Privacy

1484 readers
329 users here now

Protect your privacy in the digital world

Welcome! This is a community for all those who are interested in protecting their privacy.

Rules

PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!

  1. Be nice, civil and no bigotry/prejudice.
  2. No tankies/alt-right fascists. The former can be tolerated but the latter are banned.
  3. Stay on topic.
  4. Don't promote big-tech software.
  5. No reposting of news that was already posted. Even from different sources.
  6. No crypto, blockchain, etc.
  7. No Xitter links. (only allowed when can't fact check any other way, use xcancel)

Related communities:

founded 4 months ago
MODERATORS
1
 
 

cross-posted from: https://lemmy.dbzer0.com/post/36880616

Help Combat Internet Censorship by Running a Snowflake Proxy (Browser or Android)

Internet censorship remains a critical threat to free expression and access to information worldwide. In regions like Iran, Russia, and Belarus, journalists, activists, and ordinary citizens face severe restrictions when trying to communicate or access uncensored news. You can support their efforts by operating a Snowflake proxy—a simple, low-impact way to contribute to a freer internet. No technical expertise is required. Here’s how it works:


What Is Snowflake?

Snowflake is a privacy tool integrated with the Tor network. By running a Snowflake proxy, you temporarily route internet traffic for users in censored regions, allowing them to bypass government or institutional blocks. Unlike traditional Tor relays, Snowflake requires minimal bandwidth, no configuration, and no ongoing maintenance. Your device acts as a temporary bridge, not a permanent node, ensuring both safety and ease of use.


Is This Safe for Me?

Short answer: Yes.

Long answer: pobably. Here is why:

  • Your IP address is not exposed to the websites they access. So, you don't have to worry about what they are doing either. You are not an exit node.
  • No activity logs. Snowflake cannot monitor or record what users do through your connection. The only stored information is how many people have connected to your bridge. Check docs for further info on this.
  • Low resource usage. The data consumed is comparable to background app activity—far less than streaming video or music.
  • No direct access to your system
  • No storage of sensitive data. Snowflake proxies do not store any sensitive data, such as IP addresses or browsing history, on your system.
  • Encrypted communication. All communication between the Snowflake proxy and the Tor network is encrypted, making it difficult for attackers to intercept or manipulate data.

You are not hosting a VPN or a full Tor relay. Your role is limited to facilitating encrypted connections, similar to relaying a sealed envelope.

Your IP address is exposed to the user (in a P2P-like connection). Be mindful that your ISP could also potentially see the WebRTC traffic and the connections being made to it (but not the contents), so be mindful of your threat model.

For most users, it is generally safe to run Snowflake proxies. Theoretically, your ISP will be able to know that there are connections being made there, but to them it will look like you're calling someone on, say, Zoom.

Historically, as far as we know, there haven't been any cases of people getting in legal trouble for running entry relays, middle relays, or bridges. There have a been a few cases of people running exit nodes and getting in trouble with law enforcement agencies, but none of them have been arrested or prosecuted as far as I know it. If you are aware of any cases, let me know so I can update this post.

Do not hesitate to check Snowflake's official documentation for further reference and to make informed decisions.


How to Set Up a Snowflake Proxy

Option 1: Browser Extension (Brave, Firefox, or Chrome)

  1. Install the Snowflake extension.
  2. Click the Snowflake icon in your browser toolbar and toggle "Enable Snowflake."
  3. Keep the browser open. That’s all.

Note: Brave users can enable Snowflake directly in settings. Navigate to brave://settings/privacy and activate the option under "Privacy and security."


Option 2: Android Devices via Orbot

  1. Download Orbot (Tor’s official Android app).
  2. Open the app’s menu, select "Snowflake Proxy," and toggle it on.
  3. For continuous operation, keep your device charged and connected to Wi-Fi.

Your device will now contribute as a proxy whenever the app is active.


Addressing Common Concerns

  • Battery drain: Negligible. Snowflake consumes fewer resources than typical social media or messaging apps.
  • Data usage: Most users report under 1 GB per month. Adjust data limits in Orbot’s settings or restrict operation to Wi-Fi if necessary.

Why Your Participation Matters

Censorship mechanisms grow more sophisticated every year, but tools like Snowflake empower ordinary users to counteract them. Each proxy strengthens the Tor network’s resilience, making it harder for authoritarian regimes to isolate their populations. By donating a small amount of bandwidth, you provide someone with a critical connection to uncensored information, education, and global dialogue.

Recent surges in demand—particularly in Russia—highlight the urgent need for more proxies. Your contribution, however small, has an impact.

By participating, you become part of a global effort to defend digital rights and counter censorship. Please, also be mindful of your threat mode and understand the potential risks (though very little for most people). Check Snowflake's official documentation for further reference and don't make any decisions based on this post before taking your time to read through it.

Please share this post to raise awareness. The more proxies, the stronger the network.

– llama

2
12
submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]
 
 

It's hard to make the full switch towards a more private life, but switching your mail already fixes a big underlying issue: that being, Google or other companies having access to all your emails. So, I'll cover the basics of making your online mailing more private.

Switching Mail Providers:

Your email is a big part of your online footprint and helps you keep track of your online identity. So, in order to keep that to yourself, I encourage leaving services like:

"Gmail" or "Outlook",

for others like:

"ProtonMail" or "Tutanota".

This is already a big step towards keeping all your emails private and safe. Both of these are free and respect your privacy on their free tier, but expand in features with paid plans. This takes time, as you have to switch your email on most accounts to this new email.

For the best privacy, you should delete most accounts and create new ones with this new email or with aliases. Some people, like myself, prefer to have multiple emails over aliases. For example:

(Self-hosting your own mail domain is possible, but it’s a harder process, and custom domains are not always accepted or reliable.)

(You should keep your old email for a year or so to make sure no important service was left behind locked to that email. Once that's done, you can delete the account.)

Tips:

If you can, you should try expanding your protocol with this:

  • Adding 2FA to any online website, especially email. I use ~~"Authy" ~~for this. -> Better use Aegis, good app!

  • Switching your browser to something like "Librewolf".

  • Switching to a password manager like "Proton Pass" or "1Password".

  • Encourage your close family to do the same once you're comfortable with the process.

  • Switch social media to private alternatives.

  • If you take any efforts to switch browser or install Aegis, try to use "F-droid", or even better, "Droidify". These being a FOSS app store, and a good Material alternative frontend. For apps not in here, consider "Aurora store", a more private **"Play store" **alternative

This is about it for me, quick posts from class, feel free to add into this topic bellow.

Edit:

Important additions after reading the comments:

  • Proton is a bit disencouraged by some for some political views published by the CEO under proton's account and image. They backed down, and I believe it isn't something too bad as for users to leave such a good privacy oriented suite of apps. I encourage anyone who cares about this topic to research before making the switch.

  • Mail is not 100% private with any option, and shouldn't be used for highly sensitive information. For that use end to end encrypted apps well respected, like "signal". Still is best to just don't send very sensitive information online.

  • As a comment pointed, for a mail to be as private as possible, both the sender and reciever should have a private mail, otherwise you can be private but the other person would still be having your mail conversations stored under "gmail" or similar.

Sorry if this post didn't give the best newbie advice, I tried to track back some of my old knowledge, but I'll take more time to research the next time. Take care and stay private!

3
4
5
6
7
 
 

cross-posted from: https://lemmy.sdf.org/post/31274457

Archive

An exploitation avenue found by Trend Micro in Windows has been used in an eight-year-long spying campaign, but there's no sign of a fix from Microsoft, which apparently considers this a low priority.

The attack method is low-tech but effective, relying on malicious .LNK shortcut files rigged with commands to download malware. While appearing to point to legitimate files or executables, these shortcuts quietly include extra instructions to fetch or unpack and attempt to run malicious payloads.

Ordinarily, the shortcut's target and command-line arguments would be clearly visible in Windows, making suspicious commands easy to spot. But Trend's Zero Day Initiative said it observed North Korea-backed crews padding out the command-line arguments with megabytes of whitespace, burying the actual commands deep out of sight in the user interface.

Trend reported this to Microsoft in September last year and estimates that it has been used since 2017. It said it had found nearly 1,000 tampered .LNK files in circulation but estimates the actual number of attacks could have been higher.

"This is one of many bugs that the attackers are using, but this is one that is not patched and that's why we reported it as a zero day," Dustin Childs, head of threat awareness at the Zero Day Initiative, [said].

"We told Microsoft but they consider it a UI issue, not a security issue. So it doesn't meet their bar for servicing as a security update, but it might be fixed in a later OS version, or something along those lines."

[...]

8
14
The Meaning Of Privacy. (www.counterpunch.org)
submitted 1 day ago* (last edited 1 day ago) by [email protected] to c/[email protected]
 
 

Structures of surveillance have their roots within the infrastructure of our commercial sector and government. This is not new, but the government’s audacity has grown monstrous with the recent example of Mahmoud Khalil and the blatant disregard for the most basic rights of habeas corpus.

9
6
Buying a computer online? (lemmy.dbzer0.com)
submitted 1 day ago* (last edited 1 day ago) by [email protected] to c/[email protected]
 
 

Hi there! If I buy a computer on Amazon from a trusted brand like Apple or Lenovo, will they keep my name and address and connect that information to the serial numbers of the computer's parts? I'm especially worried about this when I visit various websites that track serial numbers from my PC while browsing or when using gaming platforms like Steam. Would it be wiser to purchase it from a physical store using cash, or a second-hand computer from ebay instead?

10
 
 

I've always had it on, but it's kind of a pain in the ass. Especially on worse (not necessarily slower) networks.

On laptop it's fine for the most part since the use-case is a bit different, but on a phone it's causing me some annoyances/issues.

With my carrier indoors it takes on average 62 seconds to connect. This is pretty annoying if toggling/switching VPN servers more often.
But when travelling (e.g.: in a train) it can make the difference from slightly spotty signal to almost never being connected successfully, impacting usability.

As such, I often find myself not even using VPN in such cases in the first place.
For comparison, plain Wireguard is done before I can pull away my finger from the "connect" button, usually even on 2G EDGE.

Do you keep this (perhaps a bit paranoid-level) option on?
Even if actually useful in the future, it would only protect traffic recorded from User to VPN anyway.

11
 
 

Archived version

Here is an Invidious link for the video (and 'Lola' part starts at ~5 minutes)

To demonstrate this, Sadoun introduces the audience to “Lola,” a hypothetical young woman who represents the typical web user that Publicis now has data about. “At a base level, we know who she is, what she watches, what she reads, and who she lives with,” Sadoun says. “Through the power of connected identity, we also know who she follows on social media, what she buys online and offline, where she buys, when she buys, and more importantly, why she buys.”

It gets worse. “We know that Lola has two children and that her kids drink lots of premium fruit juice. We can see that the price of the SKU she buys has been steadily rising on her local retailer’s shelf. We can also see that Lola’s income has not been keeping pace with inflation. With CoreAI, we can predict that Lola has a high propensity to trade down to private label,” Sadoun says, meaning that the algorithm apprehends whether Lola is likely to start buying a cheaper brand of juice. If the software decides this is the case, the CoreAI algo can automatically start showing Lola ads for those reduced price juice brands, Sadoun says.

12
 
 

Fastbackgroundcheck. com says there's info on me on truthfinder, spokeo, peoplefinders and instantcheckmate. When I try going through all four of those sites takes a super long time, including a few times in the past when I tried getting reports on myself.

The progress bars reach 100% and reset continously. If these sites are legimate like some reddit users claim, then why or be upfront about wanting me to pay? Right now I'm convinced that these sites are snake oil, maybe they work if you pay but the behavior of the free options turn me off. They act 100% like typical scam websites, the kind that asks you to complete three surveys on external sites with fake progress bars.

Basic info like my full name, address, age, and siblings can be found with search engines easily but I feel like there's no point in trying to wipe it if there aren't methods that could definitely work.

13
14
15
16
 
 

cross-posted from: https://europe.pub/post/9313

cross-posted from: https://europe.pub/post/9311

In case you ever wanted to blur your house from google street view you can. A little privacy i suppose, its pretty easy. you dont need a reason to do it. This probaly the only thing google lets opt out of which is cool.

Originally posted on Reddit

17
18
19
 
 

@privacy Privacy Roundup: Week 11 of Year 2025

Hi Lemmy, shared with <3 from Mastodon.

https://avoidthehack.com/privacy-week11-2025

20
 
 

cross-posted from: https://futurology.today/post/4000823

And by burned, I mean "realize they have been burning for over a year". I'm referring to a bug in the Tor Browser flatpak that prevented the launcher from updating the actual browser, despite the launcher itself updating every week or so. The fix requires manual intervention, and this was never communicated to users. The browser itself also doesn't alert the user that it is outdated. The only reason I found out today was because the NoScript extension broke due to the browser being so old.

To make matters worse, the outdated version of the browser that I had, differs from the outdated version reported in the Github thread. In other words, if you were hoping that at least everybody affected by the bug would be stuck at the same version (and thus have the same fingerprint), that doesn't seem to be the case.

This is an extreme fingerprinting vulnerability. In fact I checked my fingerprint on multiple websites, and I had a unique fingerprint even with javascript disabled. So in other words, despite following the best privacy and security advice of:

  1. using Tor Browser
  2. disabling javascript
  3. keeping software updated

My online habits have been tracked for over a year. Even if Duckduckgo or Startpage doesn't fingerprint users, Reddit sure does (to detect ban evasions, etc), and we all know 90% of searches lead to Reddit, and that Reddit sells data to Google. So I have been browsing the web for over a year with a false sense of security, all the while most of my browsing was linked to a single identity, and that much data is more than enough to link it to my real identity.

How was I supposed to catch this? Manually check the About page of my browser to make sure the number keeps incrementing? Browse the Github issue tracker before bed? Is all this privacy and security advice actually good, or does it just give people a false sense of security, when in reality the software isn't maintained enough for those recommendations to make a difference? Sorry for the rant, it's just all so tiring.

Edit: I want to clarify that this is not an attack on the lone dev maintaining the Tor Browser flatpak. They mention in the issue that they were fairly busy last year. I just wanted to know how other people handled this issue.

21
 
 

It looks like the Privacy Act might be a way to audit DOGE on a per-person level. Jamie Raskin has suggested mailing them a formal request for your data.

While there does appear to be precedent for this, I can't find much more information about it. So this is more of a thread in search of info.

Here is some from NPR:

The Privacy Act was once a quite sleepy law in my privacy classes. It's gotten increasing prominence in part because there's been so much compliance with the Privacy Act. You know, every agency now has to put out, you know, notices about having new collections of information in databases. And there's chief privacy officers at every agency. You have to pay attention to it and adhere to its commitments, which are to ensure that you don't collect information you shouldn't be collecting for a proper purpose, and that you're not sharing it unless you meet the conditions of the Privacy Act.

22
14
submitted 1 week ago* (last edited 1 week ago) by [email protected] to c/[email protected]
 
 

cross-posted from: https://programming.dev/post/26910708

My small company (less than 30 employees) has been using Skype for internal group meetings and messaging. Since it's closing, we're looking for alternatives.

I think few people in the company are privacy minded (one of the higher ups had to get scolded to stop using some random AI to listen to all his meetings and write summaries), so we need something with a low barrier to entry.

We have basically no IT department, so self hosting would be a challenge. We do self host a redmine server via docker, and we have to connect to it via VPN when we're off-site (we have several full time remote employees).

Our feature requirements are: Group and individual messaging Screen sharing Meetings up to 2 hours Inexpensive Meetings with up to 10 participants Windows (some people use Skype from their phones also, but not a requirement) Minimal friction to setup and use Minimal bugs (mature)

Some of the ideas floated: Teams Discord Google Meet Signal Telegram Jami

I really don't think we could pull off Matrix, but am I wrong? Which of these ideas bothers you the least? Is there something else I'm overlooking?

23
 
 

Join this tactical, practical, and heretical discussion between Meredith Whittaker, President of Signal and leading advocate for secure communication, and Guy Kawasaki, host of the Remarkable People podcast

24
 
 

Someone made a compilation of academic reviews and blogposts here: https://community.signalusers.org/t/wiki-overview-of-third-party-security-audits/13243 but none of them seem to be real security audit reports, ex. compare with real security audits to Delta Chat: https://delta.chat/en/help#security-audits

25
 
 

Privacy rights groups have called on Apple’s legal challenge to a secret U.K. government order asking it to backdoor an end-to-end encrypted (E2EE) version of its iCloud storage service to be heard in public, rather than behind closed doors.

view more: next ›