Encrypt all the things!

Posted on
of 106
  • Nice work USA, sneaking that shit through.

    Donate to Tor.

  • Mate just got this book. Anyone read it? Does it tell us anything we don't already know?

  • Has anyone read Yasha Levine's Surveillance Valley? It made for an easier read than I expected but also found it interesting to read about the US intelligence communities backing of different privacy tools (Tor and Signal in particular)

  • Has anyone read anything about the new Microsoft Edge version? I'm hearing good things about performance, but wondering how it stacks up in terms of privacy

  • It uses Chromium so should be pretty quick. Dunno about privacy but I'm sticking with FF for that.

  • Yeah, just read that at launch it was using hardware fingerprinting which makes it objectively worse than Chrome/FF, which is impressive

  • Vivaldi for all your browser needs...

    Edge C is faster and better than Edge & therefore IE11. But none of that is saying much.

  • I've not read anything about it because I wouldn't use it. The only reason the Chromium thing was in my head is our corporate side had to roll out an Edge update recently so I'd heard mumblings about it. I'm still mostly FF, Chrome, Canary and Tor with ad blockers, noscript and pi.hole.

  • I've been using Blokada (usual VPN and hosts file jobba) on my OnePlus 3T to block ads and it's worked fine.

    Got a new phone (Oppo Reno 2) and set up Blokada exactly the same and loads of sites now have ads on them. Any ideas what I should be looking at to work out why?

    Or alternative blockers (although I think they all work the same way).

  • How safe is google docs? I use it for some life admin stuff, but I have so far been reluctant to put the spreadsheet with my household finances on there.
    I am not so worried about any individual hacker holding me to ransom, more about future loan providers etc getting access to it after some massive leak.

  • How safe is google docs?

    Very safe.

    It's HIPAA certified making it good for medical records and health providers.

    Strong guidance:

    • Ensure you have multiple 2FA methods configured on your Google account, once done remove phone recovery options (as these can be social engineered and spoofed). Ensure that whatever is your recovery email is configured to a similarly paranoid level.
    • Do nothing dodgy with your Google account (if it gets banned you're banned from all of Google)
    • Review API and App access granted, purge everything you do not trust with those files... and in the future be diligent about "Login with Google" to review the permissions... never grant anything access to Google Drive

    If you do those things, then Drive is absolutely the safest of all cloud storage. And for the record, I have my whole life in mine, every legal doc, house doc, health doc... going back to 1996. I trust it and rate it.

  • Not loving the recent(ish) news that quite a few apps have been reading the contents of the clipboard when opened on phones. It seems this has been going on a while, and will be addressed in the next iOS version (on iPhones).


    The public beta of iOS14 shows clearly when an app is snooping on the clipboard. It's very easy to copy-paste a password in one app and for that to subsequently get read by another app, once opened.

    In addition to the main culprits (Linkedin, Twitter, Reddit) I've found Guru Maps (was previously called Galileo Maps) is another that reads the clipboard without reason or permission.

    I used Guru maps a lot over the years as an offline GPS for cycling...which looking at it now isn't great. If only this was apparent sooner. The quicker this is called out and the apps updated, the better.

  • I understand why they did this... almost all use it to detect spam. Mobile spam via apps is copied from a doc and pasted across sites. The clipboard being device scoped means that the app can detect spam and fraud very early as it can see a client doing this.

    So I understand why they did it... but wow, it's so obviously a bad idea!

  • Spam prevention shouldn't be an opportunity for normal user data to be compromised.

    I guess clipboard should have its own set of access permissions. Wonder what Android does?

  • Android lets any app read it.

    And the distinction is: Is the clipboard content locally analysed, or remotely analysed?

    One of those is a major problem... the thing is, as it's not clear at all they're both a major problem.

  • Neither should be happening. Block spam elsewhere. Reading my HDD because I might be sending spam isn't acceptable so neither should clipboard listening.

  • Do you want me to stop reading your hard drive?

  • I'm not worried about you. It's the mind-controlling lizard people I'm trying to keep away from my stash of apple pie recipes.

  • Stopping spam and top-secret apple pie recipes are both important, I agree.

    It just isn't clear with the user interface what is open access and what is not.
    Don't Lastpass and 1password both copy to the clipboard?. A copy once, paste once approach might be better rather than a persistent clipboard copy.

  • Treat it like a camera, storage, etc and have any app ask for clipboard access. Then you can allow once, allow all the time, deny.

  • You can spoof android clipboard data, but you do need root.

  • ain't nobody got time for rooting phones any more.

  • Assuming they are similar to Keepass, they can use a different clipboard, connected to the keyboard being used.

    As ^^ , I have clipboard spoofed, but can still copy paste with the Keepass keyboard in use.

    (It's possible, I guess, that it's using some sort of sendkey macro as opposed to clipboard.)

  • Post a reply
    • Bold
    • Italics
    • Link
    • Image
    • List
    • Quote
    • code
    • Preview

Encrypt all the things!

Posted by Avatar for Velocio @Velocio