Dashlane announced today that it's integrating passkeys into its cross-platform password manager. "We said, you know what, our job is to make security simple for users," says Dashlane CEO JD Sherman, "and this is a great tool to do that. So we should actually be thinking about ushering in this passwordless era." The Verge reports: Passwords are dying, long live passkeys. Practically the entire tech industry seems to agree that hexadecimal passwords need to die, and that the best way to replace them is with the cryptographic keys that have come to be known as passkeys. Basically, rather than having you type a phrase to prove you're you, websites and apps use a standard called WebAuthn to connect directly to a token you have saved -- on your device, in your password manager, ultimately just about anywhere -- and authenticate you automatically. It's more secure, it's more user-friendly, it's just better. The transition is going to take a while, though, and even when you can use passkeys, it'll be a while before all your apps and websites let you do so.

Going forward, Dashlane users can start to set up passkeys to log into sites and apps where they previously would have created passwords. And whereas systems like Apple's upcoming implementation in iOS 16 will often involve taking a picture of a QR code to log in, Dashlane says it can make the process even simpler because it has apps for most platforms and an extension for most browsers.

Just over two years after its launch, Facebook is shutting down the Facebook Gaming app on October 28, 2022. Now, when you open the app, you'll see a banner stating that the app will no longer be available on iOS and Android after that date. The app also won't be available on the Google Play Store or the Apple App Store. From a report: "Despite this news, our mission to connect players, fans and creators with the games they love hasn't changed, and you'll still be able to find your games, streamers and groups when you visit Gaming in the Facebook app," the notice reads. "We want to extend our heartfelt thanks to all of you for everything that you've done to build a thriving community for gamers and fans since this app first launched."

If you've been using the app, you can download your search data before the app is discontinued. The app launched in April 2020 toward the start of the COVID-19 pandemic as a way for users to watch their favorite streamers, play instant games and take part in gaming groups. Facebook experienced some hurdles trying to launch the app, as Apple rejected the app numerous times, citing its rules that prohibit apps with the main purpose of distributing casual games. Apple's rules forced Facebook to remove actual gameplay functionality from the app.

Google is trying "to make it easier for developers to create Android apps that connect in some way across a range of devices," reports the Verge. Documentation for the software development kit says it will simplify development for "multi-device experiences."

"The Cross device SDK is open-source and will be available for different Android surfaces and non-Android ecosystem devices (Chrome OS, Windows, iOS)," explains the documentation, though the current developer preview only works with Android phones and tablets, according to the Verge.

But they report that Google's new SDK "contains the tools developers need to make their apps play nice across Android devices, and, eventually non-Android phones, tablets, TVs, cars, and more." The SDK is supposed to let developers do three key things with their apps: discover nearby devices, establish secure connections between devices, and host an app's experience across multiple devices. According to Google, its cross-device SDK uses Wi-Fi, Bluetooth, and ultra-wideband to deliver multi-device connectivity.... [I]t could let multiple users on separate devices choose items from a menu when creating a group food order, saving you from passing your phone around the room. It could also let you pick up where you left off in an article when swapping from your phone to a tablet, or even allow the passengers in a car to share a specific map location with the vehicle's navigation system.

It almost sounds like an expansion of Nearby Share, which enables users on Android to transfer files to devices that use Chrome OS and other Androids. In April, Esper's Mishaal Rahman spotted an upcoming Nearby Share update that could let you quickly share files across the devices that you're signed into Google with. Google also said during a CES 2022 keynote that it will bring Nearby Share to Windows devices later this year.
"This SDK abstracts away the intricacies involved with working with device discovery, authentication, and connection protocols," argues Google's blog post, "allowing you to focus on what matters most — building delightful user experiences and connecting these experiences across a variety of form factors and platforms."

Last year, DuckDuckGo announced a free service designed to fend off email trackers and help people protect their privacy. The Email Protection beta was initially available through a waitlist. Now, it's now in open beta, meaning everyone can try it without having to wait for access. From a report: Email Protection is a forwarding service that removes trackers from messages. DuckDuckGo will tell you which trackers it scrubs as well. During the waitlist beta, DuckDuckGo says it found trackers in 85 percent of testers' emails. Anyone can now sign up for an @duck.com email address, which will work across desktop, iOS and Android. DuckDuckGo says you can create unlimited private email addresses, including a throwaway one for every website, if you prefer. You can also deactivate an address at any time.

The kingdom of Google's third major operating system, Fuchsia, is growing a little wider today. ArsTechnica: 9to5Google reports Google completed the rollout of Fuchsia to the Google Nest Hub Max. Along with the original Nest Hub/Google Home Hub, that puts two of Google's three smart displays on the new OS, with the one holdout being the 2nd Gen Nest Hub. The Nest Hub Max is the first device running Fuchsia that Google is currently selling -- the Home Hub only got Fuchsia after it had been discontinued. The Google smart display user interface is written in Flutter, a Google programming language designed for portability, which runs on Android, iOS, Fuchsia, and the weird cast platform Nest Hubs typically use. So it's not right to describe the user interface as "similar" after the OS swap -- it's the exact same code because Flutter runs on nearly everything.

You are getting a slightly newer code version, though, and it comes with a Bluetooth menu. If you dive into the settings and hit "about device," you'll see a "Fuchsia Version" field that will say something like "6.20211109.1.3166243." It's a bit weird to do an entire OS switch to the futuristic, secretive Fuchsia project and then have basically nothing to show (or say) for it in terms of obvious improvements in performance or security. You can dive into the minutia of the Fuchsia source code, but it continues to be a mystery in terms of what practical benefits it offers consumers. Google never talks about Fuchsia, so not much is known about what, exactly, Google is accomplishing here.

Microsoft could be preparing to name its next big OS update the "Windows 11 2022 Update." A report adds: References to this naming have appeared in near-final versions of the next big Windows 11 release, currently named 22H2. Twitter user XenoPanther spotted the Windows 11 2022 Update naming in the Get Started app that appears when you set up a new PC. The naming could simply be a placeholder, or it could indicate Microsoft is finally simplifying its often confusing update names for Windows. We've seen a variety of names over the years, including the Creators Update naming for a big Windows 10 update, more mundane naming like the Windows 10 May 2021 Update, and more recently, the Windows 10 21H2 moniker. Microsoft had considered naming its updates after animals or people but transitioned to the more safe monthly naming instead of point releases like Apple does with iOS, iPadOS, watchOS, and many other software updates. A move to just the yearly naming for Windows 11 updates would make sense if Microsoft is planning fewer big drops of features.

Apple is advising iOS and iPadOS users to update to the latest software version to patch two security holes that could allow an application to execute arbitrary code with kernel privileges. They also issued a patch for WebKit, the browser that powers Safari and all third-party browsers on iOS. For this vulnerability, Apple says that "processing maliciously crafted web content may lead to arbitrary code execution."

"With two major security fixes, we recommend all iPhone users update to iOS 15.6.1 immediately and all iPad users update to iPadOS 15.6.1," writes Chance Miller via 9to5Mac. "You can do so by heading to the Settings app, choosing General, then choosing Software Update."

An anonymous reader shares a report: 'Beware in-app browsers' is a good rule of thumb for any privacy conscious mobile app user -- given the potential for an app to leverage its hold on user attention to snoop on what you're looking at via browser software it also controls. But eyebrows are being raised over the behavior of TikTok's in-app browser after independent privacy research by developer Felix Krause found the social network's iOS app injecting code that could enable it to monitor all keyboard inputs and taps. Aka, keylogging.

"TikTok iOS subscribes to every keystroke (text inputs) happening on third party websites rendered inside the TikTok app. This can include passwords, credit card information and other sensitive user data," warns Krause in a blog post detailing the findings. "We can't know what TikTok uses the subscription for, but from a technical perspective, this is the equivalent of installing a keylogger on third party websites." [emphasis his]

After publishing a report last week -- focused on the potential for Meta's Facebook and Instagram iOS apps to track users of their in-app browsers -- Krause followed up by launching a tool, called InAppBrowser.com, that lets mobile app users get details of code that's being injected by in-app browsers by listing JavaScript commands executed by the app as it renders the page. (NB: He warns the tool does not necessarily list all JavaScript commands executed nor can it pick up tracking an app might be doing using native code -- so at best it's offering a glimpse of potentially sketchy activities.)

An anonymous reader quotes a report from XDA Developers: While Apple switched to 64-bit-only support with iOS 11 in 2017, Android still supports legacy 32-bit applications. However, Google is in the process of switching to 64-bit-only support, and last year's Android 12 was the first version of the OS to support 64-bit-only builds. While the company did not make the switch with the recently released Android 13, it is reportedly working on a 64-bit-only version of the OS for the upcoming Pixel Tablet. According to Mishaal Rahman, Google is currently testing a 64-bit-only build of Android 13 for a device codenamed 'Tangor.' For the unaware, that codename refers to the upcoming Pixel Tablet, which the company showcased during its I/O keynote earlier this year. If the Pixel Tablet launches with a 64-bit-only version of Android 13, it will be among the first Android devices to drop 32-bit support. "Dropping 32-bit support on the Pixel Tablet will likely reduce RAM usage, but the tablet won't be able to run 32-bit applications," notes the report. "But that shouldn't be a problem for most users, as all recently updated apps on the Google Play Store offer 64-bit support due to the mandate Google put in place in 2019."

A security researcher says that Apple's iOS devices don't fully route all network traffic through VPNs as a user might expect, a potential security issue the device maker has known about for years. From a report: Michael Horowitz, a longtime computer security blogger and researcher, puts it plainly -- if contentiously -- in a continually updated blog post. "VPNs on iOS are broken," he says. Any third-party VPN seems to work at first, giving the device a new IP address, DNS servers, and a tunnel for new traffic, Horowitz writes. But sessions and connections established before a VPN is activated do not terminate and, in Horowitz's findings with advanced router logging, can still send data outside the VPN tunnel while it's active.

In other words, you might expect a VPN client to kill existing connections before establishing a secure connection so they can be re-established inside the tunnel. But iOS VPNs can't seem to do this, Horowitz says, a finding that is backed up by a similar report from May 2020. "Data leaves the iOS device outside of the VPN tunnel," Horowitz writes. "This is not a classic/legacy DNS leak, it is a data leak. I confirmed this using multiple types of VPN and software from multiple VPN providers. The latest version of iOS that I tested with is 15.6."

"Apple is set to expand ads to new areas of your iPhone and iPad in search of its next big revenue driver," reports Bloomberg.

The Verge writes that Apple "could eventually bring ads to more of the apps that come pre-installed on your iPhone and other Apple devices, including Maps, Books, and Podcasts." According to a report from Bloomberg's Mark Gurman, Apple has internally tested search ads in Maps, which could display recommendations when you search for restaurants, stores, or other nearby businesses. Apple already implements a similar advertising model on the App Store, as developers can pay to have their app promoted on a search page for a particular query, like "puzzle games" or "photo editor." As noted by Gurman, ads on Maps could work in the same way, with businesses paying to appear at the top of search results when users enter certain search terms.

Gurman believes that Apple could introduce ads to its native Podcasts and Books apps as well. [Gurman describes this as "likely".] This could potentially allow publishers to place ads in areas within each app, or pay to get their content placed higher in search results. Just like Maps, Podcasts and Books are currently ad-free.... Gurman mentions the potential for advertising on Apple TV Plus, too, and says the company could opt to create a lower-priced ad-supported tier, something both Netflix and Disney Plus plan on doing by the end of this year.
Bloomberg points out that Apple is already displaying ads inside its News app — where some of the money actually goes back to news publishers. ("Apple also lets publishers advertise within their stories and keep the vast majority of that money.")

And while you can disable ad personalization — which 78% of iOS users have done — Bloomberg notes that "Another ironic detail here is that the company's advertising system uses data from its other services and your Apple account to decide which ads to serve. That doesn't feel like a privacy-first policy."

Bloomberg's conclusion? "Now the only question is whether the customers of Apple — a champion of privacy and clean interfaces — are ready to live with a lot more ads."

Thursday Meta published a blog post by their "product management director of Messenger Trust," who emphasized that they've begun at least testing end-to-end encryption by default for Messenger chats. But Meta also announced plans "to test a new secure storage feature for backups of your end-to-end encrypted chats on Messenger...."

"As with end-to-end encrypted chats, secure storage means that we won't have access to your messages, unless you choose to report them to us."

CNBC provides some context: The announcement comes after Facebook turned over Messenger chat histories to Nebraska police as part of an investigation into an alleged illegal abortion. Meta spokesperson Andy Stone said the feature has been in the works for a while and is not related to the Nebraska case...

The feature is rolling out on Android and iOS devices this week, but it isn't yet available on the Messenger website. The company has been discussing full-scale deployment of end-to-end encryption since 2016, but critics have said the security measure would make it much more difficult for law enforcement to catch child predators....Meta said in the release that it is making progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023.
Other privacy enhancements announced Thursday by Meta:

• "We plan to bring end-to-end encrypted calls to the Calls Tab on Messenger."

• Meta announced that the deleting of messages will start syncing across your other devices "soon."

• Messenger will continue offering the option of "Disappearing" messages, in which viewed messages in an end-to-end encrypted chat automatically then disappear after a pre-specified period of time.

And there's more, according to Meta's announcement:.

"This week, we'll begin testing default end-to-end encrypted chats between some people. If you're in the test group, some of your most frequent chats may be automatically end-to-end encrypted, which means you won't have to opt in to the feature. You'll still have access to your message history, but any new messages or calls with that person will be end-to-end encrypted. You can still report messages to us if you think they violate our policies, and we'll review them and take action as necessary....

"Last year, we started a limited test of opt-in end-to-end encrypted messages and calls on Instagram, and in February we broadened the test to include adults in Ukraine and Russia. Soon, we'll expand the test even further to include people in more countries and add more features like group chats....

"We will continue to provide updates as we make progress toward the global rollout of default end-to-end encryption for personal messages and calls in 2023."

Facebook announced on Thursday it will begin testing end-to-end encryption as the default option for some users of its Messenger app on Android and iOS. The Guardian reports: Facebook messenger users currently have to opt in to make their messages end-to-end encrypted (E2E), a mechanism that theoretically allows only the sender and recipient of a message to access its content. Facebook spokesperson Alex Dziedzan said on Thursday that E2E encryption is a complex feature to implement and that the test is limited to a couple of hundred users for now so that the company can ensure the system is working properly. Dziedzan also said the move was "not a response to any law enforcement requests." Meta, Facebook's parent company, said it had planned to roll out the test for months. The company had previously announced plans to make E2E encryption the default in 2022 but pushed the date back to 2023. "The only way for companies like Facebook to meaningfully protect people is for them to ensure that they do not have access to user data or communications when a law enforcement agency comes knocking," Evan Greer, the director of the digital rights group Fight for the Future, said. "Expanding end-to-end encryption by default is a part of that, but companies like Facebook also need to stop collecting and retaining so much intimate information about us in the first place."

An ongoing dispute over privacy between Apple and Facebook is roiling the digital economy, leading companies to shift billions in ad spending as users continue to limit the data available to advertisers. The feud took off last year, when Apple rolled out iOS 14.5, a version of its mobile operating system that made it easier than ever for iPhone and iPad users to opt out of letting apps like Facebook track their activity on their devices. The two companies weren't always at odds. In fact, they were almost business partners. From a report: In the years before the change, Apple suggested a series of possible arrangements that would earn the iPhone maker a slice of Facebook's revenue, according to people who either participated in the meetings or were briefed about them. As one person recalled: Apple officials said they wanted to "build businesses together." One idea that was discussed: creating a subscription-based version of Facebook that would be free of ads, according to people familiar with the discussions. Because Apple collects a cut of subscription revenue for apps in its App Store, that product could have generated significant revenue for the Cupertino, Calif., giant.

The companies also haggled over whether Apple was entitled to a piece of Facebook's sales from so-called boosted posts, said people familiar with the matter. A boost allows a user to pay to increase the number of people that see a post on Facebook or Instagram. Facebook, which considers boosts ads, has always contended that boosts are a form of advertising, in part because they are often used by small businesses to reach a bigger audience, said one of the people. Apple, which doesn't take a cut of advertising from developers, argued that Facebook boosts should be considered in-app purchases, according to a person familiar with the matter. Apple's standard terms would entitle it to take a 30% share of those sales.

Meta, the owner of Facebook and Instagram, has been rewriting websites its users visit, letting the company follow them across the web after they click links in its apps, according to new research from an ex-Google engineer. The Guardian reports: The two apps have been taking advantage of the fact that users who click on links are taken to webpages in an "in-app browser," controlled by Facebook or Instagram, rather than sent to the user's web browser of choice, such as Safari or Firefox. "The Instagram app injects their tracking code into every website shown, including when clicking on ads, enabling them [to] monitor all user interactions, like every button and link tapped, text selections, screenshots, as well as any form inputs, like passwords, addresses and credit card numbers," says Felix Krause, a privacy researcher who founded an app development tool acquired by Google in 2017.

Krause discovered the code injection by building a tool that could list all the extra commands added to a website by the browser. For normal browsers, and most apps, the tool detects no changes, but for Facebook and Instagram it finds up to 18 lines of code added by the app. Those lines of code appear to scan for a particular cross-platform tracking kit and, if not installed, instead call the Meta Pixel, a tracking tool that allows the company to follow a user around the web and build an accurate profile of their interests. The company does not disclose to the user that it is rewriting webpages in this way. No such code is added to the in-app browser of WhatsApp, according to Krause's research. [...] It is unclear when Facebook began injecting code to track users after clicking links. "We intentionally developed this code to honor people's [Ask to track] choices on our platforms," a Meta spokesperson told The Guardian in a statement. "The code allows us to aggregate user data before using it for targeted advertising or measurement purposes. We do not add any pixels. Code is injected so that we can aggregate conversion events from pixels."

They added: "For purchases made through the in-app browser, we seek user consent to save payment information for the purposes of autofill."

DNSFilter, a Washington, D.C.-based provider of DNS-based web content filtering and threat protection, has announced it's acquiring Guardian, a privacy-protecting firewall for iOS. Financial terms of the deal were not disclosed. From a report: Guardian was founded in 2013 by Will Strafach, a security researcher and former iPhone jailbreaker who in 2017 discovered that AccuWeather was secretly sending precise location data to a third-party company without a user's permission. The company's "smart firewall" iPhone app blocks apps from sharing users' personal information with third-parties, such as IP addresses and location data, by funneling data through an encrypted virtual private network (VPN). The startup, which claims to have so far blocked more than 5 billion data trackers and 1 billion location trackers, recently joined forces with Brave to integrate its firewall and VPN functionality into its eponymous non-tracking browser.

An anonymous reader quotes a report from Wired: As marketers, data brokers, and tech giants endlessly expand their access to individuals' data and movements across the web, tools like VPNs or cookie blockers can feel increasingly feeble and futile. Short of going totally off the grid forever, there are few options for the average person to meaningfully resist tracking online. Even after coming up with a technical solution last year for how phone carriers could stop automatically collecting users' locations, researchers Barath Raghavan and Paul Schmitt knew it would be challenging to convince telecoms to implement the change. So they decided to be the carrier they wanted to see in the world. The result is a new company, dubbed Invisv, that offers mobile data designed to separate users from specific identifiers so the company can't access or track customers' metadata, location information, or mobile browsing. Launching in beta today for Android, the company's Pretty Good Phone Privacy or PGPP service will replace the mechanism carriers normally use to turn cell phone tower connection data into a trove of information about users' movements. And it will also offer a Relay service that disassociates a user's IP address from their web browsing.

PGPP's ability to mask your phone's identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a "yes" or "no" about whether a device should get service. On the PGPP "Mobile Pro" plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There's also a "Mobile Core" plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month.

Both of these plans also include PGPP's Relay service. Similar to Apple's iCloud Private Relay, PGPP's Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you're looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay -- in this case, Invisv -- but the information about the page you're trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you're trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay. In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. The carrier is still working to bring its services to Apple's iOS. It's also worth noting that Invisv only offers mobile data; there are no voice calling services.

Mark Zuckerberg believes that Apple and his company are in a "very deep, philosophical competition" to build the metaverse, suggesting the two tech giants are ready to butt heads in selling hardware for augmented and virtual reality. The Verge reports: The Meta CEO told employees earlier this month that they were competing with Apple to determine "what direction the internet should go in," according to a recording of his comments during an internal all-hands meeting obtained by The Verge. He said that Meta would position itself as the more open, cheaper alternative to Apple, which is expected to announce its first AR headset as soon as later this year. "This is a competition of philosophies and ideas, where they believe that by doing everything themselves and tightly integrating that they build a better consumer experience," Zuckerberg said of the brooding rivalry. "And we believe that there is a lot to be done in specialization across different companies, and [that] will allow a much larger ecosystem to exist."

Since rebranding Facebook's company name to Meta, Zuckerberg has been pushing for the concept of interoperability for the metaverse, or what he sees as the next major chapter of computing after mobile phones. Meta recently helped stand up the Metaverse Open Standards Group with Microsoft, Epic Games, and others. The idea is to spur the creation of open protocols that will let people easily move through future immersive, 3D worlds with their virtual goods. Apple is absent from the group, which Zuckerberg called out as not surprising in his comments to employees. He explained how Apple's approach of building hardware and software it tightly controls had worked well with the iPhone, but that for the metaverse, "it's not really clear upfront whether an open or closed ecosystem is going to be better."

[...] If VR and AR do take off like Zuckerberg hopes, it seems he wants to position Meta as the Android to Apple's iOS. There is a parallel to draw already: Meta's Quest headset already allows the side loading of apps that are not approved by Meta's VR app store, similar to how Google's Android allows for sideloading. And even though it just increased the price of the Quest by $100, Meta's hardware is still mostly sold at a loss or breakeven. [...] Zuckerberg's remarks suggest that even as he tries to invent his way out of being under Apple's thumb on mobile, the two tech giants are going to be battling for years to come.

iPhone and iPad users looking to subscribe to Netflix via the streaming platform's iOS app are being redirected to an external website which removes the need to pay the App Store tax. From a report: As 9To5Mac reports, the redirection looks to be rolling out globally and takes advantage of a new iOS API that allows apps classed as "reader apps" to sign-up new users and manage their accounts outside of the App Store.

Reader apps, as described by Apple, provide one or more digital content types -- including magazines, newspapers, books, audio, music, or video -- as its primary function. That includes popular services such as Spotify, Zinio, Amazon Kindle, and YouTube. In the case of Netflix, new customers are diverted to a separate website at the tap of a button in the app to enter personal data, choose a payment method, and select a streaming plan. This update ensures transactions are no longer Apple's responsibility and all subscription management is therefore completed by Netflix. Once signed up, the Netflix iOS app should provide full content access.

In an upcoming update, Chromebooks equipped with mobile data will be able to serve as a Wi-Fi hotspot for other devices, just like Android and iOS devices can today. 9to5Google reports: The work-in-progress feature has made its first appearance in ChromeOS code in the form of a new flag coming to chrome://flags. The details are quite slim at the moment, with little more than the flag description available today. That said, it's easy to imagine how a mobile hotspot would work on ChromeOS, based on how the same feature works on Android phones today.

Presumably, you would be able to choose the name and password for your Chromebook's hotspot through the Settings app in ChromeOS, where you can also toggle the hotspot on and off. If it truly follows the example of Android, there would also be an easy way to turn on your hotspot through a Quick Settings toggle.