I’m building up to doing the same. Already using Protonmail and Kagi. Looking for a less Google-dependent phone to switch over to and then I might pull the plug myself.
I have been using NprdVPN for 5 years. Speed is pretty good, and their zero-log policy have been proved by 3th party. They also use RAM only servers which is better.
I am not sure about that particular leak and the kind of data that was leaked, but I am pretty confident about their zerolog policy as today. NordVPN has undertaken not one, but three independent audits, which is more than other known VPNs.
Many websites confirm their clams, like those ones:
been selfhosting the smtp relay and using the app for quite a while. If you use it as a private chat for sensitive content, it is PERFECT. Really looking forward to its future development in group chats.
How does Ford benefit from this? Why add this “feature?” … To prevent adolescent teens from driving over 80mph…? Nanny car 2024? Buy your teen this car and feel assured they won’t drive over 80mph? “Don’t worry we will alert the cops and even call you when they get arrested!”
I wonder if insurance companies would offer a lower rate for drivers with NannyCar features.
We monitor everything that you do, and limit your ability to cost us money:
No loud music, must use turn signals, no driving over 80mph, we track your movements, must wear seatbelt, pay tolls, have approved air pressure, no loud kids in the car, no distractions like hands on phones … stop at stop sign for 60 seconds. We can stop the car if we suspect is is being carjacked or involved in bank heist.
Or a more nefarious motivation…Ford … we monitor the music you like, where you stop to eat, which commercials you don’t skip, where you buy gas, … and sell the information to advertisers…
This is how it’ll happen. Opt in. They’ll charge more by default and then you can share your safe driving with them to lower your premium. It’s often how it currently works with odometer readings, except not through a smart car, just a quick dash reading.
I’m imagining a nagging-nanny removing discounts for minuscule violations it deems catastrophic. “On September 2 you exhibited ‘road rage’ by not using your turn signal before passing.”
Micromanaged driving. AI anti-privacy bot calculating your every move. Big-Nagging-Nanny
They already do this. I was offered to plug some kind of monitoring device into my car for a period of time to determine my driving behavior for potential lower rates. I went for higher rates.
It sounds overcomplicated, is there really a need for the blockchain aspect? Could the same security be provided by a simpler method (like how keybase has their identity proofs?) but better to have it and not need it than need it and not have it ig
How many people have verified how many people’s identity with PGP signatures? Also I’m willing to bet a horribly shocking amount of people would just accept a new key from someone (not necessarily sign it) and trust them regardless.
Yeah these issues are definitely not new, but replacing “I trust the people who sign/verify my keys” versus “I trust the blockchain” is not too far off. What rules are going to be in place for peers to validate entries to the blockchain and independently reach enough concensus to achieve true decentralization?
Blockchains are an immutable ledger, meaning any data initially entered onto them can’t be altered. Yen realized that putting users’ public keys on a blockchain would create a record ensuring those keys actually belonged to them – and would be cross-referenced whenever other users send emails. “In order for the verification to be trusted, it needs to be public, and it needs to be unchanging,” Yen said.
The benefit of doing this with a blockchain instead of a privately held and maintained database is that the latter can be compromised, and you just have to trust "whoever" is maintaining that private database. Blockchain means that the ledger is distributed to many nodes, and any post-entry modification to that chain would be instantly recognized, and marked invalid by the other nodes operating the chain. Besides that, when you're looking up a public key for a recipient on such a blockchain, you would be looking it up at a number of nodes large enough that in order for a malicious entry to come through, they would all have to be modified in the same way, at the same time, and you would have to be asking before the change got flagged. Poisoning blockchain data like this is simply not possible; that's what makes this an especially secure option.
As long as there is an appropriate method for adding a legitimate entry to the chain, incorrectly entered data can be handled by appending corrected data on to the chain, and marking the error as such. Sensitive data, in this case, would be along the lines of "I accidentally added my private key instead of my public key." The action necessary here is the same as if I published my private key anywhere: stop using that key pair and generate a new one.
Proton rolled out the beta version of Key Transparency on their own private blockchain, meaning it's not run by a decentralized series of validators, as with Bitcoin or Ethereum. Yen said Proton might move the feature to a public blockchain after the current version serves as a proof of concept.
Because the Proton blockchain is currently private, the keys they are currently adding could easily be affected by a man in the middle attack.
No. That's not how that works. Just because a blockchain is "private" doesn't make it suddenly changeable, and it doesn't mean there's a unsafely small number of nodes. People commonly get invited to participate in beta testing; that's kind of how software development works.
And there would be no way to invalidate those keys for any of the affected users, ...
Remember when I said:
As long as there is an appropriate method for adding a legitimate entry to the chain, incorrectly entered data can be handled by appending corrected data on to the chain, and marking the error as such.
Yeah, and that's called a fork. The chain doesn't vanish; a new chain is created, forking off of the old one. That's why we have both Ethereum and Ethereum Classic.
Oh wait, you're talking about a 51% attack. Read the whole article that you linked. It is amazingly difficult to perform, and as the number of nodes goes up, it becomes even more difficult.
Has anyone successfully performed a 51% Attack on Bitcoin?
Nope, not yet.
Some miners have come close to reaching 50% or more of the total mining power over Bitcoin’s history, but nobody has actually performed a successful 51% Attack.
If Big Daddy Bitcoin hasn't suffered a 51% attack, I find the risk of that happening vanishingly low.
There have been three. BTG, ETC and VTC. All three of those are Proof of Work. PoW is going by the wayside, I'm hopeful that Proton would be using Proof of Stake, which is a much more difficult model to 51% against. (You would need to possess 51% of the tokens.) Even if someone managed to do it, it would still be noticed pretty much immediately, and then you'd fork to a new chain and move on.
A fork assumes the old chain continues to exist instead of being completely replaced. Without insight into the chain, which is we can’t have until it’s public, you can’t make any guarantees of immutability.
Put differently, I’ve got a revolutionary new financial encryption system. It can safely act as the middleware between you and any vendor. You can trust me with your credit card numbers because of my years experience and industry clout. You can’t see my system and I won’t do a PCI audit because it’s in beta. You can totally trust me though.
You do realize that when it's out of beta, they could easily drop the beta chain and start a brand new one, right? And that the methodology for someone adding their public key as well as the blockchain node application (wallet) would be open source, so that anyone can look at the code? And that Proton isn't adding your public key to the chain, you are? And that being a beta blockchain kind of necessaily depends on having many nodes, in order to test scalability?
You're out of your depth here, and I'm not going to bother explaining any further.
But it’s not public. It’s a private blockchain. The immutable ledger aspect only matters if everyone can see the ledger. Otherwise we take at face value all of the things you said. Assume they run one node and that one node is compromised by a malicious actor. The system fails. Extend it to a limited number of nodes all controlled by SREs and assume an SRE is compromised (this kind of spearphishing is very common). The system fails again.
Sure, you can creatively figure out a way to manage the risks I’ve mentioned and others I haven’t thought of. The core issue, that it’s not public, still remains. If I’m supposed to trust Proton telling me the person I’m emailing is not the NSA pretending to be that person (as the Proton CEO suggested), I need to trust their verification system.
It's. In. Beta. Of course it's not being offered to the general public yet. It's likely that there are very many beta nodes, in order to test scalability. When it's out of beta, you drop the beta chain and start a new one.
Yen said Proton might move the feature to a public blockchain
I’m not interested until it’s public. Additionally, building out the chain then dropping it to rebuild a new public one is rewriting history, which violates the whole “immutable” part of “immutable ledger.”
Untestable security claims for sensitive information are useless. I’m a huge fan of Proton and I’m excited to test this but only once the blockchain is public. Until then there is no way to verify the trust so there is no trust.
If you disagree, I might have something for you. I’ve got the strongest financial encryption known to man on top of the best transit system ever that makes it super easy to do stuff. It’s all based on blockchain, of course. Just give me your credit card info and bank details. It’s in beta so I won’t let you audit it, but unless you’re shilling you don’t have a problem with that.
Yeah I guess I missed the part where security fundamentals weren’t supposed to be a part of a secure product. Do you mind explaining how a product centered on trust can be developed without trust? I think that would really help me understand why you think repeating the word “beta” allows a security-focused company to sidestep normal foundational components.
I don’t think we read the same article. We’re talking about a product those goal is secure verification of identity, correct? Something all about security?
Proton rolled out the beta version of Key Transparency on their own private blockchain, meaning it's not run by a decentralized series of validators, as with Bitcoin or Ethereum. Yen said Proton might move the feature to a public blockchain after the current version serves as a proof of concept.
It's not rewriting history. We're talking about validation of public keys. The exact same information can be added to a public non-beta chain, to satisfy the concerns about security that would come from maintaining a previously private beta chain into production.
… which gives a timing attack and the ability for bad actors to impersonate someone. I agree with you that, once public, this is a good idea. You cannot convince me that this is a good idea if done privately because there is no way to trust but verify, especially in the highly sensitive contexts they want trust in.
If it’s not public, I won’t trust it. You trust it blindly because it’s in beta. We’re not going to come to an agreement over these mutually exclusive positions.
I don't "trust it blindly" because it's in beta - I understand that it's a work in progress because it's in beta. Jesus christ you people and your fucking tinfoil hats.
Your only response to valid criticism about the lack of verification is pointing to the state of development as if that magically washes away all of the criticism. It doesn’t.
While I do have many tinfoil hats, basic fucking trust measures do not require me to pull them out. This is cryptography 101 shit not anything complicated.
You don’t understand basic trust relationships. I don’t really care about your opinion. I already called out that your blind trust in beta software conflicts with my security fundamentals so we’re at an impasse. Once you understand why validation is important or can show why a critical component of trust architecture is somehow not necessary, I’d be happy to be happy to reconsider your opinion.
Keep living in your weird fantasy world where applications and solutions should pop into existence fully formed, feature-rich, and bug-free, with no development or testing whatsoever.
It doesn’t matter what the tech is, if you can’t audit it, you can’t trust it.
Also a single private blockchain owner is just a blackbox data store, not a blockchain. I’ve already explained how it’s vulnerable to very simple attacks, much less the complicated attacks that will be thrown at something like this.
This says it only detects chrome extensions, so I am not surprised it doesn’t detect your Firefox extensions. Why do you say that Firefox won’t leak extensions at all? Do you have a source for that?
The way it’s written doesn’t say whether it simply isn’t made to work for Firefox or whether it couldn’t be made to work for Firefox. Fortunately, the latter appears to be the case.
Detecting extensions using web accessible resources is not possible on Firefox as Firefox extension ID’s are unique for every browser instance. Therefore the URL of the extension resources cannot be known by third parties.
and also for Chrome:
in manifest v3 extensions will be able to enable ‘use_dynamic_url’ option, which will change the resource URL for each session (browser restart). This will render this detection method unusable.
Though it should be noted that this method isn’t the only way to detect extensions.
But there is no easy way to detect all extensions, instead most popular ones
It doesn’t really matter if its easy or hard, I’m sure Google already has automated processes in-place to detect all extensions published to the store and fingerprint browsers. They might even have the same for Firefox extensions, who knows.
The only time I use ddg is to find conspiracy sites to add to the blocklist I maintain. All the trash rises to the top in that search engine. It's rubbish.
Mostly to avoid conspiracies. The intended users are people who want to protect vulnerable family members.
Another purpose is to demonstrate that the big social networks could get rid of disinformation if they wanted to - "look what 1 person can achieve, in their spare time", kinda thing.
Its pretty nice. I am using it for a couple groups. It has some screen reader accessibility issues, but the devs are responsive and fix them as i find them.
Is that July 20th, 2019, or July 19th, 2020? Regardless, I’m under the impression that the VPN world (or really the tech world in general) evolves waaay too quickly to rely on information that’s either 3 or 4 years old. Also, as I’m typing this, I also think I saw info that That One Privacy was acquired by a company that sells multiple VPN services, a few of which are included in that sheet if I’m remembering correctly.
privacy
Active
This magazine is from a federated server and may be incomplete. Browse more on the original instance.