Alongside this release I seem to have lost all thinking traces from all models - now it only generates a one-line summary similar to Gemini. I'm guessing this is an anti distillation measure? I'm surprised to see no one else complaining about this, it's a significant reduction in usefulness not being able to explore alternative angles that the model discarded in the final output.
This kills me everyday. I used to _only_ read thinking traces — the response is just what it thinks I want to hear, but I need to know what it's actually thinking to catch deeper misunderstandings earlier, or gain deeper insights into the problem it's exploring. Hiding thinking traces to curb distillation efforts is gross... both anti-consumer and anti-competitive at the same time. I can't wait to switch to open models at work for this reason alone.
Even that isn't sufficient - I've been using this for years and every so often AWCC still manages to get through. The only 100% protection from it is to use Image File Execution Options to match on the installer name to prevent it from ever running.
Which is pretty much the case with Visa and MC too. There's little card payment fraud in Europe thanks to mandated strong authentication, and very low transaction fees as interchange is capped by the EU; card issuers don't initiate chargebacks so easily.
You're confusing fraud as in unauthorized payments with fraud as in you not receiving what you paid for. The latter is not prevented by 3DS in any way.
Ask anyone who tried to dispute a purchase that happened within the EEA, whether online with SCA or card present with PIN, card issuers often tell you to deal with the merchant directly. The interchange cap has significantly reduced revenue made on card payments, they have an incentive to avoid unnecessary manual work.
Meta had(has?) a similar bug with one of their business manager features, the attacker has complete control of the initial body text which makes it highly convincing.
Trying to report this was an exercise in futility, I guess they get so much beg bounty spam that their security submission process filters out the occasional legitimate issue.
I've been receiving these for so long I started thinking it must be just me being targeted and not widespread, as Meta seems to not do anything about it.
Emails comming legitimeley from noreply@business.facebook.com with the text below. Go and decypher which part is Meta template and which is creative use of user supplied text...
Your Meta's Page may be at risk due to unusual
activity is not part of or affiliated with
Meta. Only approve requests and invitations from
people and businesses that you know and trust.
Meta will never ask for passwords, payment
information or personal details in an email. You've
received a partner request. Partners are other
businesses that you work with on Facebook. Partner
sharing lets you give access to your business assets,
but not to your business portfolio. This request is
from:
Your Page is under restriction review Contact Meta
Support: metafanpageviolate@gmail.com Protect yourself
from fraud: Verify the identity of the requester by
contacting the business using official contact information.
I've started to assume that any non-chain hotel is compromised after losing $2k to hackers that completely owned the hotel's email system. Thankfully DMARC made it irrefutable that it was their system at fault and they assumed liability. BEC is shockingly common and difficult to detect until it's too late.
Not just BEC, at multiple non-chains I have found keyloggers, card stealers and everything in between. I refuse to use anything but apple pay on an actual payment terminal (or a 3P booker that passes on a virtual card) and no ID scans or copies.
I recently had to go through the recovery flow for an admin account and it was wild. Despite Google manually unlocking the account and giving me a reset link, every login was forced to authenticate via SMS using the (removed) phone number. Luckily I was able to get a hold of it and get the code, but even after adding a TOTP and security key 2FA, further logins still required SMS.
It feels like the security team made this change to reduce account hijacking but it's at complete odds with the recovery flow and modern security practices. Better hope your phone number doesn't get hijacked or recycled because it's the key to your account now, security keys be damned.
Google enabled 2FA on my Gmail account without any prior notice. I have the username, password, recovery email, and all emails from the account are forwarded to my Fastmail, but I can't ever log into the account again because it is trying to do 2FA by SMS to a number I don't have.
I've tried everything to find someone inside Google to fix this, but so far no luck. At least with Meta you can find someone on a forum like Swapd who will take a small bribe to fix these issues.
My SO has identical situation. Identical. She still receives emails for this account because she set forwarding years ago, I still get notifications because I'm set as a recovery account, but without the phone she doesn't have for the last 15 years we have no way of logging in.
We have everything else but this alone is not enough.
You could try logging into Gmail just to the point before the SMS is sent, then phone the number you used to have and speak to the current owner. Apologize that you forgot to take the number off your account and so they are receiving text messages meant for you, but you would like to get one more message from them and they won't be bothered anymore. Then you will switch to a new number on your Gmail and they will not receive your messages. Many people will be happy to help a stranger if you are nice and polite to them.
The other option is to contact the phone company and explain, asking an open ended question if there is any way they could help you, with the permission of the current owner of the number, to get one more text message and move your Gmail to a new number. It doesn't sound in any way like you are trying to pull a scam, so they might help.
I've tried for 5 years now on-and-off to talk to the current owner. They read my texts but won't answer them and don't seem to answer any call from a number they don't recognise.
I also tried to get blackhat and tried to find anyone who can intercept the text, but I've not been able to, even on some rather shady forums...
In the United States, AT&T Wireless has an Office of the President, while Verizon has Verizon Executive Relations. Other companies might have something similar. I remember the Office of the President doing some amazing things for customers, mostly related to billing that were the customer's own fault, when nobody at any tier of the call center could help them. Even calling your own phone company, they may have internal contacts at the old number company if it is different. You could also try the executives at Google or their legal team, who almost always respond to certain types of requests. When I worked for government, other governments would bend over backwards to help us, maybe companies do the same for each other or would respond to someone from the FCC or another level of government. Just brain storming but you seem like the kind of person that will eventually figure this out.
Very similar situation. I could even see information being sent to the recovery email. So, when the time came to setup my business, I chose Zoho and avoid Google whenever possible.
Every shared hosting provider has this risk. Critical projects should be using dedicated or VPS hosting, preferably with encrypted filesystems too as even datacenter techs can fall victim to social engineering.
I'm pretty surprised that they got away with unsigned updates and shared hosting as long as they did. I wonder how many similar popular projects are out there on dodgy infrastructure.
