Tl;dr: TPMs are very unlikely to make your privacy better or worse, but they could definitely be abused by a company like MS to make end users’ experiences worse. They could also be used for significant security and privacy gains… they’re a tool.
The TPM can be used to provide a cryptographic binding between aspects of your system’s configuration and a unique key which is resident within the TPM (a process called “attestation”). It can also generate secondary keys that are associated with the base key, and use those to do cryptographic operations like encryption/decryption and authentication.
Telemetry wise, the TPM’s only utility might be to “prove” that the data sent from your PC wasn’t tampered with. That said, I don’t think MS is actually doing that, and they don’t need to in order to be incredibly invasive in their telemetry.
The (imo) worst way in which a TPM might be abused in a user-hostile sense is to detect if the OS has been modified by the user, or if an installation isn’t legitimate, etc. That could be used to disable certain features if you try to install unauthorised software, dual boot Linux or whatever. This would be similar to the smartphones of today, which can for example disable access to banking apps if jailbroken/rooted.
TPMs (>2.0 at least) otherwise have the potential to realise a significant improvement in security and privacy for users, if used correctly. They can be used for encryption and credentials that are bound in hardware and therefore practically impossible to steal. And can detect hardware tampering and potentially foil Evil Maid attacks. Imagine if your login sessions for various websites were bound to your hardware, such that a dodgy extension could never steal your cookies.
This announcement doesn’t have anything to do with cryptocurrencies or nfts. I’m not sure if I like the idea yet either, but please don’t conflate it with all that other scammy nonsense.
While it is funny (honestly replacing any tech term with circlejerk in a tech article makes it sound so funny to me, I have the mind of a child), it’s not very relevent here.
How does DivestOS compare to Graphene in your opinion?
Divest is based on Lineage, which isn’t as secure as Graphene (by a significant margin), but my understanding is Divest has done some things to improve sscurity/privacy.
I realize since we’re talking a Pixel here, Graphene is the security/privacy answer. I have other phones in my “support circle” that can use Lineage or Divest, and I’d like to advise people appropriately.
What, social lives? Get outta here with that nonsense and be a hobbit like the rest of us :)
Seriously though, if you’re thinking on a phone I’d reccomend just creating a second profile instead of getting a whole new device. The apps won’t be running when the profile is running, and as a bonus you can usually restrict the profile’s permissions. Also consider checking out web wrappers (e.g. frost) or PWAs.
On a desktop you can always just use the web version, bonus points if you auto clear cookies or have a separate profile.
Edit: if you already have a spare then that might work better than profiles.
I think that a spare device with disabled GPS and maybe even disabled microphone (can i do that?) would work best. Some of the features on Instagram can’t be accessed on a browser
This is basically like Domain Keys-Identified Mail (DKIM) but for a specific email address, without needing to own a domain to set it up. I’m gonna call it “P(ersonal)KIM” for short.
If this is implemented correctly it’ll be a few clicks to set up and then just work in the background to make it harder to impersonate you via email, even if you have a free email address.
i guess it’s related to the following; exercising your rights under gdpr requires the other party to be able to identify you. that’s why they need this information. if you want to (potentially) fuck with them: first ask for a listing of all the information they have about you, before asking for deleting your data. this listing must contain the request itself. if your request is missing, they are likely breaking compliance rules.
first ask for a listing of all the information they have about you, before asking for deleting your data. this listing must contain the request itself. if your request is missing, they are likely breaking compliance rules.
I'm not quite understanding, do you mind breaking that down for me?
one of your rights under gdpr is that you are entitled (free of charge) to a listing of all the data the other party has about you.
when you ask them about this listing this request itself becomes data the party has about you. it should therefore he included in the listing. (it is self referential, but that’s how it is).
if the information that you requested such a listing is missing from the data they provide in response to you request, they are in breach of gdpr rules. from them on you might want to file a complaint.
( I’ve no idea whether this would result in any meaningful compensation, if at all. but at least it should keep them busy.)
The reason that we ask for ID is to safeguard your personal data by verifying that the request is genuine before proceeding with deleting your personal data. This process is consistent with guidance published by the Information Commissioner’s Office. (https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/)
The purpose of this process is to prevent someone unauthorised from requesting deletion of your data, for example where there are shared email addresses, or someone has access to your account or email address, or where someone is spoofing your email address. Please see our Privacy Policy (xxxxxx) for more information about personal data we collect store and process.
Please be assured that when you send ID to our dedicated ID email address, this is automatically and permanently deleted from our systems within 7 days. We do not continue to store or process your ID beyond this time or use it for any other purpose other than to verify your identity to action your erasure request.
If you would prefer not to send ID via email, you can post copies to our address and upon receipt from our team we will then securely dispose of the copies. Please send these to:
Data Protection Team,
xxxx
xxx
xx
I hope the above explains our rationale and allays any concerns you may have. If you have any further questions please do not hesitate to ask.
With the Fairphone you get more than just a replaceable battery. You get replaceable nearly everything. Also they do their best to ethically source the materials. In terms of ROMs there is also Iodé, also based on LOS, and if you go with a FP4 instead Ubuntu Touch.
privacy
Oldest
This magazine is from a federated server and may be incomplete. Browse more on the original instance.