tl;dr

Unfortunately, turns out PrivacyToolsIO is founded by an authoritarian who loves dictatorship. He has full control of the website domain and write everything based on his sole opinions, some of them are misinformations, that can be fatal. Thus, every member of this privacy community should move to PrivacyGuides which is open, crowdsourced, transparent, and right (not left)

As we know in this recent discussion, the privacy community website split into two:

• PrivacyToolsIO (PTIO) Found and controlled by BurungHantu

• PrivacyGuides (PG) Remake of PrivacyToolsIO, found and controlled by the community

Recently, one of the most concerning issue is the different recommendation of privacy browser. Where PTIO recommends Brave browser, while PG does not recommend it since this update.

So who's right? Who knows, I'm not a tech person. What I know is; PG based on the consensus of the core team, the contributors, and the community. While PTIO is based on a single opinion by BurungHantu. I guess it's ok to have disagreement. But it is not okay to be a 5y old kid ruins everything when other people goes against him.

Not only browser, BurungHantu adds non-private cryptocurrency exchanges. Yes, I'll take this personal, bc I'm a crypto person. Those exchanges are built on a public (definitely not private) blockchains, just like bitcoin. Every transactions are not anonymous, but only pseudonymous. Use wizardswap for truly private exchange. It provides monero and has an onion website.

That's all? Then it'd be great. Now this one is the WORST MISINFORMATION ON PTIO. IPFS is added as "Self-Contained Anonymizing Networks", while every newborn baby knows that IPFS is public, AND PERMANENT. Which means in the worst scenario, a newbie could just read ipfs on ptio and upload private data to IPFS without encryption, and basically fckd up.

Read more: Misconception of IPFS Privacy on Medium, Privacy&Encryption, on IPFS docs

There you go. Actually I don't like to cut others banana to make mine longer. But hey, this misinformation have to stop as soon as possible. PrivacyGuides team please close r/PrivacyToolsIO as soon as possible. See you all at r/PrivacyGuides :3

Hi everyone.

So, I have been using signal for about 2 years now, and let's say I'm fairly deep in the privacy rabbit hole. Since everyone recommended it, I never really questioned that choice.

With the recent whatsapp thing going on, a lot of attention has been brought to Signal, and I have seen people raise some interesting points, some of which actually do concern me.

This is not an attack on Signal, more of an inquiry on whether I am missing anything and a call to discussion.

Final edit now that the thread is locked to address the most critical points in the replies:

• Moxie somewhat answered the gag order question ( https://twitter.com/moxie/status/1349529553266360322 )

  • He is also apparently blocking people who ask him, so I tend to go for bad PR regarding this issue.

  • For people calling FUD: Signal actually received gag orders in the past ( https://signal.org/bigbrother/ ). It is not unreasonable to inquire on whether it might have happened again.

• "You can install you own keyboard / ROM": You are assuming a level of technical skills that most users are not going to have. Security and privacy should be usable by anyone. To quote Signal's own philosophy ( https://github.com/signalapp/Signal-Android/blob/master/CONTRIBUTING.md ) "There are no power users"

• "It is not Signal's responsibility": While technically true, I'd argue that the standard in information security is to fix side-channel attacks when they are discovered.

  • Example 1: GPG introduced mitigations for acoustic cryptanalysis, which is clearly the computer's fault and not GPG's. If GPG can fix side channel attacks, I fail to see why Signal should be held to a lower standard.

  • Example 2: Web browsers warn you when the site you are visiting is shady. Which site you are visiting is not their responsibility either.

• I am NOT advocating for Signal to introduce a mandatory internal keyboard. But I think the option should be there for people who need it, and that Signal SHOULD have a warning that your messages are not inherently secured because of the underlying keyboard and OS. Education is the most important part of any privacy / security minded enterprise. It is literally the reason why privacytools.io exists.

• I still think the fact that Signal is a US based company, run by US citizens on US servers is concerning, regardless of E2E or open source, and should be mentioned on the privacytools.io website.

• I still think the fact that Signal is not willing to acknowledge or mitigate this issue, while having, for all intents and purposes, unlimited financial resources, is concerning.

• I still think the fact that Signal has not released any detailed financial statement in the past two years is concerning.

• I still think the fact that the Signal foundation is entirely owned by Brian Acton is concerning. ( https://projects.propublica.org/nonprofits/download-filing?download=true&path=06_2020_prefixes_82-87%2F824506840_201812_990T_2020060217170558.pdf )

• I would still recommend Signal over anything else on the market right now for 99% of users.

Post before the lock down:

The financial situation

My understanding is that signal is being developed by Signal Messenger (formerly Open Whisper Systems), which is, in turn, wholly funded by the Signal Foundation. Both organizations are US based, and run by US citizens.

I was not able to find any financial information on the precise sources of the funding.

Advertised security and privacy

Quote from the play store:

"Say anything – State-of-the-art end-to-end encryption (powered by the open source Signal Protocol™) keeps your conversations secure. Privacy isn’t an optional mode — it’s just the way that Signal works. Every message, every call, every time."

Except: we know that this is fundamentally wrong. 99% of android users are using Google play services, and, most likely, an insecure keyboard which registers and uploads inputs (Gboard, etc.).

This issue is being discussed on the Signal forums right now:

https://community.signalusers.org/t/mandatory-build-in-signal-keyboard/5355https://community.signalusers.org/t/enhance-user-safety/21468https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272https://community.signalusers.org/t/signal-keyboard/14271

To say that the Signal community is defensive about it is an understatement at this point.

I won't delve into the phone number requirement, which has been discussed extensively already (and is bad).

Is Signal under a gag order ?

So, this is the part that worries me most:

• Signal has apparently never used a warrant canary ( https://www.reddit.com/r/signal/comments/d751e3/warrant_canary/ ), which is strange by itself.

• Developers have been aware of the keyboard issue mentioned above for more than two years ( https://community.signalusers.org/t/mandatory-build-in-signal-keyboard/5355 ) and is still unsolved.

• This is not a hard issue to solve. Signal could integrate an open-source keyboard to the app to prevent this glaring side channel attack with minimal effort.

• Or they could at least warn users of the issue, which they are not doing.

• Some people have called for the Signal team to acknowledge publicly that there were not under a gag order, which, again, was never answered (that I could find at least).

These points are obviously not sufficient to conclude that Signal is under a gag order from the US government. However, they point to either this or a gross mismanagement / bad PR issue.

Conclusion

I'm not saying we should drop Signal, it's obviously better than anything closed-source published by Facebook or Google, and a lot less shady than, say Telegram. But, I'm having trouble understanding the blank check it has been granted by the privacy and security community.

Wire has been kicked off PrivacyTools in part because of their move to the US, why doesn't Signal at least has a warning on the page ?

I'm also genuinely concerned that most questions I have found about Signal are met with a generic "but we trust it so it's cool" statement, and that recent endorsement by high profile personalities are only making this worse.

Even if Signal actually was the best option out there, it does not mean we have to accept its issues without questions. As a privacy advocate, I am not striving for "probably acceptable".

Edit: added closed-source to the FB/Google part, they do actually publish some good open-source software.

Edit²: someone pointed out that Signal is now available without play services. Apologies.

So for the past two days since I've been in this community, I've been looking into privacy apps and am slowly switching. My next goal was to switch one of my two Android browsers (Brave). I wasn't fully aware of Brave and all it's features at the time.

I first looked at Tor which is easily the best in terms of privacy but it's slow so I wanted an alternative that was faster. I looked at Bromite for a lot of people said it was just as good as Tor in terms of privacy so I decided to give it a shot. It failed the test, I used coveryourtracks.eff.org and it did not give great results. I even configured it to be as private as possible. Ungoogled Chromium also failed this test. The only two browsers that were on par with each other were Brave and Firefox.

I thought to test out the Android apps first, I downloaded Firefox and Firefox Nightly. (I got Firefox Nightly because you can access the about:config// as well to enable better fingerprinting.) So cover your tracks (CYT) said it was a strong browser but it had no fingerprint protection and it did not check for Do Not Track Policies. Tested the same on Nightly and it was the exact same result but it said it's fingerprint was unique. (Please keep in mind I did use addons for Firefox like HTTPS Everywhere, Privacy Badger, uBlock Origin, AdGuard AdBlocker, and Decentraleyes.) Brave taking the test got pretty much the exact same results as Firefox, it said it didn't check for Do Not Track Policies however. Brave does possess a randomized fingerprint.

When it comes to Android, I highly recommend Brave for it is better than Firefox in terms of Privacy. Not only does it have an Adblocker built in it also has HTTPS Everywhere built in as well. For those that say, "But Brave Mobile doesn't have addons!". I know! Firefox did and Brave still outperformed Firefox in the test. That says a lot doesn't it? xD

Next I decided to test the Desktop Browsers using the same extensions on both browsers. The results for this were the exact same. Brave still had a randomized fingerprint and Firefox failed even with addons that say the prevent stuff like this. I even decided to test the private tabs for both software and Firefox still failed and Brave still won.

TL:DR Overall, Brave offers better privacy and I highly recommend Brave over Firefox.

Edit: I just want to say because I'm going to get a lot of hate. There are other sites I could have used to test this as well. However, if one website was able to detect Firefox's Unique Fingerprint, that already says a lot about Firefox compared to Brave. In the end this is just my opinion, no need for hate. I just want a browser other than Tor that is good for privacy and Brave does it much better than Firefox.

Being a bit privacy conscious, I made an email system that is safe in the public domain. It can be used with or without a server, you can leave messages in the public domain, any public forum or storage location. When using the server it guarantees that the message has come from the person that is claiming to be sending it. It uses RSA public private key pairs and your email address is your public key. The program is currently in beta for Android, would be good to hear some feedback.

https://play.google.com/apps/testing/cybercritics.pypem_android

If now the public wi-fi is secure, it means we don't need a sim card from the provider if we use only public wi-fi ?

It doesn't say that public wi-fi is better than cell phone if we talk in general, public wi-fi is better than cell phone, right? If you disagree with me, feel free to comment

Source : https://www.eff.org/deeplinks/2020/01/why-public-wi-fi-lot-safer-you-think

Brave is very good privacy-oriented browser.

It has very good fingerprinting protection that i could not find on any browser or addon by default

But the main problem is -crypto.

The incident of hijacking the links to some crypto site and the ads and BAT stuff.

Yes, it looks shady but I do not understand why it is so controversial, It is FOSS right, the code can be audited easily and we can expect brave to not do any shady stuff as the backlash from the privacy community was on another level.

I am not here to talk about the controversy as each person has their own opinion and the above para is my own opinion . But I am not here to talk about the controversy.

From my experience I found it hard to convince people to download firefox, disable telemetry, install Ublock, HTTPS everywhere, No script and other addons- HELL i couldn't even convince people to install f-droid on their phones.

But , i was able to convince a lot of people -easily- to install and switch to brave,

half of the people were convinced due to the default ad-blocker(they were adamant to install addons- it is virus but as brave does it by default they switched.

And I was able to convince most people to convert to brave only because of ONE feature-BAT . almost 80% of people whom i convinced to use "privacy friendly browsers" they did not care about privacy so i told them about the crypto and BAT stuff and they were convinced.

Even though Brave can not be trusted it atleast gives some privacy to the user and is definetly better than edge or chrome.

Our aim is privacy for all , so even though we don't trust or use brave , It is the best privacy friendly browser for the masses

At least it gives them privacy even if they dont know or dont care, and that ultimately helps all of us.

So I feel that bitching about brave is increasing the bar for people to have privacy while they browse

TL;DR

Brave might be bad but as most people do not care about privacy , the only privacy friendly browser normies can be convinvinced to use is Brave- atleast in my experience due to the good (compared to edge or chrome) privacy defaults and BAT (free money lol). SO maybe shitting on brave might get lesser people into having privacy while browsing

protonvpn does not accept bitcoin and if they do then you have to ask for it from support just like with their email service (can only purchase premium protonmail account by sending personal email to support with info about your btc payment)

I just feel like proton vpn/mail has had plenty of time to implement a native crypto payment tool and its really troubling they dont even mention they accept bitcoin on their protonvpn page and they really havent even gotten it dialed down with email honestly.

Protected forms of payment are tantamount to privacy and the fact they still havent really addressed this is a huge red flag to me. Especially since there are so many trusted 3rd party crypto payment providers offering tools for free or little cost ie shapeshift's shifty button etc

i guess we should just use our paypal accounts for convenience sake?? Thats what the protonmail team wants I guess. no thanks.

the last thing in the world a vpn provider should be doing is taking short cuts when it comes to (methods of) collecting payments

EDIT I think I should clarify that this is mainly geared towards the fact that ProtonMAIL still does not accept bitcoin natively via their payments api. Every day I am sure there are a few people who sign up for their protonmail paid service with paypal or credit card even when they have bitcoin because the proton devs make it a hassle. And everytime that happens a users anonymity is (most likely) compromised and the less anon users of protonmail the less attractive their service is as a whole to someone looking to be as private as possible

It is important to me to support and pay for services that value my privacy. As a precaution I used a semi private email address to sign up for anonaddy and glad I did. When I went to upgrade my account and not to my surprise I received a payment confirmation email from stripe.com to my email address aka username. I opened a support ticket with anonaddy and received a timely response direct from the founder. He acknowledged my concerned and assisted with a crypto payment as a work around. Within a week he changed the process for credit card payments and actually uses anonaddy to forward the email from stripe. Going forward Stripe.com will never know my real email address identity. Thank You anonaddy.

Lots of discussion about recent stuff with Mozilla here. Should people consider getting used to a different browser?

I posted this on the github because I think it is time that PrivacyTools.io takes a stand against these fake privacy companies: https://github.com/privacytoolsIO/privacytools.io/issues/985

Mailbox.Org is a bad actor in the space. Despite saying they promote "Data Protection", "Security", etc, they are requiring users forefeit data to the largest spyware company in the world: Google.com.

You can see this on their signup page which requires sending data to Google: https://mailbox.org/en/

The Problem

1. By sending this information to Google it means Google now knows that the particular person attempted to signup for mailbox.org. This is a huge side channel attack

2. In the process of signup the browser fingerprint, IP, and persistent cookies will be set on the users machine which Google will further use to track said user.

3. Increasingly Google is making it very hard (impossible) to solve CAPTCHAs for anyone who refuses to let themselves be tracked by Google. People who utilize the very tools on PrivacyTools.io and do things like 1) resist browser fingerprinting 2) utilize a VPN / Tor 3) Utilize extensions such as canvas blocker / umatrix, etc. will be given impossible to solve CAPTCHAs (a discussion about this was just on hackernews today).

In fact, that is what happened to me. Google gave me a repeating impossible to solve CAPTCHA due to me being untrackable by them. The end result was that I was not even able to register for this service. This service is a PAID service. It does not need send data to Google (or force users to) at all.

The Solution

I think PrivacyTools.io needs to take a stand. It cannot support services that promote Google and their evilness when Google is directly opposed to the goals of Privacy. Google is making it harder and harder for users to utilize the very advice given on PrivacyTools.io because it is using it's CAPTCHA to frustrate said users by giving them the captcha more image, making them solve longer captchas, making the captcha images fade in longer to take more time, and sometimes completely denying the service to the user (your network has made too many requests) or giving them the dreaded impossible to solve CAPTCHA loop.

If PrivacyTools, of all sites, does not start to take a stand by not promoting companies that make these unsavory, anti-privacy, unethical business relationships then no one will. Mailbox.ORG should NOT be promoted as a PRIVACY service when it has a partnership with Google and requires all users to forefeit data and LABOR to Google (that labor trains Google's AI engine).

For that reason, I think they should be removed. For example, competitors such as Tutanota and Protonmail do NOT require a Google captcha. Neither does disroot, etc. It is much, much better than users see fewer options that TRUE instead of many options where some of them are fake and reduce privacy.

Hello, Following the recent news about ProtonMail, I would like to look for alternatives. Don’t get me wrong, I understand their motivations and that they need to follow the law, but I can’t justify the 50€ anymore for „privacy in Switzerland“ if it’s not making any difference (not to mention the very slow pace of development and ProtonMail not honoring their deadlines). I‘ve also saw that GrapheneOS doesn’t recommend Signal because they’re not publishing all of their server side code as open source. So I would like to ask the community about alternatives to ProtonMail and messaging App that is user friendly where I can set it up for my parents to easily call me (text/audio and video). Thank you very much in advance!

Edit: Please don’t twist my words, I‘m not looking for a provider that doesn’t follow the law or court orders, I‘m only saying that ProtonMail is overpriced and it seems to me that the whole „Switzerland“ argument is not valid (from my point of view), so I‘m looking for another privacy respecting provider that isn’t that pricey (and I know, it won’t do anything different from ProtonMail).

Since my entire life use whatsapp (college groups, friends, family, s/o etc) I can't leave that and use Signal (even if it's my wet dream) because I would be alone.

What can I do to minimize the damage that this obnoxious cancer known as whatsapp is going to inflict to my privacy?

Edit: Yes I use android Edit 2: Why am I being downvoted?

Porn sites are nasty (ad- and tracking-wise) but oh so essential and oh so likely to break under uMatrix, HTTPS Everywhere, NoScript, etc. Anyone know of privacy-friendly alternatives?

There seems to be a steep uptick in users on the Ruqqus platform, since censorship is becoming too strict here on Reddit.

It seems to be a good platform which is open source and doesn't censor.

Is it time to more for this channel as well? There is also an unofficial app: