cross-posted from: https://feddit.org/post/12078124 > The author addresses the issue.

Aujourd'hui nous célébrons le droit du travail et les luttes sociales.

Quelques rappels ✍️:

\--\> Le capitalisme est un système qui priorise le profit sur les personnes. Il conduit à une inégalité générale et à la destruction 💥

\--\> La censure numérique est un outil utilisé par ceux en pouvoir pour contrôler l'information et supprimer les voix dissidentes 🔊

\--\> Nous sommes confrontés actuellement à un cirque politique et médiatique clownesque. Peu importe le bord politique, nous devons rester lucide et continuer à défendre une vision de justice globale 🙏

\--\> Vous pouvez contribuer et être acteur d'un internet plus libre, plus juste et beau ❤️.

(en aidant des projets comme : @nos\_oignons @torproject @i2p @Framasoft @PartiPirate @debian @archlinux @privacytools @privacyguides ... )

\#numerique #1ermai #1ermai2025 #droitdutravail #censure #internet #politique #oppression #tor #linux #FOSS #opensource #libre #framasoft #partipirate #droit #justice #debian #i2p

Hello,

as this is a fairly active community we just wanted to let you know that this community is no longer federating with Lemmy.World due to defederation from lemmy.one for lack of moderation.

Our announcement can be found here: https://lemmy.world/post/28173093

We recommend migrating to a community on an instance that is maintained better.

Before today, mailbox.org's 2FA mechanism was unorthodox. In the login screen, you typed in the TOTP in the password field and then added a 4 digit static pin at the end. This got people confused, as it's different than the usual login+password then TOTP. Now it's just like that.

There's also other goodies, like separate passwords for IMAP and SMTP, WebDAV, CardDAV/CalDAV (one password for both), Exchange Sync. Before today, you'd be using your main mailbox.org password for all of the above. Looks like IMAP access is not even possible without creating a separate password https://kb.mailbox.org/en/private/account-article/how-to-use-two-factor-authentication-2fa/

There doesn't seem to be support for the YubiKey TOTP anymore. No passkeys or hardware webauthn either for now.

mailbox.org is based on OpenXchange.

🛡️Privacy Means Safety - Privacy Guides🔏

@privacyguides

https://www.privacyguides.org/articles/2025/03/25/privacy-means-safety/

>Encryption can’t protect you from adding the wrong person to a group chat. But there is also a setting to make sure you don’t.

>You can add your own nickname to a Signal contact by clicking on the person’s profile picture in a chat with them then clicking “Nickname.” Signal says “Nicknames & notes are stored with Signal and end-to-end encrypted. They are only visible to you.” So, you can add a nickname to a Jason saying “co-founder,” or maybe “national security adviser,” and no one else is going to see it. Just you. When you’re trying to make a group chat, perhaps.

>Signal could improve its user interface around groups and people with duplicate display names.

I may need to visit the United States briefly, therefore I want to offline backup my text messages and signal messages from my GrapheneOS phone. Once I return home I want to restore my data from the offline backup. Does anybody have experience and recommendations for this?

Hi 👋 just shared the site with one of my buddies and he told me he doesn’t care much about it because there’s no way you’ll be 100% privacy enforced since you’re using an iPhone and sharing your location, name, birthdate , personal files, photos.

I’ve to say this gets to me but on the other side I’m also respectful of everyone‘s opinion because after all, this is what makes us special

How are you handling these circumstances usually, do you say something?

I really like the convenience of using fingerprint unlock for lockscreen and password manager. I do however don't like the thought of being forced to unlock both physically.

I use Android with GrapheneOS.

I have set up lockdown, but it takes some time to hold the power button and then click lockdown.

Any creative solutions?

I recently discovered this setting and thought it might be of interest to others::

> This setting is intended to help our users in the European Economic Area (EEA), the United Kingdom and Switzerland control the use of their personal data to train, test, validate, and align our own Al models as well as third-party Al models

Fastbackgroundcheck. com says there's info on me on truthfinder, spokeo, peoplefinders and instantcheckmate. When I try going through all four of those sites takes a super long time, including a few times in the past when I tried getting reports on myself.

The progress bars reach 100% and reset continously. If these sites are legimate like some reddit users claim, then why or be upfront about wanting me to pay? Right now I'm convinced that these sites are snake oil, maybe they work if you pay but the behavior of the free options turn me off. They act 100% like typical scam websites, the kind that asks you to complete three surveys on external sites with fake progress bars.

Basic info like my full name, address, age, and siblings can be found with search engines easily but I feel like there's no point in trying to wipe it if there aren't methods that could definitely work.

I have a lot of friends and family that use SMS/RCS and I can't get them all to use Signal.

I have the option to send SMS from a simple FOSS SMS app, and then we can communicate back and forth.

I've heard something about RCS getting E2EE and find that appealing.

What is the future of RCS? What are my options, and should I just stick with SMS?

Edit: Stick with SMS when I have to, and use Signal etc when possible ofc.

>A contractor for Immigration and Customs Enforcement (ICE) and many other U.S. government agencies has developed a tool that lets analysts more easily pull a target individual’s publicly available data from a wide array of sites, social networks, apps, and services across the web at once, including Bluesky, OnlyFans, and various Meta platforms, according to a leaked list of the sites obtained by 404 Media. In all the list names more than 200 sites that the contractor, called ShadowDragon, pulls data from and makes available to its government clients, allowing them to map out a person’s activity, movements, and relationships.

>ShadowDragon says in marketing material its tools can be used to monitor protests, and claims it found protests around Union Station in Washington DC during a 2023 visit by Benjamin Netanyahu. Daniel Clemens, ShadowDragon’s CEO, previously said on a podcast that protesters should not “be surprised when people are going to investigate you because you made their life difficult.”

>“The long list of sites and services that ShadowDragon’s SocialNet tool accesses is a reminder of just how much data is accessible and collected from and about us to provide surveillance services to the government and others,” Jeramie Scott, senior counsel and director the Electronic Privacy Information Center’s (EPIC) Project on Surveillance Oversight, told 404 Media in an email. “SocialNet is just one example of the unchecked surveillance ecosystem that lacks any meaningful transparency, oversight, or accountability that allows the government to circumvent Constitutional and statutory protections to access sensitive personal data,” he added.

>The leaked list of targeted sites and services include ones from major tech companies such as Apple, Amazon, Meta, Microsoft, and TikTok. It also includes communication tools like Discord and WhatsApp; activity- or hobby-focused sites like AllTrails, BookCrossing, Chess.com, and cigar review site Cigar Dojo; payment services like Cash App, BuyMeACoffee, and PayPal; sex worker sites OnlyFans and JustForFans; and social networks Bluesky and Telegram. Even relatively obscure social networks are included in the list, such as BeReal.

I haven't played Minecraft since 2015, but I get the feeling I might again in the new few years as I wanna find new hobbies. I know that game has changed a whole lot but I don't have any official online data on it.

I've had this Microsoft account for over a decade and its probably full of personal information that I wanna let go of, I've already exported all my data. I would need to pay $30 for another copy of Minecraft, same price I paid in 2013. I just did a bunch of searching and its not possible to transfer my Minecraft license to another account.

Update:

https://darkmentor.com/blog/esp32_non-backdoor/

>Apple reportedly filed an appeal in hopes of overturning a secret UK order requiring it to create a backdoor for government security officials to access encrypted data. > >"The iPhone maker has made its appeal to the Investigatory Powers Tribunal, an independent judicial body that examines complaints against the UK security services, according to people familiar with the matter," the Financial Times reported today. The case "is believed to be the first time that provisions in the 2016 Investigatory Powers Act allowing UK authorities to break encryption have been tested before the court," the article said.

>Although it wasn't previously reported, Apple's appeal was filed last month at about the time it withdrew ADP from the UK, the Financial Times wrote today.

>"The case could be heard as soon as this month, although it is unclear whether there will be any public disclosure of the hearing," the FT wrote. "The government is likely to argue the case should be restricted on national security grounds."

At launch, access to Mullvad Leta was restricted to users with a paid Mullvad VPN account, but it is now free and open to all.

Mullvad Leta has been audited by Assured.

• FAQ
• Terms of Service

Just a heads up, some of the details in the FAQ and Terms of Service seem a bit outdated and might not be accurate anymore.

Some relevant information from their FAQ section is as follows:

What can I do with Leta?

Leta is a search engine. You can use it to return search results from many locations. We provide text search results, currently we do not offer image, news or any other types of search result. Leta acts as a proxy to Google and Brave search results. You can select which backend search engine you wish to use from the homepage of Leta.

Can I use Leta as my default search engine?

Yes, so long as your browser supports changing default search engines.

Navigate to https://leta.mullvad.net/ in your browser and right-click on the URL bar.

From there you should see Add “Mullvad Leta“ with the Mullvad VPN logo to the left.

If you do not see this, you can attempt to add a custom search engine to your browser with:

• The name set to: Leta
• The URL set to: https://leta.mullvad.net/?q=%25s

You can select which backend engine to use as follows:

• Google: https://leta.mullvad.net/?q=%25s&engine=google
• Brave: https://leta.mullvad.net/?q=%25s&engine=brave

Did you make your own search engine from scratch?

We did not, we made a front end to the Google and Brave Search APIs.

Our search engine performs the searches on behalf of our users. This means that rather than using Google or Brave Search directly, our Leta server makes the requests.

Searching by proxy in other words.

What is the point of Leta?

Leta aims to present a reliable and trustworthy way of searching privately on the internet.

However, Leta is useless as a service if you use the perfect non-logging VPN, a privacy focussed DNS service, a web browser that resists fingerprinting, and correlation attacks from global actors. Leta is also useless if your browser blocks all cookies, tracking pixels and other tracking technologies.

For most people Leta can be useful, as the above conditions cannot ever truly be met by systems that are available today.

What is a cached search?

We store every search in a RAM based cache storage (Redis), which is removed after it reaches over 30 days in age.

Cached searches are fetched from this storage, which means we return a result that can be from 0 to 30 days old. It may be the case that no other user has searched for something during the time that you search, which means you would be shown a stale result.

What happens to everything I search for?

Your searches are performed by proxy, it is the Leta server that makes calls to the Google or Brave Search API.

Each search that has not already been cached is saved in RAM for 30 days. The idea is that the more searches performed, the larger and more substantial the cached results become, therefore aiding with privacy.

All searches will be stored hashed with a secret in a cache. When you perform a search the cache will be checked first, before determining whether a direct call to Google or Brave Search should be made. Each time the Leta application is restarted (due to an upgrade, or new version) server side, a new secret hash is generated, meaning that all previous search queries are no longer visible to Leta

What could potentially be a unique search would become something that many other users would also search for.

What is running on the server side?

We run the Leta servers on STBooted RAM only servers, the same as our VPN servers. These servers run the latest Ubuntu LTS, with our own stripped down custom Mullvad VPN kernel which we tune in-house to remove anything unnecessary for the running system.

The cached search results are stored in an in-memory Redis key / value store.

The Leta service is a NodeJS based application that proxies requests to Google or Brave Search, or returns them from cache.

We gather metrics relating to the number of cached searches, vs direct searches, solely to understand the value of our service.

Additionally we gather information about CPU usage, RAM usage and other such information to keep the service running smoothly.

I am not the author.

I found this blog to have both a short summary of the reasons as well as a pretty complete overview of the options for protecting against this specific threat model. I can just send this to people and they'll understand the why and the how.

>Firefox maker Mozilla deleted a promise to never sell its users' personal data and is trying to assure worried users that its approach to privacy hasn't fundamentally changed. Until recently, a Firefox FAQ promised that the browser maker never has and never will sell its users' personal data. An archived version from January 30 says: > >>Does Firefox sell your personal data? >> >>Nope. Never have, never will. And we protect you from many of the advertisers who do. Firefox products are designed to protect your privacy. That's a promise. > >That promise is removed from the current version. There's also a notable change in a data privacy FAQ that used to say, "Mozilla doesn't sell data about you, and we don't buy data about you." > >The data privacy FAQ now explains that Mozilla is no longer making blanket promises about not selling data because some legal jurisdictions define "sale" in a very broad way: > >>Mozilla doesn't sell data about you (in the way that most people think about "selling data"), and we don't buy data about you. Since we strive for transparency, and the LEGAL definition of "sale of data" is extremely broad in some places, we've had to step back from making the definitive statements you know and love. We still put a lot of work into making sure that the data that we share with our partners (which we need to do to make Firefox commercially viable) is stripped of any identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP). > >Mozilla didn't say which legal jurisdictions have these broad definitions.

>Hot off the back of its recent leadership rejig, Mozilla has announced users of Firefox will soon be subject to a ‘Terms of Use’ policy — a first for the iconic open source web browser.

>This official Terms of Use will, Mozilla argues, offer users ‘more transparency’ over their ‘rights and permissions’ as they use Firefox to browse the information superhighway — as well well as Mozilla’s “rights” to help them do it, as this excerpt makes clear: > >>You give Mozilla all rights necessary to operate Firefox, including processing data as we describe in the Firefox Privacy Notice, as well as acting on your behalf to help you navigate the internet. >> >>When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox.

>Also about to go into effect is an updated privacy notice (aka privacy policy). This adds a crop of cushy caveats to cover the company’s planned AI chatbot integrations, cloud-based service features, and more ads and sponsored content on Firefox New Tab page.

>Signal CEO Meredith Whittaker says her company will withdraw from countries that force messaging providers to allow law enforcement officials to access encrypted user data, as Sweden continues to mull such plans.

>She made the claims in an interview with Swedish media SVT Nyheter which reported the government could legislate for a so-called E2EE backdoor as soon as March 2026. It could bring all E2EE messenger apps like Signal, WhatsApp, iMessage, and others into scope. > >Whittaker said there is no such thing as a backdoor for E2EE "that only the good guys can access," however. > >"Either it's a vulnerability that lets everyone in, or we continue to uphold strong, robust encryption and ensure the right to privacy for everyone. It either works for everyone or it's broken for everyone, and our response is the same: We would leave the market before we would comply with something that would catastrophically undermine our ability to provide private communications."

>Sweden launched an investigation into its data retention and access laws in 2021, which was finalized and published in May 2023, led by Minister of Justice Gunnar Strömmer. > >Strömmer said it was vital that law enforcement and intelligence agencies were able to access encrypted messaging content to scupper serious crime – the main argument made by the UK in pursuing its long-term ambition to break E2EE. > >The inquiry made several proposals to amend existing legislation, including the recommendation that encrypted messaging must store chat data for up to two years and make it available to law enforcement officials upon request. > >It would essentially mirror the existing obligation for telecoms companies to provide call and SMS data to law enforcement, as is standard across many parts of the developed world, but extend it to encrypted communications providers.

Hello everyone!

I was wondering what solutions people have for Calendar syncing that are not Proton / Tuta.

Specifically, I was wondering what E2EE options are available that are ideally cross-platform as well.

The main reason why I ask is I am frankly frustrated with how both Tuta and Proton rely on their own apps, and don't necessarily integrate well with all operating systems. Especially with Proton's growing suite of apps, it feels like they are in some ways creating their own walled garden. While it is at this time a better privacy option than the conventional options, it is still a situation that feels like a vendor lock-in situation.

Any suggestions would be greatly appreciated, including those that require a self-hosted server :)

>Proton: “We’re consolidating our social media presence due to limited resources and no longer posting on Mastodon. Follow us on Reddit for the latest updates”

cross-posted from: https://lemmy.ca/post/39305551

> I recently transferred one of my domains over to Combell (a registrar based in Belgium), and they gave me an email inbox under my domain as part of the package. However, I’m wondering if it’s trustworthy. > > If it isn’t, I can set the registrar to redirect mail to the Posteo alias I currently use for the site. However, it would be convenient to be able to use this inbox. > > I would, of course, be using PGP encryption when possible (although in practice this is infrequent). > > Any thoughts?