this post was submitted on 20 Jan 2025
413 points (97.9% liked)

Technology

60610 readers
3263 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 2 points 44 minutes ago

I'm in a quest to find a good email provider that doesn't ask for a cellphone or another email address while creating an account, cock.li used to do this but now it's "getting back on its feet"

[–] [email protected] 47 points 4 hours ago (2 children)

Phone numbers social security numbers

Stop making personal information into digital ids because when it inevitably ends up in some kind of data breach. These companies all throw their hands up saying sucks to be you.

[–] [email protected] 1 points 1 minute ago

Nah, man. Gotta get my $2.97 check.

load more comments (1 replies)
[–] [email protected] 8 points 3 hours ago (1 children)

Theres an LTT video where one of the boys intercept all Linus' calls and texts, classic prank.

[–] [email protected] 19 points 2 hours ago

You mean the Veritasuim video with linus in it?

Source

[–] [email protected] 94 points 6 hours ago (10 children)

This should be what digital ID looks like:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEZ26+ARYJKwYBBAHaRw8BAQdAsUGMjbGNUyyz9PHsHKP4xj/tIfYIuHb4miPH 0iCPpu60K0VSUk9SOiBFYXJ0aC5leGUgaGFzIGNyYXNoZWQgPG5vQGVtYWlsLmV4 ZT6IcgQTFggAGgQLCQgHAhUIAhYBAhkBBYJnbr4BAp4BApsDAAoJEI6E3uMn31Z3 028BAM5o8ER0dqTsxFlZSgZOvvgFHGuy2eFgF3rULkGKl1KrAP9fdE7WwnYbBer/ AVmw5jr0P5m/XsEQQrSueuk/FLYBBbg4BGduvgESCisGAQQBl1UBBQEBB0BDR0Bv pf4jxbwp9rVowFTnL59NGqnnh6XyF/LjAoYDGgMBCAeIYQQYFggACQWCZ26+AQKb DAAKCRCOhN7jJ99Wd1dMAP45xmN03SodkWHi7PYOORqNXJUBdMzzfsRXdqE8ZXaW vAD+PqNqPcbwJYCOEAXkg7DlZ0SX3o9MViZLdzHFQ3TpUA8= =krDh -----END PGP PUBLIC KEY BLOCK-----

PGP Key Fingerprint: 857957d40f06cc816fd3d29a8e84dee327df5677

Should be good until quantum computers come around

[–] bestboyfriendintheworld 9 points 3 hours ago (4 children)

Now type it a form that doesn’t allow copy and paste.

[–] [email protected] 11 points 3 hours ago
[–] TriflingToad 5 points 2 hours ago (1 children)

tbh ive never had a password box that I can't copy/paste into

[–] [email protected] 10 points 1 hour ago

I've seen a few. They're super annoying when trying to use a password manager with a decent password.

[–] [email protected] 2 points 2 hours ago

Or even just a paper form.

load more comments (1 replies)
[–] [email protected] 42 points 5 hours ago (1 children)

I'm sad PGP didn't become a popular way to log into websites. A challenge-response protocol could have even been built into web browsers. Big tech is reinventing that idea as Passkey, but with a very big tech flavor.

[–] [email protected] 18 points 5 hours ago* (last edited 5 hours ago) (1 children)

I mean, passkeys are... sort of... PGP... 🤷‍♂️

[–] [email protected] 8 points 2 hours ago

I'm already hearing about restrictions on exporting passkeys and some apps requiring that you're not running a custom ROM on Android and stuff like that. Makes me worried they're going to fuck that up and make it restrictive bs

[–] [email protected] 2 points 3 hours ago

Nah, there are more than enough algorithms available that won't work on quantum computers, I'm not too worried about that

[–] Imgonnatrythis 12 points 5 hours ago (1 children)

Thanks, gonna need your phone number to verify that though.

[–] [email protected] 5 points 2 hours ago

No you don't! That's why we have key-signing parties!

load more comments (6 replies)
[–] [email protected] 195 points 7 hours ago* (last edited 3 hours ago) (11 children)

To the same audience: quit selling my fucking phone number!

I ditched a phone number I had for 10+ years because it was leaked everywhere. Only a few short months after updating my number with the DMV and a handful of other government agencies I started receiving scam calls/messages again.

At some point we need to adopt some fucking privacy laws. This is absolutely bonkers—is no one else fed up??

Edit: I already know how to silence unknown callers. What I want is to not have the problem in the first place, ideally by 1) having companies not sell personal data to third parties and 2) being able to block spoofed (non-encrypted) caller ID.

[–] [email protected] 8 points 3 hours ago

quit ~~selling~~ demanding my fucking phone number!

FTFY

[–] [email protected] 8 points 3 hours ago* (last edited 3 hours ago) (1 children)

Australia has a "do not call register". It seems to mostly work, but telcos are having trouble with calls originating from outside the network with spoofed caller ID. We still get spam/scam calls from India among other places.

Even if they're not calling you directly, they are still using your phone number to link you to things and create a shadow profile behind the scenes.

load more comments (1 replies)
[–] [email protected] 3 points 3 hours ago (1 children)

I have an app called Silence that lets me block calls from numbets not in my addreasbook. Highly recommended

https://github.com/x13a/Silence

Reminder: Dont blindly trust random internet sources!

[–] [email protected] 1 points 3 hours ago

That’s not the problem I’m referring to; this is already built-in to iOS (and I hope Android).

[–] [email protected] 84 points 7 hours ago (3 children)

Oh everyone is fed up but we just elected a guy and government who is sure to make it all way way way worse.

He just helped put the nail in the coffin of the lie that crypto is for anything but scams, don't worry, it's gonna get real bad before it gets any better.

[–] [email protected] 13 points 5 hours ago (1 children)

In South Africa, where I live, everyone is assigned an ID Number at Birth. You need an ID number, thumbprint scan AND proof of address to get issued a SIM card number due to a law introduced called RICA. It was meant to help fight crime. Worried that the government could listen in to calls or read their SMSs, the criminals just switched to WhatsApp, which also happened to become cheaper than SMSs and gained popularity in this time.

The cops never seemed to crack WhatsApp. The only drug busts that happen are when an open secret becomes laughably too open and when they harass every person arriving from South America at O.R. Tambo international airport just to catch the decoy mules carrying 12g of cocaine (total). Every dealer I ever organised with was over WhatsApp.

So now, woopsi, RICA stopped nothing and just became a liability. That treasure trove of fragile data made its way to scammers and spammers. A total net negative.

I'd encourage everyone else in other countries to apply major pushback to any government proposals in this direction.

[–] [email protected] 4 points 2 hours ago

Do people still believe that drug trade is ran by criminals?

I am pretty sure in every country, it is controlled either police or the spooks.

I am done pretending otherwise. Criminals are just useful idiots, the real thugs are the police and security apparatus

load more comments (2 replies)
[–] [email protected] 37 points 7 hours ago (6 children)

I'm pretty sure a lot of scam calls use machines that call every possible phone number within an area code and see who answers. There is no way to avoid it.

load more comments (6 replies)
load more comments (6 replies)
[–] [email protected] 35 points 7 hours ago (6 children)

It is the same thing that happened with US Social Security Numbers, which were originally just tracking numbers for that one purpose that were coopted by capitalists and treated like something special.

[–] Corkyskog 6 points 4 hours ago

I remember I was flipping through some of my mom's old college stuff and there was a club that she was involved with and everyone listed their address and social security numbers. It was wild, no idea why they felt the need to collect socials. But this was a very long time ago.

load more comments (5 replies)
[–] Pika 5 points 4 hours ago* (last edited 4 hours ago) (1 children)

Are internet security and internet privacy incompatible goals?

Yes. They are completely incompatible goals when anything relating to identity/being is linked to it. Examples of this could be anything from your name, to your behavioral patterns, to your phone number

Disregarding the entire possibility that ANY site is hack-able/breach-able, the issue stands that the reasons that most sites request PII is valid, for security reasons. There does not exist any valid method of ensuring users identity that does not violate users privacy. CAPTCHAS are proven inefficient, email domains are easy as a 1-2 click. Once the setup is done server side changing to a new address is as easy as changing your server settings and registering a new domain, then just pointing your MX records there. Heck depending on your postfix setup you might not even have to change server settings, if your account lookup is setup to ignore the domain and it all uses the same database. Even phone numbers have proven troublesome but its the least troublesome method available

The entire reason PII style setups are used, is because its an easy verification site side, but a hard to spoof verification customer side. Like the article says, phone numbers are hard to change for verification, many only let you change so many times in X period, and usually require some form of physical identity to register, and the ones who don't are forced such as VOIP style numbers get blocked.

We lack currently a good system aside from that, because at the end of the day, how do you prove you are who you say you are, without disclosing your identity. I personally think it should be fine to give up some PII for security purposes, but this NEEDS to be restricted only to security and should never be shared with any entity, and this includes government overreach. Alas this will never happen.

[–] [email protected] 5 points 3 hours ago (1 children)

This assumes a legitimate need to prove who you are outside the context of that specific site, rather than just within it. Sometimes that need is real, sometimes it is not.

When it's not, and you only need to prove you are the same person who created the account, then a simple username and password is sufficient. Use 2FA (via authenticator app or key, NOT via SMS or email) on top of that. This allows users to prove to a sufficient degree that they are the owner of that account.

This is how most Lemmy instances work, for example. I can sign up by creating a username and password, with optional 2FA. They do not need my email. They do not need my phone number. They do not need my name, or my contacts, or anything else that is not related to my identity within their server.

I realize that this is untenable at large scales for any communications platform. Spam (and worse) is a problem wherever there are easy and anonymous signups. I'm honestly not sure how Lemmy is as clean as it is. I guess it's just not popular enough to attract spammers.

[–] Pika 2 points 2 hours ago

You are correct with this comment yea, the biggest drawback (which as acknowledged we have seen on lemmy) is the anonymous of the account. It's easy to spin up spam instances, and due to how federation works its hard to combat against it. I remember LW had an issue regarding that a bit ago with someone threatening to just keep changing domains to avoid blocking, which is indeed a problem for any of these style services. I agree at large scale, most sites are not going to want to have to put up with losing that level of control moderation side. It creates a lot of headaches and for most sites it's just easier to enforce a policy that forces disclosing PII.

load more comments
view more: next ›