Ive been on the hunt for a while for something like this. I started looking again since the life360 breach. This is nearly perfect. Just need the iOS app to have a little more support and be in the app store for my less techy friends/family.

I just tried changing my email on studentaid.gov to a simplelogin alias (using SL is a habit at this point) and I got notifications that emails from it were bounced while trying to verify the email change with sent codes. I looked it up and found a bunch of Reddit posts about issues with SL and iCloud.

Im considering buying a new phone and i don't really consider a Pixel. I really like Fairphones approach, with the self repairable stuff. Even though they don‘t have a headphone jack. But well… I can’t change it. I’ll definitely go with the adapter over wireless headphones.

But to my question: What private OSes are there? Fairphone sells FP4s with eOS, how is that? And does it work on the FP5? GrapheneOS only works on Google Pixels right?

Hi! 2 and 4 months ago @Hellfire103 and @Charger8232 made a post about their privacy setup. So I though I would also share mine.

Remember these rules:

• Be respectful! Some people are early on in their privacy journey, or have a lax threat model. Just because it doesn’t align with yours, or uses some anti-privacy software, doesn’t mean you can downvote them! Help them improve by giving suggestions on alternatives.

• Don’t promote proprietary software! Proprietary software, no matter how good it may seem, is against the community rules, and generally frowned upon. If you aren’t sure, you can always ask! This is a place to learn. Don’t downvote people just because they don’t know!

-** Don’t focus solely on me!** I want to mention that this thread is not designed to pick apart only my setup. The point is to contribute your own and help others. That doesn’t mean you can’t still give suggestions for mine, but don’t prioritize mine over another.

• Be polite! This falls under “Be respectful”, but be kind to everyone! Say please, thank you, and sorry. Lemmy is really good about this, but there will always be someone.

Here is my setup:

Web browsing

• I use Librewolf for almost everything.
• For 3D stuff (games, 3d modelling) I use Brave.
• On mobile I use Vanadium.
• My preferred search engine is Kagi.
• Most if the time I have MullvadVPN enabled.

Desktop and laptop

• I have self-build Ryzen + Radeon PC and Ideapad with Ryzen CPU.
• I use Arch Linux BTW!
• I have disk encryption and Nitrokey as a decryption key (or a long password of course).
• I have secure boot with locked BIOS.
• I'm running self-compiled linux-hardened kernel.
• I'm using Gnome (Wayland).
• I have only open-source apps installed.

Mobile

• I have Google Pixel 7a with GrapheneOS.
• I have different 5 profiles: main, google, school, finance, anonymous.
• I have PIN on every profile and also fingerprint for main and school profiles.
• I always use VPN, either Mullvad or self-hosted Wireguard.
• I don’t use a privacy screen protector (for now).

Messenger

• Signal for my family.
• Viber for my schoolmates.
• MS Teams for school.
• Matrix for help with some open-source projects.
• Discord for voice chat and local scouts group. I have Aliucord on mobile and Armcord on desktop.

Online accounts

• Passwords are safe in self-hosted Bitwarden (Vaultwarden).
• I use 2FA if I can. Either hardware 2FA - Nitrokey, or TOTP with Aegis.
• I use SimpleLogin for email aliases and randomly generated usernames and passwords.

Video streaming

• I watch only Youtube. Newpipe on mobile and Invidious on desktop.

AI

• I do not use AI a lot, but if I do I use locally running LLama3 8B or Duckduckgo's LLama3 70B

Social Media

• I had Instagram, Snapchat and Viber accounts, but I've deleted them.
• I use only Lemmy on clearweb and Dread on darkweb.
• I have Mastodon account, but I don't use it.

Email

• I use ProtonMail.
• One of the best privacy things you can do is use SimpleLogin (or other email alias service).

Shopping/Finance

• IRL I use cash most of the time.
• Online I use Monero if I can, otherwise just my credit card.
• Cashew app for helping managing my purchases.

Music streaming

• I use only RiMusic on my phone, that's it.

TV shows

• I use a VPN, that's all I'm gonna say...

Gaming

• Minecraft, Veloren, SuperTuxKart, and some Steam games.

Programming

• I forgot how to code in Python, because Rust is so much better.
• VS Codium.

Productivity

• LibreOffice for simple stuff.
• Typst for proper documents.

Paid services

• ProtonMail - 4$ per month
• SimpleLogin - 30$ per year
• MullvadVPN - 5$ per month
• Kagi - 10$ per month. For 5$ you get 300 searches, I use ~350 searches so I will try to lower my searches.
• Domain - 13$ per year

Self-hosted

• Everything runs on Raspberry Pi 4 with encrypted micro SD card.
• Pi-Hole for blocking ads on network level.
• Bitwarden (Vaultwarden) for storing all my passwords.
• Wireguard server (with pihole as DNS) for connecting back home from anywhere.
• Ntfy for self-hosted push notifications.
• MollySocket for Signal push notifications.
• FindMyDevice if I lost my phone.
• Cloudflare DDNS, because I don't have static IP.
• Nginx Proxy Manager.
• Watchtower automatically updates docker containers.
• My website.

Misc

• I have Samsung Galaxy Watch 4 classic. I'm trying to do something about it...
• I'm using Syncthing to sync documents and pictures between my devices.
• I don't have a car (because I can't - I'm 17) and I won't have one for quite some time. I have a bicycle and my parents have 2 (smart/spy) cars.
• I'm into crypto (mostly XMR) and I'm trading a little (making a trading bot) on MEXC. I also have Ledger Nano S Plus.
• I have a 3d printer and it's fun and usefull :)

TODO

• self-host Git repos for my projects.
• Buy a privacy screen protector when I break my current one.
• Buy a faraday bag, just in case.
• Do something about my spywatch (maybe sell).
• Make backups... Yep, I don't have any yet.
• Monitor and harden all my devices.
• Memorize cryptowallet's private key in case it gets lost.

Thanks for reading!

cross-posted from: https://lemmy.world/post/17746311

This release, I2P 2.6.0, continues our work by fixing bugs, adding features, and improving the network's reliability.

Newer routers will be favored when selecting floodfill routers. I2PSnark received features which improve the performance of PeX(Peer Exchange), in addition to bug fixes. Legacy transport protocols are being removed, simplifying the code in the UDP transports. Locally-hosted destination will be reachable by local clients without requesting their LeaseSet, improving performance and testability. Additional tweaks were made to peer selection strategies.

I2P no longer allows I2P-over-Tor, connections from Tor exit IP addresses are now blocked. We discourage this because it degrades the performance of I2P and uses up the resources of Tor exits for no benefit. If you are a helpful person running both a Tor Exit and I2P we encourage you to continue to do so, using different IP addresses for each. Non-exit relays and Tor clients are unaffected by this and do not need to change anything.

As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.

RELEASE DETAILS Changes

• Router: Increase minimum version for floodfill routers

• Router: Disable I2P over Tor

• Address Book: Cache locally hosted destinations

Bug Fixes

• I2PSnark: Peer Exchange Tweaks

• I2PSnark: Bugfixes

• Router: Peer Selection Tweaks

Other

• Translation updates

I want to keep a timeline of the places I go like Google Maps can, and export it to mac for my diary*. The maps app doesn't have to be great, it just needs to keep a timeline in the background, I would still use Apple Maps as my main navigation app.

*(ideally I can automatically export it somehow, perhaps with the Shortcuts and Scriptable app but just tell me any apps with a timeline and export feature)

I've just been playing around with https://browserleaks.com/fonts . It seems no web browser provides adequate protection for this method of fingerprinting -- in both brave and librewolf the tool detects rather unique fonts that I have installed on my system, such as "IBM Plex" and "UD Digi Kyokasho" -- almost certainly a unique fingerprint. Tor browser does slightly better as it does not divulge these "weird" fonts. However, it still reveals that the google Noto fonts are installed, which is by far not universal -- on a different machine, where no Noto fonts are installed, the tool does not report them.

For extra context: I've tested under Linux with native tor browser and flatpak'd Brave and Librewolf.

What can we do to protect ourselves from this method of fingerprinting? And why are all of these privacy-focused browsers vulnerable to it? Is work being done to mitigate this?

Leaked Docs Show What Phones Cellebrite Can (and Can’t) Unlock

The leaked April 2024 documents, obtained and verified by 404 Media, show Cellebrite could not unlock a large chunk of modern iPhones.

Cellebrite, the well-known mobile forensics company, was unable to unlock a sizable chunk of modern iPhones available on the market as of April 2024, according to leaked documents verified by 404 Media.

The documents, which also show what various Android handsets and operating system versions Cellebrite can access, provide granular insight into the very recent state of mobile forensic technology. Mobile forensics companies typically do not release details on what specific models their tools can or cannot penetrate, instead using vague terms in marketing materials. The documents obtained by 404 Media, which are given to customers but not published publicly, show how fluid and fast moving the success, or failure, of mobile forensic tools can be, and highlights the constant cat and mouse game between hardware and operating manufacturers like Apple and Google, and the hacking companies looking for vulnerabilities to exploit.

Analysis of the documents also comes after the FBI announced it had successfully gained access to the mobile phone used by Thomas Matthew Crooks, the suspected shooter in the attempted assassination of former President Donald Trump. The FBI has not released details on what brand of phone Crooks used, and it has not said how it was able to unlock his phone.

The documents are titled “Cellebrite iOS Support Matrix” and “Cellebrite Android Support Matrix” respectively. An anonymous source recently sent the full PDFs to 404 Media, who said they obtained them from a Cellebrite customer. GrapheneOS, a privacy and security focused Android-based operating system, previously published screenshots of the same documents online in May, but the material did not receive wider attention beyond the mobile forensics community.

For all locked iPhones able to run 17.4 or newer, the Cellebrite document says “In Research,” meaning they cannot necessarily be unlocked with Cellebrite’s tools. For previous iterations of iOS 17, stretching from 17.1 to 17.3.1, Cellebrite says it does support the iPhone XR and iPhone 11 series. Specifically, the document says Cellebrite recently added support to those models for its Supersonic BF [brute force] capability, which claims to gain access to phones quickly. But for the iPhone 12 and up running those operating systems, Cellebrite says support is “Coming soon.”

A SECTION OF THE IOS DOCUMENT. IMAGE: 404 MEDIA.

The iPhone 11 was released in 2019. The iPhone 12 was launched the following year. In other words, Cellebrite was only able to unlock iPhones running the penultimate version of iOS that were released nearly five years ago.

The most recent version of iOS in April 2024 was 17.4.1, which was released in March 2024. Apple then released 17.5.1 in May. According to Apple’s own publicly released data from June, the vast majority of iPhone users have upgraded to iOS 17, with the operating system being installed on 77 percent of all iPhones, and 87 percent of iPhones introduced in the last four years. The data does not break what percentage of those users are on each iteration of iOS 17, though.

Cellebrite offers a variety of mobile forensics tools. That includes the UFED, a hardware device that can extract data from a physically connected mobile phone. The UFED is a common sight in police departments across the country and world, and is sometimes used outside of law enforcement too. Cellebrite also sells Cellebrite Premium, a service that either gives the client’s UFED more capabilities, is handled in Cellebrite’s own cloud, or comes as an “offline turnkey solution,” according to a video on Cellebrite’s website.

That video says that Cellebrite Premium is capable of obtaining the passcode for “nearly all of today’s mobile devices, including the latest iOS and Android versions.”

That claim does not appear to be reflected in the leaked documents, which show that, as of April, Cellebrite could not access from locked iOS phones running 17.4.

The second document shows that Cellebrite does not have blanket coverage of locked Android devices either, although it covers most of those listed. Cellebrite cannot, for example, brute force a Google Pixel 6, 7, or 8 that has been turned off to get the users’ data, according to the document. The most recent version of Android at the time of the Cellebrite documents was Android 14, released October 2023. The Pixel 6 was released in 2021.

A SECTION OF THE ANDROID DOCUMENT. IMAGE: 404 MEDIA.

Cellebrite confirmed the authenticity of the documents in an emailed statement to 404 Media. “Similar to any other software company, the documents are designed to help our customers understand Cellebrite’s technology capabilities as they conduct ethical, legally sanctioned investigations—bound by the confines of a search warrant or an owner’s consent to search. The reason we do not openly advertise our updates is so that bad actors are not privy to information that could further their criminal activity,” Victor Ryan Cooper, senior director of corporate communications and content at Cellebrite, wrote.

“Cellebrite does not sell to countries sanctioned by the U.S., EU, UK or Israeli governments or those on the Financial Action Task Force (FATF) blacklist. We only work with and pursue customers who we believe will act lawfully and not in a manner incompatible with privacy rights or human rights,” the email added. In 2021 Al Jazeera and Haaretz reported that a paramilitary force in Bangladesh was trained to use Cellebrite’s technology.

Cellebrite is not the only mobile forensics company targeting iOS devices. Grayshift makes a product called the GrayKey, which originally was focused on iOS devices before expanding to Android phones too. It is not clear what the GrayKey’s current capabilities are. Magnet Forensics, which merged with Grayshift in 2023, did not immediately respond to a request for comment.

Cellebrite’s Android-focused document also explicitly mentions GrapheneOS in two tables. As well as being an operating system that the privacy-conscious might use, 404 Media has spoken to multiple people in the underground industry selling secure phones to drug traffickers who said some of their clients have moved to using GrapheneOS in recent years.

Daniel Micay, founder of GrapheneOS, told 404 Media that GrapheneOS joined a Discord server whose members include law enforcement officials and which is dedicated to discussions around mobile forensics. “We joined and they approved us, with our official GrapheneOS account, but it seems some cops got really mad and got a mod to ban us even though we didn't post anything off topic or do anything bad,” Micay said.

There is intense secrecy around the community of mobile forensics experts that discuss the latest unlocking tricks and shortcomings with their peers. In 2018 at Motherboard, I reported that law enforcement officials were trying to hide their emails about phone unlocking tools. At the time, I was receiving leaks of emails and documents from inside mobile forensics groups. In an attempt to obtain more information, I sent public records requests for more emails.

“Just a heads up, my department received two public records request[s] from a Joseph Cox at Motherboard.com requesting 2 years of my emails,” a law enforcement official wrote in one email to other members. I learned of this through a subsequent leak of that email. (404 Media continues to receive leaks, including a recent set of screenshots from a mobile forensics Discord group).

Google did not respond to a request for comment. Apple declined to comment.

Fuck this shit, why does every fucking thing need an LLM?

Anyone have any experience with this app? Could it be malware? Are there other Foss or FLOSS alternatives?

I'm one of those oddballs who's never joined, but I'm in the market for a new to me bike, and it seems like all the action is on marketplace. Am I screwed, or is there an effective workaround ?

Edit: Not US. There are local alternatives that I know about, but they are worse, please answer question as asked ! Basically I'm thinking of alternative software ala FreeTube, or a way of spoofing facebook to make a dummy account only to be used for this and if so what precautions to take...

Digital privacy seems quite straightforward, because your digital devices are environments you more or less can have complete control over if you want to. But when you're out and about, it's a much more uncontrolled environment. There are cameras everywhere.

I wear face masks everywhere for a combo of protecting myself from illness and privacy. But the limitation is social acceptability. If anything good came out of covid it's the normalisation of face masks, but you are far from unidentifiable if your only face covering is a covid mask. We're lucky that sunglasses and hoodies on their own are fairly normal, but all of the above in combination would draw attention to you. And it's definitely not socially acceptable to walk around in a balaclava.

The other thing is forensic data. If you don't wear gloves, you'll leave fingerprints everywhere, and hair too. I suppose wearing gloves is not particularly seen as weird or suspicious, but it just seems like there are a lot of considerations and challenges with preventing the state from knowing your every move when you leave the house.

What considerations do you make for IRL privacy, if any?

(Not particularly interested in "I don't care about IRL privacy so I don't do anything"—that's fine and your choice, but ofc this question is aimed towards those who do care)

cross-posted from: https://infosec.pub/post/14981035

But as I and others looked closer, and thought about it more deeply, things became concerning.

These logs include:

Your precise GPS locations (which are also sent to their servers).
Your WiFi network name.
The IDs of nearby cell towers (even with no SIM card inserted, also sent to their servers).
Your internet-facing IP address.
The user token used by the device to authenticate with Rabbit's back-end API.
Base64-encoded MP3s of everything the Rabbit has ever spoken to you (and the text transcript thereof).

Basically title. Recently I saw a new option in Chromium website permission settings called "allow access to local network" or something like that and I know some antiviruses on Windows that can list all devices connected to the same WiFi network. I'm usually using Firefox based browsers that obviously don't have the option to disable or enable that access. So can some really invasive websites mine data about my local network, connected devices etc? And if so, what can I do to prevent it except for just disconnecting everything else when visiting such websites?

Hey friends,

I'd like to:

• Register for a social media account under a client's company name
• Research the presence companies in the client's industry have on the site
• Have a reasonable assurance the account will not be linked to my real name nor my network
• Use a VM for 10-30? hr/mo, short term

I am:

• US West Coast based
• Tech savvy but don't code (unless copypasta)
• Price conscious
• Privacy conscious in terms of social media companies linking my account and my identity

Questions:

• Have I betrayed any misconceptions?
• Is a cloud PC one of my best options, and if so:
• Can you recommend a provider and specs?
• Is there anything I'm missing?

Thank you!

Cunningham Law (backfired terribly)

Can someone please explain why PGP is needs all of these? All explanations of public key encryption mention any email embedded emails.

And I probably don't completely understand what PGP is, so please give me a good article or video on it.

Hi everyone,

I've been checking this forum but I have not managed to find duplicates (I'm using Summit for Lemmy). If that's the case I'll remove this post.

I'm about to start a PhD. I've been told I will be required to partake in publications and other shenanigans. I am not against it, but I'm very concerned about having my full name flying around the internet, as I've always been hesitant of sharing any of that information (real name, pictures, etc).

Ultimately, I only care for potential employers to know that it's actually me the one who has written this or that, which I would happily disclose in private.

What's the usual stance in this situation?

Yes, you can use Signal without sharing your personal phone number. Here’s how I did it.

I need a diary that works as an Android app and a web app. Ideally when I type something it automatically gets a time stamp.

Asking here because I want something private.

Does such a thing exist?

edit - Thank you for all the responses!! I did not expect so many replies.

The reason I said web app is because I’m looking for something I can use on my desktop and my phone. I use my desktop much more than my phone. While I currently use Windowz, I'm slowly migrating to Linux.

I'm traveling to the US mainland for the first time in my life in a few weeks.

I am not overly stressed about privacy, but I have read that US immigration can really overstep their boundaries. Are there any simple specific steps to take on my devices to protect my privace when going through US border control?

Remove my main accounts from my phone/tablet and use dummy accounts? Or just removing my biometrics?

That's a use case for aliases, catching if any company or service gives out your email to be abused by advertisers and whatnot. I tried looking for stories but didn't find any, I wonder if you have any to share.