privacy

This magazine is from a federated server and may be incomplete. Browse more on the original instance.

riccardo, in New Advertisement and Internet connection permissions for Simple SMS Messenger on Google Play Store...

So it begins

folak, in The Boost android client for Lemmy is displaying these dark pattern ads pretending to be system notifications. What security/privacy conscious Lemmy clients do you recommend?

Eternity.

13617,

PREACH, after using infinity for reddit for years this is the only app that I can ever be comfortable with. It’s genuinely amazing, thank you to the person who ported it.

Gooey0210,

This is the right answer

nezrock, in The Boost android client for Lemmy is displaying these dark pattern ads pretending to be system notifications. What security/privacy conscious Lemmy clients do you recommend?

I use Connect for lemmy, it’s really great and ad-free.

HypnoticSheep,

I’ve tried all the other popular apps, and keep coming back to Connect.
The main features that pull me back are profile-specific settings so I can set up different accounts without having to reconfigure everything every time I switch instances, and the ability to customize post card quick actions, specifically the Mark As Read quick button combined with the persistent Hide All Read toggle. It’s just so convenient, I keep coming back even though it deletes my account info every time it logs me out.

itsnicodegallo,

Connect rarely makes it on these lists, but I think it’s fantastic.

Vent, in roku remote app showing ads now

That’s crappy, but have you seen what other remote apps are doing?

Vizio has an ad that takes up around 25% of the screen!

MyQ has a large scrolling ad at the top, and they are actively hostile towards any integration that allows you to control your garage door without using their app (unless you use one of the very few subscription-based integrations they offer, of course).

vizio app with a huge ad

myQ app with a scrolling ad

aldalire,

hot damn 😵‍💫

TragicNotCute,
@TragicNotCute@lemmy.world avatar

And at least when I tried to pihole the tracking bullshit, it got mad and stopped working.

andrew,
@andrew@lemmy.stuart.fun avatar

Rage against the garage door opener.

paulwieland.github.io/ratgdo/

golden_zealot, in [Discussion] How do you feel about age verification on Porn sites?
@golden_zealot@lemmy.ml avatar

It won’t work. Ever. VPN’s free and paid exist, File sharing exists, Torrents exist, AI pornography generators exist, freenet, tor, I2P all exist. There is no action a government could take that would have any true impact in this regard unless they made the use of the internet illegal, and even at that, it would create a black market in which such things could still be purchased as physical media.

All this does is allow government entities to infringe on privacy rights further by doing what they have always done - hiding behind children.

3TH4Li4, in Google will no longer hold onto people's location data in Google Maps — meaning it can't turn that info over to the police

When big tech says they no longer need something, it means they have something even better. When they say they give you options, they mean dark patterns. Anytime you click ‘Decline’ it might as well be ‘Accept all’. Rapist mentality of big corpos.

inlandempire, (edited ) in Do I need to be a resident of the EU to get their data protection or can I just be a citizen?
@inlandempire@jlai.lu avatar

Not sure if it helps but :

GDPR Article 3 - Territorial scope

  1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
  1. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

  1. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

From what I understand, it doesn’t really matter where or who you are, it’s about whoever collects your data doing business in the EU. BUT ALSO if you are an EU citizen, it also applies to non EU companies (someone correct me if I’m wrong)

ddnomad, (edited ) in A question about secure chats
@ddnomad@infosec.pub avatar

Switch to Telegram

You know it’s not even E2EE by default, and when it is it uses a homegrown algo that is not exactly well spoken of? (at least V1)

DudeDudenson,

But how can I virtue signal when using the mainstream app???

PupBiru,
@PupBiru@kbin.social avatar

for clarity, i think that the worst thing anyone’s been able to decisively prove about telegrams encryption is that it’s vulnerable to replay attacks… which in the context of privacy rather than full security isn’t suuuuper problematic

that’s not to say that there aren’t other flaws; that’s kinda the point behind “rule number 1: DONT INVENT YOUR OWN CRYPTO”: you just don’t know what flaws there are… AES (etc) has had a LOT of eyes on it

but for the most part, the negativity with the crypto boils down to what-ifs

nightwatch_admin,

IIRC Telegram is only e2e if you explicitly enable it, and not at all for group chats. My info is probably (and hopefully) outdated though.

PupBiru,
@PupBiru@kbin.social avatar

yeah that’s also correct and a very valid criticism

ddnomad,
@ddnomad@infosec.pub avatar

And E2EE is only available on phones, circa a couple of years ago anyways

JubilantJaguar,

As I see it, the key advantage of Telegram is not technical, it is political.

Yes, Telegram is a slightly shady company with an ambiguous business model and a possibly-dodgy encryption algorithm (when it is even turned on).

But Telegram is based outside the reach of the West (in UAE, eastern Europe, maybe even Russia). Whatever its other problems, nobody thinks that Telegram is under the thumb of Western governments, as the Big Tech corporate messengers almost certainly are.

Personally I don’t care much if Russia or even China is spying on me. Because if we can be certain of anything in this world, it’s that Russia and China are not sharing their spyware data with Western intelligence agencies. And as Westerners we live outside the reach of the Russian and Chinese police states, fortunately. So for us it’s win-win for privacy. That’s the way I see it.

The ideal solution, of course, is a truly private messenger which protects everyone’s privacy, including Chinese and Russians.

ddnomad,
@ddnomad@infosec.pub avatar

Telegram’s servers are located in US, Singapore, Netherlands (and maybe some other countries) from what I’ve gathered. And all chats that are not E2EE’ed are stored there, encrypted at rest at best with keys in the same database, or somewhere else that can still be accessed in automated way. Maybe it is not even encrypted at rest.

The point is, all those countries are either in 5 eyes or have information sharing agreements with 5 eyes countries. So as far as I’m concerned, TLAs can still have their fingers in those pies, in addition to Telegram’s overall shadiness and Russian ties. So maybe you get KGB strongman keeping a watch over your chats too.

This is not something I’d have much confidence in to be honest.

JubilantJaguar,

For the average Westerner, the threat from shady Russian agents seems orders of magnitude less serious than that from their own governments and police forces.

For EE2E, the corporate spyware messengers are asking us to take their word for it. Hard.

About the server locations, that’s interesting and does indeed undermine my argument a bit.

const_void, in Brave to end 'Strict' fingerprinting protection as it breaks websites

Brave is shite

kureta, in How bad is Idea of .Zip as password manager?

If you do this, you’ll start writing small scripts to help you with repeating tasks, to simplify somethings, then you’ll start looking for help trying to improve those scripts, then you’ll find better written and tested ones and start replacing yours with those, one by one. Then you’ll probably find pass or other terminal password manager. It can be a fun learning experience but sooner or later you’ll end up using a password manager.

Tangent5280,

Ah, the programmers pilgrimage. The first hill that they must climb is the one where they spend 12 days automating something that would have taken 10 seconds every time + half hour setup time.

Gooey0210,

Pass is pretty cool, used it for many years

Now switched to vaultwarden so it’s more user friendly for my girlfriend

FutileRecipe, in Haier hits Home Assistant plugin dev with takedown notice

Specifically, the plug-ins are using our services in an unauthorized manner, which is causing significant economic harm to our Company.

How does this cause them “significant economic harm?” My immediate thought is they are losing out on data or ads, hence it being a privacy concern.

navi,

It could be poorly optimized or non-ideally programmatically poking their service.

But instead of working with devs or releasing a real API they did this shit.

Redredme, in PSA: Anyone can tell if you are using WhatsApp on your computer

In other news, water is wet. I only see FUD here.

photonic_sorcerer, in The Irish government wants to pass a law that could see you or your loved ones jailed for possession of memes, cartoons or any content that could be deemed "hateful".
@photonic_sorcerer@lemmy.dbzer0.com avatar

It’s fucking hilarious how x.com still redirects to twitter.com

Balthazar, (edited )
@Balthazar@sopuli.xyz avatar

Oh, shit. x.com = twitter, it’s not Xcom (the game series) xD | That took me waaay to long to realise lol

andyburke,
@andyburke@fedia.io avatar

honestly the lamest and funniest bit.

Perfectly ties the whole thing up in a bow: can't even technically manage a domain name change.

BeardedGingerWonder,

Willing to bet some motherfucker has hardcoded twitter domain on the backend in one (or many) link generation process(es) on the basis “it’s not like they’re going to change the name” and now it borks occasionally if they use x.com

andyburke,
@andyburke@fedia.io avatar

grep

andyburke,
@andyburke@fedia.io avatar

of course, switching it back might not be so easy... 😂

BeardedGingerWonder,

Oh god. You’ve probably hit the nail on the head both directions all the same, how many methods/classes/variables are going to have twitter in the name somewhere. Or random bash scripts that pass an arg to something else from a job scheduler. This shit gives me the heebeejeebees just thinking about it.

Murdoc,

For some reason I’m now thinking about a video game called x.com where you have to fight aliens who have infiltrated and taken over a major social media site and are trying to TAKE OVER THE WORLD Wide Web.
(Actually, that kinda sounds like a sequal to x-bill.)

daftwerder, in The Boost android client for Lemmy is displaying these dark pattern ads pretending to be system notifications. What security/privacy conscious Lemmy clients do you recommend?

Eternity is great! free, no ads, and no lag while scrolling. it also supports swipe to go back from posts.

Rez,
@Rez@sh.itjust.works avatar

I’m so used to navigating in Eternity at this point that all other apps seem clunky and unintuitive

Oha,

same

amanneedsamaid, in Here's what telegram's founder say about Whatsapp's privacy

“Here’s what someone who has never created a private messenger thinks about Whatsapp’s privacy.”

Why would anyone care about what he has to say? 💀

detalferous,

I’m confused regarding why you don’t consider telegram a private messenger.

Dra,

Telegram isn’t, so you must be very confused indeed

amanneedsamaid,

Never has been, no default e2ee, and those exploits that leaked a ton of users locations.

Not to mention, no messenger is verifiably private unless it is fully open source.

datendefekt,
@datendefekt@lemmy.ml avatar

It’s been a while since I looked into it, and things might have changed since then, but some stuff off the top of my head:

  • Messages are stored on the server, not on the device
  • end-to-end encryption not enabled by default
  • uses proprietary encryption, making security audits difficult

Apart from that it’s somewhat politically questionable, based in Dubai (I think), with dubious financial backing and Russian developers. Because it’s closed source and the encryption is proprietary, there’s no way of knowing how much info it leaks.

clot27, (edited )
@clot27@lemm.ee avatar

Messages are stored on the server, not on the device

Yes, pretty much necessary to provide multidevice support

end-to-end encryption not enabled by default

True that and telegram sucks big here, but I donth think e2ee can be enabled in a feasible way for multiple devices.

uses proprietary encryption, making security audits difficult

The MTProto isnt open source but its fully documented, there have been security audits on it.

dubious financial backing

No. Pavel Durov have always said since starting he paid for telegram’s servers from his pocket, in recent years telegram has started monetisation programs to cover its costs.

Russian developers

The founders were born in Russia, but they now have dual citizenship of UAE and France. If you are talking about politically questionable, even signal have been accused of having backdoors for CIA.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Owned by Facebook, which is a giant US company.

Of fucking course it has backdoors.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • privacy@lemmy.ml
  • localhost
  • All magazines
  • Loading…
    Loading the web debug toolbar…
    Attempt #