Enlarge

Welcome to Ars Cardboard, our weekend look at tabletop games! Check out our complete board gaming coverage at cardboard.arstechnica.com.

North Star Games has been developing the app version of its popular board game Evolution (read our review) for years, showing demos as far back as PAX Unplugged in November 2017. Now the game is out for Steam, iOS, and Android—and the results have been well worth waiting for. The final version is immaculate in look, feel, and ease of play. Even if you didn’t love the cardboard version, the digital adaptation offers a new and better gameplay experience.

Players in Evolution compete to create and grow their species to consume more food tokens, which are worth points at the game’s end and which become scarcer as the game progresses. Each species can have up to three Trait cards that give it extra powers or makes it harder to attack. One of the Traits makes species (which are herbivores by default) into Carnivores, which feed by attacking other species—including your own, if you can’t feed them by attacking species belonging to other players.

Read 8 remaining paragraphs | Comments

Enlarge (credit: anujraj)

Phishers are deploying what appears to be a clever new trick to snag people’s Facebook passwords by presenting convincing replicas of single sign-on login Windows on malicious sites, researchers said this week.

Single sign-on, or SSO, is a feature that allows people to use their accounts on other sites—typically Facebook, Google, LinkedIn, or Twitter—to log in to third-party websites. SSO is designed to make things easier for both end users and websites. Rather than having to create and remember a password for hundreds or even thousands of third-party sites, people can log in using the credentials for a single site. Websites that don’t want to bother creating and securing password-based authentication systems need only access an easy-to-use programming interface. Security and cryptographic mechanisms under the hood allow the the login to happen without the third party site ever seeing the username password.

Researchers with password manager service Myki recently found a site that purported to offer SSO from Facebook. As the video below shows, the login window looked almost identical to the real Facebook SSO. This one, however, didn’t run on the Facebook API and didn’t interface with the social network in any way. Instead, it phished the username and password.

Read 3 remaining paragraphs | Comments