oil25

That's the best solution - improved privacy and sometimes even reduced gas prices when using cash.

What's the penalty? It ought to be equivalent to a DUI, given the impairment is similar if not worse from phone distraction at the wheel.

That's too bad, looks like I'll have to stick with GSuite Gmail to have browser-based, non-Javascript access to my email.

Sincere question - why is JavaScript required to sign up for Fastmail? Is it for browser fingerprinting? If so, what data is collected, how is it used and how long is it retained? No specific mention of it in the privacy policy. If I sign up in a virtual machine, can I later use Fastmail without running scripts?

Curious how you are managing disk encryption for all those devices, if you are at all.

Same here, but I have found wireless performance to be subpar. Ended up double-NAT'ing a second APU with Debian to use 802.11. Still plenty happy with OpenBSD though.

For usability while balancing security, cache PIN for at most a day.

https://github.com/DataDog/yubikey/blob/master/gpg.sh#147

This statement has no effect when using Yubikey - the PIN is cached by the key itself and it will remain unlocked indefinitely until it's physically unplugged. See https://dev.gnupg.org/T3362

Anyone disillusioned by the thought that Apple values privacy would be well served by reading iOS, The Future Of macOS, Freedom, Security And Privacy In An Increasingly Hostile Global Environment - https://gist.github.com/iosecure/357e724811fe04167332ef54e73...

There is so much more to privacy than is made apparent to the user as a few OS knobs to "limit" ad tracking.

I tried again and now get the Incapsula crap - maybe related to IP address (which changes often on Tor)?

Edit: the page loads for the first time after assigning a new IP in Tor, but subsequent loads throw the captcha. Odd system.

Characterizing this software feature as an "attack" or "backdoor" is pretty hyperbolic. In order to abuse multiplexing, the adversary needs local code execution ability, by which point you've already lost.

Works fine here, even over Tor - Firefox 70.0.1 with javascript.enabled=false in about:config.

I'm happy with LineageOS running on a Pixel, no Play Services and only open source applications installed over adb.

California Consumer Privacy Act takes effect next year - https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac...

I doubt it's possible. I think Google uses the device browser (SFSafariViewController) to do OAuth, so users aren't asked to sign in in every application. No doubt they think this is a feature. Why not simply use Google Maps in an private browser window if you're looking to improve privacy? Or even better, check out OpenStreetMap.

Can someone post a TLDR? Twitter blocks Tor exit nodes, so the content is unavailable:

403 Forbidden: The server understood the request, but is refusing to fulfill it.

MAC address of your radio, plus the BSSID of every wireless network you've ever connected to and saved.

On OpenBSD:

    # echo "lladdr random" >> /etc/hostname.athn0

I agree completely. These efforts to "break" end-to-end encryption seem entirely ineffectual so long as open source alternatives exist - they are plenty and well proliferated. Banning the use of unapproved software is impractical, like asking everyone to turn in guns. So what's really their end game?

I also experienced the gigabit performance issue (Debian 9 and 10, APU4C4); estimate a bandwidth cap of about 400 Mbps, too. I don't actually have a need to exceed that speed on my home network, so I'm still happy. But also curious if anyone has built a beefier, more capable open source hardware router that also isn't a power hog.

I've been using the APU2 platform for a home network router and can strongly recommend it. I especially like the open source firmware (coreboot) with frequent, signed releases. Wireless performance on OpenBSD was lackluster, so I'm back to running Debian for 802.11. Performance is strong even at full WAN bandwidth capacity of 400 Mbps.

By far the biggest tracking offender is Javascript. Enabling it could reveal your operating system, cpu/gpu architecture, screen resolution, draw a precise and unique canvas fingerprint, etc. There are also mutable browser headers like user-agent and of course your IP address. However, the more advanced and insidious tracking is based on your behavior - what time you're active, what wifi networks are in range, who you communicate with, what is your writing style, and so on. Most of that collection happens on mobile phones, so I strongly advise against signing in on Android/iOS devices if you don't want to be tracked across the Web and beyond, or using telemetry-free open source mobile operating systems altogether.

The poster was concerned about video being hacked. This would be hard to hide, at least for being owned in real-time, if one were keeping track of the packets coming and going.

How would keeping track of packets detect a compromised web cam absolutely? An SSL-encrypted connection to Amazon servers, for example, could easily be used to exfiltrate pictures, audio and even low-bandwidth recordings while still blending in with typical, expected Web traffic.

The web is made from HTML, CSS and Javascript.

Considering the World Wide Web predates Javascript by many years, and the fact it's possible to create a functional, readable, and accessible Web page without Javascript altogether, this characterization is absolutely inaccurate.

Instead of assuming you could lock down your internet pipe. Use a RPi as a security appliance with strong whitelisted firewall policy. At least have some insight into what traffic is going to and from your LAN.

Not only would a Raspberry Pi be severely under-powered for routing even a small home network, in no way does monitoring that "goes to and from your LAN" defend against an adversary Snowden warns about.

Could also put in an entirely passive NIDS on a physical layer in-line with your network’s service entrance. Very difficult for anyone to defeat, when done right.

Again, I'm not sure what threat model you think this defends against, but certainly not a three letter agency intent on either tailored exploitation nor passive monitoring of your inbound and outbound network traffic by the same actor.

What a poorly designed site. Nothing but a spinning circle with Javascript disabled - Firefox reader mode doesn't work, either. Completely unacceptable from a privacy and usability perspective.

It was asked in good faith and I did explain my reasoning for why anonymity and security are different concepts. Have you got a citation for the claim that Signal "uploads entire contact lists" or was this just FUD?

For some of us, security == anonymity.

I don't follow. How is security equal to anonymity? If anything, security is what enables privacy, which could enable anonymity. There are plenty of circumstances where you need security, but not anonymity - for example a message to your partner. Of course if you do need anonymity, there's a lot more involved than simply installing a "secure app" or anything of that sort.

Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails.

I don't know about that in the US. I was able to open a pre-paid T-Mobile account to use with my LineageOS Android device without identity verification. Perhaps it is different elsewhere now?

And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger.

That sounds troubling, is it what Signal does? Would like to read more about that - is there a Github issue for reference?

A private messenger should be usable anonymously, shouldn't it?

It would make a good feature, but anonymity is not a requirement for privacy. I want my connection to the bank's website to be private, but there's no need for it to be anonymous. Signal offers a lot of advantage over traditional SMS with familiar usability. It doesn't perfectly solve everyone's threat model for privacy and anonymity, and doesn't have to.

For most users, I think maintaining exclusive ownership of a phone number is much easier than securing their email account or a traditional username+password credential, so posit it's a natural fit for a secure mobile messenger.

I use Signal because the most important thing to me about a messenger is security and privacy. Other features notwithstanding, iMessage simply does not offer the same guarantees as Signal so long as Apple manages encryption keys vs the users themselves, and obviously remains closed source and proprietary. In other words, I would only consider Signal to be a truly end-to-end encrypted application of the two, and that's of utmost value to me.