Edit: I made a mistake, I meant to add Mailfence instead of Fastmail, but forgot to update both the icon and text

Hey everyone, here's a follow up to my previous post, I tried to summarize all your suggestions and these are the options I have for the main Proton products I've been using.

I removed Bitwarden based on your feedback (basically they're enshittifying).

I'm not including Tuta, because I dislike their UX/UI, also they seem to not apply their LLM policy to their own devs.

I'm not including Mullvlad, because of one of the founder's donation to a far right political party in Sweden, said founder has a blog post to justify this, which links to another blog post where he claims to be a libertarian anarchist which is just another word for Ancaps which is a dealbreaker for me.

A lot of people recommended using one's own domain for email stuff, I forgot to mention I do have a custom domain, which will make migrating a lot easier indeed. Just need to update my accounts credentials.

Let me know what you think!

How is this even possible? I thought Youtube and Reddit ads are impossible to block via a DNS filter.

When uploading a real recording, there is a good chance your location & therefore possibly your identity can be revealed from the footage itself.

1. You can triangulate low volume background sounds such as air planes: https://cybernews.com/privacy/aircraft-doppler-audio-geolocation-privacy/

2. You can check the position of the sun/moon/stars, shadows, weather...: https://www.bellingcat.com/resources/2020/12/03/using-the-sun-and-the-shadows-for-geolocation/

If Streamers & Journalists CAN do it, government agencies ARE doing it.

If you need privacy be aware of this when recording / editing friends <3

"A group of Facebook users says Meta was aware of receiving user data from hundreds of medical providers without users' knowledge or consent.

Users recognized at least 664 hospital systems and health provider websites from which Meta received patient information..."

Twitter's age verification in the EU literally needed ur ID or a picture of ur face really sounds like a privacy issue so I figured I could post this here. At the moment I've been using a vpn but since it's literally the only reason why I use one I was curious if there was any other way to do so that would be free

Okay, so I tried Tuta and found the UI clunky and buggy. I tried Mailbox.org and their billing is a mess and they took my money without crediting the account. *(I have a pending ticket, we'll see what they said.)

I do have a proton mail account, but I haven't given them $ yet because of... well you know. Sadly, out of the three I've tried their product is the best.

Wondering what to check out next. I really want to ditch the G but I'm evaluating services before I jump off the ledge this time.

I grew up with the N64 and OoT. I quit console gaming after the GameCube, having loved WW, only to return to Nintendo for a year or so when the Switch came out. I was still able to "plug 'n' play" shit back then. I don't own any consoles at the moment. I would like to purchase the Switch 2 in order to play the remake of OoT and then, probably, just sell it. No, I do not have friends to borrow shit from.

What should I expect privacy wise? Do I need to create an account, send Nintendo a saliva, urine and hair sample in addition to a voice sample and image and age verification? Or can I just buy the console, buy the cartridge and play and be happy?

Give us all your data, but: “no automated system is perfect,” the company admitted, advising users to “review Muse’s activity and only grant the access you’re comfortable with.”

Patients Can Pursue Claims Over Alleged Unlawful Tracking of Medical DataA federal judge certified four classes of Facebook users pursuing privacy claims against Meta over alleged collection of sensitive medical information through tracking technologies on healthcare websites. The ruling allows federal and state privacy claims to proceed collectively.

Pretty cool watch. Probably old news by now on any serious scale though.

He basically isolated some low frequencies (which means they penetrate materials well) of plane engines and calculated based on a few of them a precise location where the video was taken.

I used to always prefer to pay later (with no interest), cuz i heard it would prove schufa score but I just received an email from klarna, how in the future they will need to view all my purchases history to make sure it fits my budget and income.

What the heck? I thought EU was better for privacy. If we don't buy things on credit, we get a bad credit score, and if we do, then we have to sell our data ?

Starve Big Tech of your attention on 27th November - don't use any of their apps.

Sign up at this tracker to contribute to showing the number of hours withheld 😊

The strike is organised by Take Back Big Tech, and this tracker page was made by Pull The Plug.

PLEASE SHARE THIS LINK WITH YOUR FRIENDS AND FAMILY THAT STILL USE BIG TECH APPS 😃

I've cancelled my subscription yesterday, conveniently it was about to renew at the end of the week, so I have a few days to migrate from Proton, here's what I'm thinking of, but I'd love to hear what other people are switching to

Has anyone else dealt with these?? They're NFC, track how long they're in the bathroom, and where they are. I dont know what company this is through, nor what they are doing with all the data they're collecting. They also use things called smart passes. I'm thinking about emailing the school district and not allowing them to make my child use them. It seems invasive and creepy. :( If anyone has any advice how to approach this, please let me know. Or knows about them in general. I just don't trust it. Thank you!!

Also!! Would super appreciate helping me lay out properly communicated points, as I am not a confrontational person, and am very mad. I'm worried I'll just sound like I'm pitching a fit for no reason. I never want to be that parent that is dreaded by schools. But this is important. Especially due to my more sensitive situation (my children are foster kids)

Edit for FAQ:

• each kid gets an individual digital pass, it records their geolocation, behavioral problems, responses to medical questionnaires, and it can be shared with 3rd parties according to their privacy policy. (Students are considered "customers")

• I'm from the US.

• they are supposed to wear it all day, every day and check in every place they go with kiosks.

• they are also being limited to 3 bathroom breaks a day... So I guess fuck you if you've got heavy periods or IBS. And you can't go in between classes. Bathrooms will be locked unless it's an emergency, but you have to have a teacher override the lock. Which isn't exactly how an emergency works.

• one of my biggest concerns as someone in the US is a school shooter situation where they get access to this system and now they can pinpoint where every kid is and is going. Can prevent stragglers.

My email to the principal (I will be doing a follow up about the health problems)

Hello Principal,

This is Blah463.I have several concerns about this smartpass system and the general bathroom break policy. While I understand the issues posed by students being able to go to the bathroom freely, I believe an old school solution would be better and not as concerning (like signing out of the classroom). I believe it is through Raptor Technologies, though please correct me if I am wrong.

I apologize if this comes across as harsh, as I am honestly quite angry I was not even asked permission for this. I would have declined. This puts my and every other student in danger, risks data breaches, makes it more difficult for students to use the bathroom (despite this showing to have negative effects on their urinary health, and makes them less likely to properly hydrate).

Here is Raptor Technologies' Privacy Policy, I will be citing it directly throughout this email. https://apps.raptortech.com/About/Privacy

Their Privacy Policy

Starting directly with their privacy policy, as this INCLUDES students and their information. "Customer Information may relate to different types of individuals, including Customers’ staff, volunteers, visitors, students, parents/guardians, and other individuals." They follow COPPA (https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa) for students under 13, which means the company is less restricted on their data collection and use for anyone 13 and older, as they no longer fall under these guidelines. There should ALWAYS be a requirement for the student, at the very least, to CONSENT to their data being collected.

What Data is Collected?

According to their privacy policy, the customer information that may be collected (which once again, includes students):

• Attendance and hall pass information, such as dates and times of arrival and departure, attendance in classes, and hall pass permissions.

• Dismissal information, such as pick-up times, persons and vehicles authorized for pick-up, and confirmation of pick-up.

• Health screening responses, such as any symptoms individuals report as part of a health screening process or service. (This one is of special concern, what about HIPAA? https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html)

• "What Rights Does the Privacy Rule Give Me over My Health Information?"

THIS DOES NOT APPLY TO SCHOOL DISTRICTS, I DO NOT CARE ABOUT THE SCHOOL HAVING MEDICAL INFORMATION, IT IS THIS 3RD PARTY COMPANY I HAVE CONCERNS ABOUT.

"Receive a notice that tells you how your health information may be used and shared.

Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing"

• Behavioral health information, such as bullying, disrespectful behavior, depression, or other inappropriate or concerning behavior. (Once again, this is a HIPAA concern.)

• Geolocation information, If enabled, our Services will collect information about precise geolocation to provide certain location-enabled features, such as the user’s location during an emergency.

• Usage information, including information we log automatically when individuals use any applications in connection with the Services, such as the times and frequency of access to the application, interactions with application features, and other technical information.

How Customer Information is Used

- "Allowing Customers to...manage attendance, hall passes and dismissal processes; undertake health screenings; prepare for, respond to, and recover from emergencies; identify student wellbeing concerns, and develop and engage in compliance and training initiatives;"

How They Share Customer Information

• "At the direction of the Customer. Our Customers may direct us to integrate a Service with third-party offerings, software, or applications. In such cases, we will share Customer Information with those third parties at the Customer’s direction." Meaning, once again, you would not inform parents properly of where their child(ren)'s information is being stored or shared.

• "In the event of a corporate transaction. In the event of a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of our business or assets, we may share Customer Information with acquirers and other relevant participants in the transaction." According to Liz Mineo from the Harvard Gazette, "...while customers have made the decision to share with 23andMe, from whom they get a lot of benefit, they really have very little say about what will happen should the company be taken over or should the company go bankrupt, and its assets sold," as an example of how data can STILL be shared with 3rd parties, even if the company IS reputable. Which Raptor Technologies is NOT.

Raptor Technologies' Past Data Breach (Jan 2024)

Here are several articles reporting about their data breach in 2024, exposing millions of school records including: safety procedures, student medical files, and court documents. This is unacceptable. This is why this information SHOULD NOT all be stored TOGETHER on a private company's off-site servers.
https://www.wired.com/story/us-school-shooter-emergency-plans-leak/
https://www.edweek.org/technology/a-massive-data-leak-exposed-school-lockdown-plans-what-districts-need-to-know/2024/01
https://hackread.com/texas-school-safety-software-data-leak/
https://www.techradar.com/pro/security/school-software-breach-reveals-private-data-on-millions-of-users
https://www.k12dive.com/news/raptor-technologies-school-safety-data-leak/704790/
https://www.twingate.com/blog/tips/Raptor-data-breach "The data exposed in the breach included school lockdown plans, student medical records, information on students flagged as posing a threat on campus, evacuation plans, court documents outlining family abuse and restraining orders, names and ID numbers of staff, parents, guardians, and students, details about school security measures, drivers licenses of school visitors, active shooter response plans, campus maps and CCTV locations, locations and descriptions of "safe rooms," emergency contact lists, layouts of schools or classrooms, infrastructure issues, monthly drills, safety protocol violations, background check details, and information on at-risk students."
https://databreaches.net/2024/01/11/us-school-shooter-emergency-plans-exposed-in-raptor-technologies-data-leak/


THIS WAS NOT EVEN FROM HACKING. This was the company publishing these documents by accident on a PUBLIC WEBSITE, meaning ANYONE ONLINE could have access to the information.

I will never trust a company that messes up this badly.

Safety Concerns

Not including the data breach, I wonder about the practices of staff that have access to this information, people in general do not have good digital practices. Often using very insecure passwords (especially the same passwords for multiple things), being careless about what information they share, being susceptible to social engineering (how most hacks happen), etc.

In the United States we have the ever-present concern of school shooters, if someone with these intentions were to get access to where EVERY STUDENT is at any given time (since they are required to check-in at kiosks), as well as the school's emergency plans, they now know how to target as many people as possible. This is morbid, but it is a genuine problem.

I understand the problems with students and damage to the bathrooms, but this is not the solution. Period. I did not consent to my student's data being shared with 3rd party. I do not mean to come at this with aggression or anger, but this is something I am very protective of in a world where companies sell data like candy is given out at Halloween, except they get lots of money in return. This normalizes to students that privacy is not a right, they were not asked if they were OK with their data being sent off. This normalization leads to apathy. I believe schools should teach digital hygiene practices, but this is not what this is about.

I am willing to discuss other solutions for my child. Though I believe it is a concern for everyone, and I will be contacting other parents with my concerns, as most people are not technologically savvy enough to realize what risks these devices pose.

I will glady come in for a meeting to further discuss my concerns, but I can assure you, I will not be persuaded to allow this breach of privacy. Schools are meant to protect children, not put them further in danger and teach them to not care about their data and safety. I would also like to see the school's specific privacy agreement with Raptor Technologies. My student is of particular concern when it comes to privacy with being in the foster care system.

Thank you for your time

Blah463

Consent-O-Matic selects what cookies you want (you choose in the preferences), but the last commit was last year (due to the fact that those who work on the project have less time, see https://github.com/cavi-au/Consent-O-Matic/issues/591#issuecomment-4845151993 and https://github.com/cavi-au/Consent-O-Matic/issues/600#issuecomment-5559403316).

Does anyone know of any alternative that is similar and staying updated? Preferably have Firefox and Chrome add-ons.

(if there is a better community to post this question to, please let me know which it is)

One number, zero privacy?

Recently, reports emerged that LG TVs are sniffing around your local network, and even listening to your local environment, even when the TV is purportedly “off.” Some of those voice commands were then stored in plain text and uploaded to the internet. LG’s response? To deny everything.

For decades now we’ve documented how while “smart” TV makers are obsessed with making money off of in-home surveillance (which is now more profitable than the actual TV), they do an abysmal job protecting the data they collect. They also routinely don’t respect consumer choice when users say they don’t want to participate in the full scope of hyper-commercialized mass surveillance.

That latter point is central to a new study out of Northeastern that conducted 5,943 experiments across twelve commercial “smart” TV devices. The researchers found that most smart TVs utilize automatic content recognition (ACR), a technology that captures audio or video snapshots of viewed content and then monetizes that data to help build personalized profiles of viewers.

TV makers insist that users are supposed to be able to opt out, but the choice simply doesn’t work across a large segment of TVs. Companies like Vizio simply ignored the consumer requests entirely more often than not:

“We find that the advertised ACR opt-out fully suppresses ACR-attributable traffic on only four operating systems; on Samsung Tizen traffic consistent with ACR activity persists in more
than 60% of evaluated scenarios, and on Vizio SmartCast a content correlated endpoint hosted on Amazon Kinesis continues to receive traffic in 100% of opted-out scenarios.”

These companies have been awful for a long while now, and U.S. regulation of the sector has varied between soggy and inconsistent. Many smart TV manufacturers fail to encrypt sensitive data, or remove features if you refuse to have your daily viewing habits measured and monetized (by say, disconnecting your TV from the internet).

Vizio was fined $2.2 million by the FTC back in 2017 for failing to tell customers that their televisions were spying on them. The company also wound up facing a $17 million lawsuit that wound up giving consumers somewhere between $13 and $31 (lawyers in the case saw $5.6 million in fees).

The researchers say since they can’t see the precise scope of what’s being collected due to encryption, they’re unsure whether Vizio is technically violating its FTC agreement (not that we have a current FTC that would care if they were):

“The opt-out setting has no observable effect on traffic sent to this endpoint; however, we cannot inspect the payload due to encryption so we cannot confirm whether this violates the FTC settlement.”

Results of whether opting out of ACR tracking actually stopped ACR tracking were all over the map. Roku, for example, ignores opt-out requests when users are watching Roku’s own channels. None of the smart TV vendors track Netflix viewing for fear of violating agreements with the streaming giant. Samsung’s opt out function was more likely to actually work when a user was watching antenna broadcasts.

On two Smart TV platforms, personal viewing data collected by ACR remains unencrypted, despite years of bad press and scandal on the subject. Many appear to be violating the law, but because U.S. regulatory oversight has been gutted, they see no meaningful accountability. That includes smart TV OS’ like VIDAA, which is most prominently found on Hisense and Toshiba smart TVs:

“VIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it. Each message carries a Client ID, a permanent identifier for the TV that can’t be reset, along with the time zone, the app name, the input (antenna, HDMI), the antenna channel and an audio fingerprint.

The app name alone can be revealing. We saw ACR on apps such as VIDAA Kids, which raises concerns under the U.S. children’s privacy law (COPPA), and Christianity and Money. VIDAA’s own HOME OS app sent show and film titles in place of the app name.”

Keep in mind these researchers just focused on ACR — or video, image, or audio snippets taken to track your viewing and build a profile on you. There are numerous other ways smart TVs can track you — and numerous other avenues via which your traffic is being surveilled by everybody along the chain, including your telecom provider.

This persists because companies do not fear U.S. regulators, because U.S. regulators have been largely lobotomized via corruption. The United States also remains too corrupt to base even a baseline privacy law for the internet era or regulate the data brokers that further monetize much of this data. Still the researchers were nice enough to provide regulators a path, should they someday choose to do their jobs.

What do you folks use instead of Proton and Google? Ideally I'm looking for:

• Non-profit.
• European-based if possible.
• Paid is fine.
• Low-risk. E.g. unlikely to disappear, unlikely to go bankrupt.

My reason to want non-profit is that it's the best way to align mine and the provider's incentives, I think. I'd consider for-profit as well, but it's best if it's a non-profit.

So far I like disroot a lot. But they are principled about being unpaid, so if the financial ends don't meet each other my emails will be in trouble. I'm donating to them, but I have my worries. I'm willing to pay a little if I know that my money will go for a quality service, for expansion of coverage (new users) and for open-source technologies.

Proton and their founder Andy are just a piece of sh*t in terms of upper management, so that's not worth discussing.

Posteo seems adequate. Tuta feels similar to Posteo with a bit more push for fanciness. Is there something similar but non-profit?

Your iPhone knows more about you than anyone. Here's how to lock it down in an afternoon: passcode, account, location, lock screen, radios, browser and backups. Full checklist at the end.

A coalition of private-sector security firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries.

Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption.

“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” the Google Threat Intelligence Group (GTIG) said in a Monday blog.

Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers' internet connections without their knowledge.

The firmware’s pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices.

Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation.

The coalition also disrupted the command-and-control domains used to manage the affiliate modules. “Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices,” according to GTIG.

Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps.

Videostrong did not immediately respond to The Register’s inquiries.

This backdoor and botnet operation is part of the same ecosystem as BadBox 2.0, another notorious botnet that infected more than 10 million TV boxes and other devices before Human, Google, and TrendAI disrupted it in March 2025.®

Share any TCP network service (like a web server, game, etc.) with your contacts through Jami! It can also manage an embedded web server as needed to easily share simple websites or directories.

Snap, the parent company of Snapchat, reached a settlement in a social media addiction lawsuit on Monday, resolving claims before the case was set to go to trial this month, according to lawyers for the plaintiffs.

The teenage plaintiffs, identified in court documents as S.J. and K.D.B., had alleged in the suit that Snapchat was designed to be addictive and that using the platform from a young age contributed to their mental health issues.

"We are glad to reach resolution for our clients," Mark Lanier, founder of The Lanier Law Firm and lead counsel for the plaintiffs, said in a statement to CBS News. "We believe this jury would have found the companies' conduct reprehensible."

Snap was the last social media company named in the lawsuit to settle the case, which was set for opening arguments this week. Meta resolved claims last week, while Alphabet and TikTok, the other defendants, each also resolved the allegations.

Terms of the Snap settlement were undisclosed, according to Morgan & Morgan founder John Morgan and attorney Emily Jeffcott, trial counsel for K.D.B.

In a statement to CBS News, Snap said that "the parties are pleased to have been able to resolve this matter in an amicable manner."

The suit was one of several bellwether cases brought by plaintiffs who have alleged that social media platforms harmed their mental health and were designed to keep young users hooked.

In a landmark decision earlier this year, a jury found Meta and Google-owned YouTube liable and awarded $6 million to the lead plaintiff.

Meta also agreed to pay up to $17.1 billion and add child-safety measures to its social media platforms as part of an August settlement with dozens of U.S. states. The states accused Meta of deliberately designing its platforms to be addictive and of misleading users and the public about the technology's risks.