cley_faye
@cley_faye@lemmy.world
- Comment on The EU still wants to scan all your chats – and the rules could come into force by October 2025 11 hours ago:
More money. More power. More control over millions of people. Control over what you say? Not their problem; just control everything.
The ability to deny other what they want is a drug to some people; make them feel superior.
- Comment on The EU still wants to scan all your chats – and the rules could come into force by October 2025 11 hours ago:
As long as owning a device that allow full E2E encryption without spyware isn’t illegal.
It bears repeating a lot of time : the technology to circumvent these things exist, and will continue to exist. However, there’s nothing preventing obtuse lawmakers from making it illegal to own. And then, it’s just a matter of catching someone and finding some rooted android phone in his pocket.
- Comment on The EU still wants to scan all your chats – and the rules could come into force by October 2025 11 hours ago:
but so far nothing happened
Things happens frighteningly fast these days. It’s not a matter of being complacent; it’s a matter of budding things in the nip. Which won’t work. Then tirelessly fight back against it.
Unless you’ve been sleeping under a rock these last few… weeks. Not even months. Some legislation can go from 0 to 100 extremely quickly if left unchecked.
- Comment on The EU still wants to scan all your chats – and the rules could come into force by October 2025 11 hours ago:
The EU decides what’s GDPR. And it seems recently it decided to not be buggered by those old ideas that are privacy, freedom, etc.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 13 hours ago:
And Gmail can retrieve your mails from proton using IMAP. It’s even in their own (proton’s) documentation.
I don’t think it can. Where in the documentation did you find that?
An online search brought me here : getmailbird.com/…/access-protonmail-com-via-imap-… which did looks like a documentation page about how to do exactly that. Obviously, it has nothing to do with them, and the actual details makes no sense the lower you get in the page. I’ve been had :)
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 13 hours ago:
I’ll just repost the same message here, for completion sake.
Well, I’ve been had. There is no IMAP support indeed, during my quick lookup around it, I ended up on a website that does look a lot like a real documentation that claim it does. My bad.
The point about sending and receiving messages in cleartext stands, as SMTP works that way, but at rest it is possible they’re keeping them encrypted.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 13 hours ago:
Well, I’ve been had. There is no IMAP support indeed, during my quick lookup around it, I ended up on a website that does look a lot like a real documentation that claim it does. My bad.
The point about sending and receiving messages in cleartext stands, as SMTP works that way, but at rest it is possible they’re keeping them encrypted.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 22 hours ago:
Ok yeah thats a far cry from Proton actually “Having your unencrypted emails on their servers” as if they’re not encrypted at rest.
See my other reply. There is no way to retrieve your mail using IMAP on a regular client if they’re encrypted on the server. And Gmail can retrieve your mails from proton using IMAP. It’s even in their own (proton’s) documentation.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 22 hours ago:
Now, Proton and various other “encrypted email” services then take that plaintext and encypt it with your public key, then store the ciphertext on their servers, and then they’re supposed to discard the plaintext, so that in case of a future court order, they wouldn’t have the plaintext anymore.
You would not be able to retrieve your mails using IMAP from a regular mail client if they were doing that. You can even retrieve them from Gmail, which is unlikely to support any kind of “bring your own private key to decrypt mails from IMAP”.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 22 hours ago:
Yes. They support IMAP. Which means, IMAP client can read your mails from the server. IMAP protocol does not support encryption, so any mail that does not add another layer of encryption (like GPG with encryption) implies that your mail is available in plaintext through IMAP, and as such, on the server.
If that’s not enough, when you send a mail to a third party that just use plain, old regular mail, it is sent from their (proton’s) SMTP server, in plaintext. Again, unless you add a layer of encryption (assuming the recipient understands it, too), it’s plaintext. On the servers.
Receiving is the same; if someone sends a mail to your proton address, is shows up in full plaintext on their SMTP server. Whatever they do after that (and we’ve established it’s not client-controlled encryption), they have access to it.
In the case of GPG with encryption (not only for signature), then the message is encrypted everywhere (assuming your “sent” folder is configured properly). But that requires both you and the other party to support that, which have nothing to do with proton; you could as well do that over gmail.
So, no, not a bold claim. The very basic of how emails standards works requires it.
Now, I’m not saying that Proton have nefarious plans or anything. It is very possible that they act in good faith when they say they “don’t snoop”, and maybe they even have some proper monitoring so that admin have a somewhat hard time to check in the data without leaving a trace, but it’s 100% in clear up there as long as you’re not adding your own layer of encryption on top of it, and as such, you, as the user, have to be aware of that. It might be fully encrypted at rest to prevent a third party from fetching a drive and getting data, logs might be excessively scrubbed to remove all trace of from/to addresses (something very common in logs, for maintenance purpose), they might have built-in encryption in their own clients that implement gpg or anything between their users, and they might even do it properly with full client-side controlled keypairs, but the mail content? Have to be available, or the service could not operate.
- Comment on heaven 1 day ago:
Heavn is a human construct, so really, nobody’s going there.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 1 day ago:
It’s probably different. The crypto bubble couldn’t actually do much in the field of useful things.
Now, I’m saying that with a HUGE grain of salt, but there are decent application with LLM (let’s not call that AI). Unfortunately, these usages are not really in the sight of any business putting tons of money into their “AI” offers.
I kinda hope we’ll get better LLM hardware to operate privately, using ethically sourced models, because some stuff is really neat. But that’s not the push they’re going for for now. Fortunately, we can already sort of do that, although the source of many publicly available models is currently… not that great.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 1 day ago:
We’re still in the “IT’S GETTING BILLIONS IN INVESTMENTS” part. Can’t wait for this to run out too.
- Comment on Proton’s Lumo AI chatbot: not end-to-end encrypted, not open source 1 day ago:
Any business putting “privacy first” thing that works only on their server, and requires full access to plaintext data to operate, should be seen as lying.
I’ve been annoyed by proton for a long while; they do (did?) provide a seemingly adequate service, but claims like “your mails are safe” when they obviously had to have them in plaintext on their server, even if only for compatibility with current standards, kept me away from them.
- Comment on Mastercard deflects blame for NSFW games being taken down, but Valve says payment processors 'specifically cited' a Mastercard rule about damaging the brand 1 day ago:
Their condition (both via and mastercard) include stuff which, when you read it attentively, boils down to “we only prevent illegal things. And stuff we deem bad.”.
It’s not even a game of telephone or anything, they have their conditions that says “yes we did” and their PR that says “we probably didn’t”. They could be playing alone and still losing this one.
- Comment on Big tech has spent $155 billion on AI this year. It’s about to spend hundreds of billions more 1 day ago:
Love that the pic associated with that link is Mark “Metaverse” Zuckerberg. A hallmark of successful dubious ventures, if any.
- Comment on Great Advertise 1 day ago:
Fakery and masquerading as actual content is annoying, yes, your point being?
- Comment on Great Advertise 1 day ago:
“unless your work involves drawing stuff, in which case fuck off”
- Comment on How it feels using TOR as a Brit rn 🤘 2 days ago:
I just hope they won’t move toward the “oh, you use encryption? Let’s see how it protects you from solitary in jail” step too fast.
And no, I’m not sarcastic, I’m worried.
- Comment on Whatever happened to the blockchain/smart contract 'revolution' we were told about? 2 days ago:
It’s being used for what it’s very good at. That means very little applications (although there are some), on a different scale, and certainly nothing that can promise a quick buck for free. Basically, empty promises just farted out.
Most of the real world usage were bogus, either because they did not actually work as advertised, or because they had lots of negative properties for businesses (imagine a system that would try to prevent fraud if done well… nobody wants that). There’s also the issue that a lot of “funky, interesting stuff”, once you filtered out the bad and the ugly, were just… less efficient, less useful versions of what we already used to do.
There are still people clinging to it (and the recent fuckery in the US might revive that… although for all the bad reasons), but the press moved forward to the next thing.
- Comment on Is this the end of Bootloader Unlocking in the EU? 3 days ago:
WTF just happened in Europe in the last few months. We used to be some sort of (dimmly lit) beacon of user freedom and privacy considerations. Now, I know there’s been a push for new legislations that basically fuck individual privacy over, but last I checked it was just a proposal. And now we’re doing a fucking 1260° turn toward full stanglehold on everything.
- Comment on Is this the end of Bootloader Unlocking in the EU? 3 days ago:
80 of people would just shrug as all control of their PC was taken away
Isn’t that actually the case? I know of these issues. And around me, I talk about them (without being pushy I hope). At work, the privacy issues with windows are seen as glaring warnings. But beyond that… I’m pretty sure the vase majority of people don’t care. Some are probably even enthusiast to have a “new update”, having no idea what it means.
- Comment on Slurrrrrrrrrrrrrrrrrrrrrrrrrrrrp 4 days ago:
And it probably should be. We could even have a set of small plates embedded somewhere for quick swapping on demand.
I like computers, but having an individual computer to run a single drink display really is overkill. At least use one to drive all the labels simultaneously, if you still want the ability to display nifty animations of liquid flowing above the actual liquid actually visibly flowing.
- Comment on UK households could face VPN 'ban' after use skyrockets following Online Safety Bill 5 days ago:
Oh, sweet summer child. Of course you can ban them. Lawmakers don’t always care about the technicality of things, because in most cases they don’t have to.
You can’t prevent VPN from existing, and short of a very tightly curated whitelist of services, you can’t prevent people from actually using them, sure. Unless you’re on the side of the state, the Law, and the enforcement. In which case, you can. A blanket ban on VPN usage is the perfect gateway to “we’ve seen traffic from your house toward a known VPN server, so, blam, arrest”. And it does not have to stop at known server.
Given the regular tries to outright ban encryption, this is the perfect venue to mass target encrypted communications. Depending on the wording, the mere presence of unobservable traffic could be enough for an arrest.
If what I’m saying here sound dystopian to you, just remember that not only most of this was actually tried (and aborted) time after time, but also that until quite recently, the general public actually using strong encryption was illegal in many places, including our western countries, experiments to make state spyware mandatory are also a recurrent thing (which might take hold with the “ID verification through your phone” apps soon).
- Comment on "Steam Did Not Respond To Us": Collective Shout Defends Calling On Payment Processors To Ban Adult Games 5 days ago:
Because THEY decided that THEIR opinions are better than everyone else’s, so YOU have to listen to THEM, willingly or not.
Something something free speech and all that jazz.
- Comment on "Steam Did Not Respond To Us": Collective Shout Defends Calling On Payment Processors To Ban Adult Games 5 days ago:
You dropped this
/s
- Comment on Think about what today is considered next level vs what it used to be 5 days ago:
My next level is going back to that. Not with a huge CRT or a full-blown hifi system, but a nice place with a screen, some offline way to play music/audio, a few books maybe…
- Comment on UK Government responded to the "Repeal the Online Safety Act" Petition. 6 days ago:
Fuck them.
- Comment on Microsoft admits it would have to let Trump spy on EU data if demanded 6 days ago:
There are provisions. I don’t remember the exact name of it, but basically, the US says “yah, these business are legit ok, you see?” and the EU is like “oh, ok, deal”. This includes the big providers and a handful of others, obviously.
And yes, it is a farce.
- Comment on Microsoft admits it would have to let Trump spy on EU data if demanded 6 days ago:
It is possible. The question is, is it done often, and is it done on hardware you can trust. I’m somewhat confident if I run my services on bare metal, the provider would have a hard time getting my encryption keys, although it’s not impossible even in this situation. How many people do so with VPS and managed instances, where snooping around the runtime and exfiltrating data unbeknownst to the user is trivial?
Also, beyond that, how many fall for the convenience of things like SSE, whether it’s with customer provided keys or not? That should be a red flag, but people find it oh so convenient.
We’re bound to see stuff bubble out where “we did all the right things” boils down to clicking a checkbox in some web UI and be done with it in the future.