Privacy

0 readers

40 users here now

Everything about privacy (the confidentiality pillar of security) -- but not restricted to infosec. Offline privacy is also relevant here.

founded 1 year ago

MODERATORS

[email protected]

I'm checking out various "personal knowledge management" tools in a sandbox to see if it be an upgrade my ragtag collection of text file-based notes. (fedia.io)

submitted 3 weeks ago by [email protected] to c/[email protected]

35 comments fedilink hide all child comments

I'm checking out various "personal knowledge management" tools in a sandbox to see if it be an upgrade my ragtag collection of text file-based notes.

First candidate is #Logseq, supposedly "privacy-first".

How #privacy friendly is something based on Electron (aka Chrome)? Debatable, but then they also do this:

Have "Send usage data" on by default
Start with an example page that embeds a YouTube video, and accepts all cookies

tcpdump and mitmproxy go wild when starting the program.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 3 weeks ago* (last edited 3 weeks ago) (2 children)

You might feel I'm nitpicking about a possible edge case here, but you are promised privacy.

Without sniffing the network traffic, or going through the source code, you have no idea that your note titles are being sent to Google Analytics. Even the opt-out toggle tells you that no user data is collected.

It's another example of a company (they sell premium services) using "privacy-first" as a buzzword instead of living by it as a guiding principle.

At least there is an opt-out, I guess

3/3

[–] [email protected] 2 points 3 weeks ago (1 children)

Ok then, number 5: the desktop version of #TiddlyWiki, #TiddlyDesktop.

The Chromium wrapper isn't as old as the wiki web software itself but still goes back to 2014.

Standard Chrome traffic and... a lot of calls to googleapis.com. Why? Because it calls the Google spell check API with everything you enter.

All your text is being sent to Google.

I couldn't turn it off and on top of that a dummy API key is used so the API returns an error, meaning the functionality is completely useless.

$Shows the contents of one of the calls to the Google spell check API. The payload of the call contains the following JSON: { "text": "So I've disabled \"network activity\", surely it won't pass my biggest secrets on to Google, right?\n\n...\n\nRight?", "language": "en", "originCountry": "USA" }$

[–] [email protected] 1 points 3 weeks ago (1 children)

@[email protected] I use the Node.js version of Tiddlywiki and see no such traffic. I don't use TiddlyDesktop, though, so can't comment on that.

[–] [email protected] 1 points 3 weeks ago

@[email protected] This is definitely TiddlyDesktop only. It was added because people were missing the spell checking that their browser normally does (https://github.com/TiddlyWiki/TiddlyDesktop/issues/32)

[–] [email protected] 1 points 3 weeks ago

Ok then, number 5: the desktop version of #TiddlyWiki, #TiddlyDesktop.

The Electron wrapper isn't as old as the wiki web software itself but still goes back to 2014.

Standard Electron traffic and... a lot of calls to googleapis.com. Why? Because it calls the Google spell check API with everything you enter.

All your text is being sent to Google.

I couldn't turn it off and on top of that a dummy API key is used so the API returns an error, meaning the functionality is completely useless.