• 3 Posts
  • 73 Comments
Joined 2Y ago
cake
Cake day: Jun 22, 2023

help-circle
rss
A perfidious trick? EU Council Presidency wants to introduce mandatory #ChatControl through the bac
Patrick Breyer @echo_pbreyer@digitalcourage.social 🇪🇺⚠️ A perfidious trick? The EU Council Presidency wants to introduce mandatory #ChatControl through the backdoor 🚪: An Art. 4 amendment would MANDATE "all reasonable mitigation measures," including scanning, enforced with sanctions! 😡 https://cdn.netzpolitik.org/wp-upload/2025/11/2025-10-30_Council_Presidency_CSAR_Policy-debate_14032.pdf
fedilink



There is a thing like that for Android but from what I can tell, it doesn’t work as well as the Apple version, at least so far.


Oh cool, someone finally did it. I’ve been wanting that for years!


My idea for a long time has been to connect my laptop charger to a pedal-powered generator, so I can still stay online for as much time as I want, but I have to get some exercise (by pedalling the generator) to keep the computer running. Let’s say 30 minutes of pedalling for a few hours of connection time.


I’ve tried to use it but it’s way too flaky. :(


I will check on that but I had thought that the point of moving from mag stripe to chip cards was to stop exposing the card number. The is instead a 2 way encrypted conversation between the chip and the bank server. I had expected the phone app to do about the same thing.

Also, payment terminals (I was once pretty familiar with them) are likely to be more secure than phones.


Just tap your card. I’m baffled about why people think it’s important to use their phones.


Lol a Google share link on the privacy forum. Anyone know where it goes? OP can you fix it?


Do you mean TOTP? FIDO? Or what? FOSS ones exist but they might not do exactly the right thing. I’ve had some ideas for self-built too. What would you do on the host interface side? Wouldn’t you want the host to not have the secret?

It’s an interesting question.


Self hosted or go home.


Yeah I don’t currently use any ride hailing apps and haven’t posted to Craigslist in ages. Some services will be more paranoid than others. Depends on how much fraud they encounter I guess.


The thing in the US was about a sim farm in New York and the reporting was pretty stupid from what I could tell. At present you can get US mobile phones and sims without ID. Also, most services that send sms validation don’t care if it’s a real mobile number. I use a VoIP number and it’s usually fine.

If you’re using a hosted sim to forward SMS to your real phone # or email, you have to expect that a determined or powerful enough opponent will link the two. What happens then probably depends on what you were doing.


Interesting though as you say, also shady. Also seems marginal. Sending enough SMS to recover the monthly cost of the SIM cards seems likely to get the carriers’ attention after a while. Outbound SMS from Twilio are around 0.8 cents each in the US fwiw. Much less hassle. Maybe even less from carriers. No idea about EU.


The news article was about a specific incident in the EU and idk if it generalizes to “governments” but yes, sim farms, and in some cases racks full of real phones running apps, really do exist, mostly for skeezy if not criminal purposes. It’s not like some privacy conscious rando having a few burner phones for whatever. If they have 10,000 active phone numbers terminated in a warehouse, they are up to something sus.


The UN thing was stupid, it peddled a story about disabling the phone network bla bla. The real purpose of those sim banks is various forms of illicit scraping or click fraud, signing up for 100’s of fake SMS verified Facebook accounts so you can run sales scams, etc. That sounds like the nature of the thing that was just busted.


Article lede: European law enforcement in an operation codenamed ‘SIMCARTEL’ has dismantled an illegal SIM-box service that enabled more than 3,200 fraud cases and caused at least 4.5 million euros in losses.


I think you don’t want to know the real answer. It sounds like you want a phone app, but what you really have to do is flush your phone down the toilet and use a totally different approach. Also, there is absolutely no way to avoid difficult opsec. The communications technology is irrelevant since the greatest vulnerability in any security system is the people who use it. Do you think the private messenger software will free sessions with your therapist from spying? Guess again.

As the saying used to go, you’re seeking a Star Trek solution to a Babylon 5 problem.



IDK how it works exactly, maybe the secrecy only counts when you confess your own sins, not someone else’s. I’m sure there is theological doctrine one way or the other.


I don’t know, it might depend on the crime. I believe that clergy get a higher level of privilege than therapists. You can literally confess a murder to a priest and they aren’t allowed to (and won’t) tell anyone.

Famously, in the 1970s, Daniel Ellsberg stayed out of jail after it emerged that Nixon’s fixers had broken into Ellsberg’s psychiatrist’s office to get his case files. These days they would just break into a computer.


I agree with that. I also get ill at the thought of posting a facebook meme, or even having a facebook acccount.

https://reason.com/2025/10/10/tennessee-man-arrested-gets-2-million-bond-for-posting-facebook-meme/


If you go to a therapist, make sure they don’t keep any computerized records of your therapy sessions. :(

https://en.wikipedia.org/wiki/Vastaamo_data_breach


I don’t have working cell service in my burner phone at all right now. I just use my regular phone as a wifi hotspot and run the retail app on the burner. But tello.com has some low cost pay-as-you-go plans. They are a T-mobile MVNO and are supposedly ok. I’m on a redpocket monthly plan and am fairly happy with it despite horrible reports about them in the past. Look at r/nocontract on spezzit for more ideas.


I’ve managed to avoid banking apps altogether but I know they often want you to be running stock Android, no rooting or whatever. There is a retail app that I sometimes use but I relegate it to a burner phone. If I had to run a banking app with any regularity, I’d probably do the same thing.



ONE participant of the phone call is getting paid. It’s unclear if the other one is even being informed. Anyway apparently the app shut down today because of a huge data leak, but I haven’t looked into the details.


Spotify

You had me going til that one.


For sharing with your friends you might look into Magic Wormhole. In my case I just put the file on a personal web site, usually.



Use a separate phone for the work stuff.



Less expensive than I expected, but no headphone jack, no SD slot, comes with /e/OS.

In the end any mobile phone is inherently privacy invasive because of tracking by the cellular carrier, and the unending security bugs in the software. It’s hard to do much about this.


Meanwhile the guy who breached a Finnish therapy database and held 33,000 records for ransom just got out of prison after serving around 2 years of a 6 year sentence:

https://en.wikipedia.org/wiki/Vastaamo_data_breach


Not commenting on the other stuff but people should get used to the fact that anonymized private data is still private, so a so-called privacy app should not be leaking or disclosing or selling it. It might be LESS invasive than personally identifiable data, but it’s not NON-invasive.

Who is willing to pay for it after all? Almost certainly, someone who is up to no good. And if you can think of a way it can possibly be misused, then enabling that misuse is invasive.



Lemmy is inherently bad at privacy. You can gain a little bit by running your own instance. Using anyone else’s instance discloses TMI.


Yea, I can see that. So, that guy might like the satellite pager, but probably will not like the price tag.

No he didn’t like the satellite pager because it didn’t have enough coverage. He wanted it to work worldwide. The cost was also an issue. And I don’t know if they work well indoors.


LoRA is sort of a slower version of wifi and as such, you should assume Meshtastic is monitored, at least for traffic metadata. The actual messages are encrypted though.

Use of ham radio for this type of thing, or with any type of encryption, is against the ham regulations, though depending on how it is done it could be made hard to detect.

There is actually still such a thing as a satellite pager, a receive-only device that can get pages that cover regions as big as small countries. They stopped making the receivers quite a while back, but some are still around and the subscriptions are still available, though expensive. This info is itself some years old so maybe they are all gone by now.

POCSAG pagers still exist in the US too, though again, they are quite expensive compared to cell phones. Their main attraction is supposed to be higher reliability, so e.g. doctors can get paged even with the mobile phone network is out. I don’t know if that advantage still exists. In the more distant past there was something called ARDIS which I think is gone now. That was quite a robust signal, so you could get paged even in sub-basements of buildings and places where mobile phones didn’t work. Repair technicians who worked in those places often carried them.

I’ve followed this stuff slightly as it’s interesting for the reasons you say, but I’d have to say it’s not really cost effective for most of us. POCSAG in particular only works in relatively localized areas like single countries. I know a guy who would want something like it, but only if it worked pretty much everywhere, since he travels a lot.


It’s usually sent encrypted (by TLS) so it can’t be read by external entities monitoring internet traffic. Then the host decrypts it and stores it and can access it. Yes it’s trust me bro. Email is fundamentally not all that private, because of that.


Mail transport these days is usually encrypted over the wire, but once it lands at the receiving server (i.e. gmail) it is stored in the clear, or at least in a way that the host can read it.


Interesting counterpoint to the stuff we sometimes talk about here. It's more for public chat rooms though. MLS (RFC 9240) still interests me and I've been wanting to try coding it.
fedilink