a-bug-in-peloton’s-api-may-have-exposed-a-whole-lot-of-user-data

A bug in Peloton’s API may have exposed a whole lot of user data

An old version of Peloton’s API, the software that allows the company’s bikes and recalled treadmills to communicate with its servers, may have exposed private customer profiles, according to a report from TechCrunch. The bug was first spotted by Jan Masters, a security researcher at Pen Test Partners, and reported to Peloton on January 20th, but the company is only just now confirming that the bug has been fixed.

Using Peloton’s API, Masters was able to scrape all sorts of customer information that would typically be private, depending on the individual user’s settings. That includes customer profiles, which can potentially feature their age, location, birthday, and workout history. All Masters had to do was make an unauthenticated request to Peloton’s API and customer data was his. Masters has a more thorough explanation of how the exploit worked on Pen Test Partners’ blog and also summarized his findings in the video below:

After reporting the bug to Peloton, Masters set a 90-day deadline to address the issue. That deadline came and went without Peloton saying whether the API was fixed, which prompted Masters to turn to TechCrunch. Peloton finally responded and shared the following statement with the publication:

It’s a priority for Peloton to keep our platform secure and we’re always looking to improve our approach and process for working with the external security community. Through our Coordinated Vulnerability Disclosure program, a security researcher informed us that he was able to access our API and see information that’s available on a Peloton profile. We took action, and addressed the issues based on his initial submissions, but we were slow to update the researcher about our remediation efforts. Going forward, we will do better to work collaboratively with the security research community and respond more promptly when vulnerabilities are reported. We want to thank Ken Munro for submitting his reports through our CVD program and for being open to working with us to resolve these issues.

The screens on Peloton’s bikes and treadmills are what make the company’s workout ways so compelling. It’s how subscribers attend classes, track their workouts, and even do other non-bike or treadmill exercises. It’s a feature that Peloton charges $39 per month for an all-access membership to. Yet, like all connected devices, particularly fitness ones, it can leave private customer information more vulnerable than a non-connected stationary bike would.

Masters writes that Peloton apologized and said it resolved a majority of the API issues within a week of his report. What’s not immediately clear is if anyone other than Masters gained access to customer data while the API was in a leaky state.

When The Verge followed up to check, Peloton said it had nothing new to share that it hadn’t already provided TechCrunch and Pen Test Partners. The company also reiterated it responded to the API issue immediately.

microsoft’s-feud-with-apple-over-xcloud-on-ios-got-a-rival-kicked-from-the-app-store

Microsoft’s feud with Apple over xCloud on iOS got a rival kicked from the App Store

In 2020, Microsoft was battling to bring xCloud or Xbox Game Streaming to the iPhone and iPad, and the conversations had an unlikely victim: Shadow — a third-party cloud gaming app that lets you stream PC games to an iPhone or iPad.

Emails between Microsoft and Apple, revealed in the Epic v. Apple trial today, show how the Xbox maker was trying to get xCloud on iOS. Microsoft was trying to figure out how Shadow, Netflix, and other similar “interactive” apps were able to exist in the App Store while Apple was refusing to approve xCloud. Microsoft put forward Shadow as an example of such a service, only to see it suddenly removed from the store.

“We were showing two examples where a game or an application was able to exist, and we didn’t understand why we couldn’t,” explained Lori Wright, Microsoft’s head of business development for Xbox, during the Epic v. Apple trial today. “I believe they [Apple] ended up pulling Shadow out of the App Store based off this email we sent until they submitted changes. That was not our intention of course, it was a byproduct.”

Shadow on iPhone.
Image: Shadow

While Shadow’s removal wasn’t permanent, Apple has temporarily removed the app from the App Store twice in the past year. Shadow was first removed in February last year, with Apple reportedly citing a “failure to act in accordance with a specific part of the Apple App Store Guidelines.” Apple once again removed Shadow from the App Store in February, and the app returned a week later.

Shadow revealed that the app was removed the second time “due to a misunderstanding” around the nature of the app. “Unlike game streaming services, Shadow provides a full Windows 10 PC, rather than a library of games,” explained Luc Hancock, a community manager for Shadow. “This unique approach allows Shadow to comply with the App Store guidelines, so that you can access your Shadow PC on any iOS device to run your favorite games and software.”

Valve struggled for more than a year to launch its Steam Link game streaming service on iOS. Apple rejected the app, likely because it allowed an iOS user to access another app store, Steam, within Apple’s tightly controlled ecosystem. Apple revised its rules after rejecting Steam Link, and the app was finally approved two years ago in May 2019.

xCloud on iOS via the web.
Photo by Tom Warren / The Verge

Apple continued to make it difficult for services like xCloud and Stadia to run the way Microsoft and Google wanted to on iOS devices after those conversations, only slowly making App Store policy carve-outs that would let the services operate under severe restrictions. Apple now insists that developers individually submit games as separate apps using their streaming tech, only then bundling them together as a “catalog”-style app.

Microsoft wasn’t impressed with Apple’s approach, calling it a “bad experience for customers.” This public spat has now boiled over into the courtroom battle between Epic Games and Apple, with lawyers on Epic’s side questioning Microsoft and Nvidia representatives about their struggles to bring cloud gaming apps to iOS.

Both Microsoft and Nvidia have had to give in to Apple’s restrictions and launch their cloud gaming services through the Safari web browser instead.

anker-powerconf-c300-review:-a-little-bit-of-everything

Anker PowerConf C300 Review: A Little Bit of Everything

Our Verdict

The Anker PowerConf C300 is a consistent strong performer across lighting conditions, with a bevy of genuinely useful features that help make up for some stumbles in presentation.

For

  • + Consistent image quality
  • + Bonus features work well
  • + Lots of value

Against

  • – Detachable camera shutter feels cheap
  • – Laggy Software

Anker’s new $130 PowerConf C300 webcam is part of a new initiative from the charger company to break into productivity gear. Labeled under the Anker Work brand, this camera is clearly aimed at professionals looking to buy the best webcams for video conferences. That means it packs a detailed 1080p sensor with multiple field of view options including 78 degrees, 90 degrees and 115 degrees, plus plenty of advanced features like AI framing, HDR and 60 FPS recording.

That’s a level of customizability that’s usually reserved for more expensive, enthusiast shooters like the Razer Kiyo Pro. But while the Anker’s visual fidelity didn’t quite live up to those $200 Kiyo Pro’s, probably because it doesn’t have the Kiyo’s powerful sensor, its strong suite of features still make a strong argument for spending slightly more on it than you would on a more casual but proven camera like the Logitech C920.

Regarding those features, the Anker PowerConf C300 comes with 4 shooting modes, including Personal, Meeting, Streaming and Custom. Personal and Meeting modes both use a “flexible angle” that adjusts the field of view and image framing based on your head movement and placement, although the former tends to be more zoomed-in while the latter is more zoomed out. Streaming mode, meanwhile, locks the camera at a 90-degree field of view and turns on 60 fps recording, while custom mode lets you set your own field of view and frame rate combinations in addition to getting the option to toggle on the HDR and Anti-Flicker settings.

In practical use, I found that most Streaming mode and Meeting mode photos tended to look identical, so for the below tests, I stuck to taking photos in Personal and Meeting modes. I did not include Custom mode in my tests, as I do not have an HDR monitor to test with.

Well-Lit Room

Anker PowerConf C300 Personal Mode

(Image credit: Tom’s Hardware)

Anker PowerConf C300 Meeting Mode

(Image credit: Tom’s Hardware)

Logitech C920

(Image credit: Tom’s Hardware)

In terms of image fidelity, the Anker PowerConf C300 was roughly on par in a well-lit room with the Logitech C920, which is our leading mid-range 1080p webcam. However, perhaps reflecting its slightly higher price and more extended feature set, the Anker PowerConf C300 was much more accurate when it came to colors.

While the Logitech tends to give me a cooler color temperature than in real life, color in photos taken with the Anker came across as far more neutral and natural. This also extended to background elements, which tend to get washed out when using the Logitech.

Low-Light Room

Anker PowerConf C300 Personal Mode

(Image credit: Tom’s Hardware)

Anker PowerConf C300 Meeting Mode

(Image credit: Tom’s Hardware)

Logitech C920

(Image credit: Tom’s Hardware)

When I drew my curtain and turned off all light sources in my office except for my computer monitor, I found that the difference between the Anker and Logitech webcams was, well, night and day. While the Anker now portrayed me with a cooler but still accurate color tone, its fidelity remained largely unchanged.

Meanwhile, the Logitech C920 introduced significant grain to its photos, especially on background elements. The Logitech’s color temperature also got even cooler than before, which made me look sickly.

Overexposed Room

Anker PowerConf C300 Personal Mode

(Image credit: Tom’s Hardware)

Anker PowerConf C300 Meeting Mode

(Image credit: Tom’s Hardware)

Logitech C920

(Image credit: Tom’s Hardware)

I also took shots with the Anker PowerConf C300 and Logitech C920 pointing towards my window, to test how they work in an overexposed environment. While this is an over exaggeration of most user setups, it can help shed light on how a webcam might work under heavy light saturation.

The Logitech was, unfortunately, mostly unusable. While it did catch a glimpse of the buildings outside my window, which is impressive given that many webcams instead render windows as pure sheets of white, my face is bathed in too much shadow for me to want to call anyone under these conditions.

The Anker, however, again retained most of its fidelity in these conditions. The edges of my head were tinged by light in shots I took with it, but none of my face was hidden by excessive shadow. And while photos did suffer from a “white sheet” effect, putting the emphasis on the face is the right choice here. Even background elements appeared without issue, arguably looking better than in more neutrally lit shots.

Build Quality of the Anker PowerConf C300

Build quality is where it feels like the Anker PowerConf C300 stumbles most, although its emphasis on versatility extends to its build as well. That means you can tilt it forward 180 degrees, plus swivel it a full 360 degrees. For placement, the monitor mount fits snugly and has the typical hole for connecting a tripod on the bottom. It also connects using a detachable USB-C cable and has an optional privacy cover, but it’s here that the camera starts to show its weaknesses.

Image 1 of 2

(Image credit: Tom’s Hardware)

Image 2 of 2

(Image credit: Tom’s Hardware)

The first, and less egregious, problem is that the webcam only includes a USB-C to USB-C cable in the box. If you want to connect over USB Type-A, you have to use a small adapter that you’re likely to lose. It’s a small price to pay for USB-C functionality and can be easily resolved with your own USB-C to USB-A cable, but small and easily lost parts are still worth bringing up. Which takes us to the removable privacy slider.

Image 1 of 2

(Image credit: Tom’s Hardware)

Image 2 of 2

(Image credit: Tom’s Hardware)

The privacy slider is a detachable and purely physical switch, which means there’s no hardware level shut-off here, and you get two in the box. While that sounds like a nice gesture, it’s a testament to how easy it is to make one of these unusable. That’s because the slider attaches using glue. This introduced a few problems, the most dramatic one being that you probably won’t want to take the slider on and off a lot. Doing so can weaken the adhesive, and it’s not like it’s easy to find a place to store the slider in the meantime without leaving the glue open to the air. While this doesn’t present a major issue if you plan to use it all the time, I personally think the slider’s kind of ugly, and wouldn’t want it on at all times. Additionally, if we’re not meant to remove it frequently, why make it detachable instead of building it into the device?

There’s also the question of whether the glue will leave residue on your device, although I haven’t found this to be the case with my unit. It can be tricky to pry the slider off, though, which I suppose makes me happy that I have long fingernails.

As for the slider itself, it does its job well when attached securely, although its thin plastic has me worried about the slide rail’s durability over time. I’m also worried that the glue could break down over time, although this didn’t happen to me in the few days I used this camera while writing this review.

There’s also no guiding marks for where the slider should go on the webcam, so it’s easy to make a mistake when installing it, and adjusting it could weaken the glue.

Top: Logitech C920, Bottom: Anker PowerConf C3900 (Image credit: Tom’s Hardware)

The Anker PowerConf C300’s cord measured a little over 59 inches when pulled fully taut, which was long enough to easily reach all of my desktop’s USB ports.Logitech says the C920 has having a nearly-identical 60-inch cord, but as you can see in the picture above, its cord is noticeably longer than the PowerConf C300’s. When I pulled it taut and measured it with some measuring tape, it hit 70 inches, making it nearly a foot longer.

The PowerConf C300 also has built-in dual microphones that produce loud audio but also tended to give my voice a somewhat warbly effect that hurt clarity.

Special Features on the Anker PowerConf C300

The Anker PowerConf C300’s guide gives you instructions for downloading the free AnkerWork app, which is how you’ll access the camera’s different preset recording modes, adjust settings like brightness and saturation and set up a custom recording mode with HDR, anti-flicker, and/or 60FPS support.

Image 1 of 2

(Image credit: Tom’s Hardware)

Image 2 of 2

(Image credit: Tom’s Hardware)

The user interface is simple and light, although it’s a bit annoying to me that I need to scroll down a long list to see all the different ways a recording preset will affect my shot. I would have preferred a layout that puts as much information on my screen at once as possible. But the biggest problem here is lag, which makes the image setting section (where you can adjust photo settings like brightness or sharpness) near unusable.

Every time you press a button or move a slider in the AnkerWork app, you’re going to need to wait at least a second while it applies your changes to the camera. This is obnoxious but not insurmountable when turning HDR or Anti-Flicker on or off. But for image settings, it makes it difficult for you to select a specific number, move by small increments, or test out different settings. That’s because the lag starts as soon as you click on the slider and move your mouse, and can last as long as 5 seconds. You won’t get to see where your slider ended up until after the lag ends. There’s buttons to move the slider by increments of 1 for fine tuning, which helps with this somewhat, but using them takes agonizingly long thanks to each button press triggering even more lag.

Compare this to the user interface and snappy response times for the software for the Razer Kiyo Pro, which also supports HDR and 60fps shots, and it’s easy to see there’s a lot of room for improvement here. A large firmware update and software pitch did hit as I was finishing this review, which helped reduce lag times in most instances, but they are still present and still make the image menu almost intolerable to use.

(Image credit: Tom’s Hardware)

As for the HDR and Anti-Flicker support, turning them on is as simple as flipping a toggle (and waiting for the lag), although the former is only available when recording at 30 fps. I wasn’t able to test HDR as I don’t have an HDR monitor, but turning it on even on my non-HDR setup still made images appear slightly brighter and richer.

As for 60 fps recording, it works smoothly once you click the toggle on. A 20 second video recorded at 60 fps also only took up 45.5 MB on my hard drive, which was only 0.5 MB larger than a 30 fps video of the same length. You can also stream at 60 fps, which I had no issue doing on a private YouTube stream.

Anker’s auto frame and solo frame options can be a little trickier to see the benefits of. While they automatically zoom in to put the focus on your face as soon as you turn them on, you really have to move a lot to see the frame actually adjust to follow you.

Bottom Line

(Image credit: Tom’s Hardware)

The Anker PowerConf C300 has consistent fidelity and enough premium features to more than justify its $130 price tag, even if the implementation for those features needs some work. Regardless of lighting conditions, it always had color accurate shots with no visible artifacting in my testing. And on top of that, its multiple fields of view and auto framing options made taking those shots in the best conditions possible easy.

60 FPS and HDR recording are also boons at this price point, as they’d usually require you to upgrade to something like the $199 Razer Kiyo Pro. They work well here, although the PowerConf C300’s picture quality doesn’t match those premium webcams and the software for accessing those features can frequently be unbearably laggy.

Still, if you want a webcam that can do more than your typical casual shooter but don’t need to go full premium, the Anker PowerConf C300 is an easy choice.