Privacy

This magazine is not receiving updates (last activity 52 day(s) ago).

sneakyninjapants , in Telegram founder and CEO alledges signal has backdoors, they don't provide reproduceible builds, etc.

Telegram's server side software is closed source, owned and ran by them exclusively so they really have no room to talk. WhatsApp doesn't even have OSS clients so they're even worse in that regard

eager_eagle , (edited )
@eager_eagle@lemmy.world avatar

exactly, they (Telegram) don't need to put sketchy code in the clients when most messages are not E2E encrypted and they control the servers lol

rottingleaf ,

Still the code in telegram desktop client may not be sketchy, but is ugly as fuck, so that too should be considered.

itsnotits ,

and run* by them

shrugal , (edited ) in Telegram founder and CEO alledges signal has backdoors, they don't provide reproduceible builds, etc.
@shrugal@lemm.ee avatar

It's hard to overstate what a nothing-burger this article really is! Let me break it down:

  • Signal got $3 million from the Open Technology Fund at some point in its development
  • Some anonymous source alleges that the OTF's ultimate goal is to promote US foreign interests
  • The current chairman of the board Katherine Maher worked at the National Democratic Institute and Wikipedia before
  • The same anonymous source says she was recruited because of connections to the OTF
  • She has at some point voiced the opinion that a completely free internet without regulation just reproduces existing power structures, and that balancing regulation and 1st amendment rights is a tough problem
  • Signal doesn't have reproducible builds on iOS (it absolutely does on Android btw)
  • Some people feel like Signal chats come up more often than they should in court cases and media reports

That's it, that's the whole story. That's the reason why the Telegram guy of all people thinks you should be careful, and better use his chat service instead, and the Twitter guy agrees.

I mean, reproducible builds on iOS would be nice, but that platform has much bigger problems from a privacy/security/sovereignty/freedom standpoint anyway. And the rest is just nothing turned up to 11.

eager_eagle ,
@eager_eagle@lemmy.world avatar

tl;dr "Signal might be untrustworthy because the tech came from a State-sponsored project and the current chairman acknowledges that Wikipedia has a white and Western bias."

just wait until they find out pretty much all tech we have can be traced back to government-funded research.

9488fcea02a9 ,

Did you know the early early internet researchers were part of a clandestine government organization known as ARPANET???? The entire TCP/IP stack is just a state-sponsored backdoor into your life!!!

WAKE UP SHEEPLE!!!!

refalo ,

yea just wait until they find out why the first digital computer was made:

ENIAC was designed by John Mauchly and J. Presper Eckert to calculate artillery firing tables for the United States Army's Ballistic Research Laboratory (which later became a part of the Army Research Laboratory). However, its first program was a study of the feasibility of the thermonuclear weapon.

Coasting0942 ,

Getting “Tor is pentagon spyware” vibes from OP

eveninghere ,

I guess it's the usual Russian propaganda tactic throughout Telegram. Mixing conspiracy theories with half-truths.

The NSA indeed distributed a defected encryption library in the past. These days I'm pretty sure big techs use open source encryption to avoid this trap.

And Telegram says blah, blah, iPhone is exploited. But IF Telegram is correct on this one, Andriod versions would be defect as well.

seathru , in Proton Mail Discloses User Data Leading to Arrest in Spain
@seathru@lemmy.sdf.org avatar

No company is going to legally go to bat for you for $10/mo. I love how Proton nonchalantly calls out the user's dumb move in the article:

Proton provides privacy by default and not anonymity by default because anonymity requires certain user actions to ensure proper OpSec, such as not adding your Apple account as an optional recovery method. Note, Proton does not require adding a recovery address as this information can in theory be turned over under Swiss court order...

deweydecibel , (edited )

At any point in the process, does it warn you about setting up recovery with personal email addresses?

Feels like with as much as Proton advertises nowadays as a privacy protecting service, they need to be taking into consideration that a lot of their customers now are going to be average users who don't know anything about proper OpSec. They should be much clearer about what things they can't protect you from.

It shouldn't be in a press release like this, they should be explaining the difference between privacy and anonymity to the customer. It's not like their marketing team isn't aware of the fact most people don't know any better.

It's in their best interests, too, because it doesn't matter how many times you say "we provide privacy not anonymity", the headlines are a bad look.

Railcar8095 ,

Unless you're targeted by law enforcement, having a recovery email won't be an issue. 99.99% of the userbase world never have a problem with this.

I get what you say, but it's really nitpicking at this point I think.

leraje ,
@leraje@lemmy.blahaj.zone avatar

It is worth noting though, that Proton doesn't allow you to use certain domains for recovery addresses. Admittedly this was awhile ago and maybe things have changed there but when I first joined Proton they wouldn't allow me to set a duck.com or simplelogin.com or addy.io address as a recovery email.

Obviously using an apple ID is stupid but Proton could make more of an effort too.

Canary9341 ,

They are actually quite aggressive about blocking disposable emails, most free services don't work. I have used protonmail a few times for semi-disposable accounts that used disposable emails to sign up, and some of them were banned later.

pineapplelover ,

I actually set simplelogin as recovery lol

Railcar8095 ,

So they will ask proton again for the address where everything is being forwarded... Not a good plan.

It would be fun to daisy chain a bazillion emails, all forwarding to each other in circles and have the cops just call yahoo 20 times.

pineapplelover ,

But all emails are encrypted so they can't be read anyways.

Railcar8095 ,

No, only the ones on Proton. If you send or receive an email from outside, it's unencrypted there.

But still, it's little to no difference for law enforcement. They will get the real address and whichever little info Proton or the other provider has on you.

pineapplelover ,

As far as I know, Simplelogin doesn't store anything.

https://simplelogin.io/faq/

Railcar8095 ,

Nowhere they say to m that they can't see what your final email address and they have your logging email too.

If you have a specific quote saying the opposite, please share

classic ,

What would be a more appropriate email address to use - or just no recovery email?

glorious_puffy ,
@glorious_puffy@lemmy.world avatar

Ideally no recovery mail or you can create burner gmail account with a vpn

EngineerGaming ,
@EngineerGaming@feddit.nl avatar

Doesn't Gmail require a phone number upon registration? One of the worst choices for "burner" mails.

glorious_puffy ,
@glorious_puffy@lemmy.world avatar

Do they now? I remember creating 10 gmail account using a free vpn back in 2022. iirc outlook doesn't require a phone number

EngineerGaming ,
@EngineerGaming@feddit.nl avatar

Oh, nice! Where was the VPN server, if you remember? Also heard of it being possible on a real Android device, but not on an Android VM so even harder to fake.

glorious_puffy ,
@glorious_puffy@lemmy.world avatar

Canada or USA

seathru ,
@seathru@lemmy.sdf.org avatar

It's best for anonymity to not use one at all. Proton provides a recovery key to allow access to your account if you manage to lock yourself out. Keep that key somewhere safe/secure.

classic ,

Thank you. Recovery key seems like a better route for sure

drwho ,
@drwho@beehaw.org avatar

Thing is, Protonmail has been telling people this from the very beginning. It's like it gets rediscovered every year or so when somebody else gets busted.

azalty ,
@azalty@jlai.lu avatar

Proton does require a recovery email address if you sign up to a mail forwarding service or similar, right after creating the account. In that case the account remains locked if you don’t, so that’s just a lie

Setarkus ,

In the article it says that that's a one-time verification address. Though that leaves the question if/how long it's stored

azalty ,
@azalty@jlai.lu avatar

Still, it wasn’t optional for me, so I’m pretty annoyed that they’re saying it.

You can remove the mail after but indeed, I won’t trust proton with not keeping that info

eating3645 , in Telegram founder and CEO alledges signal has backdoors, they don't provide reproduceible builds, etc.

Lol telegram calling signal insecure is too funny.

rollerbang ,

Isn't it that Telegram doesn't claim to be super secure, apart from possibly their encryption on mobile?

This doesn't prevent them from uncovering other possible plots in supposedly secure platforms.

possiblylinux127 ,
@possiblylinux127@lemmy.zip avatar

True but in this case there credibility is low

AllNewTypeFace , in How Do I Prepare My Phone for a Protest?
@AllNewTypeFace@leminal.space avatar

Leave it at home and, if you need a phone, take a burner that doesn’t have your personal data and isn’t logged into any of your accounts.

SnotFlickerman ,
@SnotFlickerman@lemmy.blahaj.zone avatar

You also have better found a way to pay for the burner in cash or with a pre-paid debit card. A lot of places in the US won't let you buy a "burner phone" without a credit/debit card that has your name attached to it.

DigitalDruid ,

[Thread, post or comment was deleted by the author]

  • Loading...
  • helenslunch ,
    @helenslunch@feddit.nl avatar

    you can buy a prepaid SIM card from Best Buy with cash and a used phone from craigslist.

    It's a good idea, but be sure not to share your phone number with anyone. You can't trust anyone not to add it to their phone, attach your name, email, and other personal identifiers to it and upload it to Google or whoever, to be subpoenaed later.

    rar ,

    Treating phone numbers in contact list with username was a brilliant idea (for the spread of mobile messengers like Whatsapp) but also a very horrible idea (for user privacy and everything else). I can't just change a phone number for privacy. My acquaintances will gladly update them with my name, my old and new number, ready for Zucc to scoop them up in a fucking silver plate.

    EdibleFriend ,
    @EdibleFriend@lemmy.world avatar

    Walmart lets you. At least as of October. The only rule was the amount of phones.

    nossaquesapao ,

    What about buying second hand?

    delirious_owl ,
    @delirious_owl@discuss.online avatar

    Wut? The US is like one of the easiest places to buy anonymous mobile phones and plans.

    Baku ,
    @Baku@aussie.zone avatar

    Seriously. In Australia, you have to "activate" your Sim card with your full name, email, bank details (depending on the carrier), and a copy of your driver's license. Hell, I bought my last phone directly from a carrier, completely outright, with cash, prepaid with no plan, and they took a photocopy of my drivers license. Buying phones elsewhere they've never done that to me, as long as it's prepaid and bought outright, but for some reason the major telcos do it for all purchases

    delirious_owl , (edited )
    @delirious_owl@discuss.online avatar

    Usually what you do in this situation is go to the tourist hot spot and find a mobile shop pretending to be a tourist without a drivers license. Usually within a few days you'll find someone who will use their info and sell you a Sim card.

    GBU_28 ,

    There's a difference between "none of my personal shit on it" and a full on ghost phone.

    The first is worth doing.

    If you get arrested, they are GOING to identify you before you leave detention. Being fully ghosted and keeping your mouth shut will just keep you in detention at minimum for the hours allowed to them, and if they can pin you with some fake crime, even longer. If arrested, you will not escape them without some level of identification.

    ricecake , in "just got doxxed to within 15 miles by a vision model, from only a single photo of some random trees. the implications for privacy are terrifying. i had no idea we would get here so soon. holy shit"

    Geo guessing is related to open source intelligence techniques, and it's pretty easy to get surprisingly good at it.
    People who are good at it can take a picture of someone's room and deduce enough about them (sometimes) to be able to get their name, address and phone number.

    It being automatic is pretty cool, but you were already leaking the information to anyone interested.

    https://www.sans.org/blog/geolocation-resources-for-osint-investigations/

    https://youtu.be/p7_2ZA1HHMo?si=O19_7LA3SoyvZEm1

    geoma ,

    Yep. If you play geoguessr.com or others you wont find it that surprising.

    geoma ,

    Yep. If you play geoguessr.com or others you wont find it that surprising.

    Ilandar , in Why people don't talk about Google Maps' privacy issues

    I am pretty over these videos of people whining about the amount of data big tech collects while refusing to move to alternatives because "muh convenience".

    UraniumBlazer ,

    For those unaware, Organic Maps (uses OSM) is really good! It's good for 90% of all ur navigation needs. For the rest 10%, there's no good alternative to google maps unfortunately.

    MagneticFusion ,

    Let me suggest Magic Earth.

    Has live traffic updates, uses OSM database, amazing UI with tons of features, can work offline by downloading maps, and very privacy respecting (feel free to look through their privacy policy it is very short and simple). Only downside is it is not FOSS, but I tried using Organic Maps and then OsmAND for almost the past year and gave up because they just are too much of a downgrade from Google Maps both in terms of UI and traffic updates, whereas Magic Earth feels like the perfect compromise.

    Ilandar ,

    Some further clarification on the closed source thing from their FAQ:

    Why is Magic Earth free? What is the business model?

    Magic Earth is free for all our end-users but we also have a paid Magic Earth SDK for business partners. For instance Selectric.de (a supplier for navigation solutions for ambulances and fire trucks), Smarter AI (developing ADAS systems) or Absolute Cycling (using the platform on bicycles). For more info on the SDK, you can check magiclane.com.

    Will Magic Earth be Open Source?

    No; since it is also used commercially (we have a paid Magic Earth SDK for business partners), we cannot make the code public.

    whyNotSquirrel ,
    @whyNotSquirrel@sh.itjust.works avatar

    Like there's no open source project with commercial paid licence ?

    Doods ,

    Or a source-available model.

    UraniumBlazer ,

    Traffic updates aren't exactly a problem for me as I travel everywhere using my bicycle/public transit.

    The only problem I face is that I can't get public transit information on OSM. Now ideally the city should be the one making this information accessible. Unfortunately for me, I currently live in a shitty city (although not for long). Therefore, within a matter of months, Organic would meet almost 100% of my navigation needs.

    Jumuta ,
    @Jumuta@sh.itjust.works avatar

    pretty sure organic is working on that, I remember there being docs on building with PT data.

    MagneticFusion ,

    Magic Earth has public transit data. https://www.magicearth.com/feature-availablity/
    Scroll down under transit to see if yout city is on the list

    swooosh ,

    Nothing competes with osmand for hiking or cycling.

    jherazob ,
    @jherazob@beehaw.org avatar

    My issue with these is that my use case is public transport, for that it seems like GMaps is still unbeatable, i hope to find an alternative as good or better based on OSM soon because it's the one tool i still have no alternative to

    UraniumBlazer , (edited )

    Same same. This is a problem in shithole cities. Good cities have their own transit apps (which are like Uber for public transit).

    Unreliable ,

    Out of curiosity, any examples? I know for NYC people use Citymapper, but that's available for most big cities.

    UraniumBlazer ,

    Calgary, Hong Kong, Vancouver, Toronto, Montreal, etc.

    Obi ,
    @Obi@sopuli.xyz avatar

    Where are you from? Where I live (in the Netherlands) there's an official tool from the public transport services which works just as well as gmaps to plan your train/tram/metro/bus journey.

    Facebones ,

    If you're American, some of them support transit now. I have Magic Earth and it supports it in most major metro areas (and even my dinky little city I believe lol)

    vatlark ,

    Wow, organic maps is really nice, seems like a much cleaner user interface than OsmAnd, whereas OsmAnd has more options.

    ReversalHatchery ,

    I think 5 out of that 10% is supplemented by OsmAnd. But it does not have public transport schedules and traffic data.

    michael_palmer ,

    Traffic data? If a grandmother had a penis, she would be a grandfather To implement this function, Osmand should gather location data from every user.

    ReversalHatchery ,

    Not necessarily. The data is out there. I don't think they could make it a part of the core app for legal reasons, but OsmAnd has a plugin system. Basically anyone could make it other than OsmAnd devs. Distribution could happen over an F-droid repo.

    kilgore_trout ,
    @kilgore_trout@feddit.it avatar

    the data is out there

    Where? GMaps sources this data from each of its users.

    ReversalHatchery ,

    That's where. But also I wouldn't be surprised if there are also other sources.

    lemmyvore ,

    And Google also trusts that data because it's collected at OS level.

    If an open project tried to collect location data they could not trust it. There's no way to prevent malicious users from sending bogus data.

    michael_palmer ,
    lemmyvore ,

    There are often individual apps for various cities and transport organizations.

    Traffic has always been a mixed bag. Yeah it's nice to be able to see that street A is more busy than street B. But so can everybody else, and they're all going to use street B now.

    BearOfaTime ,

    Meh, I find most people don't even bother.

    I use secondary routes 90% of the time by default, because they're just as fast with less mental effort and less risk.

    Why go with all the lemmings?

    ReversalHatchery ,

    But so can everybody else, and they're all going to use street B now.

    In my experience that's not how it works out. It's about balancing the load, while making the driver take the least amount of detour needed.
    Street B only has to handle the remaining traffic, and street A has a chance to unclog or at least be a faster route as some of its traffic does not exist anymore.

    lemmyvore ,

    The app doesn't control what people do, it just makes recommendations based on busy segments, based on data which is already obsolete by the time it's being used. Ultimately the lemmings will do whatever their lemming brain tells them to.

    (That is, assuming the app doesn't actually try to spread people around the various routes. But I doubt that any app maker wants to assume responsibility for that.)

    Ultimately traffic apps are mostly useless. You can't "solve" traffic congestion with apps any more than you can make water flow faster through a pipe. Congestion is constrained by available road space and choke points. Google Maps is mostly an excuse for Google to collect location data, with a thin layer of features on top to make it seem worthwhile.

    ReversalHatchery ,

    Water does not think, it flows where it can.
    People while driving cannot know which route isn't clogged, because cars are not flowing like water. If that would be the case all the small streets around main roads would be full too. If a street is clogged, and the driver sees it, they can decide to go on a different route, but in waze if they are using it to plan a route, it'll try actively to avoid roads that are too busy.

    lemmyvore ,

    If that would be the case all the small streets around main roads would be full too.

    They are. If they aren't then your city is not really that busy. It's actually a major problem in some cities for the residents of small residential streets that suddenly start getting lots of traffic because their street gets recommended on Waze or Maps.

    Niiru ,

    What are the rest 10%?

    PrivateNoob ,
    @PrivateNoob@sopuli.xyz avatar

    Reviews most definitely. Hard to beat that

    Gradually_Adjusting ,
    @Gradually_Adjusting@lemmy.world avatar

    I'm glad I came back to this thread. Would never have heard of this!

    delirious_owl ,
    @delirious_owl@discuss.online avatar

    Can you search for street addresses?

    dditty ,
    @dditty@lemm.ee avatar

    Will give this a try later, tysm! Apparently it also works with Android Auto?

    InevitableWaffles ,
    @InevitableWaffles@midwest.social avatar

    Yes, it does. I have used it successfully for months. My main issue is I need traffic data due to a new job and figuring which route to take. AFAIK, no other nav app has traffic data. That's the only real bummer.

    kilgore_trout ,
    @kilgore_trout@feddit.it avatar

    HERE WeGo has traffic data but of course, as in Google Maps, it sources from other users of the same app.

    If not many people use HERE, then the data is also not reliable.

    LordKitsuna ,

    I genuinely don't understand how anyone can believe this, I keep trying it over and over and over and it fails on the absolute most basic of business searches. And some of the directions it gives are just completely nonsensical, and it's voice guidance is absolutely terrible making it fairly easy to miss a Direction if you're not able to be looking at the screen

    I hate giving my location to Google but at the end of the day they are still the only GPS navigation that doesn't suck at basic navigation

    UraniumBlazer ,

    Do u live in some place less humans live? Like a village or something? OSM is mapped by volunteers, which means that less OSM enthusiasts around you = worse mapping. Perhaps you could start a little bit of mapping?

    As for the voice navigation, well Organic doesn't have its own voice. It uses ur phone's native text to speech engine. If u have completely degoogled ur phone, then u probably would be using some other tts engine (which most probably sucks ass).

    As for the searches, yeah, they need a better local search engine.

    LordKitsuna ,

    I don't just mean the voice, even just HOW it gives directions. Google maps gives you multiple warnings for a turn , one way before, one approaching, one right at. It also will often tell you which lane to take a turn in if multiple exist (use the second from the left lane to turn left) if your next turn is right after with little warning.

    It's been a hot minute so i can try again to see if it's changed but directions were terrible with little extra warning and no taking the next direction into account.

    The map was also just... Messy, little outlines for buildings everywhere a bunch of random green squares all over the map that I couldn't figure out how to turn off and wasn't even sure what they were meant to represent other than they seemed to roughly correspond with grassy or treed areas but for using it as a navigation app that is extremely annoying because it just makes the whole map of cluttered mess and makes it difficult to really tell what I'm looking at when I'm trying to drive and need to see my next Direction quickly and easily at a glance

    PrivateNoob ,
    @PrivateNoob@sopuli.xyz avatar

    Well change can only be done through voicing disapproval first, although Google will most definitely won't stop the data gathering in Maps.

    Well It's understandable if a lot of people wouldn't switch over to OSM-based apps. I've tried OSMAnd, and I observe 3 drawbacks. Lengthy public transport calculation (fair since it's computing on the phone), no reviews in POI areas (really hard to catch up on), weird results in transportations

    Ilandar ,

    Well change can only be done through voicing disapproval first

    Yes, but if you as the consumer never actually stop giving the company your money and/or data then there is little incentive for them to change. Just complaining by itself does absolutely nothing to a company the size of Google. You need to actually follow it up by using your limited power as a consumer to support an alternative. Only then, and if enough people do the same, will the first company consider making changes. If they don't, at least you are supporting an alternative project and helping it to improve so that it may one day feel like less of compromise.

    PrivateNoob ,
    @PrivateNoob@sopuli.xyz avatar

    Absolutely agreed.

    agressivelyPassive ,

    Most people (public and private) never go beyond disapproval, though.

    You'll hear people complain about this and that, but never even looking for an alternative.

    umbrella ,
    @umbrella@lemmy.ml avatar

    also a lot of open maps alternatives rely on YOUR contribution to be good instead of a hired team at some corpo.

    use it and help out with it and you will have your open mapping app!

    Templa ,
    @Templa@beehaw.org avatar

    I always try to keep in mind there are a lot of people that are simply unable to transition to alternative apps because they lack knowledge and time to do research on such things. What we see through videos isn't the majority of the people, it is people that make content for the majority.

    People have hard times getting into more technical stuff already. Expecting people that are struggling to survive in capitalism to spend their free time learning about underground alternatives or to turn into sys admins and host their own stuff is out of touch if reality in my opinion.

    Edit: just wanted to add, I wouldn't say the problem is on the people, but on big tech that predates on them

    Ilandar ,

    Those people aren't complaining. The guy in the video specifically mentioned Open Street Maps as an alternative, but only in the context of "well maybe one day Google will go in this direction". He has zero interest in actually switching and ends up making a bunch or excuses justifying his Google Maps usage. He is not trying to be part of a solution here, he is just whining.

    Substance_P ,

    The problem for me is when someone sends me a location pin it is almost always a Google map link. I have the same issue with people in my community using whatsapp.

    Ilandar ,

    Can't you just open that in a web browser? Take the address, put it in an alternative map app. Problem solved.

    Substance_P ,

    I guess you are right, for me I just try to avoid all Google links and products in the first place. I understand that you can tweak privacy controls and settings that allow you to manage how your data with Google is collected, I could also use a privacy browser or incognito, but my main issue is not giving any of these juggernaut corporations a chance to swing and cash in on my personal data.

    Ilandar ,

    Sorry, I'm a bit confused. Is your problem that you feel forced to use Google Maps? Or that you feel forced to ignore your friends because they use Google Maps? I assumed the former with my initial reply, but now it sounds like your have the latter problem.

    Substance_P ,

    I'm not ignoring my friends; I'm just pointing out that due to the convenience of these apps, the people around me use them without seeming to care about their privacy implications.

    Ilandar ,

    Is that actually a problem for you? It's their life, they are free to do whatever they want. I'm trying to understand how this actually affects you since your original reply started with "the problem for me is...".

    SomeGuy69 ,

    Which GoogleMaps alternative has user reviews? I downloaded organic maps suggested here and there are no reviews. When I'm in a new town I need to know where I can and where I shouldn't eat, shop or stay. At least there are some icons on organic maps, but that's it.

    Ilandar , (edited )

    The "user" reviews on Google Maps (and similar platforms like Yelp) can be fake. Go to the Fake Review Watch channel on YouTube or visit their website if you want to see real examples of this. This is a service that businesses of all sizes, all over the world are paying for - sometimes on a massive scale.

    However if you still really want to rely on Google reviews, use GMaps WV.

    drkt ,
    @drkt@lemmy.dbzer0.com avatar

    GoogleMaps reviews are fake in favor of corporations, it's useless data

    SomeGuy69 ,

    Not when you're new in an unknown city. In my local city the ratings still make sense, I compared it with my own experience, so why would that change drastically elsewhere? It's often the only option you have, visiting every website individually is too time consuming and doesn't tell you anything about the service either. I bet even you look at reviews. It's easy to say their are faked but there is no non faked alternative.

    drkt ,
    @drkt@lemmy.dbzer0.com avatar

    what the f are you doing that you need to vet this many businesses in such a short time span?

    I seriously don't look at the reviews; I don't even use google maps because it's useless to me as a pedestrian.

    Onse ,

    Visit a new city and spontaneously finding a good restaurant matching your criteria. I heavily rely on reviews for this usecase as well as being able to search e.g. for „vegan restaurants“ in a certain area, which also matches reviews with the word in it.

    DaseinPickle , in Telegram founder and CEO alledges signal has backdoors, they don't provide reproduceible builds, etc.

    Maybe he should focus on adding e2e encryption to the default chats and group chats instead of spreading FUD.

    just_another_person , in The Best Secure Email Providers in 2024

    TLDR: Proton and Tuta

    MagneticFusion ,

    This has been the answer for years now and sill be the answer for at least the next few years as well

    ISOmorph ,

    Let's see what europes e2ee ban will bring. Proton is one of the "high risk" services mentioned in the bills debate. Might not be too long before you have to host your own mail server if you want privacy in europe.

    electro1 ,
    @electro1@infosec.pub avatar

    I'm probably going to downvoted to hell with this... But didn't people say Proton might be a government Op, even Tuta was mentioned as a honeypot in a recent Court case, so they released a blog post titled: Tuta is not a honeypot....

    Idk... my guts tell me, if something is too good to be true, then it's not true... Proton offerings are amazing for a free plan... And their clients looks good and they sponsor YT channels... I used to be happy to see an Open source project succeed as a business, but the concept of honeypots, made me rethink my view

    Smoke ,
    @Smoke@frogdrool.net avatar

    @electro1 @ISOmorph imagine your enemy has infinite money, manpower, and resources to turn against you.

    why would the DoD give away a weapon like TOR?

    why would satoshi release bitcoin at 51% difficulty?

    why would Putin allow for the grotesque corruption of the oligarch state?

    because they have the other half.

    electro1 ,
    @electro1@infosec.pub avatar

    because they have the other half.

    could you please elaborate, or matter of fact, ELI5...

    Isn't the whole purpose of having power and control, is to have it all, or make it appear that you're not in control?

    wagoner ,

    Idk... my gut tells me... didn't people say... might be... I'm probably going to be down voted to hell... if something's too good to be true...

    What a ridiculous response.

    electro1 ,
    @electro1@infosec.pub avatar

    What a ridiculous response.

    what's so ridiculous about it?

    wagoner ,

    I quoted the bits that answer your question and which completely undermine the bits I didn't quote.

    electro1 ,
    @electro1@infosec.pub avatar

    first of it's a comment not a response.. secondly, you quoted everything in wrong order to make it appealing to further ridicule, which brings me to my last but not least point, is that what you do? you find something ridiculous and get your dopamine kick by saying how ridiculous it is!

    I quoted the bits that answer your question and which completely undermine the bits I didn't quote

    Not what I asked, I don't see ridiculousness in my comment, so if you care to reply with feedback, please do, otherwise stop bothering me

    wagoner ,

    This is all kinda of weirdness. You were the one who asked me a question, and I responded to it. And now I'm done. Have a nice day.

    electro1 ,
    @electro1@infosec.pub avatar

    This is all kinda of weirdness

    lmao, wow...

    BrikoX OP ,
    @BrikoX@lemmy.zip avatar

    You thinking it's a honeypot is a win for the government. All they need to do is spread some propaganda instead of actually bothering to run a service that is hard to keep alive. And if they were to run a honeypot, having it outside 14 eyes countries would be the most stupid decision the government could make.

    electro1 ,
    @electro1@infosec.pub avatar

    You thinking it's a honeypot is a win for the government. All they need to do is spread some propaganda

    Good point, but I didn't think of it that way just because, I saw things and read stuff that made me suspect it...

    to run a service that is hard to keep alive. And if they were to run a honeypot

    But they did, and it worked for them before, and it'll always work unless no one start using that service, so there's no point in keeping servers operational.. time for a rebrand. plus they're getting paid.

    having it outside 14 eyes countries would be the most stupid decision the government could make.

    having it outside the US ( if we're talking about the US ) maybe, but the 14 eyes... It's just s story at this point, even countries outside the 14 eyes spy on their citizens and make secret deals.. So..

    BrikoX OP ,
    @BrikoX@lemmy.zip avatar

    Good point, but I didn't think of it that way just because, I saw things and read stuff that made me suspect it...

    There is "speculation" spread about every single "privacy" focused service for exactly that reason. If you don't trust them, you are not using them. I'm not saying don't be suspicious, but also look at facts that make it unlikely of it being a honeypot.

    But they did, and it worked for them before, and it'll always work unless no one start using that service, so there's no point in keeping servers operational.. time for a rebrand. plus they're getting paid.

    Right, but there are plenty of easier services to target that provide more sensitive information. If you are a honeypot, you have to be profitable and expand your services or people will move somewhere else. That all takes time and work. Buying other services like SimpleLogin or Standard Notes and integrating their staff into your scheme would be unnecessary complication.

    having it outside 14 eyes countries would be the most stupid decision the government could make.

    It's not a story. So called 5 eyes, 9 eyes and 14 eyes refers to country agreements to share intelligence and make cooperation instant instead of having to go through proper channels that take time. I'm sure there are many conspiracy theories about specific things that might not be true, but there is no dispute that these agreements exist.

    Government run honeypots are usually facilitated by federal agencies, INTERPOL, or EUROPOL, and if they want to run something in a country where they are not welcome it has to be court approved. Hence, it being run in 14 eyes countries, make it easy. Switzerland on the other hand not only requires everything to be approved by their courts, but also require using their specific privacy laws when making determination, which are the strongest in the world.

    You only need to look at previous known honeypots to see where they originate and what they target.

    clmbmb ,

    Yes, and both have proprietary clients. I have proton and I'm in the process to moving away mainly because I can't use their calendar and contacts natively in Android. Not sure about Tuta, but I never liked them.

    Twitches ,

    Same calendar doesn't give notification unless I open it. I'm just looking to replace Google.

    vatlark ,

    Huh, works fine for me for nearly a year now. The only thing I still use google calendar for are some shared calendars.

    After proton adds Standard Notes. I'm hoping google maps will be the last product I'm tied to.

    archer ,

    It works for me in GrapheneOS, should work on regular Android, too? What I'm missing is a dedicated Proton contacts application including integration into the phone app.

    MagneticFusion ,

    That's very odd I get notifs from Calendar without any google play services

    Twitches ,

    I think I figured it out, it was some battery optimization settings. Now just waiting for contact integration into the phone

    clmbmb ,

    I get notifications some times, but mostly I get them at totally random times. It's very annoying.

    Twitches ,

    Check your battery optimization, so if you go to the app in your settings turn off all battery optimization. Just did this, not sure how well it's going to work, but, maybe

    clmbmb ,

    I've done this. Didn't help. I'm in a Samsung S20+ and checked with my wife's pixel too and still have problems.

    Twitches ,

    I have the same phone. I'm guessing mine probably won't work either :(

    just_another_person ,

    Didn't Proton release some kind of adapter to solve this issue and allow for IMAP?

    LittleBobbyTables ,

    Yes, Proton Mail Bridge. I use it with KMail, works pretty well, I’d say.

    Edit: I think this client is only for desktop, however. Android users will have to find another option.

    just_another_person ,

    That sucks, but good to know.

    refalo ,

    Well do you want privacy or do you want convenience? You can't really have both here IMO

    clmbmb ,

    You don't have 100% privacy as long as you send mails to people and services that don't support proton's encryption. If I wasn't privacy I can always use gpg.

    RiQuY ,

    Mailbox.org too.

    TCB13 ,
    @TCB13@lemmy.world avatar

    The guys who decided to block GrapheneOS for no reason and don't provide reasonable explanations nor fix the issue.. yeah right.

    Pantherina ,

    What, source?

    How would you block an OS?

    And btw there are some reasons why GrapheneOS may be criticised

    TCB13 ,
    @TCB13@lemmy.world avatar
    Pantherina ,

    Thanks! TLDR spamhaus (a big spamlist provider) has them on their spamlist, or maybe not, and they are using some fancy CDN.

    It is VERY likely just a technical error.

    delirious_owl ,
    @delirious_owl@discuss.online avatar

    Wish I could signup on Tor.

    I use dnmx instead

    smileyhead , in Telegram founder and CEO alledges signal has backdoors, they don't provide reproduceible builds, etc.

    Telegram: There are backdoors in Signal encryption!

    Also Telegram: not encrypted

    fushuan ,

    It's encrypted though?

    You are trusting their server security and them as a company, sure, but it is encrypted against the server for sure.

    It's not as good as ir could be but that's no reason to spread misinformation.

    electric_nan , in Telegram founder and CEO alledges signal has backdoors, they don't provide reproduceible builds, etc.

    Looks like a push to discredit Signal right now. While I know Signal isn't perfect, I do like it and I haven't seen anything that is better (on the whole). The 3rd "emoji-point" is quite an accusation, and I would love to see any evidence of this kind of thing, that didn't result from the cops unlocking a defendants phone, or having infiltrated a chat.

    CaptainSpaceman ,

    The 3rd emoji is just bs. Then again, most of his post is bs

    MajorHavoc , (edited )

    While I know Signal isn't perfect, I do like it and I haven't seen anything that is better (on the whole).

    Agreed. But it is worth mentioning that XMPP with OMEMO seems to be the current gold standard - runs almost everywhere, tons of available (free) servers, secure end to end messages, and fully auditable public source code.

    electric_nan ,

    I have used xmpp a lot, but I can't really recommend it to friends and family as a secure messenger. There are too many compatibility issues between clients and servers. If your friend is on a client or server that doesn't support the same encryption protocols, then you can't have a secure chat. Basically there is too much user knowledge and effort required at this time, for xmpp to be a good, secure, general use chat. I very much look forward to this changing. I also really like Matrix, but it is still a bit rough around the edges as of my last check.

    MajorHavoc ,

    Agreed on all points. It's not the best solution when I can't get both parties into it successfully.

    That's why I still use Signal a good bit.

    SLfgb ,

    I use xmpp all the time.
    Biggest hurdle for certain fam/friends using xmpp has been certain android builds (samsung) and ios interfering with timely notifications.
    User knowlege is not a problem as I can recommend the apps that are compatible encryption protocols with mine.

    electric_nan ,

    That's great, and I'm happy it's working out for you. It's still kind of a bummer that this open protocol ends up fragmented across all those clients and severs. I've met other Linux enthusiasts online, connected with them via xmpp only to find we can't encrypt our chats. Neither of us wants to give up our preferred client for various reasons, so we have a non-working situation.

    SLfgb ,

    Hmm, I see. But isn't there an obvious solution to this? One of you just run two different clients side-by-side?

    electric_nan ,

    Sure there are workarounds, but every one of them erases a bit of convenience or is at odds with the benefits of federation. Again, I think XMPP is great, but I wish it was better. As it is now, it doesn't fully meet my needs better than Signal does.

    SLfgb ,

    Yea, I hear you. I use both.

    SLfgb ,

    Well if only those samsung & ios users that never get my messages until I see them and tell them to open their app had phones that didn't interfere with it running in the background / push notifications it would be working out for me even better, but that's not an issue with the protocol or client but with OS's being hostile to xmpp.

    toastal ,

    client or server that doesn’t support the same encryption protocols

    Outside of TLS which most any server uses by default, XMPP or not, the server is not responsible for E2EE. Conversations Compliance & Are We OMEMO Yet have existed for a long while & I never see anyone recommending a client not on these lists so while certain features may be fragmented, the communication essentials have been more or less established for years now. XMPP is an extensible format, and some applications that aren’t for chatting with your friends/family, don’t need many of these features which allows the protocol to morph into something stripped down for the task… which is why the base spec is basically barren, & community XEPs are what folks get behind for adding new features for different use cases.

    refalo ,

    That may be true, but wake me up when they capture 0.5% of the messaging app market :)

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    Tin hat time:

    I wonder if Russia's trying to get everyone on Telegram because they have control over it.

    electric_nan ,

    This is probably just Telegram seeing an opportunity to peel some users away from Signal during a period of heightened paranoia in the West (anti-genocide organizing).

    noodlejetski ,
    Legend ,

    They moved from Russia because Russia tried some shit so no .

    DaseinPickle ,

    Maybe not Russia, but they sure are working with a certain government:

    https://mastodon.social/@alshafei/112413115927959085

    SecurityPro , in Encrypted services Apple, Proton and Wire helped Spanish police identify activist | TechCrunch
    @SecurityPro@lemmy.ml avatar

    "helped" is very misleading. Companies can't refuse to provide information they have when served a search warrant / court order. These companies DID NOT choose to provide the info on their own.

    lemmyreader OP ,

    “helped” is very misleading. Companies can’t refuse to provide information they have when served a search warrant / court order. These companies DID NOT choose to provide the info on their own.

    You are suggesting all these companies are completely helpless against legal requests. That is not correct. A company should first make clear that the legal request is actually completely legitimate and correct. After that they can look at whether they should provide the information or not.

    See the data here :

    SecurityPro ,
    @SecurityPro@lemmy.ml avatar

    As someone who has worked fraud and online investigations, and both written and served search warrants; it is not an option. A probable cause affidavit is presented to a judge and if the judge agrees there is sufficient probable cause, a search warrant is issued. This is an order by the judge and not optional. The judge can hold the company in contempt if they refuse to obey his/her order.

    Deckweiss , (edited )

    Read the blog by the guy behind cock.li , he refused multiple illegitimate warrants so far.

    What matters is the jurisdiction of the service, not the one of the warrant author, otherwise china would have already warranted all data of all other world citizens lol

    Railcar8095 ,

    Proton complies with Swiss law, and has to be channeled through Swiss official channels who rely the request.

    So there's jurisdiction.

    Deckweiss , (edited )

    That is true. But I wasn't debating about this specific case, but rather the generalized statement.

    The comment I replied to implies "If there is a warrant, it is always legitimate and you have to follow it, because a lawyer said so". That is not true and if it were the world would quickly go to shit, which I pointed out.

    Railcar8095 ,

    I would say your interpretation was a bit extreme. Nobody implied a warrant from anywhere in the world.

    Deckweiss , (edited )

    Again, it doesn't matter where the warrant fomes from. What matters is where it goes to.

    And that detail is pretty important, while being completely left out. They say:

    it is not an option.

    But yes it is, depending on the jurisdiction.

    refalo ,

    Are you suggesting they didn't do those things? Good info either way.

    Also there IS another alternative, the lavabit way... just go out of business /s

    brunchyvirus ,

    There is a great talk from the Lavabit CEO who discusses what happened to him and his company when they found out Snowden had an email at his company. I won't link it since it's YouTube but it's an hour long but he talks about his experience with the FBI and the courts. You can search for M3AAWG 2014 Keynote, I highly recommend it.

    lemmyreader OP ,
    helenslunch ,
    @helenslunch@feddit.nl avatar

    A company should first make clear that the legal request is actually completely legitimate and correct.

    What makes you think they didn't do that?

    helenslunch ,
    @helenslunch@feddit.nl avatar

    Yep, also using "requests" when they were not at all, they were demands.

    otter ,
    @otter@lemmy.ca avatar

    Yep, which I think is why it's more important to see what data is being collected and stored, rather than giving up data based on how trustworthy an entity seems

    If the tool doesn't collect or log the data to begin with, then there's nothing that can be stolen/taken/demanded

    The solution in this case might be for Proton (and the other companies) to list out risks and data collection information along the way.

    We need X in order to do Y. Read more on how Y works. Now here are some risks, and how to avoid them:

    3aqn5k6ryk , in Instagram locked my account and forced me to appeal and send a picture of my face, so I sent a picture of Shrek. They deleted my account

    Yeah. I used to have fake facebook account because i got hooked on one of those mmorpg games. IDK what happened but something did and my account got suspended and FB requested me to upload my face and government ID. Yeah fuck that, uploaded some NSFW images and my account got deleted. Worth it.

    tristan ,

    Many years ago I had a Facebook account under my real name, and they blocked it and told me to verify ... I did everything they asked and they wouldn't accept it... I recreated it under a fake name (very obvious it's fake since it uses a celeb name) and have been using it for messaging a couple of friends for like a decade now with no issue

    TheButtonJustSpins ,

    Note that the people verifying that picture are not the people who set the policies or systems in place. You abused an innocent who's just trying to earn some bread, you didn't send NSFW materials to Zuck.

    3aqn5k6ryk ,

    I mean its not like i send some gore pictures or anything. The person on the end probably got some good chuckles about it. Eh, its harmless joke. You dont have to think about it too much.

    frauddogg ,
    @frauddogg@lemmygrad.ml avatar

    Not any of our problems; if you willfully work for Meta after everything that has come out about them, you're a scab against the people and shouldn't be regarded past that point. Fuck should I care about techbros who wouldn't know solidarity if it popped out of a manhole and blew a new hole in their ass for?

    unwarlikeExtortion ,

    I doubt those people even know they work for Meta. They probably work at an agency which does this for multiple services, not only Facebook and they probably have that job because they can't get a better one. It isn't even unheard of for this to be done by kidnapped people in captivity. Sending provoking material doesn't do anything meaningful other than make those peoples' day worse, and chances are it's already pretty close to hell on earth.

    bloodfart ,

    No one verifying images for meta is a techbro. That’s indonesian work.

    lud ,

    you're a scab against the people and shouldn't be regarded past that point.

    WTF‽ They are trying to stay alive, not murder your parents!

    Do you think they are well paid or something? If you have an income, they likely earn 100 times less or something.

    Seriously what the fuck is wrong with users on some instances?

    frauddogg ,
    @frauddogg@lemmygrad.ml avatar

    Still not my problem; my man you should not be talking about jobs and who holds 'em when Amerika is looking at a job shortage because of all the offshoring. I said what I said with my whole chest; if you work for them in any form, facility, or function, or uplift those who do, I consider you an opp

    chicken ,

    Are there actually people in the loop? Are you sure it's not all bots? It's not like they will communicate with you at all about your ban aside from template emails.

    dev_null ,

    I used a fake name on Facebook and one day I similarly got suspended asking for government ID. So I photoshopped some fake ID with the fake name, printed it, put it in a plastic sleeve and took a photo of that, and they accepted it.

    Vendetta9076 , in Microsoft plans to lock down Windows DNS like never before. Here’s how.
    @Vendetta9076@sh.itjust.works avatar

    Guys this is an enterprise feature. I hate windows as much as the next guy but y'all should actually read the article. Its not forced upon anyone.

    lud ,

    Yeah, this sounds like a pretty interesting feature that will (in theory at least) make enterprise networking more secure.

    I highly doubt this will even be possible to use on Windows home or maybe even Pro. It's probably locked behind at least some kind of extra licence as well.

    It will also likely require quite a bit of effort to set up properly in enterprises.

    People are freaking out over absolutely nothing. Just read the article and use common sense.

    reksas ,

    article should have less loaded heading though. by now it should be expected that most read only that. Heading in general should contain the essence of the article so the general idea can be seen at a glance.

    lud ,

    Yes, but people obviously shouldn't comment and get mad unless they have at least read some of the article.

    TCB13 ,
    @TCB13@lemmy.world avatar

    Yes, this mostly works as a managed DNS solution for enterprise networks that actually does what people in large organizations need and solves a ton of issues.

    Scolding0513 , in End-to-end encryption may be the bane of cops, but they can't close that Pandora's Box

    If e2ee is what is really keeping you from catching child abusers, then your department is INCOMPETENT and LAZY. Sorry, but all this does is tell me that you are a piece of shit human being(s) that thinks they have to have god-like controls to do your job of jailing actual criminals. or else it's just an excuse to control everything (it is), in which case you are just evil

    Fuck these nosey oligarchs

  • All
  • Subscribed
  • Moderated
  • Favorites
  • [email protected]
  • kbinchat
  • All magazines