Privacy

andrew ,
@andrew@andrew.masto.host avatar

Proton: "Introducing Dark Web Monitoring for credential leaks"

https://proton.me/blog/dark-web-monitoring

@privacy

ReversalHatchery ,

Problem is, nothing prevents anyone from removing the plus part before sanding the mail. Isn't it a standard at basically any email provider?

jherazob ,
@jherazob@beehaw.org avatar

Looks like another Have I Been Pwned, at least at a glance they're looking for email addresses, and given that you have your email with them if you're using this service they kinda do have it already

otl ,
@otl@hachyderm.io avatar

Finally deleted my LinkedIn account!

After putting my account into "hibernation" for the past few weeks, I finally closed it. But I'm still looking for work. Thankfully I can still find positions (SRE and software dev) by just going directly to the company's site and finding a Jobs page.

Good luck to everyone else out there looking for work!

@privacy

twoBrokenThumbs ,

I agree that going fedi doesn't automatically solve the issues.
However, moving it away from a multi tiered paid platform (they really tailored it so they could do this) and controlling the bots/scam accounts would be a completely different experience.
I think fedi would at least solve the first one, and I'd expect would help controlling the second.

cmgvd3lw ,

Do you post your achievements there?

privacypride ,

Google pulls Binance, other global crypto apps from India store

FIU, an Indian government agency that scrutinizes financial transactions, late last month issued show cause notices to nine crypto firms and alleged that they weren’t compliant with India’s anti-money laundering rules. Apple pulled the apps earlier this week and various telecom networks and internet service providers began blocking the URLs of the crypto exchange websites Thursday evening.
@privacy
https://techcrunch.com/2024/01/13/google-pulls-binance-other-global-crypto-apps-from-india-store/

imkali ,

True true. You're right there my friend.

labbbb ,

India going to dictatorship like RuSSia when it comes to financial services, Forex brokers, cryptocurrency exchanges, payment systems, P2P's etc., "nice".

There is many services that have license in offshores, so I think Indians will be fine.

thenexusofprivacy , (edited )
@thenexusofprivacy@infosec.exchange avatar

FISA Section 702 Reauthorization: House GOP leadership pulls dueling FISA bills amid backlash!

https://www.cnn.com/2023/12/11/politics/house-gop-leadership-pulls-dueling-fisa-bills/index.html

Instead, a four-month extension is attached to the NDAA -- unless it gets removed. Dozens of civil rights and racial justice groups oppose extending FISA in the NDAA.

If you agree, call your Senators TODAY and with a simple ask: "DO NOT put 702 in the NDAA."

@privacy

thenexusofprivacy OP ,
@thenexusofprivacy@infosec.exchange avatar

@drwho Not necessarily. In the short term, the huge split in the Republican party means that the NDAA's already not a slam-dunk, so throwing gasoline on the fire with FISA activism could potentially have an impact. It also adds to pressure on Speaker Johnson, who's under a lot of fire from Republicans for how badly he's handled this mess.

And even if they do the short-term reauth (which I agree is more likely than not), it's still very much an open question as to what happens next -- it could be anything from GSRA or PLEWSA (with significant reforms) to a straightforward longer-term reauth with minimal reforms as a "compromise" to the odious FFRA (which broadens the scope). So pressure now is also a preparation for the next battle.

stolid_agnostic ,

Empathy, as always, is the real problem with the GOP. They are perfectly fine when it’s immigrants, liberals, gays, brown people, etc that suffer these laws. When angry white people get affected, then they are suddenly sad about it and suddenly were the whole time.

thenexusofprivacy ,
@thenexusofprivacy@infosec.exchange avatar

House Judiciary Committee advances FISA Section 702 bill with warrant requirements, 35-2

Sen. Ron Wyden says "This is great news for anyone who cares about protecting their privacy from government overreach."

So far the only coverage is @tonya_riley's paywalled Bloomberg News article

https://news.bloomberglaw.com/ip-law/house-panel-oks-bill-to-renew-rein-in-electronic-surveillance

The bill is H.R. 6570, the Protect Liberty and End Warrantless Surveillance Act, sponsored by Rep. Andy Biggs (R-AZ). It has a lot of similarities to the bipartisan Government Surveillance Reform Act (where Wyden and Sen. Mike Lee are the Senate sponsors). But there are other bills potentially moving forward as well.... (1/3)

@privacy

EveryMuffinIsNowEncrypted ,
@EveryMuffinIsNowEncrypted@lemmy.blahaj.zone avatar

grasps pearls around neck

Imagine the scandel!

possiblylinux127 ,
@possiblylinux127@lemmy.zip avatar

The worlds on a role at this point

voxel , (edited )
@voxel@infosec.exchange avatar

is making the watching experience worse on and Microsoft Edge.

I didn't believe it the first time I heard abt it, since it sounded more like a conspiracy theory than a actual thing, but it's true. Google does add 5s timeout specifically to Firefox and Edge users when they try to watch a video on YT. If you want to know more about it, Mental Outlaw make a very good video abt it (Link: https://youtu.be/v4gXhmzQztE ). I think Google did this, to get people moving to Chrome since the majority will think this is a browser issue, nobody would expect YouTube to purposely doing this. In the attached Screenshot you can see that YouTube checks the user agent of browsers to see if it's Edge, Firefox or not. You can bypass this by changing your User agent to chrome.

Edit: Due a lot of people saying a lot of different things abt it, I want to say that I'm not 100% sure abt how exactly this works, there is a inbuild delay by Google, but who is actually affected, there are a lot of different opinions abt it. I wasn't able to verify this myself in LibreWolf, but this could be the case due my intensive hardening I did and this is just a result of what I found in the code and what Mental Outlaw and others shared across social media, if you got different or additional infos abt this feel free to comment and I suggest everyone ti also check the comment section.

@privacy

pkill ,

Not my ss

chicken ,

It would be a lot more conclusive if you could find somewhere the isGecko function is being used in association with a delay though, there are other things they could use it for.

melroy ,
@melroy@kbin.melroy.org avatar

I saw today the infamous pop-up of YouTube again that they will block the video player after 2 more videos if I keep using uBlock Origin. ** Google.

Automated_Footprint ,
@Automated_Footprint@sh.itjust.works avatar

Don’t know maybe they modify the app with malware. Better avoid

melroy OP ,
@melroy@kbin.melroy.org avatar

@Automated_Footprint
@mateomaui

For completeness. Here are all the fake sites.

jlou ,

"[GNU/]Linux being secure is a common misconception in the security and privacy realm."

https://madaidans-insecurities.github.io/linux.html

"[GNU/]Linux is thought to be secure primarily because of its source model, popular usage in servers, small userbase and confusion about its security features. This article is intended to debunk these misunderstandings".

Based on this, one should try to do as much as possible on a GrapheneOS device

@privacy

mintycactus ,
@mintycactus@lemmy.world avatar

I found the site really interesting and found a lof of usefull info. I will continue using Linux anyway.

Pantherina ,

Yes agree on that. Linux needs more standardization.

It is big problem, because it lacks the structure somehow. If there is easy tooling for app development, as Flatpaks with all the modern security practices (safe language, portals, modern GUI, Wayland, Accessibility APIs) then developers could easily follow these rules and create good apps more easily.

Currently app development is not easy and thus also very random.

voxel ,
@voxel@infosec.exchange avatar

Good news! Brave for Android now let's u use your favorite uBlock Origin Blocklists!

Under Settings > Brave Shields & privacy

Can you now add custom filterlists and edit Brave's default selection of the already avaible filterlists. Some of you now that this was possible before too (via brave://adblock) but at this time it had no UI and wasn't a official feature, now you can easily add, remove and customize fiterlists via the the settings.

#brave #bravebrowser #browser #privacy @privacy

glad_cat ,

Crypto buttons as an opt-out feature for every Reddit link.

Also this: ghacks.net/…/brave-is-installing-vpn-services-wit…

If you still trust them, I have no hope for you.

paradox2011 , (edited )

That’s good to see a comment with a link, that’s what helps people make informed decisions, not simple statements of opinion.

voxel , (edited )
@voxel@infosec.exchange avatar

Warning to all Brave Browser Users

Blocking variations.brave.com which is used for A/B testing could potentially break Brave's functionalities. For me did Brave's "forgetful browsing" feature broke which seems to be disabled by default if you block this domain.

@privacy @privacyguides

Stahlreck ,

So if you may change some configs, you mayyy be fingerprintable.

You are fingerprintable either way unless you go all out. Going full on Arkenfox/Librewolf mode (with all settings enabled that decrease convenience) you can at most fool naive fingerprinting. For the more advanced one you need Tor.

And even for naive fingerprinting, unless you use Tor or a VPN (which you would have to trust) your IP alone + the fact that you use FF (which a few % of people worldwide do) along with some other basic info about your PC will make you very unique.

Pantherina ,

A good VPN is a must of course.

voxel ,
@voxel@infosec.exchange avatar

Say (an encrypted) hello to a more private internet.

https://blog.mozilla.org/en/products/firefox/encrypted-hello/

Nothing big, but kinda interesting. I'm excited to see how this will go 👀

@privacy

library_napper ,
@library_napper@monyet.cc avatar

Do web servers support it tho?

ReversalHatchery ,

They can’t get info that has been deleted yes, but I think it might be possible to coerce the company into starting to collect logs, legally or not.

voxel ,
@voxel@infosec.exchange avatar
CausticFlames ,
@CausticFlames@sopuli.xyz avatar

I disagree that you are inherently in a worse position simply because you dont know enough to take a peek at the code or harden things. I think that again, simply being such a massive project linux gives a trickle down effect to normal users. Even as a normie, you are safer on linux than on windows, full stop. As for github scripts, thats an entirely different subject because yes, open source CAN be dangerous still (just like proprietary can).

zwekihoyy ,

what makes you suggest you are safer on Linux?

voxel ,
@voxel@infosec.exchange avatar

Ecosia, is it really so private?

A article about if Ecosia is really a private search engine.
I did spend a lot a time to analyze and investigate Ecosia, I hope this article helps people to better understand how private is Ecosia really and which are the downsides of it. Is the first article I ever written, so it isn't perfect. I'm open for feedback!

https://cryptpad.disroot.org/pad/#/2/pad/view/qQG0ryE6n8EnZSTgCLMd4m87I7hEOoOkokkPPCj+lDs/embed/

@privacy

Mubelotix ,
@Mubelotix@jlai.lu avatar

Dude forgot to stop reddit protests on lemmy

Manu ,

@voxel @privacy very informative, thanks!

voxel ,
@voxel@infosec.exchange avatar

So, I'm interested how the implementation of "Perfect Forward Secrecy" in Signal looks like, like does every messages has a different encryption key? or does it change over time like does? I tried to find any official documention of this, sadly did not find anything.

Thats why I'm asking, does anyone of you know smth about this and maybe can provide a link to a official source?

@signalapp @SignalUpdateInfo @privacy

sexy_peach ,

Diffie-Hellman is only a key exchange protocol and does not provide forward secrecy. Imagine that my and your client figure out our shared secred (key) with DH, then encrypt our chat with that. If someone breaks only a bit of our traffic, then they can read newer messages as well.

en.wikipedia.org/wiki/Forward_secrecy

Forward secrecy means that at any point messages are encrypted with keys that aren’t reused forever, which means if an attacker can intercept traffic and read a bit, or crack the encryption, that they don’t automatically get access to our future conversation as well.

solrize ,

The PFS comes from deleting the secret DH parameters after you are done using them.

thenexusofprivacy ,
@thenexusofprivacy@infosec.exchange avatar

College Board shares SAT Scores with Facebook, TikTok, and others

https://gizmodo.com/sat-college-board-tells-facebook-tiktok-your-scores-gpa-1850768077

"Gizmodo observed the College Board’s website sharing data with Facebook and TikTok when a user fills in information about their GPA and SAT scores. When this reporter used the College Board’s search filtering tools to find colleges that might accept a student with a C+ grade-point average and a SAT score of 420 out of 1600, the site let the social media companies know. Whether a student is acing their tests or struggling, Facebook and TikTok get the details.

The College Board shares this data via “pixels,” invisible tracking technology used to facilitate targeted advertising on platforms such as Facebook and TikTok. The data is shared along with unique user IDs to identify the students, along with other information about how you use the College Board’s site. Tok, and a variety of companies."

@privacy

skymtf ,
@skymtf@pricefield.org avatar

Ugh I always knew the college board was sketchy, this is a whole different level of exploitation.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • privacy@lemmy.ml
  • All magazines