French smart devices maker and now it the Withings brand is about to be sunset. Withings’ devices and software will be rebranded under the Nokia banner later this summer. Withings’ existing line of smart watches, blood pressure monitors, thermometers and cameras will all come… Read More
From ‘Hey Alexa’ to ‘Hello Moto’… Motorola has announced a partnership with ecommerce giant Amazon that will see the latter’s voice assistant tech embedded natively into most of Motorola’s devices in future. Read More
Everyone needs a helping hand sometimes. Enter the Google Assistant, which is conversational, personal and helps you get things done—from telling you about your day to taking a selfie. The Assistant is already available on Pixel, Google Home, Google Allo and Android Wear. Now we're bringing it to even more people. Starting this week, the Google Assistant is coming to smartphones running Android 7.0 Nougat and Android 6.0 Marshmallow.
Whether you need to know how to say “nice to meet you” in Korean or just a simple reminder to do laundry when you get home, your Assistant can help. With the Google Assistant on Android phones, you have your own personal, helpful Google right in your pocket.
And here are a few other things to try out—just long press on the Home button or say “Ok Google” to get started:
The Google Assistant will begin rolling out this week to English users in the U.S., followed by English in Australia, Canada and the United Kingdom, as well as German speakers in Germany. We’ll continue to add more languages over the coming year.
The Google Assistant will automatically come to eligible Android phones running Nougat and Marshmallow with Google Play Services. You'll also see the Google Assistant on some newly announced partner devices, including the LG G6.
If you happen to be in Barcelona, Spain at the mobile industry’s largest trade show Mobile World Congress this week, stop by the Android Global Village to try out the Google Assistant across a number of Android partner phones, including HTC, Huawei, Samsung and Sony.
Our goal is to make the Assistant available anywhere you need it. It came to Android Wear 2.0—via new smartwatches—just a few weeks ago and, as we previewed in January, the Assistant is also coming to TVs and cars. With this update, hundreds of millions of Android users will now be able to try out the Google Assistant. What will you ask first?
The Oscars is the most watched awards show of the year, closely followed by hundreds of millions of movie fans around the world.
This week Hollywood’s finest are gathering at the red carpet once again. While they associate the celebration with eternal fame and recognition, for online pirates it’s a highly anticipated event as well.
Traditionally, Oscar winners tend to do very well in pirate circles, so we decided to take a look at the availability of this year’s contenders through unauthorized channels.
Relying on data from Oscar piracy watcher Andy Baio, we see that all nominated* films are now available on pirate sites, most in decent quality too. There’s only one film that hasn’t been released as a screener, Blu-Ray or other high-quality rip, and that’s “Rogue One: A Star Wars Story.”
Ironically, the Star Wars movie was one of the most anticipated releases during the screener season and despite various teases and rumored leaks, it hasn’t come out yet. Instead, Star Wars pirates have had to settle for a HDTS copy.
Another issue that deserves a closer look is the availability of leaked screener copies.
For well over a decade, pirated screeners of the latest movies have started to leak online around December. Ironically, many of these titles leaked from DVD screener copies which were sent out to reviewers, including Academy members who vote for the Oscars.
This year, however, “screener season” started out a bit different than before. Previously, the first leaked screeners always came out before December 16th but this time it remained quiet.
When Christmas came there were still no leaked screeners, and it took until early January before the ball started rolling.
The silence was broken with a release of the Denzel Washington movie Fences and soon after more and more screeners appeared online. While some feared that screener season would never be the same again, at the end of the road it turned out to be a relatively regular year.
With just a few hours to go before the awards ceremony, a total of 14 screeners of nominated films have leaked online, which is comparable to previous years.
Screener leaks of Oscar nominees
The chart above shows an overview of the screener leaks per year. These are only for movies that eventually received an Academy Awards nomination*, so the total number will be even higher.
Finally, it’s worth noting that despite the widespread availability of pirate copies, screener leaks appear to be under a bit of pressure. Like previous years, most of the leaked screeners have been released by Hive-CM8.
This means that one group has to carry a pretty heavy burden. If they stop doing what they do, the screener supply could be severely limited.
That said, the focus on screeners might be a bit overstated. Except for a few prominent leaks, the interest in screener copies is not significantly higher than the average HDrip or Blu-Ray release, which are still widely available.
—
Foreign film and documentary categories are not included
Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.
BlackBerry is set to introduce the world to its ‘Mercury’ phone later this morning (or later this evening if you’re in Barcelona), but the phone — now officially known as the “KeyOne” — actually just leaked on BlackBerry’s site. We’ll have a livestream up for you soon if you want to tune in, but almost everything about the phone has now surfaced straight from the horse’s mouth. Keep reading to check out the full specs and a gallery of screenshots from the now-pulled KeyOne website…
Have you heard? A tiny bug in Cloudflare’s code has led an unknown quantity of data—including passwords, personal information, messages, cookies, and more—to leak all over the internet. If you haven’t heard of the so-called Cloudbleed vulnerability, keep reading. This is a scary big deal.
Let’s start with the good news. Cloudflare, one of the world’s largest internet security companies, acted fast when security researcher Tavis Ormandy of Google’s Project Zero identified the vulnerability.
The bad news is that the Cloudflare-backed websites had been leaking data for months before Ormandy noticed the bug. Cloudflare says the earliest data leak dates back to September 2016. It’s so far unclear if blackhat hackers had already found the vulnerability and exploited it secretly before Cloudflare fixed its code. Cloudflare’s clients include huge companies like Uber, OKCupid, 1Password (Update: 1Password claims its user data is safe), and FitBit. That means a holy fuck ton of sensitive data has potentially been compromised.
As with any major security vulnerability, it will take some time before we can fully comprehend the level of destruction caused by Cloudbleed. For now, you should change your passwords—all of them—and implement two-factor authentication everywhere you can. You’ll figure out why this is a good idea when you read about how this nasty little security disaster unfolded.
You might not be familiar with Cloudflare itself, but the company’s technology is running on a lot of your favorite websites. Cloudflare describes itself as a “web performance and security company.” Originally an app for tracking down the source of spam, the company now offers a whole menu of products to websites, including performance-based services like content delivery services; reliability-focused offerings like domain name server (DNS) services; and security services like protection against direct denial of service (DDoS) attacks.
The fact that Cloudflare is a security company makes the dustup around this new vulnerability supremely ironic. After all, countless companies pay Cloudflare to help keep their user data safe. The Cloudbleed blunder did the opposite of that.
“I’ve informed Cloudflare what I’m working on. I’m finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings,” Tavis Ormandy wrote in an advisory. “We’re talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.” Ormandy also said that the Cloudbleed vulnerability leaked data across 3,438 unique domains during a five-day period in February.
For you geeks out there, Cloudbleed is especially interesting because a single character in Cloudflare’s code lead to the vulnerability. It appears to be a simple coding error, though we’ve reached out to Cloudflare for information on what exactly happened. (Update: Cloudflare called us back and explained some things.) Based on what’s been reported, it appears that Cloudbleed works a bit like Heartbleed in how it leaks information during certain processes. The scale of Cloudbleed also looks like it could impacts as many users as Heartbleed, as it affects a common security service used by many websites.
According to a Cloudflare blog post, the issue stems from the company’s decision to use a new HTML parser called cf-html. An HTML parser is an application that scans code to pull out relevant information like start tags and end tags. This makes it easier to modify that code.
Cloudflare ran into trouble when formatting the source code of cf-html and its old parser Ragel to work with its own software. An error in the code created something called a buffer overrun vulnerability. (The error involved a “==” in the code where there should have been a “>=”.) This means that when the software was writing data to a buffer, a limited amount of space for temporary data, it would fill up the buffer and then keep writing code somewhere else. (If you’re dying for a more technical explanation, Cloudflare laid it all out in a blog post.)
In plain English, Cloudflare’s software tried to save user data in the right place. That place got full. So Cloudflare’s software ended up storing that data elsewhere, like on a completely different website. Again, the data included everything from API keys to private messages. The data was also cached by Google and other sites, which means that Cloudflare now has to hunt it all down before hackers find it.
It’s unclear who exactly has been pwned. Cloudlfare claims that only a very small number of requests led to leaked data, but since the vulnerability has been almost six months, who knows how much information is out in the wild. Furthermore, the fact that so much of that data was cached across different sites means that, while Cloudflare’s initial patch stopped the leaking, the company needs to do lots of hunting around the web to ensure that all of the leaked data gets scrubbed. And even worse, even sites that don’t use Cloudflare’s service—but have a lot of Cloudflare users—might have compromised data on their servers.
Entrepreneur and security expert Ryan Lackey offered some good advice in a blog post. And Lackey knows what he’s talking about, since his company CryptoSeal was acquired by Cloudflare in 2014.
“Cloudflare is behind many of the largest consumer web services (Uber, Fitbit, OKCupid, …), so rather than trying to identify which services are on Cloudflare, it’s probably most prudent to use this as an opportunity to rotate ALL passwords on all of your sites,” Lackey wrote. “Users should also log out and log in to their mobile applications after this update. While you’re at it, if it’s possible to use 2FA or 2SV with sites you consider important.”
Changing your passwords sucks, but you should be doing it on a semi-regular basis anyways. As we’ve argued in the past, you might as well enable two-factor authentication on everything, too, since it’s your best first defense against hackers. That said, nothing is ever truly secure on the internet, and Cloudbleed might compromise some accounts using. two-factor authentication.
This is all to say: you can’t control what happens under the hood of websites and companies like Cloudflare that power them. But you can watch your own ass—and pray to the hacker gods to keep you safe. Whatever works.
