• 0 Posts
  • 21 Comments
Joined 10 months ago
cake
Cake day: June 12th, 2025

help-circle





  • That’s not correct. Under the GDPR, the data that Facebook collects on you, makes them the Data Controller. Any partners they share data with would be considered Data Processors. When you invoke your right to be forgotten under the GDPR, then both Data Controllers and Data Processors must delete your data. So if Facebook partners isn’t deleting your data after you filed a request to Facebook, then they are violating the GDPR.

    That said Facebook is certainly violating the GDPR left and right. For example with their “Pay or Consent” model…


  • The problem is that they don’t have to prevent encryption at all…

    Many governments are already recording and storing incredible amounts of your Internet traffic.

    With this new legislation they want to require all companies, that offer some form of encrypted communication, to submit all the messages for scanning before they are encrypted. So they want to force Facebook and many others to actually intercept the messages before they get “end-to-end” encrypted, so they can get scanned by AI and other systems to look for CSAM.

    Of course they can’t prevent encryption… Anyone can get some encryption software that doesn’t submit the messages to scanning before encrypting…

    Now you as a person have the options of either using a platform that scans your messages, or finding something that actually offers privacy.

    If the government then decides that they want to investigate you, then they just dig into their trove of intercepted messages. If you only used scanned services, then they can see all your messages and probably find something in them to prosecute you over. But if you used any encrypted services they don’t have access to, then they can just start prosecuting you for using encryption that they can’t spy on…

    In either case you lose, and they gain the ability to practically put anyone they want behind bars.

    And who knows who will wield these tools at a later point, and what they might decide should be illegal, which they can then immediately dig for in all their previously stored and scanned messages.









  • These are great points, but there is something more that phones have going for them.

    All modern phones are full-disk encrypted by default, and can be remote wiped. I think this is only the case for Mac laptops, but not for Linux and Windows.

    So if your phone is stolen, it’s not really a risk of the thief having your password manager and your 2FA at the same time, but rather can they get in to your phone and then password manager and 2FA before you can trigger the remote wipe.

    Unless the attacker is sophisticated enough to mirror the whole disk and attack it offline.



  • The idea is that you could have your data stored encrypted, such that the entity that is storing your data can’t read any of your data, but can still make calculations or updates to your data without ever learning anything about your data.

    The use cases seems rather narrow to me, but there are probably many that I just can’t think of at the moment.

    One idea could be something like a VPN service that wants to store as little data about the customer as possible. They could keep the account balance in an encrypted format. When you then add money to the balance, they can increment your balance by however much you paid, without knowing what your old balance was or what the new balance is. And they could then have another homomorphic function that can check whether your balance is positive. If your balance is positive you are allowed onto the service, if it’s not positive you don’t get access. And the company wouldn’t be able to know whether you had $5 in your account or $5000, just that your balance is currently positive.

    So yeah fundamentally it’s just being able to store and update some data, while the data is fully encrypted, never decrypting the data, to ensure some form of privacy or confidentiality



  • I have been on Arch , and I’m now running NixOS as my daily driver… IMO NixOS is less of a hassle to set up, and nearly maintenance free compared to Arch… Twice a year when the channel updates there’s a bit of stuff, but every change I need to make is usually explained in the output of my nixos-rebuild… If something suddenly breaks in an update, I just boot into my previous generation, roll back my flake.lock and wait a few days for a fix to be available…