Privacy Trash Panda

Digging through trash to protect your treasure

[Privacy Trash Panda @TrashcanPrivacy]

They always want to invade your privacy. There’s often ways around it, but they try to stop you.

One day there may not be. That’s the day I’ll go in my trash can & not come out on here.

Keep protecting your treasure 🦝🦝🦝

[Global Dissident @GlobalDiss]

🚨🇪🇺 EU wants INTERNET BY PASSPORT - and plans to block VPNs to enforce it.

“The new age verification system cannot be bypassed via VPN.”

Their plan is totalitarian surveillance! 1984 is coming!

[Reclaim The Net @ReclaimTheNetHQ]

Apple just nuked Hide My Email’s best privacy trick. New aliases are now (at)private(dot)icloud(dot)com - literally labeling them “this user wants to stay anonymous.”

Services can now mass-block every single one with one domain filter, while leaving regular (at)icloud
.com untouched.

The plausible deniability that made Hide My Email useful, the inability for a service to prove an address was anonymous, disappears.

[Shoshana Weissmann, Sloth Committee Chair 🦥 @senatorshoshana]

.@SenTedCruz and @RonWyden are doing incredible work with their JAWBONE Act!

It is not the place of government to force private actors to censor free speech. It needs to stop.

But information sharing is also legitimate. Their work here strikes an important balance

[Shoshana Weissmann, Sloth Committee Chair 🦥 @senatorshoshana]

Extremely important read

"In the name of safeguarding democracy, open societies are importing the policies of authoritarian regimes they rightly identify as enemies of free expression."

"Diversity of opinion and criticism of political decisions, whether domestic or foreign in origin, lie at the very heart of free speech. Labeling such criticism as an attack on democracy implies that democratically elected leaders’ policies and priorities should be insulated from scrutiny" @JMchangama @ForeignAffairs

[Rebellion Aider @RebalAid]

Age check technology as noted here are unreliable compared to targeted surveillance, in contrast to mass surveillance, which is resource consuming and completely ineffective at the job it does. LLM models who are unreliable at this shouldn't even be used in production like this.

[Wall Street Apes @WallStreetApes]

Apple is releasing an update to Siri that will allow their AI agent to read every part of your phone

This includes your messages, email, notes, files, photos, calendar, app content and more

This is fully mass surveillance and data gathering, it’ll even have access to your health data and location history

Just think it US Government had a back door into this Siri AI system, this isn’t something that’s unlikely. They had a backdoor into old Twitter and they have worked very closely with Apple in the past

Siri even came from US government, from DARPA

[Shoshana Weissmann, Sloth Committee Chair 🦥 @senatorshoshana]

Nearly a million passports and photo IDs were left unprotected on the public internet

But don't worry guys age verification is going great!!

Great reporting from @verge

And this is for a purpose I'm understanding of age verifying people for!

[Privacy Trash Panda @TrashcanPrivacy]

They never cared about your age. It’s the (ID) verification they want

[L🇬🇧as Ohl @lukas_ohl]

Tech companies: “Our clever cryptographers have found a way to preserve privacy and 100% anonymity while also performing age checks.”

UK govt: “No, that’s not what we wanted!”

[Privacy Trash Panda @TrashcanPrivacy]

@lukas_ohl They never cared about your age. It’s the (ID) verification they want

[Privacy Trash Panda @TrashcanPrivacy]

@Arwenstar They already ask for ways to ID you (if you do take appropriate measures) with your email & phone number.

When they try to require an ID upload, I’ll be going to the dumpster in the sky. I like social media. I don’t need it.
https://t.co/wBTqG8rfsc

[Privacy Trash Panda @TrashcanPrivacy]

They always want to invade your privacy. There’s often ways around it, but they try to stop you.

One day there may not be. That’s the day I’ll go in my trash can & not come out on here.

Keep protecting your treasure 🦝🦝🦝

[Tuta @TutaPrivacy]

Euro-Office just launched its first stable version 🇪🇺🔥

We're excited to be part of this movement to bring digital sovereignty to Europe and beyond with @Nextclouders @XWiki @openproject @xwikiorg @soverinteam #eurostack 🎉

[Privacy Trash Panda @TrashcanPrivacy]

@apple never truly cared about your privacy. They only use “security” as a metric for data they collect on you.

[Berrrnado @bernard_parah]

The UK is insane.

[Privacy Trash Panda @TrashcanPrivacy]

Start refusing services that require ID checks. If it’s inconvenient to do so, they definitely want it that way.

Most people lived without using the internet 30 years ago. We can cut out a lot of “convenience” to restore our privacy.

[Naomi Brockwell priv/acc @naomibrockwell]

Everything on the internet will require an ID check soon.
And the government will monitor everything you do, pretending they don't need a warrant because you "voluntarily" gave your data and identity information away.

[Darren of Plymouth @DarrenPlymouth]

You can opt out of the NHS Palantir data transfer.

Instructions below.

Please repost widely.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: ServiceNow has been breached. Customers are reporting unauthorised access to their instances.

One customer states their security team reported this vulnerability to them, and they closed the case twice, saying they had already known since the 7th of April.

[Bernie @Artemisfornow]

🚨WARNING the bit Starmer isnt telling you is... this sort of device technology is called Client-Side Scanning.

It is already built into the Ofcom regulated Online Safety Act through “accredited technology” notices. The EU has been pushing similar rules through its Child Sexual Abuse Regulation, known as “Chat Control”.

It basically means phone companies and platforms can be pushed to scan messages, images and content BEFORE you send them, then either allowing them to be sent or blocking/reporting them.

Once the precedent is set, "to protect children", it can easily be widened to block whatever government decides is “harmful”.

And that's how you go from child safety to state approved speech.

TA DAAAA 🚨

[Windscribe @windscribecom]

If the government wants to stop crime, why not focus on the countless break-ins, car thefts, assaults, robberies done by repeat criminals who get a slap on the wrist by judges each time?
Why does crime prevention start with stripping all citizens of their privacy rights?

[GrapheneOS @GrapheneOS]

Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google's Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.

The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.

Apple's Privacy Pass brought hardware attestation to the web to help with passing captchas on their own hardware. Many people saw that as harmless since few sites would be willing to lock out non-Apple-hardware users. Apple and Google are both likely to bring broader hardware attestation to the web.

Google's reCAPTCHA is planning an approach where they use Privacy Pass on Apple hardware, their own approach on Google Mobile Services Android devices and a QR code scanning system to require an iOS or Google certified Android device for Windows and other systems:

https://t.co/7rQnioRa8A

Banking and government services increasingly require using a mobile app where they can use attestation to force using an Apple or Google approved device and OS. Apple's privacy pass, Google's 'cancelled' Web Environment Integrity and now reCAPTCHA Mobile Verification are bringing this to the web.

Current media coverage for reCAPTCHA Mobile Verification misunderstands it and the impact of it. They're bringing a hardware attestation requirement to Windows, desktop Linux, OpenBSD, etc. by requiring a QR scan from a certified smartphone to pass reCAPTCHA in some cases. They could expand it more.

Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web. Google defines certification requirements for Android which includes forcing bundling Google Chrome, etc. It's enormously anti-competitive.

Google's Play Integrity API bans using GrapheneOS despite it being far more secure than anything they permit. It also bans using any other alternative. This isn't somehow specific to an AOSP-based OS. You can't avoid this by using a mobile OS based on FreeBSD instead. You'll just be more locked out.

Google's Play Integrity API permits devices with no security patches for 10 years. The device integrity level can be bypassed via spoofing but they can detect it quite well and block it once it starts being done at scale. The strong integrity level requires leaked keys from TEEs/SEs to bypass it.

It doesn't provide a useful security feature, but it does lock out competition very well. Services requiring Apple App Attest or Google Play Integrity are primarily helping to lock in Apple and Google having a duopoly for mobile devices. Play Integrity is more relevant due to AOSP being open source.

Governments are increasingly mandating using Apple's App Attest and Google's Play Integrity for not only their own services but also commercial services. The EU is leading the charge of making these requirements for digital payments, ID, age verification, etc. Many EU government apps require them.

Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.

reCAPTCHA Mobile Verification will currently work with sandboxed Google Play on GrapheneOS but it clearly exists to provide a way for them to start using hardware attestation on systems without it. People without an iOS or Android device will be locked out when this is required even without that.

This isn't about security or any missing functionality. GrapheneOS can be verified via hardware attestation. Google bans using GrapheneOS for Play Integrity because we don't license Google Mobile Services and conform to anti-competitive rules already found to be illegal in South Korea and elsewhere.

Services shouldn't ban people from using arbitrary hardware and operating systems in the first place. Google's security excuse is clearly bogus when they permit devices with no patches for 10 years but not a much more secure OS. It's for enforcing their monopolies via GMS licensing, that's all.

[Mullvad.net @mullvadnet]

This is what the UK spyware proposal means.

There must be government spyware on every mobile device. It shall watch everything that happens, including always watching the screen, looking for things the government disapproves of.

When anything is flagged by the software as something the government doesn't like, the software must block it from being sent or displayed (in realtime).

The user of the device must not be able to shut this watching and blocking off. The only way to shut it off would be to ask the government or its proxies to do so for you, at their discretion.

Therefore the whole device must be locked down. Administrator rights and the decision of what software or operating system to run or not to run must be taken from the owner/user and handed to the government and its proxies.

Apple and Google are themselves working hard to lock down the devices they are involved in to shut out competition and establish a duopoly.

The UK government says it is "working closely" with Apple and Google and currently they synchronise and coordinate their communication on this subject.

The UK government is now proposing to mandate what would otherwise be illegal anti-competitive practices.

@GrapheneOS on the Apple and Google duopoly:
https://t.co/rbRmcUDTRu

Statement from @signalapp
https://t.co/vJILcSrs4s

@ReclaimTheNetHQ on the state spyware:
https://t.co/3FCi06bP77

The government announcement:
https://t.co/ynYjR3DIRo

[Ben Graham @BenGrahamUK]

Well done to Signal for speaking up.

It's obvious that this isn't really about keeping children safe, it's about giving the state greater surveillance powers over ordinary citizens.

The same politicians claiming the moral high ground on child protection are the ones who voted against a national rape gang inquiry.

Forgive me if I don't take their lectures on safeguarding seriously.