• 7 Posts
  • 37 Comments
Joined 3Y ago
cake
Cake day: Jan 03, 2022

help-circle
rss

Yeah pimeyes absolutely needs to be shut down and laws need to be in place to protect private citizens from having their information sharable and searchable without their explicit consent. “Publicly available information” is always the line people use to defend these services. I’m arguing that our modern capabilities needs to be adjusted for. Things shouldn’t be so publicly accessable in the first place and personal data aggregation should be a much more vetted and potentially licensed business. Can we talk about what other purpose these facial recognition databases serve other than to stalk, expose, or extort people? If they required proof of identity and only allowed searches of your own face then I could understand the value.



I think the only real path forward is for a developer to figure out a way to decentralize video hosting. The future of the free internet is decentralization. We’ve seen which way the wind blows when platforms are centralized.

Consumer storage is abundant and cheap as hell. There will need to be incentives for: 1. Creators 2. Node hosters 3. Moderators. Potentially AI could do the heavy lifting on number 3. Figuring out a way to avoid ad based revenue would be another hurdle. In an ideal world, creators would accept that only 10% of their viewers would contribute to them monetarily (through patreon or donations) and use the platform for its freedom from corpo bullshit.

But as much as the Foss and decentralized crowd has been growing, I think we’re still a long way out from average people becoming fed up enough to care. I still get eye rolls from everybody I know IRL when I try to get them to open an invidious link.


I’m in the same boat as you in that I need Instagram for work. My approach is to create a separate work profile in GrapheneOS. I handle all of my mobile work apps in that profile using a separate VPN from all other profiles. I don’t expect to be completely free from tracking in this profile, but for my threat model I don’t mind too much. Any web queries I make in this profile I keep strictly work related.

People arguing you just shouldn’t use Instagram need to remember Instagram is a tool just like Windows, Adobe, etc. Sometimes you need a specific tool to do your job and I believe as long as you containerize that aspect of your life then you’ll be fine.

Just don’t use your work Instagram for personal stuff, not even browsing memes.


I had a few episodes saved offline in my apple podcast app but it appears you are correct. Surely there’s an archive somewhere?


Legality of OSINT and Data Aggregators Hoarding Leaked Data?
I was listening to a Bazzell podcast where he mentions his company self hosting and maintaining a database of personal data and credentials for use in OSINT investigations. Some acquired through public sources but others acquired through leaks. Then of course there are data aggregate companies that do the same but are going on to sell this data for a profit. What is the legality of this? Obviously acquiring publicly available data is legal, but how are these companies able to hold on to leaked usernames, passwords, and other confidential personal information. Especially those that were initially acquired through illegal means?
fedilink

In most cases it’s just too annoying of a process to get on the list. But I understand why the invidious team prefers to vet instances rather then have something like a beacon system that auto populates all consenting instances.



I operate an invidious instance. Google has really cracked down the past two weeks on YouTube front ends. Its extremely frustrating.

Invidious devs are finalizing a workaround so hopefully things will be working again in the next week or two.


Damn. You’re correct. My brain saw instance and ignored the rest.


Looking in the NewPipe settings I found a place to enter instances and there is one already configured. I guess I was proxied the whole time without realizing. Thanks for the clarification btw.


Understanding YouTube Frontend Options
I'll start by stating my threat model is avoiding corporate tracking, profiling, and analytics. For anything beyond that scope I believe tor is ideal. Correct me if I'm wrong but my understanding is that Newpipe is a frontend to provide an alternative to the awful YouTube app and/or youtube account. However, your IP along with other device information may still be exposed to google servers. Any ideas as to what info beyond IP is sent to google? Whereas invidious instances act as a proxy in addition to what is offered by Newpipe, but you are trusting your privacy to the instance owner. My idea for utilizing these services is the following: Newpipe for managing subscription based YouTube viewing. Google would have my IP, but this IP would be a VPN IP address that periodically changes. Much more reliable than invidious and better quality. App is great. Invidious for random video searches as well as content I may want to be slightly more cautious about associating with. I'm looking for feedback on this conceptual setup. I've also been considering making a public invidious instance that I can use but hopefully obfuscates my viewing through its usage by others.
fedilink

I often wish all services could provide an opt out “I’m aware no 2fa is risky but I really don’t give a damn about this account so fuck off with the constant email verifications”. Or if companies insist on forcing 2fa, at least support hardware keys. Don’t even get me started about banks…


Good point. I’m aware of the icloud method of imessage cracking, but I often forget that I’m not always the weakest link; it’s up to the people around you as well.


I eventually managed to get the yubikey to work, although it is very buggy and the steps to get it working are unacceptable IMO for the “most secure phone OS”. Hardware keys should be a major priority and should simply work just as easily as using passwords, but it seems to be a stale open feature request for a few years. Luckily for me, once bitwarden is authenticated with 2fa I don’t need my hardware key unless I reinstall it. So that’s one major hurdle behind me. Another plus is that while you need sandboxed google services to utilize hardware key auth, they don’t need network permissions to work.


If iMessages are e2ee and you aren’t using iCloud, is there any evidence your messages aren’t private? As far as I’m aware iMessage is considered a very secure messaging channel. It seems like most people distrust it due to the Apple affiliation. Not that I blame them, I feel the same about Google.


Just for the sake of getting used to / transitioning to a single gos phone, does it make sense to use the insecure phone as a hotspot and utilize the pixel without a sim (so data only device). I would be using e2e encrypted apps for texts and calls so this makes sense in my head.


Appreciate the info.

It seems absurd to me that a third party online service is required for a hardware key to work in the first place. I figured it would be authenticating strictly between the locked service and the user.


Most helpful comment. Thank you. I’m heavily considering carrying two phones. My biggest hurdle is the Yubikey at this point because it locks me out of my password manager and most of my more important apps.

You mention using the usb-c connection. I tried that but it doesn’t seem to register. I guess I just need to research some more.

Thanks for giving me some hope!


When I initiate Yubikey auth via NFC in Bitwarden, it takes me to a Yubikey demo page. From what I’m reading online, for some reason I need to install google play for the key to work correctly.

Also seeing lots of chatter on the forums that a recent gos update broke most banking apps and they’re working on a fix.

Thank you for the info about the keyboard. I’ll check that one out.


I really like mostly everything about GrapheneOS on paper. The UI, user profiles, security features. It’s the inability to use it in a practical setting that’s frustrating me. Yet I see many people claiming they switched to GrapheneOS a month or a year ago and love it. So there’s got to be a solution. I can’t imagine those individuals installed gos and it was smooth sailing since day 1.


Help me to not revert back to iPhone after GrapheneOS Issues
I recently acquired a pixel phone and set up gos. Prior to trying gos I was using an iPhone hardened as much as possible based off of recommendations and guides from respected OSINT experts. It’s only been a week but I’ve found gos extremely frustrating and mostly useless except for web browsing. I can’t seem to get my Yubikey to work so my 2FA is borked. Works fine on my iPhone. I’ve previously managed to degoogle my life but now certain apps require me to use sandboxed google apps just to run. I’m facing the nearly insurmountable task of convincing my friends, family, and colleagues to download and use signal when they are all using encrypted iMessage. Most of my banking apps just simply do not work. Mobile banking is unfortunately something important that I need in my occupation. A part of the appeal of gos was being able to have an isolated dedicated profile for banking. There’s also a few features that I’m assuming are iPhone exclusive that it really sucks to have without. Double tapping the bottom of the screen to shift everything down so you can reach the top of the screen with your finger when using one hand. Holding down on the space bar to move the text cursor between characters. Maybe these exist on gos though? I understand most of the issues lay on the shoulders of the app developers. I’m grateful for the devs for creating and working on this project. I’m not bashing anyone here. I’m simply asking for some guidance on how I can break through the hurdles and make this work for me, from the mouth of those who were once in my position.
fedilink


[Question] YouTube frontend with algorithm?
I’ve been using invidious for a few years. I recently changed up my morning routine and have been eating breakfast watching YouTube via the TV app versus on my PC. It made me realize I kind of miss the recommended videos in some circumstances like when I just wanna veg out. Are there any current viable yt front ends that either maintain the algorithm or utilize their own to find you new content?
fedilink

Can data removal services be trusted?
What is the general consensus on trusting data removal services with the data you provide them? I’ve spent 5 years telling myself I’ll go through the long lists of data aggregators and one by one manually send removal requests. But it’s such a massive undertaking. I’d like to finally get it done through one of these services, but my gut tells me it feels wrong. Has anybody used them and how do you feel about it? Is DeleteMe a good choice?
fedilink

For my own understanding, what potential dangers are there using a Yubikey as opposed to an open source key?


I always wonder what legal risks hosting something like this comes with. If you host a public server and uploads are client side encrypted, seems like it would be a magnet for illegal file transfer and CSAM, no?


I haven’t. I doubt it would solve all of the problems I experience.

Anybody downvoting me can share their experience running protools with multiple hardware fader interfaces and 18 input DAW interface, pci SDI cards, and 6 separate display monitors.

Adobe software, Davinci Resolve, 3ds Max and its 20 plugins. None of these work or work seamlessly in Linux.

I can’t even get my surround sound to work properly in Ubuntu without having to manually adjust multiple convoluted conf files.

That’s the truth. I love Linux. I use Debian and Ubuntu on a bunch of servers I run. But fanboys need to stop deluding themselves into thinking it’s easy or even worthwhile to use Linux in lieu of Windows for anything and everything. I would be ecstatic if that changed.


I don’t think it’s the options that make Linux a hard pill to swallow. For me it’s the lack of support for hardware and most software. Sure there are alternatives or WINE but that’s usually a big downgrade from just running it on windows.

My Ubuntu box I use for browsing/watching videos and listening to music just barely works and was frustrating to get properly configured. Linux for the dozen professional softwares I use for work is basically impossible. As much as I hate it I had no choice but to stick with windows.

It’s not the fault of Linux developers. The hardware and software companies just largely do not support it still.


QEMU. Using NAT but it’s attached to the host’s NIC. I know this is probably what’s causing the issue. I’m not sure how to connect it to the VPN.


[Question] Securely Passing Host VPN to KVM?
I've attempted to create a VM on my ubuntu host machine that is accessing the internet via a dedicated VPN app. I'm able to disconnect my host VPN and access the web within the VM, but cannot access the web when the host VPN is enabled. Ideally I'd like to enable the VPN on the host and pass through web access to the VM. I have two questions: 1. If my use case is to use a VM to increase privacy and security as well as isolate my operations within the VM from my host, is it better to have the VPN app from inside the VM or pass the host's through to the VM? 2. If it doesn't make much of a difference, how can I go about passing the host's VPN to the VM? In either scenario, I'd still like to keep the host's VPN active while being able to use the VM, which I currently cannot.
fedilink

Is it the privacy community in general or Lemmy that’s gotten infiltrated by all of these antagonistic socially inept 15 year olds recently? Never started a thread on Lemmy that’s gotten so many unsupportive and useless responses before. And I’m active on piracy subs…


When you detect a compromised account you could put a freeze or lock on it. If there are that many compromised logins that constant account swapping is an issue then twitch needs to overhaul their account security.


Maybe I’m missing something but you can tell a compromised account from a secure account by the user behavior, no? If an account is compromised the activity will be spam/harassment, etc at which point a ban on that account would happen. And compromised accounts could be accessed from a non-vpn Ip also.




Think of it from the reverse direction. If you have a twitch account in good standing that’s verified with a valid email and has no violations, why all of the sudden would it make sense to apply a ban to this account? Perhaps preventing new accounts from being created on a sketchy IP could be a sensible solution, but shadowbanning an existing account makes no sense and is a lazy approach to security. In addition, fingerprinting makes it so a service can easily differentiate between users using the same IP.


I’m curious to hear the opinion of those downvoting this response. It seems off brand for privacy enthusiasts to disagree with my take on IP bans.


I’ve only experienced a shadowban while using ubuntu. I switch between all the major operating systems on the same twitch account and with the same vpn service/servers. The bans have only been initiated while on linux, although they did follow over to the other OSes until some type of timer was passed.

This follows what some online shopping services do, which is to assign weights to certain user metrics and if a set threshold is crossed it rejects your payment or otherwise blocks you from a transaction. So VPN+MacOS might work but VPN+Linux matches some type of metric fraud systems associate with criminals.


It’s trivial for twitch to differentiate between users who are logged in and have verified accounts. Slapping bans by IP is archaic and lazy when you have more precise metrics to go by. And at the very least, they should make you aware that you are banned before accepting your money for their services.


Your question is a good one. I’m not the one who downvoted you fyi. To answer your question, it is absolutely a personal anecdote based on my own experimentation. I’m sure others will add their own experiences. Based on my experiences there’s no doubt about twitch shadowbanning based on VPN use. I’ll admit I don’t have a basis for Linux and adblockers being a part of the equation, but I made it clear in my original post that those were assumptions.

To further speculate, I have an idea that the shadowban may actually be triggered by somebody using the same VPN server doing something that triggers it, affecting anybody else on that server. I can’t possibly provide evidence for that theory, but it would explain the seemingly random nature of the shadowbans.


PSA: Twitch Shadowbans Users on VPN + Linux
If you notice your chat messages show up in the chat feed but don't appear on the streamers in-screen chat, you have been shadowbanned. Twitch will still take your money for donations, subs, etc, but your feedback won't be seen by anybody but you. This shadowban does not appear in the appeals page and can be applied randomly and intermittently. You are never informed about this by the way. You'll likely be talking in a chat and assuming you're being ignored. Hop into a private tab and load up the stream where you'll be able to notice if your messages are missing in chat. From my observations, there seems to be some type of algorithm/system that determines who to shadowban. I'm assuming it assigns extra points for factors like VPN usage, Linux, and adblockers. Once you've been shadowbanned, switching one of those three will not work to unban you until some arbitrary timer expires. I'm posting this in case anybody else has experienced this and felt frustrated and isolated. You're not being ignored (unless you're a twat and are being ignored). You're just being punished by Twitch for being privacy conscious.
fedilink

Godspeed invidious team!

Fuck Google. Everything they touch turns to garbage and is a privacy nightmare. “Don’t be Evil”


Unless you automate this to run a search at random intervals, wouldn’t google see a blast of searches and just ignore it as noise? I imagine they employ AI already to filter out nonsensical activity or bot activity.

Really, just stop using google. I migrated from google many years ago. It’s been great. The frustrating part is when they buy up good products and run them into the ground (Nest, Fitbit). Seriously fuck google.