The Privacy Iceberg

Very easy - as long as your router is on the table of hardware.

It's like $6.50USD /month, 2x the cost of mainstream vpn's.

It's valuable for me so I'm happy to pay and support them, but I'm mostly only need them while traveling.

A beginner will choose what seems private, regardless of whether or not it actually is.

What's up with brave? I know they are bloated as hell but I thought they tried to be private.

A man holds a laptop computer as cyber code is projected on him in this illustration picture taken on May 13, 2017.

Did AI write this?

"As seen on TV" does not imply privacy, it just implies a large advertising budget. These are software that market themselves as private (and are sometimes better than nothing at all) but may still be just as bad as software on the tip of the iceberg.

I'm a big fan of Duckduckgo, since Im using it for a couple of years. The search results have become much better compared to the past.

It's fine. For legal reasons (particularly in the EU and California) they had to add a Terms of Use fit the browser, and the had to translate a bunch of broad, idealist, simple phrases into legalese so they wouldn't get killed by those governments.

Privacy policy changes are worrying. They also implemented Privacy Preserving Attribution, which sends anonymized data to advertisers, and enable it by default. I personally like LibreWolf.

How the heck is TOR less secure than any of the vpns?

This isn't a ranking of security. It is ranked based on the experience level at which people generally begin to start using certain software. They build on top of each other.

That's how amnesiac it is.

Yea, telegram being advertised as a privacy messenger is a joke. If people want to have group chats like in discord and don't care about privacy, whatever. But to try and flaunt how privacy focused you are while using your own home-brewed encryption is a joke. Not to mention the fact you have to turn it on for every chat you want end to end encrypted.

The whole thing about not giving out data is really only accomplished by spreading user data across several countries. So you would have to get a search warrant from every country to get the data, relying on some countries not wanting to cooperate with other countries. That is not real security. Real security would be encrypting it so you literally couldn't give them the data, even if they had a search warrant. Ya know, like signal.

WhatsApp claim to use this. They do not show their code nor did they do any kind of audit. Therefore we have to assume that there is no encryption.

To be honest, and it wouldn't work here, but I sometime enjoy the cryptic nature of iceberg memes at the lower ranks. It's like a scavenger hunt.

Iceberg explanations are a whole Youtube genre, though - it's such a convenient narrative structure.

True. Apple would need a category on its own, but if i have to choose would place it on "As seen on TV".

It is fairly private and they quite give a fight about maintaining that status. There are no cases I am aware off they comply to open the system for authorities publicly and if so, they do not claim encryption anymore (as per UK.) Now... the key word is publicly; If I were a zealous top intelligence agency I would not force Apple to break an account for me so to obtain evidence on an individual so I can present it to a judge... for me Apple or Protonmail (or any other popular encrypted service really) would be far more valuable a place where I quietly could obtain intel on tens of thousands of targets and with that find other ways to find evidence if need be. It is a good sacrifice for the sustainability of the scheme.

Of course, this is just a thought and no evidence has been brought up. Apple is a large company and some whistleblower could easily popup if that were the case... yet again, having the right tight team is easy to keep it undercover, specially in a closed sourced software. The fact that the US is eyeing so many encrypted SaaS but Apple, with its omnipresence reach, is almost always left alone is a bit odd.

Well, following that (not fully wrong) logic everything until enthusiast level is useless since it runs on Windows and often not degoogled Chromium. And (given the meme doesn't contain /e/OS, iode, ShiftOS or Linux Mobile anywhere) anything until activist that happens on mobile phones is equally useless since it runs on Apple/Google Android.

I'm more annoyed about "Linux" as a whole being sorted into "Enthusiast". Using your Steam Deck in Desktop mode, buying a brand new Linux laptop for +600€ or even installing and using Linux Mint really isn't as enthusiastic anymore. :D

It collects and stores information about your system and also has your identity tied to your purchases.

I don’t think it’s a big privacy concern as far as tracking and spying on you.

But realize any device you install steam on then is tied to your real identity if you purchased games on that account. And can be used with data gained from other parties to determine your online activity if a government were to be able to obtain both.

I could also imagine DRM, though not directly privacy related, being a thing. Like the issues of freedom and openness are probably also important to many people who value privacy and might therefore prefer GOG or something over Steam.

Edit: I see someone else mentioned this already: https://lemmy.world/comment/16903223

Ditto

afaik the client does collect a bunch if data, most (all, i think? but not a 100% on that) of which is opt-in.

they do need stuff like IPs for internet related features.

telemetry wise there's the steam hardware survey, which is opt-in, and it asks every single time it attempts to collect your systems hardware and OS information. this could technically be identifying information, but since it's opt-in it's not a privacy violation and it's entirely optional. (plus it's super useful for all involved: users, devs, and steam. it's kind of a win-win and straight up necessary info for devs to know which hardware they should optimize for)

they might be putting it at the top because steam has native support for DRM?

but that's also weird, because DRM isn't a privacy violation. it's a shitty practice, barely does anything, barely works, and keeps breaking or hobbling otherwise perfectly good games, all of which is shitty, but it's little to do with privacy. and the dev has to specifically opt-in and integrate it as a feature...unless they're thinking of 3rd party DRM that can be waaay more intrusive, like Vanguard... THAT'S a privacy and security nightmare just waiting to blow up in people's faces.

otherwise...i haven't really heard anything bad about steam privacy wise?

doesn't mean that there's nothing to be concerned about, but i feel like there'd been some news about it if there was...

I forgot to put it on there. I would put it probably in The Beginner. Chromium-based browsers aren't all bad, such as Vanadium or Trivalent, so people sometimes feel more comfortable sticking with what seems familiar (coming from Chrome).

I like your thinking. Here an example why password manager make sense. If you would use the same password at every website and one of the would be for example Facebook, and they would get breached. Your password associated with your username and email , is now know to some hacker group. And in case of Facebook, the password is not hashed , it was stored in plain text. Now they have fun to try different websites with combinations of your name , email and password.

Alternatively a password manager stores for every website a different password, and your only mission is to keep that manager secure with a good , rememberable password.

Also , what I do , is using an email alias service. So I have a different Password and Email for each account. I don’t have to care if something gets breached, I am safe and aware of what information gets stolen.

And for future, we could all use passkeys and FIDO2 to block most phishing attempts.

1. A password managed is basically like a physical vault. If someone gets into a physical vault, they've gained access to all your valuable items, but the vault is extremely difficult to get into.
2. Random websites do not prioritize security like they should. So when there is inevitably a breach in one of those 50 sites and you end up on haveibeenpwned.com, that does not allow them access to the other 49 sites. Often when logins are breached, the people getting that information do not care about the actual site that was breached. Rather, they know a password you use and your email, and can now try to login to actually useful sites where people often use the same login.
3. There should be multiple layers of security to your password manager. Password and Authenticator app should be basic (No SMS or Email 2FA, not secure enough). Ideally, we move towards passwordless logins altogether so there is no secret that can be compromised on the server side.

~ how is that different than having 50 different accounts all using the same password?

Because the password manager would have to be hacked itself.

If you just use the same password for everything, any of those 50 sites could be hacked.

1. With a long enough passphrase, your keepass db is uncrackable by any current tech.
2. If you have 50 accounts using the same password, if any one of those websites get hacked, they now have access to every other account.

If you don’t use a second factor to unlock your password database then you are correct.

Here is the real secret. If the only authentication you have on an account is password auth then you really have no authentication at all. Passwords are not security