• 0 Posts
  • 71 Comments
Joined 1Y ago
cake
Cake day: Jun 30, 2023

help-circle
rss

Telegram was built to protect activists and ordinary people from corrupt governments and corporation

Didn’t they announce that they were no longer sending data to China about users participating in the Hong Kong unrest, implying that they were giving data.


don’t have to break TLS to know what site you are accessing. The SNI of the cert does that.

The specific url however is protected by TLS.


They are bound by anti money laundering laws (AML) and are required to Know Your Customers (KYC).
https://support.kraken.com/hc/en-us/articles/know-your-customer-kyc-questionnaire

Yes it does compromise privacy because now when the exchange is asked who owns this wallet they have to hand your details to law enforcement.

Exchanges without KYC are getting rarer.


Doesn’t DoH and DoT completely kill this?


In an absolute sense, yes a modem can spy on you by hijacking requests and redirecting them to controlled locations. We use TLS to prevent this, even stronger with technologies like HSTS.

Does this happen in real life though? More then you think, but less of an impact then you think.

Some US providers will hijack DNS requests and redirect them to their own DNS servers, but this can be solved with DOH or DOT.

TLS interception is a thing but it requires the device you are using (phone, PC, tablet, laptop) to have a root certificate installed that the ISP also controls. Almost all browsers will only install root certificates from root certificate providers with good standing and have no quarm in untrusing the root certificate if things go badly.


Let’s flip this question. Why do you think an organisation should get my data?

Are they reputable? Are they secure? Are they domiciled in my country and follow the laws of my country?


Ideally this will be less of a concern in the future, when the vast majority of organizations no longer have utter shit for Cybersecurity.

Oh you optimistic madlad, never change.


Not one uses IIS.

How sure are you about that? I work for a global MSP and see it all the time.


Teams is built on top of the old SKYPE infrastructure. It is a bastardisation of Skype (communications) and SharePoint (data storage)

As it is built on Skype, all the acces Leo had as part of Skype still exist. MS is a US org and have the legal requirements to tap communications for Leo.


Shovel knight and FTL have sound tracks that are amazing.



non ECC ram does funny things under high load.


If your password file gets lost/compromised/stolen your accouts are still safe with the MFA codes being stored elsewhere.


KeypassXC has otp support and they recommend storing those codes in a second database seperate from the passwords themselves.


How will they enforce it? I’m sure big/medium businesses will comply, but how can you track a cash transaction between private citizens?

Because that is not the point of the laws.

Infact the NL implementation of the laws specifically says it is for business to business and business to consumer.
There is no mention of private transactions.


… I don’t know of this is satire or not.

  • There is now a feature labeled “Privacy-preserving ad measurement” near the bottom of your Firefox Privacy settings. I recommend turning it off, or switching to a more privacy-conscious browser such as Google Chrome.


Are you at all shocked that what is effectively a payday loan operator wants more info about you to sell ads encouraging you to buy things?


Never forget the several high profile hacks Sony has been the victim of and all the personal data they have had stolen.


This whole article is an advert for this companies own new secure messenger because…

Why Would We Stop Using Signal?

We had a security breach of some root keys for a legacy chat server we were running and it got attacked and destroyed. It was too hard to restore after the attack and was abandoned. We tracked down the data leak to Signal, as the engineers had used Signal to send these keys between themselves.

Human error. Why are you allowing private keys on untrusted devices?


What an absolute numpty.

Reminds me of the Defcon talk about how the feds caught a card skimmer because he mixed illegal and legal funds while using the same password for multiple sites. And the password was some Russian variation of ass.



How are you on self hosting something? You could give a couple of these a try. Data stays with you so you get to decide how much to track.

https://github.com/awesome-selfhosted/awesome-selfhosted?tab=readme-ov-file#analytics


There is a German manufacturer called GigaSet which does stock. I am rather happy with their GS5 phone and they even have a senior option if you want a not as smart smartphone for a parent.


I am failing to see any discrimination here.

The 4 banks I use all have the same policy. Auto sign out after inactivity from web. Web pages don’t really know if a monitor is turned off due to inactivity so it is safer to log them out.
because who locks their screen when they aren’t using their system?
When using an app, you have to re auth with a device specific pin or bio metric if the screen turns off due to inactivity or switching apps.


There is a level of irony here right?


I sync my KeePass database to Dropbox.

I have access to Dropbox on my phone and my desktop. Of I change either I can copy the file to the new device and setup the sync again.


Because it is a website created by a Kiwifarm transphobic individual who is scalping data from discord and selling access under the disguise of “seeing what your friends are up to” when in reality it is used to harass people.

Ntts did a video on it.


I am sure FB will give those who paid 1/11 of the amount back as credit on the Facebook marketplace.

Just like every other online retailer. Oh you paid $40 for something that we now have to refund you? Here is store credit for $9.76.



f̑̇̈ȗ̇̈c̑̇̈k̑̇̈


y̷̪͎͙̣̠̪̅͆̕͝ͅọ̷͒̍͟ͅų̸̮͎̞͙̣̥͍̽̌͒̉͋͊̽̆̽̋͘͡͠r̸̡͈͈̬̬̹̭̹̍͗̐͂̑͛̅̄̕̕͘͠ ̷̨̙̩̘̩̰̀͋͜w̸̗̖̺͖̫̐́͋̐̀̈́̋̓̕͠ę̶̡͎͉̪̰̲̼̠̭͓̳̀͐̀ͅl̶̰̺͚̫̦̍́̓̐̅̈́̓̂̑͝͝͝c̵͖̞̀̈́͋̓́̓̌̓̋̕͘͠ò̴̫̰̬̮̗͓̻͚͛́͘͟ṁ̷̳̣͔͖e̶̖̝͎̞̅̓̾̍̉́͌͆͝ ̸̳̜̳̥̠͍̲̠̣̈́̾̍͗̌͂͑̚͝m̸̧̛̳̠̦̩̱̞͎̝̯̲͚̜̬͗̓̄̓́̈́̾̾̈́̊̽ͅa̸̧̨͖̼̦͉̲͛̾́͋̌͑͌̽̚͝t̴̝̦̘̞͇͖̪͔̙̠̲͈̀̒̒̋̇̎̔̄̂̇́ę̸̧̼̮̭͉̼͔̮̥̗͇̟̥̤͛̐̉̾͗̓̆̇͛̀̚͘͟


irregular expressions.

🅆🄷🄾 🅽🅴🅴🅳🆂 𝚜𝚙𝚎𝚕𝚕𝚌𝚑𝚎𝚌𝚔 𝖜𝖍𝖊𝖓 𝔂𝓸𝓾 🅒🅐🅝 type 𝑙𝑖𝑘𝑒 a͟ ̶h̶̶o̶̶s̶̶t̶̶a̶̶g̶̶e̶👏taker👏




TCP 443 is more likely to be open than UDP 443 so using a technology that uses TCP 443 is more likely to work.


Cleartext (What does this mean in the context of protocols? Is it inherently bad?)

It’s like sending a postcard. Anyone can see who it is from, who it is to and what you are sending.

Install Wireshark and filter for DNS them open your web browser to see where you are calling to.

DoH an DoT are essentially the same thing encrypt the DNS request in a TLS session so others can’t see what you are requesting. The main difference is DOT uses port 853 so at a glance it is DNS traffic and the port may be closed. While DoH works over port 443, the same port as regular encrypted web traffic so the port is likely open.

DoQ and DoH/3 uses UDP 443 compared to TCP 443 but still encrypt the traffic.

DNSCrypt is a DNS proxy.

Do53 is yet another implementation of DNS over TLS but using port UDP 53 the regular DNS port.


Is this a private instance with no other user accounts? If so I would not worry.


Everything gets hacked given enough time. Just not everyone says they were hacked or realised they were.