HN user

nervuri

29 karma

https://nervuri.net/

gemini://rawtext.club/~nervuri/

Posts3
Comments12
View on HN
tlsprivacy.nervuri.net 2y ago

Show HN: TLS client configuration test (TLS Client Hello Mirror)

nervuri
1pts0
nervuri.net 4y ago

An analysis of the /e/OS app installer

nervuri
1pts0
blogs.fsfe.org 8y ago

Looking for a secure smartphone running only free software? Good luck!

nervuri
1pts0
Invisible Characters 4 years ago

Zero-width characters can be used to covertly watermark text and to figure out who copied text from a page and pasted it somewhere else. Server software can encode a hidden number between every few words, which corresponds to a server log entry with your username (if logged in), IP address, browser fingerprint, etc. I wrote more about this here:

https://nervuri.net/stega

I think the best solution to this type of problem would be a clipboard utility that warns you when you copy text which contains hidden characters, homoglyps, rarely used whitespace characters, etc.

0ThreadHN
We must protect our ability to transact privately online (2019) 4 years ago

The ECASH act is so far my favorite initiative for private online payments. A government-issued open-source anonymous digital dollar, functional both online and offline, no blockchain involved, no transaction fees. I hope they can make it work technically. And I hope Americans support this. It would also pave the way for other countries.

Official site: https://ecashact.us/

Rohan Grey explaining the ECASH act: https://www.youtube.com/watch?v=BStXZH5PX1I

It would also be great for GNU Taler to take off.

0ThreadHN
We must protect our ability to transact privately online (2019) 4 years ago

The ability to make large anonymous digital transactions do make corruption and tax evasion easier to get away with. As for sanctions, I imagine they can mostly be enforced by looking at the flow of goods. The money transfers can't be traced, but the weapon shipments can be.

0ThreadHN
A study of data collection by Android devices 5 years ago

- With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset.

/e/OS is no exception. I looked at the requests made by its "Apps" app. Every time it checks for updates, it tells the server what applications you have installed. These requests are made with a User-Agent header revealing your device model, build ID and Android version. Installed languages are also sent via the Accept-Language header. And there is no option to disable update checks; the closest you can get is to set the interval to monthly.

Contrast that with F-Droid, which downloads the package index in advance (like apt does), so it doesn't need to send the server a list of installed apps in order to check for updates.

0ThreadHN