• 0 Posts
  • 124 Comments
Joined 2 years ago
cake
Cake day: June 24th, 2023

help-circle


  • Bazoogle@lemmy.worldtoPrivacy@lemmy.mlThe Privacy Iceberg
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    2 months ago

    Bitwarden had some security issues historically.

    What security issues? If you mean potential security vulnerabilities researcher found that they’ve patched, I don’t understand how that would be different from Keepass and their previous security vulnerabilities. Bitwarden has never had a security issues historically that I know of. Lastpass, on the other hand…

    I generally recommend using software for password managers that isn’t internet connected.

    I also recommend they upload it to whatever cloud storage they use

    I also really don’t get these two. They seem to contradict each other.

    I usually recommend bitwarden, where they can use the browser extension and mobile phone app. It gives them autofill features on all their sites. Getting someone to change their passwords and use a password manager is already difficult enough. Giving them the most convenient option is going to make it more like they stick with it.


  • Being social is pretty similar to exercising. When you first try to do it after a while, it’s usually painful and not enjoyable. It isn’t until practicing and keeping at it that it will get easier and you can actually feel the benefits. Finding someone that you can actually share your hobbies with can go a long way, especially if they are able to give some sort of input as well that is beneficial to what you’re working on.



  • Yea, telegram being advertised as a privacy messenger is a joke. If people want to have group chats like in discord and don’t care about privacy, whatever. But to try and flaunt how privacy focused you are while using your own home-brewed encryption is a joke. Not to mention the fact you have to turn it on for every chat you want end to end encrypted.

    The whole thing about not giving out data is really only accomplished by spreading user data across several countries. So you would have to get a search warrant from every country to get the data, relying on some countries not wanting to cooperate with other countries. That is not real security. Real security would be encrypting it so you literally couldn’t give them the data, even if they had a search warrant. Ya know, like signal.


    1. A password managed is basically like a physical vault. If someone gets into a physical vault, they’ve gained access to all your valuable items, but the vault is extremely difficult to get into.
    2. Random websites do not prioritize security like they should. So when there is inevitably a breach in one of those 50 sites and you end up on haveibeenpwned.com, that does not allow them access to the other 49 sites. Often when logins are breached, the people getting that information do not care about the actual site that was breached. Rather, they know a password you use and your email, and can now try to login to actually useful sites where people often use the same login.
    3. There should be multiple layers of security to your password manager. Password and Authenticator app should be basic (No SMS or Email 2FA, not secure enough). Ideally, we move towards passwordless logins altogether so there is no secret that can be compromised on the server side.











  • I appreciate the info, I think that’s good information that I hadn’t fully thought through (but probably could have figured out had I thought about it). I’m not too interested in a Pixel, and the unlocked bootloader is really only useful if someone has my physical phone. My hard drive is encrypted, of course, so my thought as to a way they could gain information if they modify the bootloader and let me decrypt the phone for them. I wonder if the only next best thing is to basically have an alert, or refuse to boot, if there is a change in the bootloader detected, so I can do a clean install.

    Most manufacturers don’t allow re-locking of the bootloader unless it’s official Android, so it sucks the only other option would be buy from Google.

    I’m interested in what you say about the forensics kit. What could I look for to find more info?


  • lol, honestly, just Firefox. I know there’s a lot of hubbub about Mozilla and Firefox with them changing their ToS, but you can disable all sponsored items, and anonymous. And even though they changed their ToS, I don’t think they’ve changed anything. They’ve sold anonymized data for a while. People here don’t seem to like data selling of any kind, but Firefox only collects anonymized data, and it’s a free service.

    The only two real options will be Chrome and Chromium based, and Firefox and Firefox based. For Firefox based that isn’t firefox, you’ve got:

    • Librewolf
    • Mullvad
    • Zen
    • Floorp

    If you google for other browsers, and find one you haven’t heard of, there’s a 99% chance it’s Chromium based.