prepare for surveillance of any social groups you belong to, harassment at security checkpoints, detainment if you say anything they can take out of context as evidence of some crime or threat, and random acts of violence. have armed security at any event where large numbers of trans people attend. improve your opsec - switch to Signal, get an iPhone or GrapheneOS, migrate from Discord/Google/Instagram. start carrying a taser and take self-defense classes. put together a bug-out bag. stock up on HRT if you can. don’t break any laws, no matter how minor. if you are arrested or detained: comply with orders (under protest), don’t tell them your phone PIN, say nothing except “I exercise my right to remain silent and I want an attorney.”
it remains to be seen how bad this gets. if they start rounding people up in masse, we’ll all need to flee and request asylum.
Fuck that noise, Apple is already firmly in the pocket of the orange fascist. They are no longer safe and are now a threat to privacy and safety. I would bet my entire existence they are already handing over data on anyone not straight white Christofascist.
iPhones are highly regarded for security precisely because you don’t have to trust that Apple won’t hand over your data - it’s encrypted, if you set it up that way. enable Lockdown Mode, don’t use any services that aren’t E2EE. they can still try to GrayKey your phone, but it’s not Apple’s doing - GrayKey uses exploit chains which Apple legitimately does well to mitigate.
GrapheneOS is better for security than iPhones, but less noob-friendly. there are guides, though.
I’d trust an iPhone more than a random Samsung full of carrier bloatware, but I trust my Pixel running GrapheneOS more than either.
I have the USB-C port disabled for anything but charging, a duress pin, and reboots after 8 hours without a login. I’m honestly not sure if GrayKey could unlock it. I have memory tagging and a bunch of other hardening enabled, running only open-source apps I’ve verified the signatures of, running with minimal permissions. It would be hard to hack.
Yes, of course the NSA could almost certainly break it, but it would probably cost them time, money and vulns. If everyone uses GOS it will make their job very, very annoying :)
It’s already been proven that not only can Apple decrypt some of your data, they are more than willing to hand it over. They are a willing tool in the government’s quest to oppress society.
nope, neither of your sources says they can decrypt your content. in particular, from your first:
Data transmitted to Google and Apple includes metadata “detailing which app received a notification and when, as well as the phone and associated Apple or Google account to which that notification was intended to be delivered,” Wyden wrote. Sometimes data shared may include “unencrypted content, which could range from backend directives for the app to the actual text displayed to a user in an app notification,” Wyden warned.
note that iCloud Calendar, Contacts and Mail can’t be e2e encrypted, for fundamental reasons (notifications, discovery, SMTP.) but you don’t have to use those.
Apple has already said they can scan your device, using on-device hardware and software, for CSAM and report that to the FBI. Yes, CSAM is bad and shouldn’t exist, but today it’s just CSAM that’s illegal and reported, tomorrow it will be the fact that one is LGBTQ+ or anti-fascist. They said they decided not to do it, but can you really trust them?
No amount of E2E encryption will protect you from an on-device spy that can scan and upload what is sitting on your phone every time you unlock it and therefore decrypt it. Your data has to be decrypted for you to interact with it, E2E only protects you when your device is in your adversary’s hands.
From your other posts you seem to be knowledgeable about security and privacy, how is it that you are turning a blind eye to this well known “feature” of Apple devices and just trusting their word that it isn’t enabled? Why are you so bent on propping up Apple as a secure platform when it’s so glaringly obvious they can’t be trusted with your data?
They have root access on your phone and it doesn’t function without constantly connecting to apple severs for every little thing. If Apple wants access to your data, they’re gonna get access.
I know you mean the best, but an iPhone isn’t any better privacy-wise than an Android is. Regardless of their public stance, these giant monoliths have proven time and time again there’s no respect for an individual’s privacy. If they get caught lying/breaking the law, the fine is merely the cost of doing business.
It would be better to focus on universal ways someone could keep themselves safe. Drop WhatsApp/SMS for Signal, drop Chromium based browsers, use uBlock, a VPN, etc. Arguing over phones is just infighting and not worth the energy.
I disagree on dropping Chromium-based browsers. drop Chrome/Edge/etc. certainly, but Firefox is kept alive by a skeleton crew at this point, and almost certainly has more vulnerabilities than Chromium browsers. the sandboxing and process isolation, the defense in depth, it just isn’t there.
I use Vanadium, which has all telemetry disabled, JIT off by default, and blocks ads.
I will never understand why anyone trusts a corporation who has proven time and again to spy on their own users and report back to the government, even before Trump was on the scene. I guess Cypher was right, ignorance is bliss.
I don’t trust corporations. I trust math, and code, and systems design. I trust AES-256, even though the NSA picked it, because 20 years of cryptography research has revealed nothing close to a break. I trust SELinux, even though NSA invented it, because hundreds of kernel devs from around the world have audited it and touch that code regularly. I trust even proprietary systems which have been extensively independently audited and reverse engineered by security researchers, though I do trust them less.
They can already detect the number of people in a house with wifi, the underground railroad as we knew it is dead. Technological horrors beyond our comprehension have ensured that.
prepare for surveillance of any social groups you belong to, harassment at security checkpoints, detainment if you say anything they can take out of context as evidence of some crime or threat, and random acts of violence. have armed security at any event where large numbers of trans people attend. improve your opsec - switch to Signal, get an iPhone or GrapheneOS, migrate from Discord/Google/Instagram. start carrying a taser and take self-defense classes. put together a bug-out bag. stock up on HRT if you can. don’t break any laws, no matter how minor. if you are arrested or detained: comply with orders (under protest), don’t tell them your phone PIN, say nothing except “I exercise my right to remain silent and I want an attorney.”
it remains to be seen how bad this gets. if they start rounding people up in masse, we’ll all need to flee and request asylum.
good luck.
Fuck that noise, Apple is already firmly in the pocket of the orange fascist. They are no longer safe and are now a threat to privacy and safety. I would bet my entire existence they are already handing over data on anyone not straight white Christofascist.
iPhones are highly regarded for security precisely because you don’t have to trust that Apple won’t hand over your data - it’s encrypted, if you set it up that way. enable Lockdown Mode, don’t use any services that aren’t E2EE. they can still try to GrayKey your phone, but it’s not Apple’s doing - GrayKey uses exploit chains which Apple legitimately does well to mitigate.
GrapheneOS is better for security than iPhones, but less noob-friendly. there are guides, though.
Iphone? More secure?
Secure from fraudsters stealing your money? Probably.
Secure from the government? LOL nope.
I’d trust an iPhone more than a random Samsung full of carrier bloatware, but I trust my Pixel running GrapheneOS more than either.
I have the USB-C port disabled for anything but charging, a duress pin, and reboots after 8 hours without a login. I’m honestly not sure if GrayKey could unlock it. I have memory tagging and a bunch of other hardening enabled, running only open-source apps I’ve verified the signatures of, running with minimal permissions. It would be hard to hack.
Yes, of course the NSA could almost certainly break it, but it would probably cost them time, money and vulns. If everyone uses GOS it will make their job very, very annoying :)
It’s already been proven that not only can Apple decrypt some of your data, they are more than willing to hand it over. They are a willing tool in the government’s quest to oppress society.
https://arstechnica.com/tech-policy/2023/12/apple-admits-to-secretly-giving-governments-push-notification-data/
https://appleinsider.com/articles/22/02/25/surveillance-firm-says-apple-is-phenomenal-for-law-enforcement
nope, neither of your sources says they can decrypt your content. in particular, from your first:
as for your second, that’s for unencrypted iCloud backups. you have to turn Advanced Data Protection on: https://www.macworld.com/article/2606947/icloud-encryption-how-secure-is-your-data.html
note that iCloud Calendar, Contacts and Mail can’t be e2e encrypted, for fundamental reasons (notifications, discovery, SMTP.) but you don’t have to use those.
Apple has already said they can scan your device, using on-device hardware and software, for CSAM and report that to the FBI. Yes, CSAM is bad and shouldn’t exist, but today it’s just CSAM that’s illegal and reported, tomorrow it will be the fact that one is LGBTQ+ or anti-fascist. They said they decided not to do it, but can you really trust them?
No amount of E2E encryption will protect you from an on-device spy that can scan and upload what is sitting on your phone every time you unlock it and therefore decrypt it. Your data has to be decrypted for you to interact with it, E2E only protects you when your device is in your adversary’s hands.
From your other posts you seem to be knowledgeable about security and privacy, how is it that you are turning a blind eye to this well known “feature” of Apple devices and just trusting their word that it isn’t enabled? Why are you so bent on propping up Apple as a secure platform when it’s so glaringly obvious they can’t be trusted with your data?
They have root access on your phone and it doesn’t function without constantly connecting to apple severs for every little thing. If Apple wants access to your data, they’re gonna get access.
I know you mean the best, but an iPhone isn’t any better privacy-wise than an Android is. Regardless of their public stance, these giant monoliths have proven time and time again there’s no respect for an individual’s privacy. If they get caught lying/breaking the law, the fine is merely the cost of doing business.
It would be better to focus on universal ways someone could keep themselves safe. Drop WhatsApp/SMS for Signal, drop Chromium based browsers, use uBlock, a VPN, etc. Arguing over phones is just infighting and not worth the energy.
I disagree on dropping Chromium-based browsers. drop Chrome/Edge/etc. certainly, but Firefox is kept alive by a skeleton crew at this point, and almost certainly has more vulnerabilities than Chromium browsers. the sandboxing and process isolation, the defense in depth, it just isn’t there.
I use Vanadium, which has all telemetry disabled, JIT off by default, and blocks ads.
Unless you have real world data that confirms it, this is just fear mongering.
I will never understand why anyone trusts a corporation who has proven time and again to spy on their own users and report back to the government, even before Trump was on the scene. I guess Cypher was right, ignorance is bliss.
I don’t trust corporations. I trust math, and code, and systems design. I trust AES-256, even though the NSA picked it, because 20 years of cryptography research has revealed nothing close to a break. I trust SELinux, even though NSA invented it, because hundreds of kernel devs from around the world have audited it and touch that code regularly. I trust even proprietary systems which have been extensively independently audited and reverse engineered by security researchers, though I do trust them less.
Trans allies are going to need to start setting up an underground railroad.
They can already detect the number of people in a house with wifi, the underground railroad as we knew it is dead. Technological horrors beyond our comprehension have ensured that.