Agregátor RSS

The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link orSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Už to není tajemství. Apple a jeho marketingový ředitel Greg Joswiak lákají na další akci, která se uskuteční ve středu 28. října v 19:00 našeho času. Pozvánka nese slogan Pro and tell a provází ji animace s firemním logem kresleným štětcem či prstem. Ono kreslení a slovo Pro bezpochyby odkazují k ...

Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through web links, researchers reported Monday. In response to questions from Ars about the behavior, Meta said it's suspending the sharing feature while the company reviews it and considers making changes.

Like many online services, Muse has allowed users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.

A single query is all that's required

Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including:

Read full article

Comments

Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]

Bullhorn is the latest tech giant finding itself on the wrong end of a cyberattack, forcing the recruitment software provider to shut down its platform while it investigates. The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back online in the UK, US, and Australia. Unfortunately for customers hoping to get back to work, online doesn't necessarily mean working. In its latest status update, published on Tuesday, Bullhorn confirmed that some users were still struggling with single sign-on (SSO), password resets, and customizations, while several products continued to report degraded performance. Things started going sideways on Friday, October 16, when Bullhorn flagged problems getting job postings onto Indeed. By the following morning, the platform was suffering a full-blown outage, and Bullhorn confirmed later that day that it was dealing with something rather more serious than a technical hiccup. "We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said, noting that it had roped in cybersecurity specialists from CrowdStrike to help investigate the attack and restore its services. For recruitment agencies using Bullhorn, the outage meant losing access to candidate records, job applications, placements and, in some cases, the systems used to get people paid. Services began returning on Monday, but recovery has been anything but seamless. As of Tuesday morning, Bullhorn's status page still listed degraded performance across several products, including its automation tools, Talent Platform, Onboarding365 and Time & Expense. While Bullhorn is making progress getting customers back into their accounts, it has yet to answer arguably the bigger question: whether the attackers stole anything. In its customer FAQ, it said a forensic investigation is ongoing, and has not yet determined whether attackers exfiltrated customer data. Bullhorn says it will contact affected customers if the investigation finds their information was compromised, and it also warned people to watch out for opportunistic crooks looking to exploit the chaos. "Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information," it warned on Tuesday, stressing that its employees would never ask customers to disclose passwords, multi-factor authentication codes, or verification tokens. The company has also required password resets for users who don’t log in through SSO, while customers using API integrations have been instructed to rotate their credentials. The cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved. The company didn’t respond to The Register’s questions at publication time. The outage may be coming to an end, but Bullhorn's investigation into what the attackers actually did is far from over. ®

Oživeno v 20:00 | Revolut by už měl být funkční. Prošel nám převod peněz z účtu na účet a ani stavová stránka služby už nehlásí žádné problémy. Britská fintechová služba nabízející bankovní služby více než 70 milionů lidí v téměř padesáti zemích světa včetně ČR měla velké problémy. Revolut od ...

Místo mazání fotografií vyčistěte mezipaměť a zapomenuté soubory • Nejvíce paměti žerou sociální sítě, offline přehrávače a náročné hry • V nastavení aplikací smažte zbytečná data a v Galerii vysypte koš

WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support [email protected]

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]

Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. [...]

The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

In a weird way, I’ve been thinking about the idea of a Googlebook for well over a decade now — despite the fact that such a product has only officially existed for a matter of months.

I’m relatively unusual in the world of tech journalism, y’see, in that I’ve been both writing about Android and ChromeOS since the platforms’ earliest days and actively using devices from both ends of those ecosystems in my own day-to-day life that entire time. Most tech writers tend to be iPhone owners and Chromebook skeptics who see this part of the digital world from an outside view — once a year or so, when significant new devices come along for assessment — without having the perspective of someone who’s truly immersed in it day in and day out.

That distinction is always painfully apparent when you read a review that waxes on endlessly with out-of-touch iPhone comparisons and comments about the limiting nature of Google’s ChromeOS concept — positions that simply aren’t accurate for those of us who live in these ecosystems and embrace the philosophies they offer.

This won’t be one of those reviews, and I perhaps more than anyone have been champing at the bit to get my hands on one of Google’s new Android-ChromeOS-combining Googlebooks since the vaguest concept of these devices first appeared on the horizon earlier this year.

So keep that in mind when I tell you, coming from the perspective of someone who very much wanted to love this: Using a Googlebook is an extraordinarily strange experience — especially when you’re treating it like a regular laptop, as it’s being positioned by Google, and relying on it to get real work done.

But amidst all the oddness, there are some true high points along with plenty of intriguing, if unfinished-feeling, potential.

Here’s what it’s been like trying to actually work on a Googlebook — specifically, the Lenovo Googlebook, which sells for $1,149 (and was provided to me as a short-term loaner from Lenovo for the purposes of this article).

The Googlebook groundwork

First things first, let’s back up a minute and set the stage for what we’re even talking about here.

The Googlebook is a new type of laptop created by Google and built by a variety of third-party device-making partners — Acer, Asus, Dell, HP, and Lenovo, to start.

It’s meant to represent an evolution of sorts from the Chromebook, the initially simple laptop Google launched in 2012 and slowly morphed from a barebones web portal into an “everything OS” — a system that runs web apps, Android apps, Linux apps, and even sometimes Windows apps, for businesses that have specific needs that can’t be addressed in any other way.

But while ChromeOS and Android grew closer and more connected over time, Googlebook OS — the awkwardly clunky name of the operating system at the heart of every Googlebook — sets all of that aside to aim for a fresh start. The software here sports Android at its core alongside a variety of optimizations designed to bring in bits of ChromeOS-like elements and make everything seem more suited to a laptop setting.

With that in mind, starting to use a Googlebook is both immediately familiar and vexingly confusing. The interface feels a lot like Android, which is nice, but it also doesn’t quite feel in line with how you expect to work on a desktop computer. It’s a jarring sort of mashup, and it’s tough to wrap your head around to get comfortable working.

That’s true for relatively small touches like having the clock in the upper-left corner of the screen instead of in the lower-right corner, where’d you expect it on most non-Apple-made computers. It’s a little thing, but it keeps throwing me whenever I try to glance at the time during the day. That approach is similar to Android, yes, but it just doesn’t feel right in this environment or with what pretty much all of us who’d be considering this kind of device have been trained for ages to expect with a desktop computer experience.

The Googlebook’s desktop is similar to Android — but that doesn’t immediately feel natural in a desktop computing environment.

JR Raphael / Foundry

It’s true, too, for keyboard shortcuts, which don’t work the same as they did on ChromeOS — even just basic, common things like opening items on the taskbar. (Googlebook OS does have an impressive array of customizable keyboard shortcuts, if you find ’em, but there’s a ton of new combinations and muscle memory to be learned.)

The confusion is probably most prominent, though, on the app front, where Google is really leaning hard into the Play Store and the idea of Android apps being the primary way to get stuff done, despite the fact that Android apps often aren’t ideal — or even available, in some instances — in a productivity-oriented, desktop computing scenario.

The Googlebook app experience revolves primarily around the Play Store — which can be a pro or a con, depending on the moment.

JR Raphael / Foundry

At least one of Google’s own apps addresses this elegantly. Installing Google Calendar from the Play Store basically just gives you an app-like shell around the Calendar website, and you can use the Android app’s widget alongside that, if you want. (The downside is that you can’t use the equivalent Android app in full even if you want to, as there’s no straightforward path to install it — and, strangely, the same web-widget combo is not available with other Google apps, like Gmail or Drive, which give you only the web version and no option to use any associated Android widgets.)

The Google Calendar app on a Googlebook is basically just the Calendar website, though you can still use the Android app’s widget alongside that.

JR Raphael / Foundry

And since the version of Chrome on a Googlebook looks and feels like the full desktop version of the browser — like what you’d expect on a Chromebook or any other desktop computer — relying on this unusual mix of web and Android interfaces for productivity is mostly OK. Mostly.

Working in Docs, with as few as five or six tabs open, I continue encountering an occasional issue where the tab just blanks out for a second or two and then comes back — which, suffice it to say, isn’t exactly optimal for working.

The email app I use, Superhuman, appears to be completely incompatible here. The web version (which is powered by a Chrome extension) errors out anytime I open it, and the Android app is clearly not meant for large-screen, keyboard-and-mouse use and presents an incredibly awkward experience as a result.

The productivity tool Notion, meanwhile, came up for me as one of the Googlebook’s suggested tools that’s optimized for desktop use, so I followed that direction and installed the Notion Android app — only to find that the app is much more awkward and limited on a laptop than the regular Notion web experience, where all the functions are available and the keyboard shortcuts work as expected. So I decided to try to install the Notion web app for easy ongoing access to that, and I encountered a mysterious error.

width="787" height="378" sizes="auto, (max-width: 787px) 100vw, 787px">

Trying to install certain common web apps results in a frustrating error.

JR Raphael / Foundry

D’oh.

Then there’s something like Slack, which you can install from the Play Store but with an accurate warning that it’s “better on the website.” So, OK: You go to the website, try to sign in and install the web app version of it from there, and…there’s that blasted “cannot be installed” error again. (Google says it rolled out an update last week that allows any web page to be installed as a web app, but as of this writing — even with that update present on my device — the same error-encountering pattern persists.)

Other apps appear to work fine but then behave in odd and unexpected ways. I tried to install the Android version of Vivaldi, for instance, and it installs and opens without issue — but then returns an error anytime I try to actually open a website within it. That definitely doesn’t happen on a Chromebook, nor do the other aforementioned issues.

There’s just a lot of weird stuff like that, where it feels like a typical Google not-quite-fully-baked product. To be fair, that may be at least in part because of third-party app developers not yet supporting what needs to be supported for full optimization in this new environment — but either way, that’s the experience you get on a Googlebook right now, and it’s an all-too-familiar chicken-and-egg challenge that there’s no telling how long might take to see resolved.

On a somewhat related note: While the ability to install Linux apps is technically present on a Googlebook, it isn’t at all a user-friendly experience. Linux app installation is available only in a limited manner within the confines of a command-line terminal, and any such programs consequently don’t integrate into the launcher or the main Googlebook interface. That means there’s no real way to use them as a part of the standard Googlebook experience — which is a shame, as having those more traditional desktop apps available on ChromeOS went a long way in filling in pertinent function gaps for a lot of people and businesses. (Google says better Linux app support is vaguely “on the roadmap.”)

The various layers Google created to make Windows apps available for businesses in ChromeOS aren’t present in this environment, either. The official line, as relayed to me by a Google spokesperson, is that “Googlebook takes a fundamentally different architectural path than previous platforms” and they “aren’t attempting to patch together legacy PC software layers or rely on Windows emulation to make a laptop functional”:

Instead, Googlebook OS is built directly on the Android tech stack with the desktop foundations of ChromeOS, pairing the world’s largest native app ecosystem with an uncompromised, full desktop Chrome browser.

This makes it easier than ever for developers to build a true desktop-class app experience.

That’s all noble enough in theory — but as a prospective Googlebook owner right now, what good does any of that do when most developers haven’t yet built those “true desktop-class app experiences” for this environment? Or when you’re a business user whose company has the very same sort of “legacy” software requirements that led Google to work so hard on Windows app support for Chromebooks and maintain that option in that arena?

Pros, cons, and more Googlebook confusion

Let’s break from the strange stuff for a minute to focus on some positives — because, again, there is something undeniably cool about experiencing Android in a laptop form and seeing all the ways a Googlebook works hand in hand with an Android phone to make life easier.

First and foremost, Googlebooks stray from the longstanding minimalist Chromebook standard to give you a fully customizable desktop — with the ability to create any arrangement of shortcuts and widgets, just like you can on an Android home screen. That is absolutely a welcome progression from the more limiting ChromeOS approach and something I’d long hoped to see in that domain, and having those familiar forms of interactive info right in front of you while working is an incredibly helpful addition.

Having a fully customizable desktop, with regular Android widgets available, is a significant leap forward for the Googlebook.

JR Raphael / Foundry

Being able to easily access the files on your phone without any extra hoop-jumping is also a nifty touch, for the moments when such a need arises. Once your Googlebook is paired with your Android phone, you simply open the Files app on the laptop, and you can see and interact with any files on your phone right then and there. (That said, the Files app is otherwise much more barebones and limited than its ChromeOS equivalent, unfortunately — so you can’t, for instance, drag and drop directly from the phone to any specific folder on your local or Google Drive storage.)

The Googlebook makes accessing files on your Android phone delightfully easy.

JR Raphael / Foundry

As far as hardware is concerned, Lenovo did a bang-up job with its inaugural Googlebook device. This is one seriously nice laptop — a pleasure to hold, with an almost silky-feeling smooth texture on the top and a thoughtfully ridged bottom for extra grippiness when you carry it. The system has a beautiful (and big!) 15.3″ display, an excellent keyboard and trackpad, and surprisingly great speakers. Those boxes are all checked off.

The Lenovo Googlebook is a sleek and premium laptop with all the right elements in place, as far as hardware is concerned.

Lenovo

But it’s the experience inside the hardware that means the most, here in particular — so, back to that:

Native app installation aside, one key selling point of the Googlebook is how it’s able to stream apps from a connected Android phone — letting you run an app from your phone on the computer, in other words, without having the app installed locally on the Googlebook itself.

It’s a slightly confusing concept to wrap your head around, especially since you can also install most of the same apps from your phone directly onto the Googlebook if you want (and, given that this is a native Android device, installing and running Android apps on it is absolutely smoother and snappier than what you typically experience on a Chromebook). Because of that — just like with the equivalent streaming option that had been available on ChromeOS in recent years — it seems like something that’s bound to be more befuddling than beneficial for most people, most of the time.

width="652" height="1024" sizes="auto, (max-width: 652px) 100vw, 652px">

Android app streaming presents some perplexing overlap by allowing you to remotely run many of the same apps you could also install directly on the Googlebook.

JR Raphael / Foundry

That being said, I have had a couple of situations come up where it seemed like the feature might be handy. First, I needed to get a two-factor authentication code out of Authy, which is available only as a mobile app. A perfect use-case, right?

Well, not exactly: The Googlebook wouldn’t let me stream the Authy app from my phone and instead gave me an error: “Can’t cast content. This content is restricted.” So then I thought maybe I’d just install Authy directly onto the Googlebook instead, but alas: The app “isn’t available on Google Play on this device.” Bah.

Another time, I tried to open Google Wallet from my phone to get some info off my insurance card, which I have stored in that service. That worked, at first — but then the app kept hanging on a loading screen anytime I tried to open anything.

The one scenario where the app streaming has been helpful is with notifications: Anytime you get a new notification on your connected Android phone, it shows up as a pop-up in the upper-right corner of the Googlebook display. The same actions that’d be present on the notification on your phone, such as marking something as read or replying in-line, are also present on the computer, and you can click on the notification to open the associated app in full on your laptop — just like you would on your phone, only everything happens within a window on the Googlebook.

That’s a clever little sleeper feature and arguably the best part of the app streaming capability, even if you don’t necessarily think about the fact that you’re using app streaming when it happens.

Another key selling point is the addition of AI-oriented features into the Googlebook operating system. This includes a Magic Pointer feature that lets you wiggle your cursor to summon Gemini and ask it about any specific area of text or visual on your screen — which is fine but not something I find myself actually using often. Its most useful-seeming promise is being able to act on information, like creating a calendar event based on a specific area of an email or text message on your screen, but its accuracy in getting the details right in such scenarios has been pretty hit and miss in my experience.

Then there’s the integrated Rambler system for conversational voice-to-text conversion (as seen on Google’s recent Pixel phones). It works well, but by design it isn’t a direct dictation tool; instead, it adjusts and rewrites your rambling speech (hence the name) to make it better, in its view. That makes a lot of sense when you’re spouting off a quick text message while walking or driving, but unless you don’t mind losing your own specific style, intentions, and voice with longer computer-crafted communications, it doesn’t seem like something you’d be using much in a business capacity — though it can certainly be handy to have available on occasion.

As is often the case with Google products and AI features in particular, some of the smaller, less headline-making touches on the Googlebook are much more interesting than the flashy marquee features.

All in all, it’s a perplexing picture.

The Googlebook productivity puzzle

More than anything, the question that keeps coming to my mind — again, as someone who fully embraces Android and frequently works on a Chromebook — is simply: Who is this meant to serve? And, in its current state, for whom will it be a meaningful upgrade and enticement over other existing options?

I keep thinking how this exact setup would make for an absolutely brilliant souped-up Android tablet interface, with the right kind of hardware around it. You’d have the familiar Android-like environment, optimized for a larger screen, and the ability to pair that with a more desktop-like experience in the core Google apps — including Chrome, for a less limiting active web experience when you connect a keyboard (or flip around a convertible device to have one present).

As the Googlebook stands now, though, I just don’t know that it’s a great replacement yet for a Chromebook — or any other laptop — particularly when it comes to getting actual work done. At best, it feels like a fairly linear progression with some awkward adjustments and asterisks. At worst, it’s gonna be a real challenge for some people to use in the way they need a laptop to work. And I’m just not sure what’s being added, from a practical perspective, that makes it all worthwhile.

What we can say is that Google has a history of launching products that are still rough around with the edges, and sometimes, those products evolve over time — sometimes quite quickly! — and end up becoming incredible. Heck, think how much ChromeOS changed from its earliest form to the way it is today.

At the same time, Google also has a pesky habit of pivoting, giving up, and failing to follow through on once-heavily-hyped products. A fair amount of the Googlebook’s early shortcomings come down to convincing third-party developers to buy into the platform and invest the resources in making their apps work well on it, too — which is the exact same chicken-and-egg challenge that’s kept promising Google concepts from blossoming before.

For now, the Googlebook is an awkward start with plenty of potential. Where it goes next is anyone’s guess — and something that, to some degree, may depend on how many people are willing to take the leap with it early and wait for it to evolve.

Next: 7 out-of-sight Googlebook highlights

ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actions since it began Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Britain's national digital ID scheme may be dead, but Whitehall appears to have forgotten to tell the infrastructure. Despite the government scrapping its controversial plans, officials told MPs on Monday that work continues on GOV.UK One Login, digital wallets, and a growing collection of digital credentials designed to help people prove who they are. The abandoned scheme was one of Keir Starmer's flagship policies, originally pitched as a compulsory digital ID card to crack down on illegal working. Privacy campaigners weren't impressed, warning of surveillance and government overreach, and ministers eventually made it voluntary before Andy Burnham, decided to bin the whole thing. But scrapping the scheme hasn't dented Whitehall's digital identity ambitions. Officials told MPs this week that more than 80 types of documents are earmarked for the government's digital wallet, including proof of benefits, driving test certificates, and Disclosure and Barring Service (DBS) certificates. That's quite a lot of paperwork for something that's supposedly dead. The revelations came during a Public Accounts Committee hearing on Monday, where MPs wanted to know what exactly had been scrapped. "But is it not the case, based on the answers you've given us this afternoon, that the infrastructure of digital ID in the public sector is still being pursued?" asked Sarah Green, Liberal Democrat MP for Chesham and Amersham. Susannah Storey, DCMS permanent secretary, was keen to draw a line between the national scheme ministers had scrapped and the digital identity projects Whitehall had no intention of abandoning. One Login already allows people to prove who they are online, she said, but "that is not the same as a national digital identity strategy." Rod Latham, DCMS director for cybersecurity and digital identity, had a convenient explanation for why so much of digital ID was still standing: the government had only scrapped plans for a new identity product. "We already had One Login and the Gov Wallet," he told MPs, adding that work on the digital identity trust framework was also underway before the national scheme was announced. Whitehall isn't wasting time putting that technology to use, with officials confirming that testing is already underway to enable digital credentials to work with private businesses. Natalie Jones, the senior responsible owner for GOV.UK One Login, revealed that the government had opened a testing environment for private sector providers to integrate with its digital wallet technology. This would let people use digital driving licenses to prove their age in pubs, collect parcels, or verify their identity online. "We've got a bit of a chicken and egg situation. A digital driving license is only useful if there are people ready and shops and businesses ready to receive it,” Jones said, noting that further testing is planned for December, with a national rollout of digital driving licenses targeted for 2027. MPs also pressed officials on privacy, particularly whether citizens would have to consent before their information was shared between government departments. "In the confines of digital ID used in digital services, then consent is the model," said Christine Bellamy, interim director general for digital products at the Government Digital Service. There's a catch, of course. Government departments can already share data without asking permission, and officials couldn't quite explain how that squares with their promises about consent. "The strategy needs to be fully finished," Bellamy admitted, which might not be the reassurance MPs were hoping for. Jones insisted that One Login was "not a big data lake," saying it stores identity information separately and cannot see what users do inside government services. "One Login does not issue a single identifier to people," she added. Rupert Lowe MP remained unconvinced, warning that Britain could end up getting digital ID "by the back door rather than the front door." Officials maintained that the canceled national scheme was fundamentally different from the services still being developed, and that people would retain alternatives to digital identification. National digital ID may be officially dead, but between One Login, digital wallets, and dozens of planned credentials, Whitehall still has plenty of identity-related work to keep it busy. ®

Největší placená streamovací služba už roky bojuje se zneužíváním rodinného tarifu. Ten je určen jen členům jedné domácnosti, ale ve velkém jej lidé sdílejí, i když spolu nebydlí. V minulosti firma zvažovala, že bude uživatele hlídat pravidelným sledováním polohy pomocí GPS, ale nakonec od toho ...

The UK wants to take a chunk out of Apple Pay, as the Competition and Markets Authority (CMA) moves to force Apple to open access to its 12-year-old contactless payment system to rivals.

The regulator has published a consultation document that proposes requiring Apple to allow competitors to use the near-field communication (NFC) chip on its devices to enable alternative payment systems on iOS  on “fair, reasonable, transparent and non-discriminatory terms.”

The regulator says action is required because UK businesses have complained that Apple’s existing NFC access arrangements are not commercially viable.

30% of UK adults use Apple Pay?

The regulator also revealed some interesting statistics concerning use of contactless tech in the UK:

• Contactless payments represent 39% of all payments, compared to just 3% of transactions a decade ago.
• 62% of adults currently use a digital wallet.
• 50% of those use Apple Wallet — which implies that around 30% of UK adults use Apple Pay.

“These proposals open the door to more innovation, more choice and economic growth, including in the UK’s important fintech sector,” said Sarah Cardell, chief executive of the CMA.

It’s not clear if those companies will take advantage of this forced liberalization. The CMA tells us that the only services that have done so in the EU, where Apple has already been forced to open up NFC, have all been transnational entities, including Vipps, PayPal, Klarna, Curve, and BBVA. Are consumers flocking to these services to rejoice in this new market liberalization? While this open NFC has only been in place a few months, I don’t think so.

Who will really benefit from this?

Cardell also said, “By removing barriers to entry, we can help create the conditions for brilliant British businesses with great ideas to develop new products and services here — from payment apps and digital IDs to travel passes and digital keys.”

That seems highly speculative to me, but I can see UK banks offering up digital payments directly via Apple’s NFC as the most likely outcome of the new rule. In a statement, David Geale, executive director for consumers, payments and competition at the Financial Conduct Authority, said, “Opening up this technology will also support the expansion of open banking, enabling more people to make payments directly from their bank accounts.”

I imagine the banks will turn out to be the real motivation here. To my mind, it suggests the sector wants to use regulation to muscle in on the ecosystem Apple has made and wants to make direct use of NFC on iPhones to cut Apple out of the revenue generated by these payments as much as possible. 

The CMA admits, after all, that part of the reason it began this work was because it had complaints from competitors. Lenders and fintech businesses have challenged the 0.15% fee Apple takes on credit card transactions carried out via Apple Pay. The inference isn’t hard to see. With 39% of all payments made by adults in the UK being contactless, those tiny payment processing fees look like profit to banking shareholders, and they want it back. 

Apple responds

They won’t get it all back. Even the CMA concedes that Apple deserves a “fair reward” for providing access via its platforms and ecosystem, but I doubt it will hang onto as much as it makes now.

In a statement, Apple said, “We do ⁠not believe the CMA should require Apple to adopt an approach with lower privacy and security protections. We will continue to engage constructively to reach an outcome that is in the best interest of our users.”

Privacy or profits?

Digging a little deeper, the proposals will demand technical changes from Apple. The two main globally used contactless technology standards are secure element (SE), which stores information on-device, and host-based card emulation (HCE), which stores data off-device. 

Neither technology was developed by Apple, and both are used across other mobile ecosystems. While Apple now supports HCE and SE in the EU to meet Digital Markets Act regulation, it has historically avoided supporting HCE to protect the privacy and security of customers. That is almost certainly because it sees risks in storing highly confidential payment data off the device. 

Payments on Apple’s devices are instead protected by secure element. European developers wanting to use NFC with HCE systems must apply for a specific Apple NFC/HCE entitlement and meet technical, security, and regulatory standards, which will likely be the approach Apple takes in the UK if the CMA gets its way.

Will consumers really benefit from this? 

I doubt it, but the move will almost certainly prise some money out of Apple’s grasp, which will then be shared among other corporate entities, some — though probably not all — of whom may even value customer privacy as much as Apple does. In the end, it’s all about the money, and someone will take a slice of it. Does it really matter who that is?

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

The UK's financial regulator says firms' incident reporting must cover significant AI failures and near-misses as increasingly autonomous systems raise new risks. Speaking at Bloomberg's UK Policy Series on Monday, Financial Conduct Authority chief data, information and intelligence officer Jessica Rusu said the regulator wants Britain to lead safe AI adoption in financial services. Greater autonomy, however, requires clear accountability. "Poorly governed AI can create consumer harm, cyber vulnerabilities, and operational failures, potentially at much greater speed and scale," she said. "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses. As the AI Minister has recognized, near-miss reporting for agentic AI is becoming a national security priority. It is a regulatory priority too." The UK punches above its weight in financial services. The sector contributed £223.6 billion to the UK economy in 2025, or 8 percent of national output. That share was the fourth highest among OECD countries. Last week, UK artificial intelligence minister Kanishka Narayan said the government plans to work with Parliament and technical experts to assess how it could strengthen the regime to better protect Britain from AI-driven cyber threats and loss-of-control risks. "That includes identifying and reporting on serious incidents and near misses, including reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed," he said. Steven Adler, co-founder and chief scientist of independent nonprofit Guidelight AI Standards, also told MPs last week that AI oversight could learn from aviation, where reporting of near-misses is mandatory in most jurisdictions. "The way this works in aviation is that you not only want to learn about the serious crashes where someone has in fact died; you want to learn about the near-misses, because you can learn from those and help avoid them in the future," he said. However, the government has yet to commit to adding AI-specific measures to the Cyber Security and Resilience (Network and Information Systems) Bill. Alexandra Jones, Director General for Growth, Science and International at the Department for Science, Innovation and Technology, told MPs last week that amendments remain under consideration. In January, the House of Commons Treasury Committee called on financial regulators to conduct stress tests to ensure businesses are ready for AI-driven market shocks. The committee said there should be clear lines of accountability when AI systems produce harmful or unfair outcomes. ®

Ukrajina už delší dobu řeší, jak zachraňovat vojáky, kteří uvízli v zemi nikoho na pomezí fronty, kterou nepřetržitě hlídají drony. Loni na jaře jsme psali o prototypu létající sanitky Grille od německého Avilusu, jenže drsný východ, kde se improvizuje prakticky každý den, potřebuje něco ještě ...