Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy-Respecting Software

github.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Privacy-Respecting Software

#41

Post by dngray »

bscphil wrote: post #7

One thing a little weird about this list is that it has "privacy-respecting" software mixed in with privacy tools . DuckDuckGo doesn't track you individually, or at least, they don't filter-bubble and advertise to you individually, but they do collect data on what users click on. Privacy-respecting? I think that's debatable. The 1.1.1.1 app is a privacy tool insofar as it allows you to hide DNS requests from anyone i…

Another section I noticed there that is horribly wrong:

> Without using a secure, privacy-centric DNS all your web requests can be seen in the clear. You should configure your DNS queries to be managed by a service that respects privacy and supports DNS-over-TLS, DNS-over-HTTPS or DNSCrypt.

These things do very little for privacy as we painstakingly write about in this article https://www.privacyguides.org/technology/dns/

Re: Privacy-Respecting Software

#42

Post by Arathorn »

upofadown wrote: post #37
dngray wrote: post #33

Earlier quoted context omitted.

> OpenPGP is a message standard that specifically covers the offline, end to end encryption case. So the contention that it bad at other cases isn't very interesting. It's an overly complicated protocol, https://latacora.micro.blog/2019/07/16/the-pgp-problem.html which has no place in an instant messenger protocol.. There are actually some XMPP clients which offer it as an option, which you should never use when you'…

I was so annoyed at all the misleading stuff in "The PGP Problem" that I did a deconstruction: * https://articles.59.ca/doku.php?id=pgpfan:tpp I actually do PGP over XMPP these days. It is so simple that it ends up being quite reliable. So I consider it the superior protocol. >I was specifically talking about instant messengers, not email usecases. Forward secret PGP would be simple for an online application like ins…

OMEMO, signal protocol and Olm (as used by Matrix) are pretty much bitwise identical. OMEMO for instance has been implemented using both libsignalprotocol and libolm.

The “incompatibility” comes from the fact that the payloads within the encryption are utterly different. It’s nothing to do with the encryption; you’d see the same thing with PGP.

Re: Privacy-Respecting Software

#43

Post by dngray »

Hizonner wrote: post #20
dngray wrote: post #11

The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say. Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc. With the cleanup at http…

"The problem" with lists like these is that they proliferate without reason. This fragmentation means that it's basically impossible for anybody who needs one to know which ones are good or up to date. It also guarantees that most of them will be unmaintained at any given time. Somebody should make a list of lists. Or a list of lists of lists... > - Off-The-Record: Doesn't cover group chats or other side channels, su…

> just like video sharing

The difference with our video sharing section, is we primarily focus on clients which store data on the device

https://www.privacyguides.org/video-streaming/

Re: Privacy-Respecting Software

#44

Post by doix »

dngray wrote: post #32
_Algernon_ wrote: post #26

Earlier quoted context omitted.

As long as everyone involved trusts the server operator, and the risk of the server being compromised is negligible, you would be right. I do think that removing it from the list here was the right call, as most people probably aren't going to self-host.

> - Mumble: Not really private Unless your self hosting, it's not really private, as it doesn't use E2EE. If you're self hosting and restricting access, then any software could fit into the "private" category. Does that mean every self-hostable piece of software should be classified as "private"? > As long as everyone involved trusts the server operator This is the key point that is never mentioned. The software is m…

> Does that mean every self-hostable piece of software should be classified as "private"?

In my mind, as long as the self-hostable software isn't sending data back to some central server, yes? I guess we have different definitions, which is fine, this wasn't criticism of your list. I was just curious if you knew something I didn't.

> This is the key point that is never mentioned. The software is mentioned but nothing about who is running it.

It's interesting to have list of tools that can be self-hosted. My friends and I host mumble/irc/pastebin/img upload for our use. We've got it in a wireguard vpn, it works well. Finding out about other services that we can self-host and use is a always interesting. Although I can't really think of something we need at the moment.

Re: Privacy-Respecting Software

#45

Post by Ocha »

nonrandomstring wrote: post #5

Nice up-to-date collection. I'm tired of finding old lists like this but filled with legacy, unmaintained programs. > "Be careful when installing unfamiliar browser add-ons, since some can compromise your security and privacy." I like these little interjections to explain things for beginners. In this case though, I wonder what code auditing/verification is in place to support such a statement: > "At the time of writ…

Is there similar list for development tools and services? (e.g. IDEs, cloud services, SaaS Software, datacenters, etc.)

Re: Privacy-Respecting Software

#46

Post by philjohn »

dngray wrote: post #35
philjohn wrote: post #22

For 2FA leaving out Yubico Authenticator seems strange? The TOTP seeds live on the Yubikey itself, and the app only communicates via NFC (or USB) with it - no phoning home.

Yeah, it is. A lot of these lists focus on the fallacy that all open source software == secure, and anything that is not open is instantly bad. We list the Yubikey, as it is at the moment it's one of the better MFA products out there. https://www.privacyguides.org/security/multi-factor-authenti... https://www.privacyguides.org/multi-factor-authentication/

That's a great resource, thanks for putting it together!

The thing I've found great about Yubikeys is how easy it has been to onboard non-technical family members to using them.

Re: Privacy-Respecting Software

#47

Post by Elyra »

dngray wrote: post #30
Elyra wrote: post #24

Earlier quoted context omitted.

There's nothing inherently wrong with a having lists like that to serve as a starting point to see what exists for your own research, the bigger issue is that it claims to be curated when it's more like a wiki. It feels as if their project was ill-defined and grew too quickly, and they're not really sure exactly what it's supposed to be yet.

> starting point to see what exists for your own research, the bigger issue is that it claims to be curated when it's more like a wiki. Problem is they also serve to repeat bad/out of date practices. I always feel people who put together these lists are in a competition to list as many products and cover as many areas as possible, without evaluation.

I want to revise my claim of "nothing inherently wrong with a having lists like that".

This is not just a simple list of software with summaries, and after looking at it more it's worse than I thought. And you're right about propagating bad/out of date advice being a problem.

> I always feel people who put together these lists are in a competition to list as many products and cover as many areas as possible, without evaluation.

Unfortunately this seems to be the quickest and easiest way to get the most attention. Proper curation takes lots of effort, and is hard to get noticed by people who don't know any better.

Re: Privacy-Respecting Software

#48

Post by upofadown »

Arathorn wrote: post #42
upofadown wrote: post #37

Earlier quoted context omitted.

I was so annoyed at all the misleading stuff in "The PGP Problem" that I did a deconstruction: * https://articles.59.ca/doku.php?id=pgpfan:tpp I actually do PGP over XMPP these days. It is so simple that it ends up being quite reliable. So I consider it the superior protocol. >I was specifically talking about instant messengers, not email usecases. Forward secret PGP would be simple for an online application like ins…

OMEMO, signal protocol and Olm (as used by Matrix) are pretty much bitwise identical. OMEMO for instance has been implemented using both libsignalprotocol and libolm. The “incompatibility” comes from the fact that the payloads within the encryption are utterly different. It’s nothing to do with the encryption; you’d see the same thing with PGP.

How? The payload is completely defined under the base standard (RFC-4880), both the binary and ASCII protected versions. Otherwise what would be the point of a universally interoperable end to end encryption standard like OpenPGP?

Re: Privacy-Respecting Software

#49

Post by h4waii »

dngray wrote: post #36
bodge5000 wrote: post #15

Whats the current consensus on Brave? Last time I tried it, it seemed to be an alright alternative to Chrome, but remember it wasn't entirely well liked on HN for whatever reason.

> Whats the current consensus on Brave? If you want to use Chromium based browsers it's probably the only browser that is: - Cares about security, (not doing stupid shit like disabling CRLSets), they are proxied by Brave. See https://qua3k.github.io/ungoogled/ - Does try to do some anti-fingerprinting, while its not a strong as Firefox+Arkenfox, it's at least a step in the direction as opposed to other browsers which…

By these measures of security, anti-fingerprinting, and privacy, both Bromite and Vanadium are far superior to Brave.

Bromite is available on F-Droid, and unfortunately Vanadium is only available on GrapheneOS unless you build it yourself.

Re: Privacy-Respecting Software

#50

Post by dngray »

h4waii wrote: post #49
dngray wrote: post #36

Earlier quoted context omitted.

> Whats the current consensus on Brave? If you want to use Chromium based browsers it's probably the only browser that is: - Cares about security, (not doing stupid shit like disabling CRLSets), they are proxied by Brave. See https://qua3k.github.io/ungoogled/ - Does try to do some anti-fingerprinting, while its not a strong as Firefox+Arkenfox, it's at least a step in the direction as opposed to other browsers which…

By these measures of security, anti-fingerprinting, and privacy, both Bromite and Vanadium are far superior to Brave. Bromite is available on F-Droid, and unfortunately Vanadium is only available on GrapheneOS unless you build it yourself.

Vanadium and Brave are only available on Android.

Vanadium doesn't really have any privacy features that people normally think of (anti-fp, adblocking etc), it's a series of security related patches https://github.com/GrapheneOS/Vanadium/tree/12.1/patches

Bromite does have some features like this https://github.com/bromite/bromite, but we've found in experience the adblocker, is not as comprehensive as uBO, particularly in harder blocking modes https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...

That said for Android Firefox doesn't have the same process isolation like we see from chromium browsers.

I still wouldn't bother with Brave on mobile when you've got Bromite though.

Post reply on HN