• 1 Post
  • 553 Comments
Joined 2 years ago
cake
Cake day: June 21st, 2023

help-circle
  • The mobile companies are slowly hiding all radio controls to guarantee the user is too inconvenienced to keep turning them off. Guarantees more enriched telemetry gathering.

    Happens at the app level too, although it may be less malicious and more crappy coding. Watch Duty on Android, for example, is really a pain of an app in that regard. You can disable android’s WiFi/Bluetooth scanning, but their app uses that Google service specifically instead of raw GPS, so you lose the ability to get location-based wildfire alerts. If you don’t consent to Google stalking.

    What a trade-off, if you don’t give away your location Metadata, you can’t be kept safe from fires?


  • They used to run on a model of “we know best” which is arrogant, but passable in a developing industry like earlier mobile where things needed work. Unfortunately, they still think they know best, and that closed-minded approach only works so long until you lose sync with the tolerance of the general public. Honestly surprised it took them this long. iOS and MacOS have both rotted terribly.

    Take the UI aspects alone. Samsung “leaked” hints about a glass UI, saw user feedback, and pivoted. Apple released a glass UI because they would have never checked what users actually wanted, nor even bothered to see the user feedback from Samsung users and realize it’d apply to them as well.





  • GrapheneOS, the privacy and security focused aftermarket operating system, has received an experimental build for the Pixel 10 series

    Received? GrapheneOS are the authors of their software, they don’t receive. Curious how they got the binary blobs to get it to function.

    That “article” is terrible, and doesn’t even touch on the crucial issue - the crux, as it were. Android is one thing, hardware support is the magic piece Google is trying to remove to close their borders and kill creativity forever.

    Rooting for Pixel 10 native support over here, but was it an employee leak? Similar hardware driver copypasta with modifications? Did Google just finally share the necessary binaries legitimately?

    This whole thing is so vague.




  • Wow, that’s an interesting one, thanks for that. That would be quite annoying to deal with.

    In that case, since the 2FA is coming from the carrier, if you can disable 2G and 3G on your handset, the air link on LTE and above is AES-based encrypted at least, if the carrier configures it correctly, even though the channel itself often isn’t. Or if very paranoid you can use WiFi calling in airplane mode on a burner so the carrier sends the message over the wifi calling IMS-encapsulated-in-VPN-connection over the Internet.

    The chance of someone being able to intercept that 2FA code in a way that could get into your bank account is pretty much absolutely scant.

    Not trying to change how you do things either, though. Just knowing how terrible some banks can be at writing software, I’d be more apt to trust “weaker” methods versus apps. The future is quite exhausting.


  • They don’t need your permission to gather all sorts of data from most modern smartphones, nor can you really deny some of it. (Some you can, like camera, and microphone, allegedly.) Part of the whole banking<->handset manufacturer agreement also frequently allows “special access” outside of the traditional user-permission security model. For…“security” to “prevent fraud”.







  • This must be a European problem perhaps? I can’t understand why this is the deal breaker for so many.

    Banks have web sites. I don’t know why anyone would ever allow their financial institutions access to their phone’s plethora of sensors and the available telemetry on what they are doing on their mobile device 24/7. That links confirmed ID + “trusted platform” + biometrics + transactions + location + all the metadata every other app hoovers up in one convenient place. The very same people across the pond are worried about having to verify ID to look at porn, but are cool with their bank knowing the position of their accelerometer while they’re taking a dump.



  • And yet, annoyingly, these podcast platforms hide the podcasts’ URLs as hard as they can, even though these providers don’t host the podcast or files, and a “podcast” is just an XML file pointing to mp3 or m4a file URLs. (Not disputing you, just that the increasing non-openness of something they don’t even have to pay storage or bandwidth for is pretty ridiculous. They are nothing but a man-in-the-middle attempting to extract profit.)