• 13 Posts
  • 233 Comments
Joined 1Y ago
cake
Cake day: Jun 17, 2023

help-circle
rss

Prism has broken AES-256???

It is more likely that Prism can use android exploits to read data before it is encrypted by the client


Fairly sure my good Eastern Europeans don’t give a fuck about what France and Germany think and will pirate and TOR and I2P their merry life away (or so I’d like to think - you tell me)


Yeah let’s have them block github. I kind of want to see a federated git hosting platform integrated with the fediverse


I’m wondering, what are EU politicians doing dirty jobs using?


Well I get that they are stupid, but unless it’s their fetish to catch 14 year olds trying to spread rubbish propaganda, I doubt they’re going to get much. Any reporter, activist and consumer knows that anything they put on these apps goes straight to the NSA’s and MI6’s AI algorithms at the very least, and now they’re going to go to the rest of Europe.

Yes, we should be protesting against this. Does Europe have an equivalents of the EFF to fight for such rights?


My point being, what are they going to achieve with this? Ask WhatsApp to pass over their encryption keys?

It should be pretty obvious that you shouldn’t be sharing sensitive stuff on chat apps controlled by the NSA. Use element with encryption or something, maybe Briar etc. What are they going to do if you insist on using apps which use asymmetric client-side encryption, break TOR? Force you to use symmetric encryption and give the government your decryption keys?

I don’t see how they are going to spy on sensitive details of Europeans with this. They might as well ban phones completely if they want to limit communication.



Check out the dolpin-trained LLMs, he did one for Mistral and one for Phi-2. Uncensored and OSS



The short answer is to have a VPS, make that a VPN server, and then use NAT to route traffic through to the interfaces you need


Use headscale, I have no idea how people are OK with tailscale when they keep your keys and essentially have access to your network


They do not protect one’s privacy if someone is motivated enough, i.e. nation states, or if OP’s VPN company sells their information. You can be reasonably assured that Mullvad and IVPN aren’t exactly doing that. In terms of obfuscating one’s IP, if that’s a step towards one’s privacy from big tech, then yes good VPNs definitely protect one’s privacy


A VPN and the other stuff you mentioned will deal with it



Except that forums are exactly the best place to talk about (at least in theory) better OPSEC practices. Crowd-sourced knowledge is fairly good in technical spheres, even if they try to influence it


The problem with a threat model is that higher threat models are plainly dismissed by the community. For example, if your threat model is to escape the NSA, it doesn’t matter if you’re using a burner over TAILS to post this message, you will be dismissed.

The problem is not the tech, it’s the community that doesn’t want to engage


I have thought of it, but it doesn’t seem as portable to me as just rclone. I don’t like installing Cryptomator either.


Is there no way to encrypt the metadata of files using GPG? And how do people pad their files to prevent fingerprinting? Surely I’m not the first person to be asking about this? I haven’t had much luck searching online



I see. I’m using Cryptomator, but I was recently linked to rclone’s in-built encryption, which is probably what I’ll use next. Thanks



I’m using rclone, do you recommend I run borg on top of it to encrypt said files? And does borg explicitly do what I’m trying to achieve? I’m going to take a look at the documentation, thanks


I also have media and other binary blobs which I’d like to archive in an encrypted fashion, will GPG suffice? ChatGPT mentioned OpenSSL for this but I’m not sure where that’s taking me.


Can you point to where such a capability is mentioned in the documentation? I’m using rclone right now


How to randomly pad files before encryption to prevent file fingerprinting?
Hi, I was planning to encrypt my files with GPG for safety before uploading them to the cloud. However, from what I understand GPG doesn't pad files/do much to prevent file fingerprinting. I was looking around for a way to reliably pad files and encrypt metadata for them but couldn't find anything. Haven't found any recommendations on the privacyguides website either. Any help would be appreciated! Thanks
fedilink

And how exactly do they think they’re going to break PGP and TOR without running an NSA-style racket?


UBlock origin advanced mode blocking most JS + NoScript blocking functions of certain JS functions. Easy





Donate to people/communities who run I2P/TOR/Freenet infrastructure?
I'd like to be able to contribute financially to people/communities who run infrastructure, such as nodes, for layers like I2P and Freenet. Where do I find them, and does contributing directly to the projects themselves help in this regard? Thanks!
fedilink



It’s more like I’d like to not link those purchases to my identity


I didn’t know that. Thanks for bringing up this point.

TBH my threat model was to keep the bigger companies from knowing where I live. I.e. if I shop from Amazon and I enter their site at home, they can make an estimate based on my profile, my browser and my IP, amongst other things. Then, it wouldn’t matter if I ordered to an Amazon locker since they know where I live anyway.

Assuming I maintained a sanitized account and only accessed it from various locations using public WiFi, what could I do to prevent Amazon from knowing the locality I’m in, especially if it’s too big to get to a locker? Likely a P.O box but even government agencies are known to sell data to brokers. AFAIK there’s no way to pay anonymously for UPS or something, which means my identity is being tracked again.




I don’t think you can book hotel rooms without identification anymore, in the US


That’s the first time I’ve heard of it! Could you give me an example?



Thanks. Do you use mail redirection and locker services?



What do you do for stuff that can’t be shipped to the lockers?


How do you take deliveries anonymously?
I realise that this question is subject to local trends (and I'm in the US), but I encourage people in other countries to submit their methods! How do you accept packages/deliveries anonymously? Of course, there are mail redirection services, but a third party which corroborates with different parts of the chain can likely figure out your identity and what you have purchased/have incoming. I haven't been able to find a good solution to this yet, and I believe the new rule in the US is that the receivers identity must be reported to the government? This (or a variation of this, I don't remember) is a recent event. Thanks!
fedilink

How do online marketplaces like Amazon and Ebay track electronics sales?
Say I purchase a laptop from Amazon/Walmart/any big box store. I assume they note down the unique identifier for the device and link it to the purchase, which has my credit card information. How would Ebay do this? I'm curious about the extent of information that the marketplace giants have of consumers purchasing electronics from them. Cheap Chinese gizmos might not have unique identifiers but a Dell Laptop certainly has a few. I'm sure some here can imagine the technical reason for the question. Have a good day ahead!
fedilink

What is the community’s opinion on Session and Session Automated Software?
As most people here might know, Session utilises a TOR-like onion routing system with some changes to route traffic. The username is the public key whilst the password is the private key. Recently, a new project built on top of this seems to be in the works: https://simplifiedprivacy.com/freespeech/ I'd like to know the community's opinion of session and how much would you trust its technology. Thanks!
fedilink

The recent problem of maintaining privacy on the Internet (includes Networking)
If any of you have been browsing r/privacy lately you would have come across the British student who had the Air-force literally swarm the flight he was on. This is because he made some joke about a bomb sitting in an airport. Current speculation suggests that Snapchat has a word-filter and could locate the IP as that of an airport, and notified authorities immediately. Another, somewhat less plausible reason posited is that the government holds the private keys for TLS-encrypted traffic for Snapchat and could decrypt and read the message and that's how they knew. ~~For the paranoid people here: the latter claim, even if it is not true, poses great concern to us. If im may be permitted to run with it; It essentially means that using a public CA isn't exactly safe anymore. For all of you homelabbers using Let's Encrypt - think again.~~ Don't listen to me, I don't understand certificates well. Talking on a tangent: let us consider the position of TOR. It has been said that TOR devs accommodate the government and the government has backdoors built in TOR. And even if they didn't, the technique of owning a majority of instances running TOR nodes will allow them to identify and associate traffic. TOR is not safe if you want to really keep your content private. On a similar vein, I am a bit skeptical of the privacy advantages of using session, but I have yet to read their whitepaper. I haven't read much about i2p, but I wouldn't be surprised if the government has their paws in there too. What are you doing to browse and communicate privately today?
fedilink

My idea of maintaining E2EE between people in the age of the UK’s and EU’s anti-privacy laws
Before I say anything else, I should mention that this is nothing ground-breaking, neither is it terribly difficult to implement. This is simply how I envision a simple solution. Basically, the EU and the UK want the secret keys to your encrypted media/messages. Which essentially breaks encryption completely, ending E2EE usage. The alternative is, then, for the user to utilise their own form of E2EE. How though? The answer, in my opinion, is personal exchange of keys utilising asymmetrical encryption. Exchanging public keys in plaintext is fine as long as they don't have your private key. Which means unencrypted services like SMS could also be secured using this method (for example, have the public key of a user in their profile). I believe QKSMS employed encryption for SMSes for as long as it lasted, but no idea about the kind of encryption). Technically, if everyone started to use p2p messengers with asymmetrical encryption, the EU would have very little they could do without compromising every mobile in the region and preventing people from downloading APKs somehow (sorry iOS users but you're never going to have privacy anyway). However, this is only possible with a FOSS project, because a company would have to fork over the keys anyway to stay alive. A FOSS project can simply be forked once the OG maintainer stops working on it due to government pressure. That is where the problem comes, since FOSS projects can't really run their own servers to store media, making p2p the only viable option. But with some people behind CG-NAT, that becomes harder for non-technical users. I don't have a way to solve this other than the general population becoming tech-savvy enough to give a damn. Tl:dr; FOSS projects are best suited for implementing personal E2EE between users, but that makes p2p the only viable option without a back-end, which makes it difficult for people behind CG-NAT. Cheers
fedilink

How do I learn more about using RF to improve my privacy?
Hi, I have been having a look at utilising RF and trying to understand how every device around me emits RF. I recently came across RTL-SDR and HackRF, alongside software like SDR++, TempestSDR, `gqrx` etc. I know that I can spy on my monitor and record keyboard keys being pressed using RF, but what are some other ways I should be looking at to exploit my digital vulnerabilities, and trying to solve such problems? Thanks! --- Edit: I'm well aware that nothing I'm doing is that interesting to security agencies across the globe. With that said, I'm interested in maintaining my privacy, and this happens to be an avenue I find interesting. Any suggestions on how I can look to do so would be greatly appreciated!
fedilink

Is there a newer model of desktop/laptop/motherboard which supports Coreboot?
As far as I can see, the T440p is the latest Thinkpad to support Coreboot/skulls. If I wanted something newer (say, something from 2019-2022 or so) under $400, what could I even get? I want to run my own choice of linux distribution on it, so most chromebooks are out of the question (also I'd like something more powerful and upgradeable). Thanks.
fedilink

Can we prevent cars from sending data to servers if we remove their antennae?
I don't know anything about cars. Now that we have established that cars seriously undermine our privacy (look at the flurry of posts in this community in the last few hours), what can we do about it? From a networking POV, if you remove the ability to connect to the Internet, it doesn't matter what the car is recording as long as you can ensure there is no physical tampering. Depending on who you are, this is a good idea, and doable for the most part (very few people have the technical knowledge to pull out the right chip from a car). So, how do we achieve this? I implore the community to invite mechanical/car engineers who can help us on this matter, and to form methods to prevent vehicles from accessing the Internet without express consent from the user. Thanks!
fedilink

I just want to say that I’m so happy that people are taking notice of privacy concerns in cars
Mozilla released their studies, and I'm seeing a growing number of posts on the Internet about cars and the privacy nightmare they entail. I remember how this issue wasn't talked about earlier because "just buy an older car" was still prevalent. I'm so happy that people are taking notice. Thank you to this community and Mozilla for the work they are putting in!
fedilink

Which car to purchase to escape surveillance?
Just came across a post on Reddit asking about cars, thought I'd ask here too. The article the reddit post cited was: https://www.thankyourobot.com/2023/07/on-road-to-privacy-invasion-unmasking.html In short, if I'm in the market to purchase a new car, which one should I go for to improve privacy? And if we assume that such a thing is not possible anymore, what can we do for our (newer) cars to be more private? I was considering things like removing the radio antenna (if I can, that depends on the model of the car). I'm also interested in knowing just how would car companies mine information from a car if I haven't connected my mobile to it? Do cars have SIMs inside them that have free 4G/5G access and can send information that way? How would I check if my car is doing something like this? Thanks!
fedilink