Tech Insight : Netflix Plans To Tackle Password Sharing
Here we look at how popular streaming service Netflix has faced a user backlash on social media after it accidentally posted what appear to be some unpopular plans to tackle password sharing on its platform.
What’s Been The Problem?
In recent years, and particularly during the pandemic, Netflix has faced the issue of password sharing, where Netflix users share their login credentials with friends or family members who don’t live with them or don’t have their own account. This has resulted in lost revenue for Netflix as the company has missed out on potential subscribers who have shared accounts instead of paying for their own.
Pressure mounted in Netflix (and other streaming platforms) following the Intellectual Property Office in December highlighting how password sharers could be breaking copyright law and that streaming services themselves have a responsibility to enforce it.
Netflix, therefore, has faced the challenges of how to tackle the password issue without alienating paying customers and losing them to competitors like Amazon Prime and Disney+, in addition to trying to reverse falling subscriber numbers, while increasing revenue.
What Has Netflix Done To Address The Issue?
Netflix has taken several measures already to address password sharing, including:
– Limiting the number of simultaneous streams. Netflix has set a limit on the number of simultaneous streams that can be accessed with a single account. Depending on the subscription plan, users can stream on one to four devices at a time.
– Testing verification measures. Netflix has tested different verification measures, such as sending a verification code to the account owner’s email or phone number, to ensure that only authorised users are accessing the account.
– Partnership with TV manufacturers. Netflix has partnered with TV manufacturers to embed the Netflix app into smart TVs. This makes it easier for users to access Netflix without needing to log in with their credentials each time.
– Focusing on content. Netflix has emphasised the importance of creating original content that is only available on the platform, which encourages users to subscribe rather than rely on password sharing.
– Trying to encourage account sharers to move of their own accord. Netflix has done this by letting people transfer their profile to a new account.
– Trialling (in South America) the allowance of people to add sub-accounts for up to two people they don’t live with for an extra £2-£3 a month.
New Measures Revealed
The latest proposed measures to tackle password sharing were reportedly posted by mistake recently on a help page, which has since been changed. It’s been reported that these new measures, which come into force in the UK later this month, include:
– Access to the Netflix service will be limited to a single primary location (called a “Netflix household”) based on the account holder’s wi-fi network and the devices connected to it. If moving house, an account holder can request a change of primary location via the “get help” section in the Netflix app. Users will also be able to the platform while temporarily away from home on verified devices, but will need to use their chosen device to watch the service over their home wi-fi before they leave in order to verify the device they watch Netflix on for seven consecutive days
– Users must verify the devices they watch Netflix on at least once every 31 days.
– As was trialled in South America, Netflix customers will be able to buy an extra member slot for their existing accounts for an additional small fee.
– Extra members will be able to watch Netflix from anywhere but must create their account in the same country as the account holder’s.
Backlash
Examples of the kind of criticism that Netflix received on social media in a backlash against the reported new anti-password sharing measures include:
– Suggestions that requiring monthly logins and travel codes could give the impression that Netflix is treating customers like criminals.
– Criticism that the measures don’t appear to take account of long-distance relationships and families with children at college or university.
– Criticism that users can’t use their Netflix account if travelling for more than 7 days.
What Does This Mean For Your Business?
Netflix needs to increase its revenue and get at least something more from the estimated 100 million households that are password sharing. While it was happy to sign up vast numbers of users during the pandemic, leaving the password-sharing loophole open for some time means that it now faces some serious challenges. For example, taking away a feature that customers have become used to and valued, adding more hoops to jump through in terms of verification, asking for more money for the same service, and imposing new rules at a time when they have stiff competition (i.e. low barriers to exit) from the likes of Amazon Prime and Disney+ could see many users simply jumping ship. This is, therefore, a risky move and a dangerous time for Netflix and it is likely that competitor streaming platforms will be stepping up moves to highlight the comparative benefits of their service and offers to help tempt disgruntled Netflix users into switching.
Featured Article : WhatsApp’s UK Threats Over Online Safety Bill
The boss of WhatsApp, Will Cathcart, has said he would rather stop users in the UK from using the app than lower its security, as suggested by the UK’s Online Safety Bill.
End-to-end Encrypted App
One of the key security features of Meta’s WhatsApp is its end-to-end encryption. This ensures that only the intended recipient can access and read the message or data, because the information is encrypted on the sender’s device and decrypted on the recipient’s device, without being accessible or readable by any intermediaries or third parties, including the service provider or government agencies. Crucially, this complete encryption also means (in relation to the latest developments) that not even WhatsApp itself can read users’ messages.
However, this was identified as being a problem for the UK government back in 2017 (when Amber Rudd) was Home Secretary following reports that London terror attacker Khalid Masood used WhatsApp’s encrypted message service minutes before the killings, and there were calls for a ‘back door’ being built into the app.
The Online Safety Bill
The UK government’s Online Safety Bill, originally proposed by former PM Teresa May, is (draft) legislation that’s designed to place a ‘duty of care’ on internet companies which host user-generated content in order to limit the spread of illegal content on these services.
The idea of the bill is to prevent the spread of illegal content and activity (e.g. images of child abuse, terror material, and hate crimes), as well as to protect children from harmful material.
The proposed bill, in its current form however, means that WhatsApp would be required to scan messages within its app for child abuse material, something that would not be possible unless the security of the app’s encryption was weakened or removed. It has been proposed, for example, that under the bill, secure apps like WhatsApp would need to adopt “accredited technology” to identify and remove child-abuse material.
Would Rather Block UK Users
The suggestion that WhatsApp’s security would be required to be weakened in any way under the requirements of the Online Safety Bill has led to WhatsApp boss saying he would refuse to comply if asked to weaken the privacy of encrypted messages and would rather block UK users than weaken privacy.
Mr Cathcart highlighted reasons why he would be happier to block UK users as being:
– 98 per cent of WhatsApp users are outside the UK anyway, and don’t want WhatsApp to lower the security of the product.
– WhatsApp has accepted being blocked in other parts of the world, e.g. Iran.
– Proposing government scanning of private messages could embolden other countries, with different definitions of illegal content, to propose the same thing, i.e. using WhatsApp as a government mass surveillance tool.
Support For WhatsApp
Support for WhatsApp’s refusal to comply and threat to block has come from Signal president Meredith Whittaker who has suggested that blocking UK users would be the right response and that a “push back” is needed against the bill’s requirements in relation to secure apps.
Also, Dr Monica Horten of the Open Rights group had also highlighted the “potentially damaging consequences for privacy and free-expression rights” that giving the government the ability to scan private messages could bring.
Element, the U.K. startup behind the decentralised messaging E2EE Matrix protocol has also criticised the current draft of the Online Safety Bill as “an attack on encryption” and a proposal of “state surveillance and censorship” that’s reminiscent of “regimes in Russia and China” .
The UK Government
The UK government is currently sticking to its stance on the bill and re-iterating that technology companies need do more to tackle online child abuse and stop giving paedophiles a way to continue their online activities in secret.
Other organisations, such as The National Society for the Prevention of Cruelty to Children (NSPCC) have supported the idea that the Online Safety Bill could help protect children by making legal requirement for platforms to identify and disrupt child sexual abuse taking place on their platforms and sites. The NSPCC’s chairman has also said that “Experts have demonstrated that it’s possible to tackle child-abuse material and grooming in end-to-end encrypted environments.”
UK Businesses Would Be Hit Hard By WhatsApp Blocking Them
If WhatsApp were to block UK users, it could have a significant impact on UK businesses that rely on the platform for communication with their customers, suppliers, and employees. For example, some potential impacts include:
– Loss of communication with customers. Many UK businesses use WhatsApp as a key or primary means of communicating with their customers, e.g. messaging and groups. If WhatsApp were to block UK users, businesses would lose a key channel for engaging with their customers, potentially leading to a decline in sales and customer satisfaction.
– Disruption of supply chains. WhatsApp is also widely used by businesses to communicate with their suppliers and vendors. If WhatsApp were to block UK users, it could lead to disruptions in the supply chain, resulting in delays and increased costs for businesses.
– The need to find and increase reliance on alternative platforms (which may also come under the requirements of the bill). Businesses may need to find alternative platforms to communicate with their customers and suppliers, which could be time-consuming and costly. Furthermore, not all customers and suppliers may be on the same alternative platform, creating additional challenges for businesses to maintain their communication channels.
– Data privacy concerns. If WhatsApp were to block UK users, it could raise concerns about data privacy and the security of other popular communication platforms. Businesses may need to reassess their data privacy policies and take additional steps to ensure the security of their communication channels.
What Does This Mean For Your Business?
WhatsApp’s privacy, provided by end-to-end encryption, is a much-valued aspect of the app, especially since so much sensitive personal and business data is shared on the app. Also, many UK businesses (and even UK government members in relation to the recent Matt Hancock message debacle) use WhatsApp daily as an important business tool, so blocking UK users could cause huge disruption and even have a negative effect on the UK economy at particularly precarious time. It is unlikely that anybody would disagree that tech companies need to do more to tackle online child abuse but the bill in its current form will doubtless create many other problems. Allowing governments to scan private messages may set a worrying precedent and embolden other countries with concerning regimes and motivations to call for similar measures as a means to conduct potentially dangerous mass surveillance. WhatsApp’s powerful indication that it is willing to ditch UK users rather than put the 98 per cent of its users who are outside of the UK at risk is a real possibility and businesses may now be looking at the UK government to take a better- informed look at the bill and enter into negotiations with WhatsApp to resolve the matter.
Tech News : Business ChatGPT API Launched
OpenAI has announced the general release of API access to ChatGPT and their ‘Whisper’, which is an automatic speech recognition (ASR) AI model.
What Does This Mean?
An API is a set of protocols, routines, and tools for building software applications that specify how software components should interact with each other. In simpler terms, an API is a way for different software applications to communicate with each other and share data.
OpenAI is an AI research lab which has developed a number of powerful AI models, including the ChatGPT and Whisper models. Whisper is an automatic speech recognition (ASR) system that enables transcription in multiple languages, as well as translation from those languages into English.
By making the ChatGPT and Whisper models available on its API, OpenAI is allowing developers and other users to access these models and integrate them into their own applications.
What’s The Benefit Of This To Developers?
This means that developers can now use these models to generate natural language text, perform language tasks such as text classification or sentiment analysis (and more), without having to build their own models from scratch. By providing access to these models through an API, OpenAI is making it easier for developers to create powerful AI applications that leverage the latest advances in AI technology using just a few lines of code to do so. With the ChatGPT and Whisper models available on its API, companies will find it more accessible and affordable to add AI capabilities to applications, and having access to Whisper will allow developers to add voice interfaces to a much wider set of applications.
Open AI says “Developers can now use our open-source Whisper large-v2 model in the API with much faster and cost-effective results. ChatGPT API users can expect continuous model improvements and the option to choose dedicated capacity for deeper control over the models.”
Popular Apps Already Using ChatGPT API
Examples of some of the popular apps already using the ChatGPT API include Shop, and Shopify’s commerce app which uses it to improve the accuracy of in-app searches and personalised product suggestions for users.
Opportunity
Some tech commentators have also highlighted how the general release of API access to these models could provide real commercial opportunities to (up until now) hobbyist developers. This could trigger a wave of new software development which could ultimately benefit many businesses in terms of added efficiency, cost and time savings.
Change To Data Retention Policy Could Help
The recent change to OpenAI’s data retention policy, whereby it will now only retain users’ data for 30 days and promises not to use data that input to train its models, could also provide the reassurance needed for more companies to try ChatGPT. This could further fuel the rise in software incorporating these powerful AI models.
What Does This Mean For Your Business?
For OpenAI, this API offering is another move towards the full monetisation of ChatGPT, which OpenAI needs to do in order to keep running its expensive AI models. Making ChatGPT (and Whisper) available on its API means greater opportunities for developers and companies to develop more powerful apps that utilise the cutting edge of AI in a relatively easy and affordable way. This could make the app market much more competitive, and we could see AI being used in many more areas of our lives. For businesses of all kinds, this could open the door to the introduction of value adding, efficiency-improving and cost saving apps that could improve competitiveness.
Sustainability : How Businesses Are Cutting Their Website’s Carbon Footprint
In this article, we look at how slimming down websites is another way that businesses are helping to cut their carbon emissions.
Websites And Carbon Emissions
According to the Eco-Friendly Web Alliance, the internet has a significant carbon footprint, contributing to 3.7 per cent of global emissions – more than the aviation industry!
The amount of carbon emissions created by a website and its hosting can vary widely depending on several factors, such as the size of the website, the amount of traffic it receives, and the type of hosting service used. That said, a study by the Website Carbon Calculator found that the average website produces 1.76 grams of CO2 per page view.
An example of how traffic can drive this figure up comes from Eco-Friendly Web Alliance figures which show that a website with 10,000 monthly page views and an average of 1g of carbon per page view can create around 100 kg of carbon per year and this figure could rise to 1 tonne for the year with 100k monthly page views.
Sources Of Carbon Emissions For Websites
How much carbon a website produces includes the emissions from the user’s device, the network infrastructure used to deliver the content, and the servers that host the website. However, the carbon footprint can be significantly higher for large websites that receive a lot of traffic or use resource-intensive features such as video streaming. There are also certain elements of a website that can drive up its carbon footprint such as large unoptimsed images, JavaScript, heavy animations, and too many plugins. There is also an argument that today’s faster internet connections have caused web designers to think less about optimising the size of the files they use, thereby adding to the website carbon emissions problem.
How Do You Know How Much Your Website’s Carbon Footprint Is?
Although it’s not possible to work out exactly, knowing the average emissions per page view and multiplying the number of monthly page views by this figure gives a rough estimate of the amount of carbon produced by a website.
There are tools and methods available to help indicate how green your website may be and how you could bring the carbon footprint down. For example, using the Green Web Foundation tool is a way of checking if your website has green hosting: https://www.
Ways To Reduce Your Website’s Carbon Footprint
Known ways to reduce a website’s carbon footprint include:
– Using efficient website design. One of the main causes of carbon footprint from websites is the energy used by servers to load and display web pages. By using efficient website design practices, such as optimising images and using efficient code, businesses can reduce the amount of energy required to load their website.
– Choosing a green web hosting provider. Businesses can choose a web hosting provider that uses renewable energy sources, such as solar or wind power, to power their servers. This can significantly reduce the carbon footprint of a website.
– Minimising website resources. Businesses can reduce the carbon footprint of their website by minimising the number of resources it requires to load. For example, they can reduce the number of plugins, optimise images, and compress files to reduce their size. Making sure that videos on the website that play automatically are set to only play when the viewer chooses to watch them, using a zoom effect for product image rollovers rather than a new image appearing on rollover, and using a static image on the home page rather than several full-screen photos set to a cycle can also help.
– Using a Content Delivery Network (CDN). A CDN can distribute website content across multiple servers around the world, reducing the energy required to load a website by reducing the distance data must travel.
– Encouraging website visitors to reduce their carbon footprint. Businesses can educate their website visitors on ways to reduce their carbon footprint, such as by choosing green energy providers, reducing energy usage, and minimising resource consumption.
– Measuring, offsetting, and insetting carbon emissions. Businesses can measure the carbon footprint of their website and offset the emissions through investments in renewable energy or other carbon reduction projects. Businesses can also work to decarbonise their own value chains to do more good rather than doing less bad i.e., carbon insetting.
Green Energy
In addition to choosing a web host that uses green, renewable, and sustainable energy, other ways that green energy can be used to reduce the carbon footprint of a website could include:
– Renewable energy certificates (RECs). RECs allow businesses to offset the carbon emissions produced by their website by purchasing certificates that represent the generation of renewable energy. This way, the emissions produced by the website are effectively offset by the generation of renewable energy, reducing the overall carbon footprint.
– On-site renewable energy generation. If a business has the resources and infrastructure, they can generate their own renewable energy on-site using solar panels or wind turbines. This way, the energy used to power the website is generated from renewable sources, which reduces the carbon footprint of the website.
– Virtual power purchase agreements (VPPAs). A VPPA is a financial agreement between a business and a renewable energy provider, where the business agrees to purchase renewable energy at a fixed price over a certain period of time. This way, the business can ensure that the energy used to power its website is generated from renewable sources, which reduces the carbon footprint of the website.
What Does This Mean For Your Business?
While many people may have heard of how data centres are trying to reduce their carbon footprint, many businesses are unlikely to have given much thought to the carbon footprint of their website and may consider it less of priority than the carbon footprint of other parts of their operations. However, collectively, a web full of heavy websites is responsible for surprisingly large carbon emissions. In the age of fast internet connections, Whatsapping large photos to eachother and trusting design-heavy website building platforms to make websites that also act as online shops vital to the life of the business, optimising website elements and thoughts of slimming down websites have been lost in the need to compete. It makes sense that choosing a green web host could be a good way to reduce the carbon footprint of a business website but for many businesses it’s probably a case of striking a balance between giving the right experience to customers on the website, keeping up with the competition online, and making things slimmer where it can be done so in the light of these factors. That said, having a low carbon footprint for a website may be something that businesses may want to advertise, has value to increasingly environmentally conscious consumers, and is very much in keeping with an overall business push to reduce carbon emissions all the way along the value chain.
Tech Tip – How To Add Emphasis To Your Words In WhatsApp
If you’d like to be able to add a bit more emphasis to some of your messages in WhatsApp, here are some fast and easy manual ways to add bold, italic, or strikethrough.
– To make word or phrase bold, put asterisks either side of the word or phrase e.g., *text*
– To put a word or phrase in italics, put an underscore either side of the word or phrase e.g., _text_
– To strikethrough a word, put a tilde either side e.g., ~text~.
Tech-Insight : Even After Opting Out, Your Data May Still Be Shared
A recent US research paper entitled “Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?” highlights how, in many cases, user data is still being collected, processed, and shared, even when users opt out through a Consent Management Platform (CMP).
The Issue
The research was based around developing a framework to measure how well Consent Management Platforms (CMPs) worked in terms of data protection and privacy for website users because websites and regulators don’t currently have an effective mechanism to audit advertisers’ compliance with user consent.
Data protection regulations, such as GDPR and CCPA, require websites and embedded third parties, especially advertisers, to seek user consent before they can collect and process user data. Under these regulations, only when the users opt in, should these entities collect, process, and share user data.
CMPs Audited
Computer scientists Zengrui Liu (Texas A&M University), Umar Iqbal (University of Washington), and Nitesh Saxena (Texas A&M University) published a paper outlining the results of their audit of Consent Management Platforms (CMPs). These are the software tools that helps website owners and operators with the data protection of their users by managing user consent for data collection, tracking, and other online activities that may involve personal data, and to help with compliance with world’s major data privacy laws, e.g. GDPR, UK-GDPR, California’s CCPA/CPRA and more. CMPs are, therefore, a way to solicit and convey user consent to the embedded advertisers, with the expectation that the consent will be respected.
CMPs also allow website visitors to manage their preferences for data collection, storage, and sharing, along with the ability to choose to accept or decline cookies, tracking pixels, and other tracking technologies.
OneTrust and CookieBot Audited
The auditing framework used by the researchers assessed the violations of data protection regulations and evaluated two of the most widely deployed CMPs, i.e. OneTrust and CookieBot, as well as advertiser-offered opt-out controls, i.e. National Advertising Initiative’s opt-out, under GDPR and CCPA, arguably two of the most mature data protection regulations.
The Conclusion – Users Are Still Tracked When They’ve Opted Out
The results of the research (published on the Cornell University website) show that user data is still collected, processed, and shared – even when users opt-out, and that it is, therefore, doubtful if regulations are effective at protecting users’ online privacy. The findings, published in the paper, also appear to suggest that several prominent advertisers (e.g. AppNexus and PubMatic) may even be in potential violation of GDPR and CCPA. The researchers say that the results of their study have “cast a serious doubt on the effectiveness of regulations as a sole means of privacy protection. Specifically, even after users opt-out through CMPs, their data may still be used and shared by advertisers.”
How Can Your Data Still Be Shared Despite Opting Out?
The research paper highlights two main ways in which advertisers might be able to process and share user information despite negative consent. These are:
1. Through the inaccurate deployment of CMPs, e.g. the tracking code may execute first before CMPs even have a chance to block cookies or website developers may inaccurately list non-essential cookies as essential.
2. Advertisers using side-channel information to circumvent enforcement by CMPs. For example, advertisers may change their cookies to avoid detection or rely on browser fingerprinting to track users.
Roles And Responsibilities
In the light of the results, the researchers say that regulators have a responsibility to ensure that online services abide by the laws and should be using automated mechanisms (such as the framework created by the researchers) to deploy infringements of regulations at scale. The researchers say this could be done by periodically using their framework at several vantage points, or as a browser extension.
The researchers also pointed to the fact that website developers have an important role in enforcement of regulations and could deploy CMPs that are better at conveying and enforcing user consent.
What Does This Mean For Your Business?
The research has revealed that some CMPs may not be effective in terms of compliance with data protection laws due to the fact that they can be inaccurately deployed, or advertisers can use side-channel information to get around matters of consent. This means that that although CMPs are being trusted to handle consent and compliance with data protection and privacy laws, some prominent advertisers using them may actually be in potential violation of GDPR and CCPA, plus users’ negative consent is effectively being ignored in some cases, which may also be a violation of their rights under data protection laws. It could be concluded, therefore, that CMPs can be unreliable and regulations as a sole means of privacy protection can’t be relied upon.
Without the research, this would not have been known about because there doesn’t appear to have been a framework that could be used to test the effectiveness of CMPs until the researchers made one, which indicates that the problem may be more widespread than first thought.
Advertisers and businesses may, therefore, be leaving themselves open to potential fines under data protection and privacy laws because they are not respecting user opt-out decisions. Regulators may now need to increase detection and enforcement, and businesses may need to check that their CMPs are working properly and may need to consider additional measures to cover themselves. Also, as suggested by the researchers, “CMPs, advertisers, website developers, and regulators should work together to define protocols for conveying and enforcing consent.”