If you don’t know me, I make frequent write ups about privacy and security. I’ve covered some controversial topics in the past, such as whether or not Chromium is more secure than Firefox. Well, I will try my hand again at taking a look at some controversial topics.
I need ideas, though. So far, I would like to cover the controversy about Brave, controversy around Monero and other cryptocurrencies, and controversy around AI. These will be far easier to research and manage than Chromium vs. Firefox, for example. I’d like to know which ideas you have!
Which controversial privacy topics do you know of that you would like to see covered?
PLEASE DO NOT ARGUE ABOUT THEM IN THE COMMENTS!
Please save any debate for if/when I make a write up about the topic. Keep the comments clean, and simply upvote ideas you would like to see covered. I won’t be able to cover everything, so it helps bring attention!
Above all else, be kind, even if you don’t agree with an idea or topic :)
F-Droid not being trusted. They build and sign a developer’s code on their behalf, so there is a chance for injection there.
There are reproducible builds, but I would argue it’s not taken seriously enough. Like right now nobody is publicly verifying Signal’s supposed reproducible Android builds and they’ve historically had problems keeping it working.
Also how most (or all?) Play Store apps (including FOSS) contain proprietary code.
Signal as a centralized meta-data honeypot.
Oh boi I’m trying to get people to use simplex exactly because of this. I managed to bring most people to Signal and they’re cool with it because it just works, but I don’t trust them at all. Sure there was this court order where they didn’t have any user data except account created date and last active date, but since almost everybody uses either Google‘s or Apple‘s push notification servers turns out that doesn’t matter so much from what I undertstood.
You can use your own builds of Signal (or preferably Molly-FOSS) including a self-hosted server. You can bring your own push notification as well.
Google‘s or Apple‘s push notification servers turns out that doesn’t matter so much from what I undertstood.
Can you elaborate? It’s my understanding that push notifications are only used to trigger Signal to check if there are messages - the message data and who/what triggered it is not being sent to Google/Apple. If you don’t trust push notifications, you can always use a De-google’d phone and the Signal APK which will fallback to polling the server; this will obviously impact battery life as the app needs to constantly be checking for new messages.
💯 but can it be a honeypot when the OG promise was connection not meta security?
Matrix is defacto centralized around Matrix.org & servers they provide (where the cost of hosting makes it largely inaccessible to low-spec & medium-sized servers causing them to inevitably shut down & recommending users back to Matrix.org). All the metadata gets synced back to the mothership that was funded by Israeli intelligence. Avoid it.
Cloudflare is a CIA front. They offer “free” DDoS protection + static proxy thereby giving Cloudflare the ability to MitM all TLS connections thru their servers. They convinced so many ‘developers’ via ‘influencers’ that every tiny site needs Cloudflare in front of it as a precaution/optimization, but it is an entirely premature optimization that doesn’t need to so widely deployed, but it is. 🤔
Microsoft has always been an enemy but somehow managed to Trojan horse their way into the minds of developers again trying to centralize how software is created. Like we avoid Microsoft Windows, the rest of the Microsoft ecosystem should equally be avoided: Copilot, LinkedIn, Outlook, Exchange, Office, Teams, Azure, VSCode, npm, GitHub (Sponsors, Codespaces, Copilot). Literally none of these projects/services can’t be replaced to help protect the privacy of your clients, coworkers, contributors.
Cloudflare is a CIA front. They offer “free” DDoS protection + static proxy thereby giving Cloudflare the ability to MitM all TLS connections thru their servers.
I just started to learn about privacy in depth this year, and this little fact about Cloudflare has sat with me more than most things that I’ve learned. I feel like very few people think about the implications of Cloudflare’s practices. Even if its not a CIA front (I feel like it is), we should feel uncomfortable giving any private entity such power. Unrelated, but their crazy lava-lamp wall, as cool as it is, kinda gives me bad vibes lol.
I learned about Cloudflare mitm quickly because when you use Tor browser you will see how many websites use cloudflare because you can’t access all those sites. So I did a little research about this problem about cloudflare and found out how serious and huge problem it is.
Matrix originating in Israel made me decide not to use it. No way anything from that place isn’t spyware.
There is no expectation of privacy in public.
By which I mean that things like blurring a house from Street View are unreasonable.
IMO, blurring a house in Street View could lead to the Streisand effect, especially when 99% of all other property is unblurred.
If you want to remain private, in the case of Street View, your best bet is to keep it as inconspicuous as possible, otherwise people will start looking closer and ask questions; the exact opposite of what you want, even if you have nothing to hide.
Nuclear war should do the trick at re-establishing this kind of privacy.
Hell, is other people
why do you think so?
The survivors will have more immediate concerns than invading my privacy and they will understand the value of their own privacy as well.
Except if someone with the means wants to exert control over the survivors asap. there’s a class which was being busy building bunkers in the last decade or more
-
Whether phones are listening or not
-
What is the redacted part in the rationale to ban Tik Tok
A note on the latter, it is presented as national security threat. They won’t say what it is. I presume because some of the shit they don’t want a foreign power doing is sth they very much do themselves.
The answer for 1 from EFF: Is my phone listening to me?
See, I am not the guy who will stop thinking for myself because experts say there is no evidence of sth. I am not saying that there is real time eavesdropping at all times, but I have not seen convincing arguments that a working microphone cannot be used for pushing ads by simple and widely available mechanisms. In fact, the sheer amount of people who complain about this should be considered evidence in itself, especially when they never had thought of a given topic before discussing it with someone. I have considered phone proximity and shared IP address but they don’t seem to make an exhaustive explanation. I think that some stories point to Meta doing this extensively, and that disallowing microphone access for Meta products alleviates the effect. Many privacy communities I believe they are infested by spooks and trolls pushing disinformation narratives, and one of them is that phones are NOT listening as a smart thing to say and/or believe. I might as well think that this is itself can be related to the redacted part in the rationale to ban Tik Tok. Having said that, I think that the only feasible to do this technically is by a regularly updated list of keywords, rather than other ways that would leave a processing or networking footprint.
Wasn’t there a leak recently where an executive said they were listening?
-
A global look at Short form video as the latest trend in mass misinformation campaigns, including which interest groups, or states conduct them and who they contract (from large scale to possibly unwitting small creators) to produce and post it. How it developed from prior trends, and where it might go next. Perhaps not particularly controversial (in the true sense of the word), but geopolitically worth looking at and discussing more in imo. Of course a privacy and security focus on this is very much integral to the issue by default. How the existing business models around the data involved (harvesting , auctioning etc) might play into this already , and in the years to come. As well as how other business is implicated. Good old “Follow the money” I guess .
Well, real privacy don¡t exist in the same moment you goes online. Google controls half the internet and MS and Apple the rest, direct or indirect. Even the Dark web isn’t so private as people think.
An advanced user can reduce the privacy holes, gutting Windows, leaving it in an OS as is, the same with Google products, but also only up to a certain limit so as not to turn navigation into pure text or get blocked in most the pages. For this reason, we must focus on which data deserves to be protected or hidden and which are of a purely technical aspect that ensure the proper functioning of the sites we visit.
I don’t care that the page knows what country I live in, but if it has to be avoided that it knows my address, I don’t care that it knows the OS I use and the exact resolution of my screen, since this helps the pages not to be out of order or download links take me to downloads for another OS.
This is all data that matches millions of other users and is not a privacy issue. These problems arise with data that identifies the user directly, such as email addresses, which are unique and perfectly traceable, personal photos published on the Internet, bank details in these very convenient mobile payment apps, posting on Fakebook until when are we going to go pee or when we go on a vacation trip (surely some of the 5637 followers are very interested when your house is empty)…
There is a lot that the user can do to have a certain privacy at the computer level, but the worst security hole is always the user themselves and the lack of common sense…
That is, indeed, a very controversial wrong opinion.
Go to Browserleaks and see how private you are
Yo can also take a look in Blacklight or Webbkoll to check what the pages you visit are looking for and who is looking over your shoulder. You can also look how well you bock ads and trackers with this one (mine 100% score)…
VPN: essential or snake oil?
maybe neither. and the benefits depend on its kind. a public vpn can easily be contra-productive when the provider is dishonest, but even when its honest and secure, a VPN that you run for yourself at home has different effects
Nice one
There is no such thing as too many layers of obfuscation. At least until we abolish all empires, states, religions and corporations.
…when the last king is hanged on the entrails of the last priest.
Now THAT’s my kind of party.
deleted by creator
Deceptive marketing and straight up lying is so prevalent that people have all sorts of wild ideas about VPNs. That’s why it’s high time someone cleared things up.
deleted by creator
Private gun ownership e.g. via home manufacture (not illegal contrary to popular belief) or p2p sale. Also mandated gun registries.
I assumed the topic was more about online privacy.
The post talks about software but does not specifically say online privacy. I think you’re right but I also think if I had asked about defeating facial recognition cameras I wouldn’t have been disregarded.
JavaScript canvas blocker add-ons (this one specifically comes to mind, because I’ve recently had to disable it since it makes life harder; is it worth the cost of admission, or is it a lot of effort for not a lot of reward?) Other types of privacy add-ons would be good to explore as well.
I installed such a plugin after reading about fingerprinting many years ago and have not ran into any problems yet. What issues have you encountered?
Broken sites, mostly
Yeah, but which…
I didn’t really keep a list, sorry, I just gave the add-on a test drive and several sites I visited didn’t work.
Whether this guy should be forced to turn over his passwords or not:
https://www.theregister.com/2017/03/20/appeals_court_contempt_passwords/
The appeals court found that forcing the defendant to reveal passwords was not testimonial in this instance because the government already had a sense of what it would find.
Boy, I’m not a lawyer, but that sure feels like being forced to incriminate yourself.
Others take issue with the idea that technology might be allowed to trump legal process. In a 2015 California Law Review article arguing that forced decryption is necessary to balance individual rights and government power, Dan Terzian, presently an associate at Duane Morris LLP, argues that the EFF’s view is too expansive.
“Scores of companies now encrypt their data,” Terzian wrote. “In the EFF’s alternate universe, these companies are effectively immune from discovery and subpoenas.”
Only if you consider corporations persons. They’re not.
Excellent suggestion, btw.
Browsing with JS disabled by default and expecting most sites to have basic functionality like “display this text”
How dare you‽ 😂
Browser extensions aren’t the answer to preventing tracking (as apps and other processes outside the browser aren’t blocked)
some DNS providers help with that, though I get what you mean
I use primarily DNS blocking myself, but it’s a custom solution that pulls in a ton of blocklists. I get tired of the “just use a browser extension” as the solution for everything, and any time I bring up IP/DNS-based solutions people say “but that doesn’t block everything” as if browser extensions do.
The biggest scam is with Browser VPN, they are simply proxies, good to watch country restricted movies but not for more. They don’t protect privacy, because they only can create the tunnel, after the browser is already connected to your ISP server. Bad in countries with dictatorship or teocracies with controlled servers, there only steganographic methods can help in comunications (Hidden messages in Photos, music, or even innocent text files)
But normally 100% privacy isn’t possible, almost every actuation online can be tracked. You can only avoid the worst with your shitty PC against the server and AI power of big companies, goverments and secret services with their hacker squads. Tey can spy other goverments, they are swallowing this little geeks with their laptop and VPN in a breaktime if needed (China even employ savants (isle gifted autistic people) as hackers in their secret services)
Hard agree, except I do have an issue with the last paragraph in that I think it’s far dumber than you’ve described.
Simply blocking (a shit ton of) domains can really get you 99% of the way there. I’m a web developer and it’s stupid dumb how third-party stuff is hosted. It’s either exactly that (third party hosted) or a CNAME or a third party which is easily blocked.
Look, I know how complex tracking and fingerprinting can be. But from my experience, it’s really not hard to block. Of course, I’m not really speaking to first party tracking where blocking would destroy the entire experience. But for the most part, you can prevent a profile being built about you (at least for tracking and advertising) by blocking with DNS.
Problem is first party tracking. Blocking is just against third parties. For first party tracking you are just going to have to use tor browser.
I use DNScrypt and Quad9 DNS
need a convenient solution to force traffic thru tor, doesnt tails have that? why isnt it commonplace tool?
For me an AI topic is the hottest
I’ve got nothing to hide.
Genitals pics, NOW
83 Posts, 1626 Comments of completely unliked 0-bit information posts without metadata like time of post.
Check your instance, Bob, you’re not getting all the data.
that is generous of you. i’m on the same instance as them, and can find no discrepency between viewing your profile through lemm.ee vs on programming.dev
alas, i think they’re just attacking their percieved quality of your posting, and it is not that they’re missing all of the good stuff.
