3 ms·

You can't have good privacy without good security

by preisschild 3mo ago

warrantisall 3mo ago
[flagged]
- stymaar 3mo ago
  [flagged]
  - microtonal 3mo ago
    Fully agree. In the end everybody has to make their own threat assessment and make their choices based on that. I think research is particularly important to unravel what data leakage there are in various phones and apps, so that people can make informed choices. I think this kind of information presented presented in a neutral way is sorely missing.
- microtonal 3mo ago
  It turns out that companies also 'attack' your phones to get your data. E.g. at some point Facebook/Yandex apps opened localhost sockets for tracking pixel code to connect to: https://localmess.github.io/ https://localmess.github.io/
  - grapheneos 3mo ago
    GrapheneOS largely prevented it for Vanadium before this came to light and fully fixed it long before Chromium did. Android 17 prevents cross-profile loopback connections, which is one of many important privacy improvements in it. Android 17 fixed a massive number of privacy weaknesses including vulnerabilities which will not have patches backported. Only a subset of High and Critical severity patches are backported to older Android releases. Only a subset of that subset are shipped by /e/ despite claiming to provide the latest patch level.
- grapheneos 3mo ago
  We definitely don't see privacy and security as binary. Privacy depends on fixing widely abused privacy weaknesses by patching privacy vulnerabilities and shipping major privacy improvements. /e/ is missing many standard Android privacy patches and protections. Privacy also depends on security to avoid it being bypassed. It's also missing many of the standard Android security patches and protections. GrapheneOS preserves the baseline and makes major privacy and security improvements along with being far better at patching vulnerabilities rather than far worse. /e/ and Fairphone don't do the bare minimum to protect user privacy and security by keeping up with updates. Both are missing crucial standard patches and protections needed against many real world adversaries including widespread privacy abuse by apps.

You can't have good privacy without good security

warrantisall 3mo ago

[flagged]

stymaar 3mo ago
[flagged]
- microtonal 3mo ago
  Fully agree. In the end everybody has to make their own threat assessment and make their choices based on that. I think research is particularly important to unravel what data leakage there are in various phones and apps, so that people can make informed choices. I think this kind of information presented presented in a neutral way is sorely missing.
microtonal 3mo ago
It turns out that companies also 'attack' your phones to get your data. E.g. at some point Facebook/Yandex apps opened localhost sockets for tracking pixel code to connect to: https://localmess.github.io/ https://localmess.github.io/
- grapheneos 3mo ago
  GrapheneOS largely prevented it for Vanadium before this came to light and fully fixed it long before Chromium did. Android 17 prevents cross-profile loopback connections, which is one of many important privacy improvements in it. Android 17 fixed a massive number of privacy weaknesses including vulnerabilities which will not have patches backported. Only a subset of High and Critical severity patches are backported to older Android releases. Only a subset of that subset are shipped by /e/ despite claiming to provide the latest patch level.
grapheneos 3mo ago
We definitely don't see privacy and security as binary. Privacy depends on fixing widely abused privacy weaknesses by patching privacy vulnerabilities and shipping major privacy improvements. /e/ is missing many standard Android privacy patches and protections. Privacy also depends on security to avoid it being bypassed. It's also missing many of the standard Android security patches and protections. GrapheneOS preserves the baseline and makes major privacy and security improvements along with being far better at patching vulnerabilities rather than far worse. /e/ and Fairphone don't do the bare minimum to protect user privacy and security by keeping up with updates. Both are missing crucial standard patches and protections needed against many real world adversaries including widespread privacy abuse by apps.