Em Adespoton

  • 0 Posts
  • 326 Comments
Joined 1 year ago
cake
Cake day: June 4th, 2023

help-circle

  • One clarification: carrier towers can still find a phone; GPS is passive; your phone locates itself in relation to the GPS satellites.

    Most phones are also broadcasting WiFi MAC IDs and Bluetooth MACs, plus hardware and capability strings over Bluetooth. And then any apps you’ve got loaded may also be calling home with your location unless you have that disabled and rotate your ad ID regularly.

    [edit] also worth pointing out that even if you turn a smartphone “off” it still pings the local cell towers with its IMEI regularly. Surprised me the first time I witnessed that.





  • I keep all my traffic encrypted, use my own DNS, and run a VPN so that anytime I’m away from my place, my traffic is tunnelled through my home setup, which includes a piHole.

    If I need more than that to obscure the traffic source, it goes through TOR.

    I also run a few public web services off the same IP, so the traffic coming out of my address has plausible deniability.

    Plus, I use tracker and ad blockers in all my browsers/devices, of course, as well as block JavaScript by default.


  • Generally, it’s best to go by capability, not by policy.

    Any company has to do what the government of its country says. This goes both for the VPN company, AND any exit node country. So you have to always assume that whatever country your exit node is in has full access to the data exiting the VPN there.

    Then there’s the technology being used, the expertise with which it is configured, and finally the policies in place for handling and storing your PII.

    Mullvad has a strong record on all accounts, even as far as just giving a year’s notice that it will stop supporting OpenVPN.

    AirVPN has virtually no track record, fewer details on hardware, configuration, expertise and PII handling, and it’s in the EU, so has to comply with EU laws as well as Italian laws.

    Being in the EU means it has to comply with the GDPR, which does have its benefits. But it also means an EU member state could put a gag order on your account and be monitoring all your data without you ever knowing.

    So it all comes down to who you want your data to be private from and why.

    Personally, I avoid all public VPN services as much as possible, and assume that the only thing they’re really doing is tricking the next service in the hop as to what country I’m connecting from.









  • Don’t know much about it, but it appears to be an Android front end for ClamAV.

    Unless there’s a team adding ClamAV signatures for APKs, it’s not going to be all that useful to actually protect an Android environment.

    [edit] ah; looks like it’s bootstrapping itself somewhat with ESET APK signatures.

    I wouldn’t use it in its current state, but it shows some promise. I’d wait for the proposed feature list to get consumed a bit and for someone reputable to audit it.





  • Of course, I generated a PGP keypair back in 1993, stuck it on the MIT keyserver, and it’s there to this day… with a throwaway email address that no longer belongs to me and hopefully no longer exists. The good news for me is that younger me was thoughtful enough to use a pseudonym and non-identifying address, so while I’ve still got the private key around somewhere, it won’t be obvious to someone who steals the email address who that keypair belongs to… and only I have the private key.

    I also recall thinking the default algorithm and key length weren’t future proof so spent a good 12 hours generating something stronger, which I believe is still secure today.


  • PGP = Pretty Good Privacy. It’s both a company and the original product released by Phil Zimmerman that has since been mostly replaced by Gnu Privacy Guard (GPG).

    These products create paired secret keys using the ciphers of your choice. You make the public key available to the public and keep the private key for yourself.

    Then, you can either sign or encrypt some content with your private key, and anyone with your public key can validate that it was you who signed or encrypted the file.

    You can also use someone else’s public key to encrypt a file, and then only the holder of the paired private key can decrypt it. And they can use your public key to validate that it was you who encrypted it.

    Email addresses are optional, but can be embedded in the keypair. This means that someone else can verify that that address is linked with the identity of that keyholder, which assists in getting encrypted content to the right recipient, validates any signed/encrypted email sent from that address, and provides a memorable link to the public key’s owner.