• 0 Posts
  • 26 Comments
Joined 1Y ago
cake
Cake day: Jul 09, 2023

help-circle
rss

But in the end, yes, it is a MITM. If you need your data to be E2E encrypted, don’t use it.

Or do use E2E encryption. You can still have a layer of encryption within the SSL tunnel that cloudflare controls. Like you’d do for an E2EE filestore: the webserver (and cloudflare) see the website woosh by, and all that you do on it, but the files themselves are encrypted opaquely to both, and decrypted only by a browser at the other end.


If it were visual ads with no audio, I actually think this is a good idea. When you pause you’re ready for an interruption of sorts: it jars the brain less.

I’d still want to be able to maximise the video still frame to see details sometimes. Just yesterday I watched a 3blue1brown with a brief freeze-frame of extra detail to read if you wanted (and I did!)


I use temporary container tabs in Firefox. (Desktop, dunno if that works on mobile)

Every new tab I open opens in its own temporary container unless I’ve chosen otherwise (like for sites I want to remember logins )

So, even if I accept all the cookies, they all disappear with the temporary container after browsing, and don’t connect to any other container - only tabs started (e.g. by clicking links) in the same container.


And, let’s be fair, for most people the real loss from this level of compromised privacy/security is far less than the real gain from helping your relationship.

Sometimes I look at products I use from dubious companies, take a step back, and think, this company is actually a blessing in my life even if there is a smaller curse attached. That said, I’m grateful for all the tremendous effort put in by many people to make the digital (and rest of) world a safer, more private, fairer and more honest place. And I try to do at least a little of my share!


This is the way. Depending on how much convenience you are willing to sacrifice.

There are one or two apps on F-Droid for using the work partition, and you can force-freeze apps within that, so you can turn wechat actually off when you don’t want it. That also separates wechat from your phone contacts list, without denying it nominal contacts access permission (without which, iirc, it refuses to work).

For extra paranoia, run your dedicated wechat phone permanently through a VPN with location services on the phone turned off. Answer it only in a soundproofed room, Faraday caged with no WiFi connections except the dedicated wechat WiFi. Speak with a funny voice, and if you must show your face, wear a balaclava.

But that might be overdoing it a little.


So, that looks like this is less insane than it sounded… This is for if you buy your phone on a payment plan? Not for creditors more generally to have a option to repossess/dispossess your phone?


And it hides file names and sizes by splitting things up, which puts one extra layer of difficulty for someone trying to find my passwords file to target. I have a much stronger password on the syncthing directory than my normal type-each-time password to open keepassxc.


Syncthing for me, but Nextcloud has its advantages too.


And I do keepassdx on Android, with a (phone-specific) database synced with syncthing


P.S. syncthing is fantastic: I hope more people consider hosting discovery servers and especially relays


I remember something like this on the Underhanded C Contest.

(It was for blacking out parts of an image.)


Essential in the sense of privacy being central to our nature

Yeah, I’m on board with that. Really what I was thinking about was imagining a world where internet presence is not a place where there’s privacy - like if you meet a friend in public, and talk on a park bench, you can’t assume no one will see you. You know that, and accept that, and adapt accordingly.

I want a world where internet communications are private and their metadata are also private, and my internet use is private… But I’m contemplating the what ifs of a different world, and how best to live in it, and how to help my children and children’s children live in it. I do think fighting for better laws and protections is part of that and I’m incredibly grateful for people like the eff; but I think it’s also worth thinking about how we can find ways to live in a new environment, understanding that society’s rules around us don’t always work in the best ways.

(On that note: you’re quoting the US Constitution a matter of EU ruling…)

I’m not sure why you would think that I believe tick-tockers should not have privacy protection.

Just your quote, that says such people who give up some liberty don’t deserve any. I suppose you didn’t mean it that way but it seemed harsh.


But what liberty is essential? Proveably secret postcards to people on the other side of the world?

That’s also quite a harsh quote to bring in the context of the many hidden erosions of privacy - would you say the tick-tockers don’t deserve privacy or safety because they chose that social ability over a privacy they little understand?


Kind of, but written communication for everyone hasn’t even always been a thing. And cryptic letters perhaps aren’t reliable secrecy for ordinary people against trained spying. And anonymity… not without other layers to your communication. And all of that not for your ordinary postcard home: it’s something you do in special situations.

I don’t think the new law would outlaw encrypting messages to your friend with PGP; nor having a second phone that you leave at the library for anonymity.


Yes, though doesn’t client side scanning do that anyway? Or must the client side scan be completely secret and also only communicate to law enforcement/whatever secretly?


I sometimes wonder about this. I hugely value my private communication, and I grew up in a world with that ideal. But with the rise of more cleverly invasive apps and tracking, and ease of someone else putting a video of you online, and so on, I sometimes think about a world where non face-to-face communication isn’t private any more.

I don’t know what I think of that world.

After all, we haven’t always had private, at-a-distance communication, especially for all people


I wonder if projects like Signal could make a community run and certified hash database that could be included in Signal et al without threat of governments and self-interested actors putting malicious entries in. It definitely doesn’t solve every problem with the client side scanning, but it does solve some.

But… an open, verifiable database of CSAM hashes has its own serious problems :-S Maybe an open, audited AI tool that in turn makes the database? Perhaps there’s some clever trick to make it verifiable that all the hashes are for CSAM without requiring extra people to audit the CSAM itself.


Thing is, there are a load of people who don’t have the know how, time and/or care to use an alternative. That goes for scum bags sharing child porn, terrorists teaching how to make an easy pipe bomb, journalists reporting on local corruption, people sending flirty sexts to their spouses, activists trying to get a movement going, anti-vax groups, people trying to source dubiously legal and/or ethical drugs/medicines… and so on.

Banning it in mainstream apps and legal stores makes it harder - and harder to know if you can trust an app (is this niche one I found through pirates-r-us forum really trustworthy) - and easier to spot and target those who use illegal/minority options.

So I think you would catch and block a load of CSAM, even though obviously not all.


As well as small/large, I think there’s a difference between legal/effective/practical censorship.

With legal censorship but not practical, I can tell my friends things, maybe pay anonymously, but at risk of legal prosecution and worrying about my ethics as a law-abiding citizen.

Media bias (for example) gives effective censorship for many, but if I care enough I can even start my own media and promote it as best as I can - and some people can be reached.

To some extent I think the three can balance each other out: for instance I wouldn’t want anti-vaccination rhetoric to be the main thing people hear, but I do want freedom and opportunity for people to question scientific and medical consensus.

Personally I think social media is a fantastic tool and also a problem - but not a good place for a solution: so I tend not to worry about social media ‘censorship’. Maybe I’m just out of touch!




No they won’t. The bill is against social media companies, not your own encryption measures. Where the line exactly falls between hand-coding your own cypher; using good old PGP; using an app to encrypt but sending via a separate service; using an e2ee messaging app+service; being on a community/group-focused e2ee service; normal unencrypted-on-server social media… Going by the Reuters article (I haven’t read the actual bill) it seems mostly aimed at main social media platforms, with a to-be-explored relationship with private messages.


where technically feasible

It gives something that can be argued about later, right? After other parts of the bill have begun to be implemented. So, further down the road if gvmt considers e.g. WhatsApp or Signal as having CSAM and not taking appropriate steps, then they can put pressure and WA/Signal can argue back about feasibility and merit.


By the looks of it e2ee isn’t actually banned, and if e.g. Signal says “we can’t technically scan people’s messages” then they’re given a pass… maybe. The Reuters article reads like the UK gvmt are going to be going after more Facebook-like media first, rather than encrypted private messages.


Re: the notifications not coming, I’ve seen it similar from WhatsApp too. I reckon it depends much on which app you use more, so it gives enough battery time to keep aware of messages. Now I use Signal more, I think I’ve had more misses on WhatsApp.

That said, I’ve had a few weirder misses (for calls only, I think) that don’t seem to be from battery optimisation.


YMMV? I use Signal for a couple of group chats, people who have finally decided the extra security is worth everyone moving across from WhatsApp/Messenger for. Had no problems.

Then again, I’m not a big online-messaging-person generally so maybe there’s a lot of issues I don’t get round to seeing.


Its better to have no friends than fake friends

I dunno, I think there’s a lot of in-between, and a lot of value in nurturing relationships even when people have flaws and personality mis-matches.

Not that I can judge your individual situation or anything; just wanted to make the counterpoint to that statement. :-)