• 0 Posts
  • 388 Comments
Joined 7M ago
cake
Cake day: Apr 13, 2024

help-circle
rss

All services do eventually shut down, possibly moreso for higher privacy services, you might just disagree on when.



it’s not a bug and it’s still not possible, it’s for tracking who created the account of course.


Maybe, but if anything bad happens to originate from that number, the port history is still visible and now they have a suspect.


  • any carrier within range can still potentially track you, maybe not with airplane mode but Snowden says don’t trust that

  • GPS still “works” without any signal, service or net access

  • AGPS mandate forces 911 calls to reveal your location

For max privacy without going completely analog you’d want a device with NO cellular radio at all



such a qol upgrade

I don’t think you’re wrong, but I do think that if everyone thought that, they would be doing it already.

I have routinely tried to get friends and family to use ad-blockers and they simply don’t care enough to even attempt to download one.


requires

Not for everyone everywhere apparently. It seems dependent on some secret trust algorithm of your IP/fingerprint/something.

I made the same claim before and every time, people proved me wrong.


69% of the world population doesn’t use ad blockers. Google made their billions from people clicking on ads.

Not only are we technical folks, only 5% of the population, not their target audience, it seems most people don’t care enough about ads to ever try to stop them… at all.


I don’t think any of the recommendations here are even close to what OP is asking for… QUIK from my understanding is just a replacement SMS app, it does not “sync messages to other devices” or allow you to send SMS messages via your phone from other devices, nor does it have a desktop/web version, all of which is what Message+ does. Pretty sure this requires a self-hosted server to do (or a third-party proprietary service like MightyText).

SmsMatrix, KDEConnect/GSConnect, Nextcloud Talk are some examples that will do this.


exactly… it needs the vpn to even pass anything through… but the apps that don’t work with vpns… don’t work with vpns. as in, it detects the presence of an android vpn connection and refuses to work, it’s not related to what internet connection it actually uses, just that a system-controlled vpn is active on the device.


how on earth does that work? I thought it had to have an always-on VPN connection to do any filtering (or not)


A subpoena can still reveal the owner’s information to the world. Even if it’s a frivolous lawsuit that ends up getting tossed.



NFC payments that require my unlocked phone to use are a lot more secure than a physical card that can be stolen.


No access to google pay is a non-starter for me, I use it constantly to pay for lots of things.


you don’t have to load the code every time, you can save it and run locally, this is exactly what the Element desktop app does, it’s just an electron loader for a local copy of the website, and you can choose to update it whenever you want


Japan has been requiring fingerprints AND photographs for all incoming visitors for the better part of two decades now.

If a foreign national who is required to be fingerprinted and photographed refuses to comply with this requirement, he/she will be denied entry to Japan.

https://www.mm.emb-japan.go.jp/profile/PDF file/newime.pdf


I tried OpenSnitch but it would always randomly crash while interacting with the GUI, and it would reset all my tcp connections every time you start it back up.



Yes there is a risk of bugs being exploited just like any other feature in a browser. Another example is WebRTC being used to de-cloak VPN users. I think WebGPU and/or WebGL also had exploits that allowed remote code execution or escaping the browser sandbox.


What is a “shared unique similarity”? Sounds a lot like something that isn’t unique to me…


Just because someone chooses not to be a privacy advocate, I don’t think that means it is universally accepted that they are “freeloading”.

Usually the people who I see make these kinds of arguments are the ones that don’t participate in normal society and live in a bubble, and pretend capitalism isn’t necessary for most people to live their lives.


Tails is an operating system

Yes, and it comes with Tor Browser, which normally does not spoof your OS when probed via javascript (only the user-agent), that is why I asked if you had a patch to the source code, which is what they would have to be using in order to do what you’re saying.

But as it stands, I am not able to verify your claims, as Tor Browser on Tails 6.7 is still showing the true OS via javascript queries for me:

https://0x0.st/XYZF.png


Are you saying Tails has a custom fork of TBB that spoofs the OS? Do you have a link to that patch?


Right, even the most secure/private browser cannot help opsec failures… if only one person visits the same website(s) at the same time every day, you are not anonymous. But we all must define our own threat models and apply what’s realistic for us individually.


I would be very careful about saying Tor/Mullvad/Brave are anywhere near approaching k-anonymity… Tor Browser cannot even hide your real OS when queried from javascript, and there are current ways to detect all of those browsers independently.

I think one problem is that most people’s (general non-tech population) browser setups are completely bone-stock, and so by definition “random like everyone else” is likely already excluding all the stock users and placing you in a much smaller box to compare against.


Just FYI You would have to be using the same exact browser configuration you normally browse with, otherwise the fingerprint it uses will be different.


They ask the push providers (Apple/Google) for data on the push token from e.g. a messaging app. This way they associate the account from an app with an identity.

Very overlooked point. You can find privacy guides online but very few even suggest that FCM etc. might have privacy issues, let alone explain exactly why. It seems this has already been used by law enforcement in the past: https://www.wired.com/story/apple-google-push-notification-surveillance/

The Molly-FOSS fork of Signal (which aims to be even more secure/private) actually supports self-hosted push notifications using UnifiedPush.

I also found this comment:

As far as I know, FCM on Android can be configured to use a notification payload (which is piped through Google’s servers). But for a release app this is discouraged, especially if you are privacy conscious. An app would normally use FCM to receive a trigger and look up the received message from the app’s own backend. See here for more information.


If you care about security, don’t put a Sim card in your phone.

Depends on what you mean by security… or privacy. You need to define a threat model before any suggestions can be made.

If you’re worried about someone hacking into your phone via an app, a sim card likely won’t make a difference.

If you’re worried about your location being tracked… that can often be done without a sim card or any cellular service on your device.

Then there are malicious carriers (or ones compelled by a government) that could track you without even having legitimate service activated. All phones at least in the US now are mandated to have (A)GPS receivers.

All depends on what your concerns are.


My understanding is that they don’t… practically at all. But if compelled by a court to give your information, they could later learn that the information you provided was false. Or maybe someone reported you and they ask for some type of verification. Either way, it’s one of many tactics that can be used against someone, even if you only gave fake information to protect your own privacy.

Frivolous DMCAs have also been used to reveal identities of people someone didn’t like.


I think the only issue with that is that when/if it is found out then the domain will likely be seized because you violated your contract with the registrar to provide accurate information.


I have seen people with an axe to grind use frivolous lawsuits to reveal domain identities, you don’t actually have to do anything wrong for that to happen.


I wasn’t trying to do that, just making a general statement


this could be said about many popular open source projects


I don’t understand how if this requires a VPN which I can’t use?


besides lying, which might be illegal in your area, and/or grounds for having the domain seized if anyone complains.


google wallet is not required to be tied to any bank accounts, and US does not even support NFC within banking apps.


google wallet in general will not work.

also bank apps utilizing NFC is not a thing in the US