I was posting some comments on Reddit, in the "Privacy" subreddit, about better privacy options than Android or iOS—like GrapheneOS. I just received a message from the bot deleting my posts that mentioned GrapheneOS or other privacy-friendly operating systems. I accept this, since I'm not the owner of the subreddit. But with all due respect, what's the point of having a place to discuss privacy if comments recommending great privacy-focused OS alternatives get deleted? I don’t get it.

It seems like people in that community want privacy, but apparently not enough to have an open discussion about alternatives. Sure, some people might disagree—that's normal in any discussion! Should we stop talking about the NSA because some people support what they do? I doubt anyone would suggest that.

Am I missing something here? Maybe I just don’t understand the reasoning.

Do you know of a way to share your location with family members. I currently use Google maps because my family has both Android and iOS devices so preferably something cross platform. Thanks for your help.

Hi there! A little background: I write down notes a lot to make up for my bad memory. I’ve been doing this for a few years, and it’s usually a few thousand words a day: some professional, some deeply personal. Because of this, I’m trying to be conscious about keeping these notes private. While I’ve made a few changes along the way to follow better privacy practices, I thought I’d post here and see what other ideas are out there.

Right now, I have a few thousand markdown files stored in iCloud with end to end encryption. It’s far from a perfect system: ideally I would get away from cloud storage, iCloud is closed source, and there’s no native linux client. While it’s more private, writing entirely on paper isn’t an option: typing is much faster, it’s easier to query, and I can do fun things with this data. I think my next shift is towards using syncthing to maintain copies of these notes across devices, as I often edit from various machines and want to maintain multiple backups.

Rather than asking directly for proposed solutions, I’ll ask: What should I be considering? Does the editor I use matter? Does this go down to operating system level? I think the answers are both of these are yes, but I don’t know what else I should be asking myself.

I've been working in infographics that sum up some of the advice in DISENGAGE: Opting Out—and Finding New Options—to Reclaim Your Life from Spammers, Scammers, Intrusive Marketers and Big Tech. I hope it's helpful!

I'm guessing there is no way to use Lemmy without having javascript enabled?

Trying to setup a new and better network in the house. Ditching my ISP router because its just a mess and I want better security.

I keep being suggested Unifi as a setup. Its pricey but I am told its well worth the cost.

My main concern is the privacy side.

How reputable is Ubiquity when it comes to handling data? Any ideas?

cross-posted from: https://lemmy.world/post/2694719

cross-posted from: https://lemmy.world/post/2685916

OK, c’est pas vraiment "l’image du jour". Elle correspond plus à la période troublée que nous traversons actuellement.

cross-posted from: https://lemmy.world/post/2180929

Meta sneakily introduced "Platform Integrity Attestation API" which basically calls home to see whether the user has a valid license to play.

This means that to run apps user has to have online connection to perform an integrity test. Whether it's only a test on launch or continues call home like Denuvo-like DRMs is not yet clear. This could also mean that modified headsets could fail to pass this test essentially closing down the device for modifications that could damage "platform integrity". Not all details are clear yet but this doesn't look good.

Currently it's optional and up to app developers to enable it.

Privacy gives you the freedom to live your life in a way that best suits your personal goals and needs, without having to constantly balance every action between "the private game" (your own needs) and "the public game" (how all kinds of other people, intermediated by all kinds of mechanisms including social media cascades, commercial incentives, politics, institutions, etc, will perceive and respond to your behavior)

Without privacy, everything becomes a constant battle of "what will other people (and bots) think of what I'm doing" - powerful people, companies, and peers, people today and in the future. With privacy, we can preserve a balance.

As part of its efforts, the bloc has repeatedly introduced its Chat Control legislation, aimed at weakening the encryption that protects messaging services and force providers to provide a client-side backdoor for law enforcement.

A prominent computer scientist who has spent 20 years publishing academic papers on cryptography, privacy, and cybersecurity has gone incommunicado, had his professor profile, email account, and phone number removed by his employer Indiana University, and had his homes raided by the FBI. No one knows why.

Xiaofeng Wang has a long list of prestigious titles. He was the associate dean for research at Indiana University's Luddy School of Informatics, Computing and Engineering, a fellow at the Institute of Electrical and Electronics Engineers and the American Association for the Advancement of Science, and a tenured professor at Indiana University at Bloomington. According to his employer, he has served as principal investigator on research projects totaling nearly $23 million over his 21 years there.

He has also co-authored scores of academic papers on a diverse range of research fields, including cryptography, systems security, and data privacy, including the protection of human genomic data. I have personally spoken to him on three occasions for articles here, here, and here.

"None of this is in any way normal"

In recent weeks, Wang's email account, phone number, and profile page at the Luddy School were quietly erased by his employer. Over the same time, Indiana University also removed a profile for his wife, Nianli Ma, who was listed as a Lead Systems Analyst and Programmer at the university's Library Technologies division.

According to the Herald-Times in Bloomington, a small fleet of unmarked cars driven by government agents descended on the Bloomington home of Wang and Ma on Friday. They spent most of the day going in and out of the house and occasionally transferred boxes from their vehicles. TV station WTHR, meanwhile, reported that a second home owned by Wang and Ma and located in Carmel, Indiana, was also searched. The station said that both a resident and an attorney for the resident were on scene during at least part of the search.

Attempts to locate Wang and Ma have so far been unsuccessful. An Indiana University spokesman didn't answer emailed questions asking if the couple was still employed by the university and why their profile pages, email addresses and phone numbers had been removed. The spokesman provided the contact information for a spokeswoman at the FBI's field office in Indianapolis. In an email, the spokeswoman wrote: "The FBI conducted court authorized law enforcement activity at homes in Bloomington and Carmel Friday. We have no further comment at this time."

Searches of federal court dockets turned up no documents related to Wang, Ma, or any searches of their residences. The FBI spokeswoman didn't answer questions seeking which US district court issued the warrant and when, and whether either Wang or Ma is being detained by authorities. Justice Department representatives didn't return an email seeking the same information. An email sent to a personal email address belonging to Wang went unanswered at the time this post went live. Their resident status (e.g. US citizens or green card holders) is currently unknown.

Fellow researchers took to social media over the weekend to register their concern over the series of events.

"None of this is in any way normal," Matthew Green, a professor specializing in cryptography at Johns Hopkins University, wrote on Mastodon. He continued: "Has anyone been in contact? I hear he’s been missing for two weeks and his students can’t reach him. How does this not get noticed for two weeks???"

In the same thread, Matt Blaze, a McDevitt Professor of Computer Science and Law at Georgetown University said: "It's hard to imagine what reason there could be for the university to scrub its website as if he never worked there. And while there's a process for removing tenured faculty, it takes more than an afternoon to do it."

Local news outlets reported the agents spent several hours moving boxes in an out of the residences. WTHR provided the following details about the raid on the Carmel home:

Neighbors say the agents announced "FBI, come out!" over a megaphone.

A woman came out of the house holding a phone. A video from a neighbor shows an agent taking that phone from her. She was then questioned in the driveway before agents began searching the home, collecting evidence and taking photos.

A car was pulled out of the garage slightly to allow investigators to access the attic.

The woman left the house before 13News arrived. She returned just after noon accompanied by a lawyer. The group of ten or so investigators left a few minutes later.

The FBI would not say what they were looking for or who is under investigation. A bureau spokesperson issued a statement: “I can confirm we conducted court-authorized activity at the address in Carmel today. We have no further comment at this time.”

Investigators were at the house for about four hours before leaving with several boxes of evidence. 13News rang the doorbell when the agents were gone. A lawyer representing the family who answered the door told us they're not sure yet what the investigation is about.

This post will be updated if new details become available. Anyone with first-hand knowledge of events involving Wang, Ma, or the investigation into either is encouraged to contact me, preferably over Signal at DanArs.82. The email address is: dan.goodin@arstechnica.com.

I've been looking to switch from gmail to a different email provider that's more private. I've been hearing about Tuta, are there any drawbacks to it? Are there better options?

For a while I was planning on making the switch to protonmail but that's off the table now due to the recent events surrounding them.

I am looking for a wifi mesh system to improve the coverage in my home. I looked around and found a cheap solution with decent reviews, the Halo 50G by Mercusys (TP Link). I am not a fan of super cheap, super easy to use "magical" solutions, and within minutes of connecting just the access point I was seeing calls to the likes of google, facebook, amazon, etc in my network coming from the device. Not ideal.

I also found that Ubiquiti and Netgear may be the best options out there, but the prices I found are north of 600€ and I can not afford to pay that much right now.

So, my question is: Is there any wifi mesh system that is not using my network against me and does not empty my wallet? I am based in Europe and would like something under 200€ if possible, and ready to buy from the shelf.

Thank you for reading and for any recommendation.

Had never heard of this before today. Anyone tried it?

EDIT: "Being a fork of Mozilla Thunderbird, the software collects some data about the user, less than the original Mozilla Thunderbird, as outlined in Thunderbird's privacy statement. No data is submitted to Betterbird, some data may be submitted to Mozilla. No telemetry and no crash reports are submitted, however, add-on updates and blocklists are downloaded from Mozilla sites. Betterbird offers a product Start Page which processes access data as described above."

This post is long and kind of a rant. I don't expect many to read the whole thing, but there's a conclusion at the bottom.

On the surface, recommended security practices are simple:

• Store all your credentials in a password manager
• Use two factor authentication on all accounts

However, it raises a few questions.

• Should you access your 2FA codes on the same device as the password manager?
• Should you store them in the password manager itself?

This is the beginning of where a threat model is needed. If your threat model does not include protections against unwanted access to your device, it is safe for you to store access your 2FA codes on the same device as your password manager, or even in the password manager itself.

So, to keep it simple, say you store your 2FA in your password manager. There's a few more questions:

• Where do you store the master password for the password manager?
• Where do you store 2FA recovery codes?

The master password for the password manager could be written down on a piece of paper and stored in a safe, but that would be inconvenient when you want to access your passwords. So, a better solution is to just remember your password. Passphrases are easier to remember than passwords, so we'll use one of those.

Your 2FA recovery codes are something that are needed if you lose access to your real 2FA codes. Most websites just say "Store this in a secure place". This isn't something you want to store in the same place as those (in this case our password manager), and it's not something you will access often, so it's safe to write it down on a piece of paper and lock it in a safe.

Good so far, you have a fairly simple system to keep your accounts safe from some threats. But, new problems arise:

• What happens if you forget your master passphrase?
• What happens if others need access to your password manager?

The problem with remembering your passphrase is that it's possible to forget it, no matter how many times you repeat it to yourself. Besides naturally forgetting it, things like injuries can arise which can cause you to forget the passphrase. Easy enough to fix, though. We can just keep a copy of the passphrase in the safe, just in case we forget it.

If someone else needs to access certain credentials in your password manager, for example a wife that needs to verify bank information using your account, storing a copy of the password is a good idea here too. Since she is a trusted party, you can give her access to the safe in case of emergencies.

The system we have is good. If the safe is stolen or destroyed, you still have the master passphrase memorized to change the master passphrase and regenerate the 2FA security codes. The thief who stole the safe doesn't have your password manager's data, so the master passphrase is useless. However, our troubles aren't over yet:

• How do you store device credentials?
• How do you keep the password manager backed up?

Your password manager has to have some device in order to access it. Whether it's a phone, computer, tablet, laptop, or website, there needs to be some device used to access it. That device needs to be as secure as your password manager, otherwise accessing the password manager becomes a risk. This means using full disk encryption for the device, and a strong login passphrase. However, that means we have 2 more passwords to take care of that can't be stored in the password manager. We access those often, so we can't write them down and store them in the safe, Remembering two more passphrases complicates things and makes forgetting much more likely. Where do we store those passphrases?

One solution is removing the passwords altogether. Using a hardware security key, you can authenticate your disk encryption and user login using it. If you keep a spare copy of the security key stored in the safe, you make sure you aren't locked out if you lose access to your main security key.

Now to keep the password manager backed up. Using the 3-2-1 Backup Strategy. It states that there should be at least 3 copies of the data, stored on 2 different types of storage media, and one copy should be kept offsite, in a remote location (this can include cloud storage). 2 or more different media should be used to eliminate data loss due to similar reasons (for example, optical discs may tolerate being underwater while LTO tapes may not, and SSDs cannot fail due to head crashes or damaged spindle motors since they do not have any moving parts, unlike hard drives). An offsite copy protects against fire, theft of physical media (such as tapes or discs) and natural disasters like floods and earthquakes. Physically protected hard drives are an alternative to an offsite copy, but they have limitations like only being able to resist fire for a limited period of time, so an offsite copy still remains as the ideal choice.

So, our first copy will be on our secure device. It's the copy we access the most. The next copy could be an encrypted hard drive. The encryption passphrase could be stored in our safe. The last copy could be a cloud storage service. Easy, right? Well, more problems arise:

• Where do you store the credentials for the cloud storage service?
• Where do you store the LUKS backup file and password?

Storing the credentials for the cloud storage service isn't as simple as putting it in the safe. If we did that, then anyone with the safe could login to the cloud storage service and decrypt the password manager backup using the passphrase also stored in the safe. If we protected the cloud storage service with our security key, a copy of that is still in the safe. Maybe we protect it with a 2FA code, and instead of storing the 2FA codes in the password manager, we store it on another device. That solves the problem for now, but there are still problems, such as storing the credentials for that new device.

When using a security key to unlock a LUKS partition, you are given a backup file to store as a backup for emergencies. Plus, LUKS encrypted partitions still require you to setup a passphrase, so storing that still becomes an issue.

Conclusion

I'm going to stop here, because this post is getting long. I could keep going fixing problems and causing new ones, but the point is this: Security is a mess! I didn't even cover alternative ways to authenticate the password manager such as a key file, biometrics, etc. Trying to find "perfect" security is almost impossible, and that's why a threat model is important. If you set hard limits such as "No storing passwords digitally" or "No remembering any passwords" then you can build a security system that fits that threat model, but there's currently no security system that fits all threat model.

However, that doesn't let companies that just say "Store this in a secure place" off the hook either. It's a hand wavy response to security that just says "We don't know how to secure this part of our system, so it's your problem now". We need to have comprehensive security practices that aren't just "Use a password manager and 2FA", because that causes people to just store their master passphrase on a sticky note or a text file on the desktop.

The state of security is an absolute mess, and I'm sick of it. It seems that, right now, security, privacy, convenience, and safety (e.g. backups, other things that remove single points of failure) are all at odds with each other. This post mainly focused on how security, convenience, and safety are at odds, but I could write a whole post about how security and privacy are at odds.

Anyways, I've just outlined one possible security system you can have. If you have one that you think works well, I'd like to hear about it. I use a different security system than what I outline here, and I see problems with it.

Thanks for reading!

cross-posted from: https://lemmy.ml/post/26453685

Not many people have heard about secureblue, and I want to spread the word about it. secureblue provides hardened images for Fedora Atomic and CoreOS. It's an operating system "for those whose first priority is using linux, and second priority is security."

secureblue provides exploit mitigations and fixes for multiple security holes. This includes the addition of GrapheneOS's hardened_malloc, their own hardened Chromium-based browser called Trivalent, USBGuard to protect against USB peripheral attacks, and plenty more.

secureblue has definitely matured a lot since I first started using it. Since then, it has become something that could reasonably be used as a daily driver. secureblue recognizes the need for usability alongside security.

If you already have Fedora Atomic (e.g. Secureblue, Kinoite, Sericea, etc.) or CoreOS installed on your system, you can easily rebase to secureblue. The install instructions are really easy to follow, and I had no issues installing it on any of my devices.

I'd love more people to know about secureblue, because it is fantastic if you want a secure desktop OS!

John Oliver cited a 5000% rise in search queries related to leaving Meta and deleting accounts. Among the topics mentioned in the analysis, attention was drawn to early Facebook's naivete with regard to moderation requirements, the constitutional framework, and a history of governmental interference.

Oliver debunks common right-wing "cry censorship" talking points, as well as the objective difficulty of moderation endeavors, and how direct threats by Trump may have influenced Zuckerberg's turnaround.

Oliver went on to suggest Signal, Mastodon, Bluesky, and Pixelfed as alternatives that "do not seem as desperate to fall in line with Trump". For those reluctant to completely ditch Meta, Oliver revealed a new site with step-by-step instructions to "make yourself less valuable to them".

The guide was a collaboration with the EFF, and includes settings' tweaks for Facebook and Meta, whose 98% of revenue comes from micro-targeting ads, the host previously cited, to increase privacy, and recommends Firefox, Privacy Badger, as "other measures" to take in order "to block advertisers and other third parties from tracking you".

The segment culminated in a mock advert, in which the new Meta's approach to moderation is coined as "Fuck it", and hints to racism, internet scams, and calls to genocide running rampant on Meta's platforms.

The clip reminds the origins of Facebook as a site to "rank college girls by hotness", and its implication in genocide in Myanmar, which was more thoroughly discussed in an Oliver's previous special on Facebook in 2018.

Please suggest a good and relatively affordable private email provider. I am considering tuta, mailbox right now. I know proton has gone rogue.

I cannot self host one and the email provider must be somewhat reputable as I will be using this for my work portfolio. Anything with €1-€3 per month is encouraged.

I just finished setting up a custom router with dns ad blocking. Next comes a media player so I can purge this smart TV filth from my household.

Huge shout out to Louis Rossmann and the FUTO communuty contributors, check out the wiki on self-hosted software if you haven't already.

Wiki link

Is anyone actually surprised by this?

After about 2 and a half years of battling for my privacy, I'm finally at a place where I can step back and be happy. Technically the seed of privacy was planted 5 years ago, but it hadn't become a goal yet.

I used to use Windows 7 (even 10 and 11, eventually), an iPhone 6, Gmail, Google Hangouts (anyone else remember when it was called that?) and Discord as my main messengers, Snapchat, Instagram, Spotify, Netflix, Reddit, ChatGPT, Chrome, Google, Avast and Avast VPN, YouTube, Authy, and so, so much more.

I am so fortunate to be able to be where I'm at now. I use Fedora (Silverblue. I tried secureblue but it was too strict for my taste), a Pixel 8 running GrapheneOS, Proton Mail + addy.io (although I try to use email as little as possible), Signal and SimpleX Chat, a "self-hosted" music library, some cheaper ways to stream movies, Lemmy (duh), HuggingChat (because I don't have the hardware to run my own model quite yet), Tor Browser and another (I want to avoid arguments about my browser choice), SearXNG, Proton VPN (until I can get Mullvad VPN paid for), FreeTube, Aegis Authenticator, and a plethora of other software.

I got quite lucky with device compatibility. My computer and laptop just so happen to be compatible with every distro I've tried, and I've sure dragged them through hell to find the one I want. I'm blessed to have been able to snag a decent phone for GrapheneOS, and so glad to have automated the transition from Spotify.

It's been a good run. I'm glad to finally be satisfied with where I'm at. I started to see the fruit of my labor months ago. Now I can rest easy and do my part to help others become more privacy aware. I'd love to hear your story too, maybe mine isn't far off!

Bonus story: The straw that broke the camel's back that caused me to fully switch to Linux was Windows 11's Efficiency Mode. It's a cute feature that throttles the performance of programs to save on carbon emissions... and (at the time) you couldn't disable it. You could disable it per-process, but it would re-enable itself shortly after. ChatGPT was becoming quite popular at the time, but Efficiency Mode slowing down the browser made it nearly unusable. I did look for ways to permanently disable it, but either I wasn't experienced enough or it didn't exist yet. Well, no way except to replace Windows altogether!