Posts by nonoj

You'll never guess which mobile browser is the worst for data collection

FWIW

I don't randomly surf so much so there are very few sites that I have a problem accessing. But when i do anything online I use the following methods, in descending order:

1. Tor

2. Mullvad

3. DuckDuckGo (also go-to for any YT videos)

4. If none of them work then I don't need to access the site.

I know that this article only focuses on browsers but browsers are only one part of my snoop-avoiding suite.

I use a VPN, Little Snitch, a virus/malware checker. I use E2EE for cloud storage, texting, email, voice, and video with whoever in my very small circle is willing to do the same.

Each online organization gets a unique alias email address so I can specifically change/block that email address without affecting any others. Also very handy in figuring out who has sold my information. When I discover that has happened I send an email to the organization informing them I don't appreciate their selling my information. In one case an investigation on their end revealed a breach and I received a thank you response.

Due to their limitations I do no surfing on my phone or notepad. Old school; whatever it is can wait until I get home where I have all the privacy tools I can think of on my desktop.

Do I think I have all the options covered? Emphatic >nope< on that one. But its good enough for now until I encounter something else I want to add.

All time favorite quote from the movie Anon: "It's not that I have something to hide; I have nothing I want you to see."

( I usually paraphrase it as, "It's not that I have something to hide; I just have nothing I want to share with you." Ever so slightly more "in your face" than the original quote. )

Chrome Web Store warns end is nigh for uBlock Origin

I never used Chrome and never plan to. As a general rule I avoid any Google products wherever possible.

I used Firefox for a long time but got frustrated at the number of connections it was making behind the scenes. Tried Brave but didn’t care for its ad handling (back when Brave allowed certain ads to come through).

My most recent default browser is Mullvad which comes with uBlock Origin. I use DuckDuckGo browser with its marvelous Duck Player when I want to watch a YT video without all the ads and distractions.

Zuck dreams of personalized AI assistants for all – just like email

PS: For some reason I foresee AI being used to obfuscate AI. Now THAT could be interesting...

This advice goes a ways back: If you want to keep something private don't put it online.

I know that certain businesses (ex. healthcare, investment, government) require truthful personal information. But for other organizations, social media in particular, there is the option of not providing it.

If I someday receive a solicitation targeting a 24 year old descendant of the Inca Empire living in Botswana with a degree in lead typesetting and making €100,001 a year, you won't be able to wipe the smile off my face.

Oops. Apple relied on bad code while flaming Google Chrome's Topics ad tech

Yes, given the present state of mass surveillance, tracking, data collection and sharing, it is nearly impossible to avoid use the internet in a private way. But rather than give up entirely I choose to reduce my digital fingerprint where I can. That way if nothing else I can say, even if only to myself, whatever information was gathered was done without my consent.

My current configuration is Mullvad browser, VPN, and Little Snitch along with a security suite for live virus scanning. If I want to watch a YT video I drop the YT link into the DuckDuckGo browser where I have Duck Player defaulted so I can watch the video w/o ads, suggestions, and all the other unnecessary stuff YT adds to their videos.

I also have well over 100 email addresses, one for each online entity I have a relationship with. If the entity suffers a breach I simply change the email address I have for that entity and discard the old one. And if I receive spam on one of those email addresses, I know exactly which entity to contact about it. In one case, my doing that led them to discovering some bad code that was broadcasting email to the wrong people. In another case the entity had shared my email address with a marketing firm and I started receiving spam. I tore the entity a new one, discarded the email address an never heard from either the entity nor the marketing firm again. Had I used a single email address I wouldn't have even known who I got the spam from.

I am also providing misinformation where I can. Age, gender race, religious affiliation, income, work experience and so on I gladly fill in with anything but the correct information. If I someday receive a solicitation targeting a 24 year old descendant of the Inca Empire living in Botswana with a degree in lead typesetting and making $230K a year, you won't be able to wipe the smile off my face.

Watch out for rogue DHCP servers decloaking your VPN connections

My limited understanding of E2EE is that encryption occurs before it leaves the device, be it a cell phone or desktop.

If intercepted as described in the article there’s only an unencrypted file to look at.

If this is all true then maybe ensure the important communication is all performed using E2EE?

Prof asks court to protect his Unfollow Everything 2.0 extension from Facebook's ire

Re: Killing the connection?

Thank you again!

Re: Killing the connection?

Thanks - all good info even for someone who will have to look up everything you said!

I forgot to say in my post that I also have a VPN which uses WreGuard (whatever that is) and is always in use.

Killing the connection?

I use DuckDuckGo browser which stops many trackers. I also use Little Snitch… when I see a connection to FB or anything else come up that is not needed for a website to work I deny it and often blacklist it. So I >think< I’m stopping any trackers from “calling the mother ship” even if they get past DDG’s blockers. I frequently remove all browser history, cookies, etc. when going from one site to another and delete all temporary connections needed for previously visited sites.

I don’t know if this is the most effective way of handling all the tracking getting thrown at us… if anyone has any other suggestions please let me know!

Drivers: We'll take that plain dumb car over a flashy data-spilling internet one, thanks

Another vote here for Affinity and one for DxO as well. Affinity Photo replaced Adobe Photoshop, Affinity Designer replaced Adobe Illustrator, Affinity Publisher replaced Adobe InDesign. Affinity has no Lightroom product so I use DxO PhotoLab to replace Adobe Lightroom. These Affinity and DxO applications more than adequately do the job without subscriptions; I own each piece of software I use outright and only upgrade when I see a reason to.

Besides all that, my clients couldn’t care less which applications I use. They’re only interested in the unique style, level of quality and professional business relationship I offer. And the responsibility for providing those fall for the most part on me - not the tools I use.

Uncle Sam will pay for your big ideas to end AI voice-cloning fraud

Re: Respond to fake recording calls

“Don’t call without an apointment.”

LOL! Good one.

T-Mobile has some kind of traceback feature that displays “Scam Likely” on the phone when the caller’s number fails the traceback. The family joke used to be “Mr Likely called a couple of times today.” T-Mobile also offers the option of blocking callers who fail the traceback. We turned on the blocking option on and no longer receive those kinds of calls at all. So far, we’ve not missed a single important call with the traceback feature and blocking turned on.

The gov could require that all phone carriers have the traceback feature on by default and blocking as an option. Receiving a “Scam Likely” warning would be an immediate heads up that the caller might not be who they appear to be (or rather who they sound like). After that it's on the person receiving the call as to whether to answer or not.

The truth about Dropbox opening up your files to AI – and the loss of trust in tech

Re: Dropbox have been dicks in the past

I used Dropbox, sparingly, until Condoleeza Rice was appointed to the board in 2014. I immediately deleted everything on my Dropbox account and deleted the account. I then wrote an email to Drew Houston explaining my departure and asking why they would do such a thing. The condescending boiler plate response was not worth saving.

Adobe warns it may face massive fines for subscription cancellation practices

another dissatisfied user

I shifted from Adobe to Affinity a long time ago. First Affinity Photo then Designer and Publisher as they came out. DXO PhotoLab and Photo Mechanic replace enough of Adobe LR for my needs.

Last two years I was invited to participate in a 1-month project by a client who insisted on InDesign for the final project. The first year I was able to subscribe for a single month without issue. The next year the subscription/cancellation process changed so much and customer service was so awful I wound up getting charged a full year of Creative Cloud for a single month of use. After multiple attempts to get the issue rectified I gave up, wrote up a complaint and a searing survey response. It’s been almost a year later have not received a response. I’m not holding my breath.

If the FCC punishes Adobe for its cancellation processes, good. In the meantime anyone who is interested in finding out why I have nothing to do with Adobe will get an earful.

PS: From a security standpoint, Adobe is a nightmare as well. I was able to shut down, literally, dozens of connections attempted by Adobe products that were attempted, literally, all day long whether I was using their applications or not. Denying all but 3 of those connections had no affect on Adobe apps… so why were all the other connections being made? Installation required unfettered access to my Mac Keychain and several undocumented entries were made to the Keychain. When i used Adobe’s uninstall app dozens of files and folders were left behind, even some apps that still loaded on reboot. I had to manually remove Adobe entries from Keychain, go into Terminal to manually get rid of hidden files. And every interaction with Adobe using a browser meant several persistent trackers dropped on my computer. All this is all the more reason to walk away from Adobe.

Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

question from a layperson...

As a layperson with little expertise in this area, my question is what I can do about it. Does it help to use Little Snitch? NoScript? TOR browser? If I keep a list of the critical url (banking, bill pays, etc, entities only in my country) and only use them, am I still at risk for those? Or is my exposure limited to entities based outside my home country, like The Register?

Hopefully there is some direction I can take that doesn’t require a crash course in a topic I have little understanding of. One commenter mentioned changing certificates in Firefox… I wouldn’t even know where to start.

I gather from the comments I’ve read so far that there is no out-of-the-box solution. Also, I live in the US, so I know very well there is little I can do if the government decides look at my internet usage. But maybe there are things I can do now that will reduce exposure to man-in-the-middle attacks by smaller bad actors wanting to do bad things.

Thanks for any serious replies… even if they are, “Sorry, you’re out of luck."

Apple warns of three WebKit vulns under active exploitation, dozens more CVEs across its range

Re: who knew Amnesty had a Security Lab?

Just sayin’

I agree with your point but I took "Just by the way, who knew Amnesty had a Security Lab?” to be asking for a show of hands not an admission of ignorance.