Alas Poor Erinaceus

(Not as scary as I look, I promise)

  • 24 Posts
  • 70 Comments
Joined 1Y ago
cake
Cake day: Dec 18, 2024

help-circle
rss

the before-first-unlock state

Embarrassed to ask what this is exactly…?


Someone recently managed to get on a Microsoft Teams call with representatives from phone hacking company Cellebrite, and then leaked a screenshot of the company’s capabilities against many Google Pixel phones, according to a forum post about the leak and 404 Media’s review of the material. The leak follows others obtained and verified by 404 Media over the last 18 months. Those leaks impacted both Cellebrite and its competitor Grayshift, now owned by Magnet Forensics. Both companies constantly hunt for techniques to unlock phones law enforcement have physical access to. “You can Teams meeting with them. They tell everything. Still cannot extract esim on Pixel. Ask anything,” a user called rogueFed wrote on the GrapheneOS forum on Wednesday, speaking about what they learned about Cellebrite capabilities. GrapheneOS is a security- and privacy-focused Android-based operating system. rogueFed then posted two screenshots of the Microsoft Teams call. The first was a Cellebrite Support Matrix, which lays out whether the company’s tech can, or can’t, unlock certain phones and under what conditions. The second screenshot was of a Cellebrite employee. 💡 Do you know anything else about phone unlocking technology? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co. According to another of rogueFed’s posts, the meeting took place in October. The meeting appears to have been a sales call. The employee is a “pre sales expert,” according to a profile available online. The Support Matrix is focused on modern Google Pixel devices, including the Pixel 9 series. The screenshot does not include details on the Pixel 10, which is Google’s latest device. It discusses Cellebrite’s capabilities regarding ‘before first unlock’, or BFU, when a piece of phone unlocking tech tries to open a device before someone has typed in the phone’s passcode for the first time since being turned on. It also shows Cellebrite’s capabilities against after first unlock, or AFU, devices. Screenshot via GrapheneOS forum. The Support Matrix also shows Cellebrite’s capabilities against Pixel devices running GrapheneOS, with some differences between phones running that operating system and stock Android. Cellebrite does support, for example, Pixel 9 devices BFU. Meanwhile the screenshot indicates Cellebrite cannot unlock Pixel 9 devices running GrapheneOS BFU. In a statement, Victor Cooper, senior director of corporate communications and content strategy at Cellebrite, told 404 Media “We do not disclose or publicize the specific capabilities of our technology. This practice is central to our security strategy, as revealing such details could provide potential criminals or malicious actors with an unintended advantage.” Google did not immediately respond to a request for comment. GrapheneOS is a long running project which makes sizable security changes to an Android device. “GrapheneOS is focused on substance rather than branding and marketing. It doesn't take the typical approach of piling on a bunch of insecure features depending on the adversaries not knowing about them and regressing actual privacy/security. It's a very technical project building privacy and security into the OS rather than including assorted unhelpful frills or bundling subjective third party apps choices,” the project’s website reads. As well as being used by the privacy and security conscious, criminals also turn to GrapheneOS. After the FBI secretly ran its own backdoored encrypted phone company for criminals, some drug traffickers and the people who sell technology to the underworld shifted to using GrapheneOS devices with Signal installed, according to interviews with phone sellers. In their forum post, rogueFed wrote that the “meeting focused specific on GrapheneOS bypass capability.” They added “very fresh info more coming.”
fedilink


They can easily make a list of people prone to use anti-facial recognition that lives in or walks by certain areas then recognize them by body-type, height, walking rhythm…

Which is why everyone should put stones in their shoes, especially if going to a protest. 🙂




BTW, how do yachts taste?

EDIT: Ok, what I wanted you to respond was something like: “The yachts themselves are nothing more than shiny floaty slow-moving food tins that, when gently pried open, are often found to contain many delectably rich (in more ways that one) juicy humans with ketamine-spiced blood, chomp.”


I know this has been brought up before, but it’s a little unnerving to see posts and comments I’ve d
Deleting or overwriting the title and content on ml seems to propagate *sometimes*, but not always. Don't hit, I really like the idea of the Fediverse and Lemmy in particular--I guess I already sort of knew that things worked this way, but, well, I'd be lying if I didn't say this spooked me a bit. EDIT: I'm usually pretty good about not rageposting or whatever, so there's not a whole lot of stuff I want to expunge from the record, but there are some tech support type questions that I've asked in the past that now seem to me unbelievably and embarrassingly dumb that I'm not sure I want to have out there! ~~EDIT EDIT: I'd also be lying if I didn't say my eyes were wandering a bit towards raddle.me at this point...~~ EDIT EDIT EDIT: (sorry, feeling kinda punchy over here after too much early-morning ☕️) This reminds me of something from back in the pre-Snowden days, when everything was still mostly htttp and while websurfing I had Wireshark open and saw "http://www.nytimes.com/lifestyle/how-to-get-the-most-enjoyment-from-watching-clown-porn.html" flashing past. ![](https://lemmy.ml/pictrs/image/51508498-db19-46ed-8161-f29a57f81d02.jpeg) Seriously tho, this is back when I, along with just about everyone else I knew, would say things like "well, yeah, you know, Google, Facebook, the internet, etc., everything's out there in the open, but what can you do?" And then there's the feeling you get when you actually *see* identifiable stuff like this going out across the wires and you're like "...*oh*..." 🙁 Not unlike the time when my boss asked me if I liked to listen to Rush: Me: I haven't really listened to that much of their stuff, although I really like *Power Windows*. My boss: No, I meant Rush Limbaugh. Me: ...*oh*... 🙁
fedilink

@WaffleWarrior@lemmy.zip, what specific problems are you running up against? I’m confident that my fellow lemmings and I can help you figure out how to minimize or at least reduce whatever privacy related tech issues you’re having.



I just kind of assumed that 🇪🇺 had a little more sense than that. Oh well. 🙁


Does Israel have that much sway over Europe? The Germans are perhaps still motivated by guilt over the Holocaust, to the extent that they’re willing to look the other way while another one is being committed. Makes sense, right? 🤦 Pure insanity.



Why are so many European countries getting worried about encryption and/or age verification? Why *no
I can understand why governments would push for something like this after 9/11, though it of course goes without saying that this is a totally unacceptable violation of someone's basic rights. It also goes without saying that governments always want more control over their citizens, but what exactly are they so worried might happen, right now, in 2025 or the near future?
fedilink


Maybe they can find a way to host from the Moon 🌕before the Chinese 🇨🇳 colonize it 😉.



All kerfuffle about Germany aside, I’m at least interested to see where they go with this since I feel like Proton is kind of resting on its laurels as well as continuing to treat Linux users as second class citizens (I also had longstanding issues with Tuta, too long to go into here, but which would probably not effect most of its users).


I’m sure they do. Do you self-host your email? I’m not smart or patient enough to do that, so I have to trust someone, unfortunately.



FWIW: >The servers hosting Thundermail will initially be located in Germany *with more countries to follow in the future.*
fedilink

Fight Chat Control - Protect Digital Privacy in the EU
Saw this by way of https://filen.io/hub/help-us-fight-chat-control-our-privacy-and-security-are-under-threat-again/. Not shillin', just sayin'.
fedilink

Does Firefox have some sort of addon that will let you easily check to see if the site you’re on is being hosted by AWS, Google Cloud, etc?


So it’s off to PeerTube then, I guess? People could post the same video on both (yt and pt), and then on yt write something like “why not watch this on PeerTube instead?” although it’d probably get taken down.




That’s why, when I have to email someplace to request account deletion, I write “Please delete my account and all the information associated with it.” Probably doesn’t make a difference, but worth a shot I guess.


I wish there was a “Right to have your account deleted”
Basically what it says in the title. Too many sites make you jump through all these hoops to have your account deleted, and sometimes even then don't do it. I know about justdeleteme, but unfortunately that doesn't cover a lot of things. Threatening legal action with my state's attorney general—in one case, anyway—didn't work. Maybe the EU will pass some legislation that will carry over to the US . . . Anyway, don't mind me, just griping. EDIT: Sort of like the "unsubscribe" button you get at the bottom of some emails. Did they have to pass a law to get that enacted?
fedilink



Oh, sorry 🙁. Are you on mobile or desktop?



cross-posted from: https://lemmy.ml/post/30717996 > Amazon and PayPal being out of the running of course. FWIW, I think Mullvad uses Stripe . . . 🤔
fedilink



Could you explain/elaborate to a know-nothing (me) on the following from your link?:

Caveats of federation: Metadata leaking

When using federation, Matrix’s room states (containing a lot of Metadata) get replicated and stored indefinitely on every homeserver any user connects with or connects to. While this is a feature for enabling distributed chat rooms, it comes at a serious privacy cost.

To avoid this, you can either disable federation, or make sure that your users signed up with no linkable identifiers other than their user names.


Last time I tried SimpleX, you had to scan a QR code to go from Desktop to mobile and vice versa, any chance of them changing that? Otherwise it did look promising.


If I set up Filen to sync my home folder to the cloud and I change VPN countries while it’s syncing, is that likely to cause any technical or security problems?

EDIT: My tests would seem to indicate not, but what does everyone else think? Best practices?


This is looking pretty promising so far, thanks to all who responded 👍


Thanks! They claim to have zero knowledge and E2EE . . . does End 2 End Encryption mean that my data is encrypted “in transit” as well as “at rest?” Was never quite clear on that.


Hey, if I cross post this to proton@lemmy.world, maybe Andy Yen will see it, it will light a fire under their collective asses, they’ll drop everything else they’re working on, labor long and hard, night and day, until the Linux client for Proton Drive is ready! Whaddaya think? 😉


While I'm waiting for the Linux desktop client for Proton Drive . . . does anyone have any experience with Filen? https://alternativeto.net/software/filen/about/ https://tosdr.org/en/service/6820
fedilink



If I had a phone set up like that, and, say, ICE or TSA took it, what would they be able to get from it? And I know that legally they can’t make you give up your PIN, but what’s to keep them from just beating it out of you? Cops of any stripe rarely if ever face consequences for their actions, especially in the US.



Is that one a paid service? Have heard good things about it but never tried.


What search engine(s) besides DuckDuck have !bangs?
SearXNG does, I think...any others? Looking around for other engines that aren't US-based, though I guess DDG is still considered acceptable for LibreWolf's default engine. Bangs are incredibly useful!
fedilink

Thank you very much! Will definitely take a look. 🙂


Yeah, I couldn’t find anything much there either! Oh well.


Well, ignoring anything else, cozy lacks the encryption proton drive has.

Do you by any chance have a reference for that? I believe you, I’d just like to read a little more about it. Of course then there’s also Cryptomator if the host doesn’t properly protect your stuff . . .

I can make use of Proton Drive, but using the web client only, which is extremely cumbersome. There is rclone, but I’m not smart enough to understand how to set it up. 🤕 IIRC, of all the Proton Apps, Drive is the only one lacking a Linux client.


I’m not hocking anything—notice the question mark at the end of the title. I don’t have any association with Cozy; I know nothing about them. Also, I’m referencing someone’s blog post, not endorsing it or necessarily agreeing with it. Like I said, Andy Yen’s comments aside, Proton Drive doesn’t have a desktop client for Linux which is why I’m looking for a replacement anyway. I’m keeping my other Proton stuff, for now at least. Maybe read a little more closely next time?


Cozy.io as a replacement for Proton Drive?
Joan Westenberg mentioned this in her "[Trump-proof tech stack](https://www.joanwestenberg.com/american-tech-is-compromised-heres-my-replacement-stack-2/)" post; anyone have any experience with this? It says it's [open source](https://github.com/cozy), self-hostable, and based in France. Unfortunate Andy Yen comments aside, a big plus is that [cozy](https://cozy.io/en/) actually has a Linux desktop client (!), unlike Proton.
fedilink
23
Cozy.io as a replacement for Proton Drive?

Ok, duh, you’re both right of course; late night/early morning brain fart here 🧠💨



LibreWolf is to Firefox what BetterBird is to Thunderbird?
Had never heard of this before today. Anyone tried it? **EDIT:** "[Being a fork of Mozilla Thunderbird, the software collects some data about the user, less than the original Mozilla Thunderbird, as outlined in Thunderbird's privacy statement. No data is submitted to Betterbird, some data may be submitted to Mozilla. No telemetry and no crash reports are submitted, however, add-on updates and blocklists are downloaded from Mozilla sites. Betterbird offers a product Start Page which processes access data as described above](https://www.betterbird.eu/legal/index.html)."
fedilink

They have several apps on F-Droid, which is usually a good sign . . . **EDIT:** But try to sign up and they want your name, address, and phone number. Forget it!
fedilink

How important is it to verify a signature (of say Mullvad Browser)?
Because it's kind of hard! Even if I follow their instructions. Maybe I'm just dumb . . . 🙁
fedilink

Which is best at mitigating browser fingerprinting? Firefox (with or without arkenfox)? Librewolf? M
Tor is off the table for me because it's so slow. If you can point to some test sites or documentation that supports your choice, please include!
fedilink




What do you think about using Beeper just for SMS?
It would be nice if I could get SMS 2FA-type notifcations on my desktop without having to use my phone. I probably wouldn't use Signal with it, since Beeper's own page seems to suggest that sending Signal messages with it would be less secure! And, I guess, SMS isn't secure to begin with . . . If I download and install Element, and then look at the SMS bridges available on Matrix's website, the recommended bridge instructions sends me over to Beeper, since I don't have my own server. Old and confused here . . .
fedilink