5 ms·

Absolutely! The important bit is that users have no choice in the matter. They're pushed into agreeing to whatever ToS and updating to whatever software version

by jchw 2y ago

Absolutely! The important bit is that users have no choice in the matter. They're pushed into agreeing to whatever ToS and updating to whatever software version. The backlash against Microsoft's Windows Recall should serve as a good indicator of just how deeply people have grown to distrust tech companies. But Microsoft can keep turning the screws, and don't you know it, a couple years from now everyone will be running Windows 11 anyways. It's the same for Android. If you really want your Android phone to be truly private, you can root it and flash a custom ROM with microG and an application firewall. Sounds good! And now you've lost access to banking apps, NFC payments, games, and a myriad of other things, because your device no longer passes SafetyNet checks. You can play a cat-and-mouse game with breaking said checks, but the clock is ticking, as remote attestation will remove what remains of your agency as soon as possible. And all of that for a notably worse experience with less features and more problems. (Sidenote: I think banking apps requiring SafetyNet passing is the dumbest thing on planet earth. You guys know I can just sign into the website with my mobile browser anyways, right? You aren't winning anything here.) But most users are never going to do that. Most users will boot into their stock ROM, where data is siphoned by default and you have to agree to more data siphoning to use basic features. Every year, users will continue to give up every last bit of agency and privacy so as long as tech companies are allowed to continue to take it.

mormegil 2y ago
Completely agree, just one minor point: > I think banking apps requiring SafetyNet passing is the dumbest thing on planet earth. You guys know I can just sign into the website with my mobile browser anyways, right? No, you're not. For logging in, you need a mobile app used as an authentication token. Do not pass go, do not collect $200... (The current state of affairs in Czechia, at least; you still _do_ have the option of not using the app _for now_ in most banks, using password + SMS OTP, but you need to pay for each SMS and there is significant pressure to migrate you from it. The option is probably going to be removed completely in future.)
- jchw 2y ago
  Right now I don't think there's anything like this in the United States, at the very least. That said, virtually every bank here only seems to support SMS 2FA, which is also very frustrating.
  - chickenfeed 2y ago
    It's actually a real drag. I live in a rural area and the mobile signal is up and down. Sometimes I don't get SMSs for hours to a day late.
latexr 2y ago
> Absolutely! The important bit is that users have no choice in the matter. If people don’t have a choice, then they’re not giving up privacy, like the person you’re agreeing with said, it’s being taken away.
- tjoff 2y ago
  Opt out is portrayed as a choice when it barely is. Because it is very tiresome to always research what avenues exist and explicitly opt put of them and then constantly having to review that option to make sure it isnt flipped in an update or another switch has appeared that you also need to opt out of. Maybe you need to set an environment variable. Maybe that variable changes. It is pretty exhausting so I can understand people giving up on it. Is that really giving up on it though? Or are they contorted to it? If you do anything on the radio without the users explicit consent you are actively user hostile. Blaming the user for not exercising his/her right because they didn't opt out is weird.
spoaceman7777 2y ago
fwiw, on Android, you can install a custom certificate and have an app like AdGuard go beyond just DNS filtering, and actually filter traffic down to a request-content level. No root required. (iOS forbids this without jailbreaking though :/)
- randunel 2y ago
  Both android and ios allow root certificates, but most apps nowadays use SSL pinning, so that's no longer an option, either.
mikae1 2y ago
If you accept Android as an option, then GrapheneOS probably check a lot of your boxes on an OS level. GrapheneOS developers sit between you and Google and make sure that shit like this isn't introduced without the user's knowledge. They actively strip out crap that goes against users interests and add features that empower us. I find that the popular apps for basic operation from F-Droid do a very good job of not screwing with the user either. I'm talking about DAVx⁵, Etar, Fossify Gallery, K-9/Thunderbird, AntennaPod etc. No nonsense software that does what I want and nothing more. I've been running deGoogled Android devices for over a decade now for private use and I've been given Apple devices from work during all those years. I still find find the iOS devices to be a terrible computing experience. There's a feeling of being reduced to a mere consumer. GrapheneOS is the best mobile OS I've ever tried. If you get a Pixel device, it's dead simple to install via your desktop web browser[1] and has been zero maintenance. Really! [1] https://grapheneos.org/install/web https://grapheneos.org/install/web
- Nullabillity 2y ago
  As the GP already mentioned, F-Droid (as great as it is) won't help you access your bank account.
- doublebind 2y ago
  That's great... for the HN reader. However, how is that supposed to work for your significant other, or your mother, or your indifferent-to-technology friend? Don't get me wrong, I also strive to keep my device's information private but, at the same time, I realize this has no practical use for most users.
  - mikae1 2y ago
    We can act on two levels. We (as a society) can work for regulation and we (computery people) can take direct action by developing and using software and hardware that works in the user's interest. One does not exclude the other. That said. You can order a Pixel with GrapheneOS pre-installed and Google Apps and services can be isolated.
  - prmoustache 2y ago

by jchw 2y ago

mormegil 2y ago

Completely agree, just one minor point: > I think banking apps requiring SafetyNet passing is the dumbest thing on planet earth. You guys know I can just sign into the website with my mobile browser anyways, right? No, you're not. For logging in, you need a mobile app used as an authentication token. Do not pass go, do not collect $200... (The current state of affairs in Czechia, at least; you still _do_ have the option of not using the app _for now_ in most banks, using password + SMS OTP, but you need to pay for each SMS and there is significant pressure to migrate you from it. The option is probably going to be removed completely in future.)

jchw 2y ago
Right now I don't think there's anything like this in the United States, at the very least. That said, virtually every bank here only seems to support SMS 2FA, which is also very frustrating.
- chickenfeed 2y ago
  It's actually a real drag. I live in a rural area and the mobile signal is up and down. Sometimes I don't get SMSs for hours to a day late.

latexr 2y ago

> Absolutely! The important bit is that users have no choice in the matter. If people don’t have a choice, then they’re not giving up privacy, like the person you’re agreeing with said, it’s being taken away.

tjoff 2y ago
Opt out is portrayed as a choice when it barely is. Because it is very tiresome to always research what avenues exist and explicitly opt put of them and then constantly having to review that option to make sure it isnt flipped in an update or another switch has appeared that you also need to opt out of. Maybe you need to set an environment variable. Maybe that variable changes. It is pretty exhausting so I can understand people giving up on it. Is that really giving up on it though? Or are they contorted to it? If you do anything on the radio without the users explicit consent you are actively user hostile. Blaming the user for not exercising his/her right because they didn't opt out is weird.

spoaceman7777 2y ago

fwiw, on Android, you can install a custom certificate and have an app like AdGuard go beyond just DNS filtering, and actually filter traffic down to a request-content level. No root required. (iOS forbids this without jailbreaking though :/)

randunel 2y ago
Both android and ios allow root certificates, but most apps nowadays use SSL pinning, so that's no longer an option, either.

mikae1 2y ago

If you accept Android as an option, then GrapheneOS probably check a lot of your boxes on an OS level. GrapheneOS developers sit between you and Google and make sure that shit like this isn't introduced without the user's knowledge. They actively strip out crap that goes against users interests and add features that empower us. I find that the popular apps for basic operation from F-Droid do a very good job of not screwing with the user either. I'm talking about DAVx⁵, Etar, Fossify Gallery, K-9/Thunderbird, AntennaPod etc. No nonsense software that does what I want and nothing more. I've been running deGoogled Android devices for over a decade now for private use and I've been given Apple devices from work during all those years. I still find find the iOS devices to be a terrible computing experience. There's a feeling of being reduced to a mere consumer. GrapheneOS is the best mobile OS I've ever tried. If you get a Pixel device, it's dead simple to install via your desktop web browser[1] and has been zero maintenance. Really! [1] https://grapheneos.org/install/web https://grapheneos.org/install/web

Nullabillity 2y ago
As the GP already mentioned, F-Droid (as great as it is) won't help you access your bank account.
doublebind 2y ago
That's great... for the HN reader. However, how is that supposed to work for your significant other, or your mother, or your indifferent-to-technology friend? Don't get me wrong, I also strive to keep my device's information private but, at the same time, I realize this has no practical use for most users.
- mikae1 2y ago
  We can act on two levels. We (as a society) can work for regulation and we (computery people) can take direct action by developing and using software and hardware that works in the user's interest. One does not exclude the other. That said. You can order a Pixel with GrapheneOS pre-installed and Google Apps and services can be isolated.
- prmoustache 2y ago