• 6 Posts
  • 216 Comments
Joined 11 months ago
cake
Cake day: February 10th, 2024

help-circle

  • Facebook/Meta (the owners of Instagram) have been extorting phone numbers and IDs from people for years. They don’t target everyone all at once, but a few hundred here, a few hundred there. I don’t know if they do it for all new accounts, but the practice is definitely not new.

    This is one of the many reasons why I stopped using their services.



  • Why would they do that? They are probably american feds.

    Maybe, but I can think of another possibility:

    There is a certain personality type that loves to feel like an authority in whatever community they frequent, and will jump at the chance to criticize someone whose concerns, experiences, or approach to solving a problem differs from their own. It has been very common in tech support forums for ages, and I think it’s becoming common in privacy forums as the topic becomes important to more people.

    So, while it’s possible that some of what you are describing comes from government agency-sponsored influence campaigns (this would not surprise me), I strongly suspect that at least some of it is just mundane egotism. There are a lot of jerks on the internet. Many of them even believe they’re being helpful.

    Whatever the reason for it, I agree with you: Those people should be told to knock it off, and if they don’t, then they should be shown to the door.




  • This article mentions using Global Privacy Control as a replacement for Do Not Track, but doesn’t bother to explain what GPC does. Its adjacent article incorrectly claims that GPC uses the DNT: 1 header field, fails to explain further, and links to a Mozilla page that doesn’t explain it, either.

    Even the GPC web site fails here, offering several pages of vague, abstract fluff about their intentions and a useless document full of marketing industry acronyms, without anything substantial about how it works. The single mention of a spec fails to state where to find it. The closest it comes is a tangential sentence containing a broken github.io link.

    Finally, and only because I happen to know github.io’s URL format, I was able to guess my way to an organization page, and from there to a project page, which has a README file containing a footnote linking to the proposed spec:

    https://w3c.github.io/gpc/

    Geez… it’s as though the people involved don’t want anyone to know how this proposed safeguard is supposed to work.

    After reading it, it looks like these are the main differences in Global Privacy Control vs. Do Not Track:

    • Replaces the DNT: 1 header field with Sec-GPC: 1.
    • Adds a javascript property to indicate the same thing.
    • Does not honor preference changes after the first navigation to a site. (Having changes respected apparently requires clearing site data from the browser and reloading. A helpful browser might prompt the user to do this.)
    • Defines a way for sites to indicate that they are aware of GPC (but does not require them to honor it).
    • Expresses a wish that your data not be shared, but says nothing about it being collected.
    • May be considered legally binding in some jurisdictions. It’s not clear whether the few that currently recognize it will enforce it in any meaningful way.



  • Neither isolates everything. Both have some isolation features. The features enabled by default vary from package to package, so you would have to look at the permissions on each package to find out.

    For a bit more isolation than a flatpak/snap, I suggest creating a separate user account for running chromium (or any other moderately nosy software). Note that linux lets you log in to two accounts at the same time, each with its own desktop, and switch between them. Check out your desktop environment’s “switch user” function.

    For even more isolation, you could run chromium in a hypervisor-based virtual machine.






  • Matrix messaging apps. It’s nice to have modern messaging features, end-to-end encrypted, with no single point of failure, no Google involvement, and no phone numbers. I expect to start recommending it widely when the 2.0 features land in the popular clients.

    WireGuard VPN. It’s fast, even on low-power devices.

    Self-hosted Mumble. Excellent low-latency voice quality for chatting or gaming with friends.

    Radicale, DAVx⁵, and Thunderbird, for calendar and contact sync between mobile and desktop, without handing the data over to Google or anyone else.




  • The security provided by a browser is constantly changing, as the vulnerabilities, attacks, and countermeasures are constantly changing. It’s a cat-and-mouse game that never ends.

    The privacy provided by a browser would be difficult to measure, since it depends a lot on browsing habits, extensions, code changes between versions, etc.

    There’s no good way to calculate a metric for either type of protection, and even if there was, the metrics would be obsolete very quickly. For these reasons, I wouldn’t have tried what you attempted here.

    However, there is a very simple way to compare the major browsers on privacy and reach a pretty accurate conclusion: Compare the developers’ incentives.