• 0 Posts
  • 52 Comments
Joined 1 year ago
cake
Cake day: April 4th, 2025

help-circle


  • Looks like you’re worried about highly motivated hackers targeting you specifically.

    Not really, no.

    Not patching security vulnerabilities leaves you open to not just targeted attacks but also wide spread attacks, which also use the same exploits that nation states use. Just look at the recent Coruna debacle.

    Let me bring another analogy. You live in a town where theft and burglary is rampant. You have a lock on your front door but the lock is based on a legacy design which is not hard to pick. Sure, no one has broken into your home yet but if you keep using an antiquated lock, it’s a matter of when not if. And it’s not like only rich and important people’s houses are broken into. Everybody who’s vulnerable can and eventually will get attacked. If I had to choose between risking burglary and paying a little extra for a better lock, I’d choose the latter.

    Maybe you’re a political activist or just very rich.

    I don’t have to be a political activist to take measures to protect myself online nor rich to afford a used Pixel.

    Sacrificing all this just to be protected from very unlikely attacks is simply not worth it.

    To each their own, I guess.

    You can permit some connections temporarily or permanently for specific apps only.

    So you mean like OpenSnitch? If so, Rethink also has that.

    EDIT: grammar


  • So you’re excusing lazy patching with improbability? Personally, I wouldn’t bet my privacy and security on a criminal’s lack of motivation.

    It’s like eating candy from a bowl in which 5 are poisoned and 5000 are harmless. It’s improbable for you to pick a poisoned candy but because the consequences of choosing wrong are so perilous, I wouldn’t choose at all or choose a bowl with less poisoned candy.

    GrapheneOS doesn’t have good tools to monitor and block trackers.

    Yes it does. Rethink has (in addition to other awesome features) a local DNS blocklist option which you can configure to automatically block almost all telemetry apps send.





  • TL;DR The above commenter is spreading FUD. GOS will work fine and allow sideloading.

    Stop spreading FUD. Google kills sideloading on Google certified ROMs. Being Google certified doesn’t mean you have more features than ROMs which aren’t certified. Only Google certified ROMs lose the ability to sideload and have to adhere to all Google Play policies. Meaning GOS loses its certified status but doesn’t lose the ability to sideload. The only way in which GOS might be coerced to disable sideloading is if Google pushes these changes upstream to the AOSP and even then forking is always an option. Also when has Google ever hinted at disabling flashing custom ROMs? It might be right down their alley but I wouldn’t make such claims without citing sources.

    Just as a side note: Android ≠ AOSP. This is relevant as many people misunderstand the news they read. When Google changes Android (Google’s proprietary AOSP “distro”) it doesn’t necessarily mean that changes are coming to the AOSP or GOS which is also an AOSP “distro”.

    Reading through this forum thread is recommended.











  • A reasonable argument and I agree that impersonation is still possible without the scammer taking the excact username but it’ll still be easier to fool your contacts when you don’t have an active account.

    For example consider two worlds - in one you have an instagram account, in the other you don’t. The world in which you have the account, people who only know you through that account and don’t use other platforms where you’re on, are less likely to fall victim to scams because they can always verify that the scammers account isn’t your account. In the other world this isn’t possible and thus it is more likely people who don’t know you directly will believe the scammer.

    Also my point on the cost of the account still stands. I do admit that having an open account which gets scraped is an issue but if you have a “private” account, most of the 3rd parties lose access to it’s content. Although I’m sure three letter agencies and meta have a custom API which can query all accounts, public or private, the point you’re trying to make is moot, as if we’re talking about opsec, if you already have an (insta) account, all it’s data is logged somewhere and it likely won’t be deleted in the near future.



  • Unlike most other messengers, Delta Chat apps do not store any metadata about contacts or groups on servers, also not in encrypted form. Instead, all group metadata is end-to-end encrypted and stored on end-user devices, only. Servers can therefore only see:

    • the sender and receiver addresses and
    • the message size.

    By default, the addresses are randomly generated. All other message, contact and group metadata resides in the end-to-end encrypted part of messages.

    https://delta.chat/en/help#message-metadata

    > Doesn’t store any metadata on servers

    > Servers still see the sender and reciever and the message size

    Explain how this is not contradictory.

    Furthermore my original argument on protocol blocking still stands (if almost all communication platforms rely on a widely used protocol, the blocking of which is infeasble, then how is this a feature noone else besides deltachat has).

    And as the FAQ brilliantly illustrates, you don’t have to block the mail protocol to inhibit deltachat users from communicating. All you have to do, is just shut down the relays which are crucial to masking your metadata.

    Speaking of relays, all they do is transfer the trust. Without using relays you have to trust that normal mail servers wont’t log your activity (they do). With relays you have to trust that the relay operators won’t log your activity.