Not even Google sells any of your data. They collect data and sell advertising spots but not the data itself.

Selling data only works as a business model if you cannot sell ad spots. That is why news websites have cookie banners with 1000 partners but Google, Facebook, Apple, et al. do not.

How so? You cannot be forced to accuse yourself. If your self-hosted data is on encrypted hard drives then they can’t do anything about it.

Except in the UK where you can be forced to provide decryption keys.

Sadly that’s not it, I was using offline maps.

I’m not entirely sure what’s the exact issue, but it only really occurs when trying to change LoD quickly. E.g. clicking on an inter-city bus route and zooming out to see it in its entirety or zooming back in. From 10 km to 500 m can take 3-4 seconds which is enough to feel sluggish if you’re doing it often.

Probably not the most popular use case but it can get frustrating after a while nonetheless

My problem with OsmAnd is that it’s so very slow. Like, you zoom in and it takes seconds to display the map.

Yeah, that’s again a little different. You have to fully trust WhatsApp that they are doing what they promise. You can’t really verify this yourself.

Besides, if the app is open source, backdoors are generally more difficult to implement. Especially for something like E2EE, where people look very closely at what the application does with keys. Same with age verification in my opinion. You’d need to pull off a lot of gymnastics to put in a backdoor, see the xz utils one which was only achieved through several obfuscated stages in a codebase rarely ever looked at by another human.

Can you explain a little what you mean with:

So they simply scrape post decryption from the user’s device.

As far as I know, no social media company’s posts are E2EE. After all: It’s not possible to have both public posts and E2EE. “Direct messages” to other users can be E2EE but you’d have to trust the company with the encryption keys.

The only condition that requires Zero-Knowledge Protocols to function is that your device is not hijacked by hackers (and there are no deliberate backdoors and such). This can be achieved by having the app be open source with regular security audits. The social media company can do nothing to identify you, nor could the government (unless again, they collude and share secrets).

But yeah, social media can already identify most users because of surveillance capitalism. The goal however is to ensure identification is not in any way made easier via age verification.

You cannot turn a ZKP into being secretely not ZKP without significant effort though.

Take the following example protocol:

1. Social media app sends you a token to verify.
2. You append a private secrete string to the token and hash it with a known, collision resistant hash function.
3. You send the hash to the government’s server and request an “18+” signature. The signature should correspond to a public key.
4. You send the signature back to the social media app, including the secret you used.
5. The social media calculates the hash of its token + your secret and then checks whether the governmen’t signature is valid with that value.

The government will not know which social media site was used, the social media site will not discover anything about your identity beyond a binary “is above 18 years old” statement. This is because you control all communication.

To discover anything else, they would BOTH have to collude in some significant way. They can only do so in step 5, by having the social media app send the value you gave it to the government. Maybe there exists a protocol that you control that works against this threat as well, I’m not sure.

But if they collude in step 5 - what prevents the social media company from sending all information it has about you to the government already all the time, even without age verification? Like IP addresses, phone number, access time etc. If the government further controls all the ISP servers and log which traffic from where goes where, it could certainly identify you already.

Yeah, I’ve had to go through 20 or 30 circuits once to make Google’s captcha allow me through. It just failed with the message “Unusual traffic from your computer network”. Someone was probably running a botnet, as this only happens rarely. If Google wanted to block Tor, they’d have done so by now anyway.

That’s for government intelligence agencies though? Proton had to identify the activists due to a French court order which Switzerland enforced since these two countries cooperate to some extent.

Are there countries with solid privacy regulation which refuse to enforce court orders by friendly/allied nations?

Can you list countries with stronger privacy laws that woud not have forced Proton to provide this information to law enforcement of a friendly country?

There is an expectation of privacy anywhere.

The GDPR applies to everyone - including individuals. How long will you store my data? With whom will you share it? How can I contact you and revoke my consent of being recorded? What purpose is the storage of my data?

It does not infringe on your right to photograph in public by the way. As long as the person only happens to be in the photograph somewhere in the background without being the focus you are free to photograph anything and everything.

Your targeted photographs violate the freedom of movement of those you photograph. You are not free in your decisions if you are recorded. You will take the fact you are recorded into consideration and adjust your decisions accordingly.

What prevents someone from innocently setting up a security camera - which happens to also record the entrance of an LGBTQ bar and anyone who enters and exits it? Surely it would be a shame if this footage was then entered into facial recognition software to create a list of people. That is fully legal in countries without the right to privacy in public like the US.

It does increase the likelihood - marginally.

Fingerprint readers always got to balance between false positives and false negatives. If you want to reduce false negatives, false positives must be increased.

This shouldn’t really matter though. False positives are very low as-is so increasing them a little has nearly no impact on security.

Ortis has claimed that some unnamed Five Eyes foreign agent introduced him to the honeypot operation and that he didn’t notify his superiors at the RCMP about it.

How can you trust an unnamed intelligence officer though? For all we know, they might have an actual honeypot competing against Tuta and want to gain marketshare.

After all, intelligence agencies are guaranteed to be the first one’s who discovered Ortis was selling secret information. Might as well give him fake information to spread around and make criminals doubt any previous information sold by him.

Countries share information though. And it is not below a fascist US to give China some nice trade deals for detailed information on queer US-Americans. Nor is it for China to accept such a deal.

Fair enough, I’m far from an expert when it comes to working with these tools.

I’m not a graphics designer, I just occasionally dabble in GIMP. Is it really that bad or is it just different from Adobe? I’ve had some issues at first because the GUI is not intuitive in the slightest but I kind of enjoy the workflow now.

Although the most complicated thing I’ve ever done was recreating an AI generated logo with actual symmetry, logic and around 20 layers.

I genuinely believe the NSA et al is targeting those who attempt to avoid all targeting more than the average person. It’s difficult to avoid being tracked, it’s nearly impossible to additionally blend in with an unsuspicious façade. Might as well become a secret agent if you’re capable of avoiding the NSA’s gaze.