Thinking about zero-trust, zero-knowledge services, I can see how using the open-source client means E2EE is guaranteed, assuming that the community checks the code of new client releases and that the binaries are not fiddled with.

Am I right thinking that if you use a web client instead then you don't realistically know if the code your browser is sent every time you access the service is compromised? The service may be independently audited, but isn't it conceivable that a person of interest may be specifically sent one-off compromising code to be executed in their browser (or web wrapper)? Eg Whatsapp, Megasync and many others have optional web clients for convenience. I think this may be why Mega advises against using their web access which they describe as less secure.

cross-posted from: https://lemmy.world/post/47871545

🌐 Many companies now block older browser versions from accessing their websites!

This follows many browser makers ending updates 4 older operating systems, leaving legacy devices unable to use web services without an OS upgrade.

This kinda reminds me of the Java website block by browsers a few years ago, just in reverse. (Revenge? ;)

Old Android versions are also increasingly blocked from accessing the Google appstore.

Truly about security or perhaps Planned Obsolescence?

Update: "old devices can only use old os > old os can only use old browser > old browser cannot use web> poor uneducated people = screwed once again!"

"Only suggesting corporate browsers, kinda like an ad."

IE like Crypto AG:

In 2020, it was revealed that the Swiss company, Crypto AG, which provided secure communications services to ~120 governments throughout the 20th century, was secretly ran by the CIA and West German Intelligence. The CIA and later NSA were able to read encrypted communications for many countries such as Saudi Arabia, Iran, Italy, Indonesia, Iraq, Libya, Jordan and South Korea.

I was reading a recent story about a UK based age verification company, Yeti, reportedly banning a user simply for using GrapheneOS. While going through the discussion, I came across the idea of dual wielding two phones: a GrapheneOS device (or any custom ROM or Linux phone) alongside a basic "identity" phone.

Dual wielding seems like a practical way to separate personal data from services that require real world identification. The tricky part, however, is handling SIM cards. In many countries, your primary phone number is registered with the government, so it needs to stay active if you want people, businesses, and official services to be able to reach you.

I'm thinking of putting my main SIM in the identity phone and treating it as the device that represents my legal identity. The identity phone would contain only apps that are directly tied to my real world identity, such as government ID apps, age verification apps, digital identity services, and any other applications that require official identification.

Then I'd buy a separate data-only eSIM and use it exclusively on the GrapheneOS phone. I can even try regular esim with separate number too, but those are rare. Every phone operator wants to know who you are nowadays.

Most people communicate through WhatsApp and other data-based apps these days anyway, so the GrapheneOS phone could remain my primary daily device while the identity phone simply stays powered on to receive calls and SMS messages associated with my registered number.

In theory, dual wielding like this provides a cleaner separation between identity and personal computing. The identity phone becomes a dedicated device for government and identity-related services, while the GrapheneOS phone handles day to day communication, browsing, and personal activities without being directly tied to the primary SIM or identity infrastructure.

Thoughts?

P/S: it's Yoti. My apologise to the Yeti.....

I heard about this in F-Droid's latest blog post.
It is based on the Bramble protocol and is compatible with Briar.
It removed mesh-networking features of Briar and added a couple new ones:

• voice messaging
• ML-KEM (post-quantum cryptography)
• disappearing messages

More technical details are shared on their blog.

Sources are on Github https://github.com/zerionproject/Zerion

Hey everyone! I'm making this post just to share my experience switching from iPhone to grapheneos. My experience may be a little different than others, because I was already using all open source apps if possible, so moving apps wasn't horrible.(only took me like 2 days.) Moving my imsg contacts to signal fucking sucks though. Especially when they say no, and you gotta coax them ugh.

To be honest apple's iOS 26 HORRENDOUS FUCKING DESIGN LANGUAGE in conjunction with a recent exploit that forced me to update or I would get malware was the primary reason for updating. I can't even express how badly iOS 26 fucked up my phone. Along with that i was tired of dealing with issues from side loading. It felt so delicate, and it broke at any minor change. The amount of issues I had with sidestore were absurd.

The general iPhone to android switch wasn't too bad. I prefer material ui over ios 26 and maybe a little more than iOS 18's. Back on my iPhone I had icloud, so deleting apps wouldn't wipe its data and it pissed me off so much sometimes. Being able to press clear data or cache was such insane peace of mind. The large app selection(even considering FOSS only) is also super nice.

The one thing that annoys me a lot about grapheme is alarms. All my profiles can't run in background, so I have to switch to owner so I can set an alarm before sleeping. (I have auto restart, so it always goes to owner in the morning.) Oh wait actually I think of more. Lower battery life than my iphone, notifications being used for persistence, file transfer troubles over cable, and having to use 3 Mullvad VPN devices, 1 for each of my profiles. If anyone knows how to use one Mullvad device across all my profiles, please let me know. Also I'm not used to the keyboard at all.

As said earlier, me not being apple pilled or being anymore than one layer into their ecosystem made switching easy as pie. Man I remember the first time I saw that graphene boot screen on a fresh pixel I felt so cool; the first boot home screen is genuinely so clean. Just staring at that black wallpaper with 4 apps is just so calming i don't know. Although I switched to kiss launcher(its fucking perfect), I still like going to that original homescreen to look sometimes.

I would say in general the greatest boon of switching was peace of mind. My phone did what was documented and what the apps I chose did. On my old phone I couldn't trust anything. Gosh, its so nice! If anyone was interested in purchasing a device I hope my experience was interesting to you. Attached is a photo of my homescreen, if anyone is interested.

Sorry about messy grammar or ordering of information. I kinda rushed to make this post

I try to explain how attackers would guess your password, should they get their hands on your encrypted data. There are some thoughts on the strength of real-world passwords and suggestions for your new password.

I recently learned about Cape and am trying them out to see how it works. I'd be interested in any other info or opinions people may have.

They are private by nature. They don't collect a bunch of info on you to create an account. They aren't going to sell your data. Its clear it's not anonymous, but I don't need that I just need privacy.

Cool features include:

A rotating IMSI number that changes every 24 hours or so.

What they call Network Lock, which basically pings your phone when your IMSI attaches to the network to verify proximity. If it doesn't match then they deny it. This should prevent SMS interception and sim jacking.

There's also secondary phone numbers included that handle SMS only, so you can use them for services you don't want to give your real number to or as a burner number.

Phone numbers are not identified as VoIP so that (stupid) limitation from some services isn't applicable.

I also like that they seem like a very practical solution. Right now I use JMP for VoIP numbers and buy a data sim separately. I've looked at other services and had issues with them. Cape seems very straight forward and simple.

That being said, they are a very new company. Apparently this has been worked on for years but the service just went live in January. That's my biggest hesitation.

My testing over 2 days has been fine. I haven't seen anything that is negative or a red flag.

Pricing is mildly expensive overall for a single line. No family plans, which is good from a privacy stance and there's a referral discount so basically if you use that to sign up multiple accounts it brings the price down like a family plan would. But I'm a single line so I don't get any of that benefit.

There's some missing features but none that I really care about. They have a clearly marked out roadmap for the year, so I guess over time we get to see if they stick to it.

What do you guys think?

Edit: I have been using them and very happy with the service. Porting my number was a pain but I think that was more of a JMP issue (my prior provider). Actual service is spot on.

Referral code if you want $20 off your bill indefinitely: GCMHTPE2

Ohhhh Billy boy you gave your wife a STD and hid it... Now you are doing it to us. Windows is a terrible operating system and I am so glad I moved away from big tech... Remember kiddos it is all about maintaining perception. You dirty dog Mr. Gates hahahaha

We build free, open-source privacy tools — encrypted chat, anonymous mail, untraceable voice, a whistleblower drop, a browser, a network layer. All given away.

But "free and open source" means nothing if you can't check it. So:

• Source is public — read every line: github.com/Anon-Gratis
• Hashes are signed — verify the binary matches what we published
• Build it yourself — don't want our binary? Compile it from source

We don't want your trust. We want you to not need it. The only privacy tool that survives "trust me bro" is the one you can read.

🌐 anonymous.gratis · ✉️ admin@anon.gratis (PGP on site)

Your thoughts are yours. Your notes should be too.

🔒️ Go local with HelixNotes. https://helixnotes.com/

Hi there. I'm looking for advice to improve my online privacy while browing on android. I'm currently using vanilla Firefox, strict enhanced Tracking protection (fix major site errors), HTTPS-only mode, default dns, no technical data collection, delete cookies / cache / page data on quit. As extensions, I use only Decentraleyes and uBlock extensions. However, I heard vague warnings from the privacy community about using vanilla Firefox with self-hardened privacy-conscious settings, because my settings and yours might be sligthtly different, introducing entropy that can be used for fingerprinting. The only browser I recognize by name on F-Droid is LibreLynx Lite, which is barely customizable (e.g., no 'decline cookies' or 'delete cookies on restart' setting without subscribing to pro) and was last updated 7 months ago. People on the web recommend 'Mull for android', but that was last updated in 2024 and is not on F-droid anymore. I am not generally opposed but a little candid about using Brave or DuckDuckGo Browser, as these are built on Chromium and I would prefer to stay within the Firefox ecosystem. I am also naively a fan of 'hiding in the crowd': using a common browser / what looks like a common browser to a web page being more private than using a super niche one.

Any well-supported security-hardened Firefox forks on Android to speak of? Any other recommendations?

Thanks for your thoughts.

My current car is old. I had a lot of repairs done on it recently. If I get a new car, I don't want features. Lane assist, backup camera, DUI Camera, telemetry, auto breaking or other frankly silly features. Call me grumpy, but I find modern cars very distracting.

Can I ask a dealership to disable these at purchase? Is there a car that works best for being private besides just older cars?

I drive very little in a year. No, I can't ride a bike.

Looking to leave GMAIL and am currently testing Proton for a $1 a month. So far it's pretty good and the issue I have is not with Proton, but with who I'm sending messages to. If I send an email to a gmail account my information is still sitting on a Google server. So is Proton worth it? Is something like Fastmail just as good over all due to how email works? With Fastmail I can get email for my whole family for $14 a month. I won't have the VPN, ProtonPASS and other Proton apps, but are they worth the $12 a month for one person?

Data held for humanitarian work is data, and that makes it a target. Seems like it would be difficult to get substantial investment into security for aid organizations (why not feed more folks instead?)...

In this particular case, and earlier audit found:

A 2022 audit of WFP’s Palestine operations said risks related to personal data collection had not been assessed or mitigated due to limited internal technical capacity.

Hello people, my family recently bought a Renault 5 e-tech. The car itself is great, but there are some aspects that creep me out, especially the driver-facing camera. We didn't actually know that such a camera existed before we bought the car, it was only mentioned as the car was given to us.

The cameras official purpose is to see, if you are tired and paying attention to the road, by some "AI magic", I suppose. You can also let it scan your face, so that you automatically get logged into your profile.

I personally think, that that is kinda creepy, especially as there is no visual indication if the camera is currently recording and no official way to disable the camera hardware-wise. When it is being coverd, the car immediately complains about it.

When talking to friends or family about it, I got one of two reactions: equal concern, or "nice feature actually", "what about the camera on your laptop?", "you are way too paranoid", "I have noting to hide; it is only me driving being recorded".

I have also seen such cameras in other cars, BYD for example.

What do you think, is this creepy or am I too paranoid? Does anyone know where the actual data is processed, on device or on some cloud server? Do you have any experience with such cameras? I couldn't really find any information about it on the internet.

Hey all, until now I'm being super reluctant about using any AI tool. On top of all the privacy issues it obviously comes with it (I can't believe there are people talking to ChatGpt and literally teaching them how to impersonated!), I have a feeling that it only does jobs that you are capable of doing with other tools, but since it looks like a person and not a computer, people start to fantasize that it will do everything they don't know or don't want to do it and become numb and stupid. But, maybe there are some uses for it and at my office we will soon have access to Claude, so I want to explore it and check for myself. My question is what precautions should I take and what limits should I put on my usage? I thought about creating a new email account just for signing up, but obviously that's nothing nowadays.

YT alternative, GDPR, from Germany, multi-language

Hi, a long time ago, when I was less informed on privacy risks on the internet, I used to use Doodle Poll. Using my work account (only used for work and no personal resons), I accessed it again after many years as need to arrange a work meeting. It has become a lot less useful that it was as they have clamped down on free tier features.

So my question is: Is there an alternative, that is equally simple to use, and possibly privacy friendly?

Crossposted from https://lemmy.radio/post/13618800

So, I have a question on Motorola Mobility. The company is Chinese-owned, but US-based. This means it's subject to the invasive CLOUD Act, and that US kangaroo courts even can require parent companies to provide that data.

Android also would lock down Android from september 2026, meaning that vendor-independent downloading (sometimes falsely named 'sideloading') would be rendered impossible, and all apps must be from verified developers, for which they'd have to give identification, iirc.

So how would a custom OS like e/ or GOS be affected by this? How would the latter ensure it's not subject to the CLOUD Act? Or not affected at all downstream due to the locking down?

Sure, Motorola would qualify for the hardware specs needed for GOS, but legally considering, aren't there issues? I'm considering to get a new phone that would be good privacywise, but I don't like the thought of depending on the USA or China. It almost feels like a fed honeypot that way. Ethics is important to me.

I've thought about getting a Jolla phone with Sailfish instead, since that's practically Linux. Or a Fairphone with e/, but from what I hear there are concerns surrounding privacy.

So I've no idea what to do. My ideal would've been a Fairphone with hardware suitable for GOS, and then having GOS on it, but alas. If there's another option for phones also, I'd like to know.

A blogpost from Mullvad about age verification

Catch up on all the horror stories from big tech - from May. And some tech, film, blog and book tips.