sorted by: new top controversial old
Introducing the new Proton Mail apps for iOS and Android in c/protonprivacy@lemmy.world
[–] 1 point 1 year ago

Is this a joke? Do you release a completely rebuilt app, and UnifiedPush is still gone? Users of degoogled phones will still not have notifications? Will you still only use Google FCM?

Why Google (FCM) notifications on Android are dangerous:

Everyone knows that the content of the notification is encrypted, BUT THIS IS NOT ENOUGH:

https://www.privacy-handbuch.de/handbuch_73.htm

Requests to the PM Team (for example, for the implementation of Unified Push) have been ignored for many years.

For some people, using a safe ProtonMail app with a dangerous FCM can be a disaster in some countries (journalists, signals, political opposition, etc.)

Please repair it!

  • permalink
  • fedilink
  • source
    •
    SSH backdoor infection in c/linux@lemmy.world
    [–] [S] 2 points 1 year ago (2 children)

    In that case, it seems to me that the only threat is the mindless copying of public keys to other servers, as described in the article. But who does so? Do admins not create separate private-public keys for each server?

    Thank you for the explanation!

  • permalink
  • fedilink
  • source
  • parent
  • context
    • 19
    Why Google (FCM) notifications on Android are dangerous (lemmy.world)
     

    Everyone knows that the content of the notification is encrypted, BUT THIS IS NOT ENOUGH:

    https://www.privacy-handbuch.de/handbuch_73.htm

    Requests to the PM Team (for example, for the implementation of Unified Push) have been ignored for many years.

    For some people, using a safe ProtonMail app with a dangerous FCM can be a disaster in some countries (journalists, signals, political opposition, etc.)

    Please repair it!

    4
    SSH backdoor infection (lemmy.world)
     

    https://blog.thc.org/infecting-ssh-public-keys-with-backdoors

    I am not a security expert and I wonder:

    1. Does the described method infect the remote or local machine (from which I connect)?
    2. Can this method be prevented? For example, correctly configuring your etc/ssh/ssh_config

    It seems that every VPS supplier can hack you? The description shows that AWS does "harmless", but what if my hosting is a bad actor?