pending anonymous user

  • 5 Posts
  • 117 Comments
Joined 2 years ago
cake
Cake day: August 7th, 2023

help-circle
  • This is a reality of any software. Those requirements exists by themselves or in some combinations, but once you want them all, the difficulty grows exponentially.

    The Sunbird model works. Their model isn’t that hard to replicate, and have the steps laidout for you to copy. However, it doesn’t offer some perks you want with limitations. For example, you can only have 5 devices linked to 1 Signal account. There is no 2FA, fine grained access control, nor audit log. The search functionality is not particularly good.

    There are ways to overcome those limitations but you will need some tech savvy dude with proper security backgroud/training to design, implement, and manage that. It steps into semi-custom developement and integration, and be warned, it is hard to done right, especially anything with security.


  • Say your organization is doing something like Amnesty International (at least sounds awlful lot similar to me), you want a solution that

    • encryption
    • shared inbox between trusted members
    • minimal meta-data leak to providers (service providers and network node operators)
      • hide who is sending/receiving
    • easy to search/indexed
    • fine grained access control
    • audit log of who responed to who
    • multi-device
    • single stable address/contact point (how “stable” you need it to be?)
    • 2fa?
    • easy to use

    Am I correct? To be honest, it is quite a tall order. I can’t really think of a solution right now. Email is definitely out of the question because you can’t hide who is sending and receiving the email.



  • I don’t understand why you need encryption. It seems you are concerned about access control and metadata on the security side. If that’s the case, it is more advisable to host your own email server. However, be aware that once the email is sent, your recipient email system may be hosted by other email providers that you might not desire. You can reduce the metadata leaks by using encryption, but as you are aware, not everybody kin to use it. And to be effective, it must be used by both sides.









  • They both are bad in privacy in one way or the other. WhatsApp is collecting vast trove of data about you, though it can’t read the chat itself. Telegram doesn’t have end-to-end encryption enabled by default, means anyone have access to the server can read your chat history, though you’re last subject to data collection.

    If you’re doing illicit activity though, WhatsApp is better than Telegram because the chat contents are the evidence those law enforcements are going after, not the connection. They can’t arrest you because you make friends with a criminal, but they absolutely can because you have a criminal action recorded in chat history.




  • If I understand correctly, you want a two component setup. A PWA client for you to read the mail, and a server acts as IMAP client, fetches mails from all you mailboxes. The server will expose an API for tge PWA to access mail content. When new mail arrives, the server push a beacon via the Push API. The PWA would fetch the sender and title, and display a notification. If you clicks it, only then the PWA will fetch the body.

    After a quick glance of the demo, I think SnappyMail fit the bill? It seems can be installed as PWA, and my browser does ask me if I want to give it push notification permission. However, I’m not too sure if the fetch logic happens as I laid out.






  • Despite the bad title, the article itself is worth a read, though the topics covered are being discussed long ago, but serves as a good reminder.

    A point the author raises is about data security in end-to-end encrypted communications when using with AI. Remember that end-to-end encryption is specifically protecting data in transit? It doesn’t do anything after the data is delivered to the end device. Even before the age of “AI”, the other end can do whatever he wants on that piece of data. He can shared the communication with another person next to him which the sender might or might not know of, upload it to social media, or hand it to the law enforcement. And the “AI” the tech industry going forward is just an other participant of the communication built right into the device. It can do exactly the same as any recipients wants to. It can attempt to try to (badly) summarize the communication for you, submit that communication to any third party, or even report you for CSAM as it determines your engaging in “grooming behavior.”

    And the author also asked the question, “Who does your AI agent actually work for?” However, this question is already been answered by Windows Recall, the prime example of an AI agent. It collects data in an attempt to “help” us recall things in the past, but it will answer questions from anyone have access to it. Be it, you, your family/friend, or even law enforcement. The answer is anyone.