6 ms·

Most of the privacy claims (of all type of apps) are essentially garbage anyway because realistically, if a website or an app can be compelled to push an update

by rvnx 7mo ago

Most of the privacy claims (of all type of apps) are essentially garbage anyway because realistically, if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want. It doesn't even have to be a specific binary, it can be "just turn on this A/B testing / debug flag for that user" or a piece of javascript

henearkr 7mo ago
Is there any evidence that the mechanism to do that is in place? I think that would be widely decried especially on HN if that is one day implemented.
- Cthulhu_ 7mo ago
  Yes? A/B testing flags, auto-updates, server-side re-routing, etc are just some mechanisms from the top of my head that can do that. The ways to avoid it is by having locked and cryptographically verified software and connections.
  - izacus 7mo ago
    That's not evidence, that's conjecture again. Is there evidence that this kind of client push is actually used to extract data in these projects?
    - Imustaskforhelp 7mo ago
      Not sure if that counts as proper evidence, but I have seen some logs[0] albeit with encryption but from my understanding, they control the encryption keys or atleast certainly have the ability to change (if they get hacked themselves for example) Would you like to see a proper evidence of the logging policy? I feel like I can try finding that again if you/HN community would be interested to see that. Edit: also worth pointing out that keeping logs with time might be a form of meta-data, which depending on your threat-vector (journalism etc.) can be very sensitive info. [0]: my another comment here: https://news.ycombinator.com/item?id=47624960 https://news.ycombinator.com/item?id=47624960
      - izacus 7mo ago
        I'd like to see any kind of evidence that there's any substance of in these accusations of services not actually being private - not just theoretical theorycrafting about mechanisms. And how does that compare to other services we have available and people actually use.
        Imustaskforhelp 7mo ago
        At some point, essentially everyone has to trust the product and more importantly, the company/the people in the company. Firstly its worth clarifying that there isn't really something akin to zero-trust in such cases. Thus the theoretical theorycrafting about mechanisms. Those show that you have to trust proton Now, My issue with proton is that, they try to appear transparent but a lot of what they've done especially with proton meet seems to sometimes even be misleading. If they couldn't create EU/Swiss sovereign infrastructure for meet, then why are they using Cloud-act providers while within the same post talking about the implications of Cloud Act. There is some great irony in all of this and this is what is making me suspicious and how Proton seems to be misleading people rather than leading them towards more privacy. At some point, it raises atleast some questions about trusting proton. > And how does that compare to other services we have available and people actually use. That depends on what service are you talking about from, Do you want a whole eco-system or are you happy with individual apps/companies focusing on one thing in a more unix-fashion of things. Do you prefer non-profits or for-profit companies to handle such infrastructure? How familiar you are with self-hosting and what is your threat vector? Are you a corporate or a person yourself and what are your budget of things? but just to give a pointer without asking these questions, Some good pointers are posteo.de, tutanota, infomaniak (has whole ecosystem) Within the calling system, I personally used to use fairmeeting.net, it used to have screen sharing option for free as well but looks like they might have paywalled it recently. You can find multiple jitsi community instances. I feel like the only way to answer this question is if people ask with more depth. The threat model differs for everybody, for some people (like journalists), even just this proton meet fiasco is enough for them to reconsider proton ecosystem as a whole and consider it too threatening, especially with recent incidents and their lives being on the line. You might say, well where might they go and I feel like they might go to disroot (non-profit activism oriented) or tutanota or even posteo.de depending on what they might prefer.
    - nextaccountic 7mo ago
      That's evidence for the mechanism, as asked The evidence that it's being actively used in the US is in the secret proceedings of a secret court. I kid you not, look up FISA warrant
      - henearkr 7mo ago
        There is NO such mechanism (discriminated updates by user), of my knowledge, in: - Linux (apt, pacman, rpm...), - Android And I would add Windows and iOS/MacOS but I'm not at all an expert so I leave others to confirm that their "app stores" don't do such exotic prowesses. You can artificially insert a malicious script in a package that would scan your system, deduce your identity, and install something based on that, but in this case that means that it is just a malware in the first place. And that would mean that the app to be installed contains a "mutable" component of data that is not defined by the contents of the package but rather written upon post-install actions, so that is also dubious to include that for formally in the "app from that package" definition. In any case, such behavior would get your package banned from any app store or Linux distribution.
        nextaccountic 7mo ago
        Yes, the US government and US courts (including the secret court FISC) have tools to compel Google, Apple and other vendors to install malware on users devices. This is exactly the point. The US government routinely deploys malware to users devices, for multiple reasons. Here is a 2017 link about this: https://www.aclu.org/news/privacy-technology/challenging-government-hacking-whats-stake https://www.aclu.org/news/privacy-technology/challenging-gov...
        henearkr 7mo ago
        Would you mind showing me some evidence that software update systems are able to push to you e.g. a different Android update based on your device ID or specific IP? (not just country geolocation) (PS: your link is about deploying malware through other routes, not by normal software updates) Because all the other means I can think of are just basic malwarfare. As you need to rely on a vendor/distributor to get updates, then of course they are able to push you malware, there is absolutely no going around this first ring of trust. Conclusion : there is no point in accusing Proton of anything... there are just being software providers (FOSS by the way!!!).
  - henearkr 7mo ago
    One by one: - A/B testing is agnostic of who the user is, it is randomized. If it was not, that would be a bad practice and would legitimately ruin the reputation of the company doing that, - auto-updates is just the setting allowing the most recently published update to be installed. "Published" means it is for everyone. If that is to be understood in any other meaning, that would also be bad practice, - and I don't see what you mean by server-side re-routing. To be honest, maybe I just live with different platforms and apps than you I don't know. I use Android, and Linux on my Laptop, but I would also expect Windows to not discriminate by user when pushing updates.
- chrismorgan 7mo ago
  You need mechanisms to avoid the possibility. The mechanisms to do such things exist by default, by both the software provider (e.g. Proton) and the software distributor (e.g. Apple for App Store, Google for Play Store, Cloudflare or AWS for web stuff), and various countries have laws that allow them to secretly compel implementing specific backdoors. In order to block the distributor from going rogue, you need to be able to guarantee that the user device can only install/run code signed by the provider, who must never give those keys to the distributor. My impression is that Android is the only major platform that ever had this, but that Google ruined it a few years ago in the name of lighter bundles by insisting that they hold the keys. (I once had VLC from Google Play Store, but replaced it with a build from F-Droid under the same app ID; Google Play Store shows it has an update for it, but that it can’t install it.) In order to block the provider or distributor sending specific users a different build, you need something more like Certificate Transparency logs: make it so that devices will only run packages that contains proof that they have been publicly shared. (This is necessary, but not sufficient.) And if you’re using web tech, the mechanisms required to preclude such abuse do not at this time exist. If you’re shipping an app by some other channel, it can do a resource integrity check and mandate subresource integrity. But no one does things that way—half the reason for using web tech is specifically to bypass slow update channels and distribute new stuff immediately!
The_Goonies1985 7mo ago
>Most of the privacy claims (of all type of apps) are essentially garbage... True. Everything has backdoored CPUs as its foundation. Consider, for starters: (Intel's 'Management' Engine); AMD's (PSP); Apple/Arm (black-box hardware). You can layer as much theater as you like on top of the hardware-surveillance-layer in modern computers; it still won't grant you privacy.
- badgersnake 7mo ago
  Power is open. But nobody wants to build power devices for some reason.
  - ricardobeat 7mo ago
    Power?
    - supermatt 7mo ago
      https://en.wikipedia.org/wiki/Power_ISA https://en.wikipedia.org/wiki/Power_ISA
      - ricardobeat 7mo ago
        RISC-V is also open. That “some reason” is likely to be power/performance levels being quite far from ARM & Intel for consumer devices.
        vrganj 7mo ago
        China is building out RISC-V, just like they are leading actually-open AI. https://www.scmp.com/tech/big-tech/article/3347684/alibaba-debuts-its-latest-risc-v-based-chip-amid-shift-ai-agents https://www.scmp.com/tech/big-tech/article/3347684/alibaba-d... Weirdly, the authoritarian state is the one saving us from our own digital authoritarians.
        7mo ago
boramalper 7mo ago
> Most of the privacy claims (of all type of apps) are essentially garbage anyway I think that’s a sweeping generalisation.
- Ylpertnodi 7mo ago
  And sweepingly true.
  - boramalper 7mo ago
    How so? Reproducible builds are a thing.
    - stonogo 7mo ago
      So are networks
      - boramalper 7mo ago
        So? If the app is using reproducible builds and is also audited not to contain any backdoors, what do networks have to do with it?
victorbjorklund 7mo ago
I don’t think that is a useful definition even if technically true. With that logic even Linux isn’t privacy because in theory they can push code that will only run for you.
- 63stack 7mo ago
  Linux as in the kernel? Who is "they"? Torvalds?
  - victorbjorklund 7mo ago
    Choose if you think Windows is just the kernel or the operating system. The ones that control whatever source you are pulling the updates from. Very very few people are building everything from source and reading the source in full everytime. Notice I am not saying this is likely. I am saying that it is theoretically possible anytime you accept code from the outside (doesn’t matter if it is pull or push)
- progbits 7mo ago
  How will they push it?
  - victorbjorklund 7mo ago
    Push or pull is just semantics. Can you honestly say that you never ever updated anything in a Linux distro without first reading the source code, checking all the checksums etc? Be honest.
- maweaver 7mo ago
  Using what mechanism? Most Linux updates are not pushed but rather pulled at the user request. You can use Linux totally offline. This is fundamentally different than a webapp, where code is sent with every visit
  - izacus 7mo ago
    The automatic updates most distros have enabled by default. Signal desktop outright stops working if you don't constantly pull updates from them.
kalaksi 7mo ago
You'll have to be more specific what kind of "privacy claims" you're talking about. Proton is definitely a lot more private than, say, Google. But, as always, you'll have to trust the party delivering the binaries you run. Also, any company operating legally, have to co-operate with court orders etc., but afaik they try to push back
Imustaskforhelp 7mo ago
I once did some tinkering with Proton Docs and I was able to find that the comments within Proton Docs when I used it via curl definitely felt like it had something like logs (I feel like I should try doing this again to have more definitive answer) Either way, the response was encrypted but they hold the encryption key atleast within proton-docs. I also want to say that Proton allows the ability to change password through OTP, (Something which I sorta appreciate[0]) but that means that their infrastructure can then have the ability to change password and you can toggle that functionality by sending a request to proton to allow OTP and on which number, so proton themselves can do that too. Unless, I am getting it wrong, by default, Proton still has your encryption keys and even if you change them (which 99% including me might not do), even then I definitely feel like there can be some concern. To be honest, There is nothing like zero trust, that's what I learnt, You are still trusting Proton Aka The swiss laws behind it so that you know that they won't get legally forced to give more data than usual (like US companies for example) but they will still comply with the swiss laws (recent proton incident) Then, secondly, you have to trust Proton themselves, but with something like this incident where Proton Meet might be omitting somethings, it doesn't paste a clear picture of transparency or trust. I don't really know why Proton might create something like Meet especially with its infrastructure relying on the CLOUD Act, and then, try to sell it within the idea of privacy. They both are contradictory. Proton is, creating lots of products, On one hand I can appreciate that, but on the other, as part of community, I feel frustrated/sad because they don't have some core features like proper proton drive rsync support or even some API[1]'s surrounding it. I tried to do the experiment in first place because I wanted to create a commenting engine for static websites which could use proton-drive as its backend. They really could gain a lot from transparency with proper API support and letting the community do things with it, but that's not really the case :/ I am still using Proton but they definitely aren't a bastion recently. I might still recommend Proton, but I sort of hope that companies self host some open source applications themselves, whether self-hosting with hardware or in a proper EU cloud like Hetzner/OVH. But Incidents like these are making me a little more hesitant to recommend Proton nowadays. [0]: as someone who had lost one of my previous accounts after my Keepassxc database got deleted because of me accidentally wiping my archlinux with tinkering with it, Now I use Bitwarden with OTP on proton. [1]: I was able to make something like an API myself by relying on something like puppeteer, even with puppeteer though, it was really hard to make something like that. I couldn't create a public endpoint of it because having puppeteer instances for a commenting engine would be very resource intensive.
akimbostrawman 7mo ago
>if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want yes which is why i hoped they would implement a verification system like with a browser addon that compares the website client code used for encryption and alerts the user if it does not match the one served everyone else. ctemplar mail used to have this many years ago https://web.archive.org/web/20200201012958/https://ctemplar.com/ctemplar-checksum-implementation/ https://web.archive.org/web/20200201012958/https://ctemplar....
illiac786 7mo ago
Privacy and security are not binary. Statements like “because it isn’t 100% secure or private, then it is not worth it” means one has essentially no clue. There is not such thing as 100% privacy or security, for starters. It’s all layers of protection and/or trust and compromises.

by rvnx 7mo ago

henearkr 7mo ago

Is there any evidence that the mechanism to do that is in place? I think that would be widely decried especially on HN if that is one day implemented.

Cthulhu_ 7mo ago
Yes? A/B testing flags, auto-updates, server-side re-routing, etc are just some mechanisms from the top of my head that can do that. The ways to avoid it is by having locked and cryptographically verified software and connections.
- izacus 7mo ago
  That's not evidence, that's conjecture again. Is there evidence that this kind of client push is actually used to extract data in these projects?
  - Imustaskforhelp 7mo ago
    Not sure if that counts as proper evidence, but I have seen some logs[0] albeit with encryption but from my understanding, they control the encryption keys or atleast certainly have the ability to change (if they get hacked themselves for example) Would you like to see a proper evidence of the logging policy? I feel like I can try finding that again if you/HN community would be interested to see that. Edit: also worth pointing out that keeping logs with time might be a form of meta-data, which depending on your threat-vector (journalism etc.) can be very sensitive info. [0]: my another comment here: https://news.ycombinator.com/item?id=47624960 https://news.ycombinator.com/item?id=47624960
    - izacus 7mo ago
      I'd like to see any kind of evidence that there's any substance of in these accusations of services not actually being private - not just theoretical theorycrafting about mechanisms. And how does that compare to other services we have available and people actually use.
      - Imustaskforhelp 7mo ago
        At some point, essentially everyone has to trust the product and more importantly, the company/the people in the company. Firstly its worth clarifying that there isn't really something akin to zero-trust in such cases. Thus the theoretical theorycrafting about mechanisms. Those show that you have to trust proton Now, My issue with proton is that, they try to appear transparent but a lot of what they've done especially with proton meet seems to sometimes even be misleading. If they couldn't create EU/Swiss sovereign infrastructure for meet, then why are they using Cloud-act providers while within the same post talking about the implications of Cloud Act. There is some great irony in all of this and this is what is making me suspicious and how Proton seems to be misleading people rather than leading them towards more privacy. At some point, it raises atleast some questions about trusting proton. > And how does that compare to other services we have available and people actually use. That depends on what service are you talking about from, Do you want a whole eco-system or are you happy with individual apps/companies focusing on one thing in a more unix-fashion of things. Do you prefer non-profits or for-profit companies to handle such infrastructure? How familiar you are with self-hosting and what is your threat vector? Are you a corporate or a person yourself and what are your budget of things? but just to give a pointer without asking these questions, Some good pointers are posteo.de, tutanota, infomaniak (has whole ecosystem) Within the calling system, I personally used to use fairmeeting.net, it used to have screen sharing option for free as well but looks like they might have paywalled it recently. You can find multiple jitsi community instances. I feel like the only way to answer this question is if people ask with more depth. The threat model differs for everybody, for some people (like journalists), even just this proton meet fiasco is enough for them to reconsider proton ecosystem as a whole and consider it too threatening, especially with recent incidents and their lives being on the line. You might say, well where might they go and I feel like they might go to disroot (non-profit activism oriented) or tutanota or even posteo.de depending on what they might prefer.
  - nextaccountic 7mo ago
    That's evidence for the mechanism, as asked The evidence that it's being actively used in the US is in the secret proceedings of a secret court. I kid you not, look up FISA warrant
    - henearkr 7mo ago
      There is NO such mechanism (discriminated updates by user), of my knowledge, in: - Linux (apt, pacman, rpm...), - Android And I would add Windows and iOS/MacOS but I'm not at all an expert so I leave others to confirm that their "app stores" don't do such exotic prowesses. You can artificially insert a malicious script in a package that would scan your system, deduce your identity, and install something based on that, but in this case that means that it is just a malware in the first place. And that would mean that the app to be installed contains a "mutable" component of data that is not defined by the contents of the package but rather written upon post-install actions, so that is also dubious to include that for formally in the "app from that package" definition. In any case, such behavior would get your package banned from any app store or Linux distribution.
      - nextaccountic 7mo ago
        Yes, the US government and US courts (including the secret court FISC) have tools to compel Google, Apple and other vendors to install malware on users devices. This is exactly the point. The US government routinely deploys malware to users devices, for multiple reasons. Here is a 2017 link about this: https://www.aclu.org/news/privacy-technology/challenging-government-hacking-whats-stake https://www.aclu.org/news/privacy-technology/challenging-gov...
        henearkr 7mo ago
        Would you mind showing me some evidence that software update systems are able to push to you e.g. a different Android update based on your device ID or specific IP? (not just country geolocation) (PS: your link is about deploying malware through other routes, not by normal software updates) Because all the other means I can think of are just basic malwarfare. As you need to rely on a vendor/distributor to get updates, then of course they are able to push you malware, there is absolutely no going around this first ring of trust. Conclusion : there is no point in accusing Proton of anything... there are just being software providers (FOSS by the way!!!).
- henearkr 7mo ago
  One by one: - A/B testing is agnostic of who the user is, it is randomized. If it was not, that would be a bad practice and would legitimately ruin the reputation of the company doing that, - auto-updates is just the setting allowing the most recently published update to be installed. "Published" means it is for everyone. If that is to be understood in any other meaning, that would also be bad practice, - and I don't see what you mean by server-side re-routing. To be honest, maybe I just live with different platforms and apps than you I don't know. I use Android, and Linux on my Laptop, but I would also expect Windows to not discriminate by user when pushing updates.
chrismorgan 7mo ago
You need mechanisms to avoid the possibility. The mechanisms to do such things exist by default, by both the software provider (e.g. Proton) and the software distributor (e.g. Apple for App Store, Google for Play Store, Cloudflare or AWS for web stuff), and various countries have laws that allow them to secretly compel implementing specific backdoors. In order to block the distributor from going rogue, you need to be able to guarantee that the user device can only install/run code signed by the provider, who must never give those keys to the distributor. My impression is that Android is the only major platform that ever had this, but that Google ruined it a few years ago in the name of lighter bundles by insisting that they hold the keys. (I once had VLC from Google Play Store, but replaced it with a build from F-Droid under the same app ID; Google Play Store shows it has an update for it, but that it can’t install it.) In order to block the provider or distributor sending specific users a different build, you need something more like Certificate Transparency logs: make it so that devices will only run packages that contains proof that they have been publicly shared. (This is necessary, but not sufficient.) And if you’re using web tech, the mechanisms required to preclude such abuse do not at this time exist. If you’re shipping an app by some other channel, it can do a resource integrity check and mandate subresource integrity. But no one does things that way—half the reason for using web tech is specifically to bypass slow update channels and distribute new stuff immediately!

The_Goonies1985 7mo ago

>Most of the privacy claims (of all type of apps) are essentially garbage... True. Everything has backdoored CPUs as its foundation. Consider, for starters: (Intel's 'Management' Engine); AMD's (PSP); Apple/Arm (black-box hardware). You can layer as much theater as you like on top of the hardware-surveillance-layer in modern computers; it still won't grant you privacy.

badgersnake 7mo ago
Power is open. But nobody wants to build power devices for some reason.
- ricardobeat 7mo ago
  Power?
  - supermatt 7mo ago
    https://en.wikipedia.org/wiki/Power_ISA https://en.wikipedia.org/wiki/Power_ISA
    - ricardobeat 7mo ago
      RISC-V is also open. That “some reason” is likely to be power/performance levels being quite far from ARM & Intel for consumer devices.
      - vrganj 7mo ago
        China is building out RISC-V, just like they are leading actually-open AI. https://www.scmp.com/tech/big-tech/article/3347684/alibaba-debuts-its-latest-risc-v-based-chip-amid-shift-ai-agents https://www.scmp.com/tech/big-tech/article/3347684/alibaba-d... Weirdly, the authoritarian state is the one saving us from our own digital authoritarians.
        7mo ago

boramalper 7mo ago

> Most of the privacy claims (of all type of apps) are essentially garbage anyway I think that’s a sweeping generalisation.

Ylpertnodi 7mo ago
And sweepingly true.
- boramalper 7mo ago
  How so? Reproducible builds are a thing.
  - stonogo 7mo ago
    So are networks
    - boramalper 7mo ago
      So? If the app is using reproducible builds and is also audited not to contain any backdoors, what do networks have to do with it?

victorbjorklund 7mo ago

I don’t think that is a useful definition even if technically true. With that logic even Linux isn’t privacy because in theory they can push code that will only run for you.

63stack 7mo ago
Linux as in the kernel? Who is "they"? Torvalds?
- victorbjorklund 7mo ago
  Choose if you think Windows is just the kernel or the operating system. The ones that control whatever source you are pulling the updates from. Very very few people are building everything from source and reading the source in full everytime. Notice I am not saying this is likely. I am saying that it is theoretically possible anytime you accept code from the outside (doesn’t matter if it is pull or push)
progbits 7mo ago
How will they push it?
- victorbjorklund 7mo ago
  Push or pull is just semantics. Can you honestly say that you never ever updated anything in a Linux distro without first reading the source code, checking all the checksums etc? Be honest.
maweaver 7mo ago
Using what mechanism? Most Linux updates are not pushed but rather pulled at the user request. You can use Linux totally offline. This is fundamentally different than a webapp, where code is sent with every visit
- izacus 7mo ago
  The automatic updates most distros have enabled by default. Signal desktop outright stops working if you don't constantly pull updates from them.

kalaksi 7mo ago

You'll have to be more specific what kind of "privacy claims" you're talking about. Proton is definitely a lot more private than, say, Google. But, as always, you'll have to trust the party delivering the binaries you run. Also, any company operating legally, have to co-operate with court orders etc., but afaik they try to push back

Imustaskforhelp 7mo ago

I once did some tinkering with Proton Docs and I was able to find that the comments within Proton Docs when I used it via curl definitely felt like it had something like logs (I feel like I should try doing this again to have more definitive answer) Either way, the response was encrypted but they hold the encryption key atleast within proton-docs. I also want to say that Proton allows the ability to change password through OTP, (Something which I sorta appreciate[0]) but that means that their infrastructure can then have the ability to change password and you can toggle that functionality by sending a request to proton to allow OTP and on which number, so proton themselves can do that too. Unless, I am getting it wrong, by default, Proton still has your encryption keys and even if you change them (which 99% including me might not do), even then I definitely feel like there can be some concern. To be honest, There is nothing like zero trust, that's what I learnt, You are still trusting Proton Aka The swiss laws behind it so that you know that they won't get legally forced to give more data than usual (like US companies for example) but they will still comply with the swiss laws (recent proton incident) Then, secondly, you have to trust Proton themselves, but with something like this incident where Proton Meet might be omitting somethings, it doesn't paste a clear picture of transparency or trust. I don't really know why Proton might create something like Meet especially with its infrastructure relying on the CLOUD Act, and then, try to sell it within the idea of privacy. They both are contradictory. Proton is, creating lots of products, On one hand I can appreciate that, but on the other, as part of community, I feel frustrated/sad because they don't have some core features like proper proton drive rsync support or even some API[1]'s surrounding it. I tried to do the experiment in first place because I wanted to create a commenting engine for static websites which could use proton-drive as its backend. They really could gain a lot from transparency with proper API support and letting the community do things with it, but that's not really the case :/ I am still using Proton but they definitely aren't a bastion recently. I might still recommend Proton, but I sort of hope that companies self host some open source applications themselves, whether self-hosting with hardware or in a proper EU cloud like Hetzner/OVH. But Incidents like these are making me a little more hesitant to recommend Proton nowadays. [0]: as someone who had lost one of my previous accounts after my Keepassxc database got deleted because of me accidentally wiping my archlinux with tinkering with it, Now I use Bitwarden with OTP on proton. [1]: I was able to make something like an API myself by relying on something like puppeteer, even with puppeteer though, it was really hard to make something like that. I couldn't create a public endpoint of it because having puppeteer instances for a commenting engine would be very resource intensive.

akimbostrawman 7mo ago

>if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want yes which is why i hoped they would implement a verification system like with a browser addon that compares the website client code used for encryption and alerts the user if it does not match the one served everyone else. ctemplar mail used to have this many years ago https://web.archive.org/web/20200201012958/https://ctemplar.com/ctemplar-checksum-implementation/ https://web.archive.org/web/20200201012958/https://ctemplar....

illiac786 7mo ago

Privacy and security are not binary. Statements like “because it isn’t 100% secure or private, then it is not worth it” means one has essentially no clue. There is not such thing as 100% privacy or security, for starters. It’s all layers of protection and/or trust and compromises.