Verfechter von Klima- und Artenschutz, Datenschutz, Demokratie und Freier Software | wissbegierig
Aktiv bei #ÖDP
| Profile picture source | https://climatejustice.social/@stefanmuelller/113890214500384569 |
| Languages | German, English |
| Warum Gendern? | https://zeitzeichen.net/node/10874?utm_source=browser |
| Born at | 355 ppm |
'Meredith,' some guys ask, 'why won't you shove AI into Signal?'
Because we love privacy, and we love you, and this shit is predictable and unacceptable. Use Signal ❤️
Verzweiflungsmedien
Wie prekär mittlerweile die Lage von Jans Spahn geworden sein muss, erkennt man übrigens auch daran, dass Springer Redaktionen wieder angefangen haben Habeck anzugreifen. …
Zum Weiterlesen den Link benutzen.
https://cartoons.guido-kuehn.de/verzweiflungsmedien/
#csu #habeck #korruption #masken #spahn #union
The brutal, daily bombing and murder of innocent civilians, in #Palestine and #Ukraine are signs of a collapsing rules-based world order.
It is not collapsing because of #Russia or #Israel, but because the west, who was supposed to uphold it, chose not to for the simple reason that it was inconvenient.
Today Ukrainians and Palestinians are suffering the consequences. Tomorrow it will be Europeans and Americans.
If you don't stop evil in it's infancy you might not be able to when it grows.
„Wir müssen alle Grenzen zu machen!“
„Ja genau, mauern wir uns ein, treiben Inzucht, sitzen nach Generationen wieder sabbernd auf den Bäumen. Egal, die Welt dreht sich dennoch weiter.“
*Manche sind einfach nicht ganz dicht im Oberstübchen bzw. gänzlich ausgelaufen.
@billyjoebowers An old joke:
Trump aide tells him excitedly about a dream she had of a big celebration for him. Huge crowds of people, all shouting and laughing, waving flags as Trump passed by. Trump asked the aide "How did my hair look, was it ok?" The aide responded "I couldn't see, it was a closed casket."
🇩🇪Den EU-finanzierten DNS-Dienst #DNS4EU kann ich nicht empfehlen, weil Zugriffe protokolliert werden - bei "schädlichen Inhalten" sogar mitsamt IP-Adresse. https://www.techradar.com/vpn/vpn-privacy-security/the-eu-challenges-google-and-cloudflare-with-its-very-own-dns-resolver-that-can-filter-dangerous-traffic
Es gibt gute nichtstaatliche Alternativen: https://www.privacy-handbuch.de/handbuch_93d.htm
Update: Es scheint, die IP-Speicherung erfolgt im o.g. Fall für 24 Stunden, damit die Warnung vor den Inhalten nicht immer wieder angezeigt wird.
🇬🇧I can't recommend the EU-funded DNS service #DNS4EU because access is logged. When you override warnings to access "harmful websites" they even log your IP address. https://www.techradar.com/vpn/vpn-privacy-security/the-eu-challenges-google-and-cloudflare-with-its-very-own-dns-resolver-that-can-filter-dangerous-traffic
There are government-free services that do not log: https://www.privacyguides.org/en/dns
Update: I understand now the IP address is kept for 24 hours to prevent the confirmation prompt from showing again.
@echo_pbreyer I'm much more concerned by DNS4EU keeping logs of all DNS requests for up to 6 months, with an identifier for every /24 subnet which changes only every 24 hours. And this in hands of a private company.
Nice trove of data which you can correlate easily and surely the domain names will give lots of information about who is behind the identifier.
The question of the Quad9 CTO at the end is spot on: https://www.youtube.com/watch?v=rXpyUkBOw3A
From what I understand, saving the IP address when a user is dismissing the warning and wants to visit the site anyway, is a technical requirement to temporarily whitelist the domain for your IP. (Well, these 24 hours are arbitrarily chosen and this could definitely be shorter).
The other data with the anonymized ID which is saved for up to 6 months, strictly speaking is not PII, although in practice it can contain many hints to who is behind them.
@hakona @echo_pbreyer
Can you point out exactly what you mean by "valid"?
At this point I am very curious
@malteengeler I guess what Patrick wanted to say is:
If you use a privately operated service, some will log you, to profit from you.
If you use a state-operated service, some will log you, to persecute you (if you pirate stuff protected by copyright).
This service logs you, and is apparently operated by the state. So he recommends services that don't log you (and happen to not be operated by the state).
@malteengeler @echo_pbreyer since we all know the track record of the current president of the European Commission, I'm unwilling to touch any DNS service operated by the EU with a 10 mile pole.
I haven't forgotten the dumb stop sign campaign, I'm aware of the EU's hate for encryption, so off is the general direction in which I wish them to fuck.
@echo_pbreyer how would you implement a service which doesn't temporarily log an IP address in that case?
If I access badsite.example, and click through the warning, my browser will need to load multiple files from the domain. I can't click through a warning to download badsite.example/style.css
So it needs to know not to block me. How else would you do that other than by IP address?
@noa how else would you make a user-friendly DNS?
You either serve NXDOMAIN which means you need to be reasonably technical to unblock it (which is how nextdns works).
Or you temporarily redirect to a page which let's the user choose to unblock or not.
Which would you think gets more users?
@Edent IMO: There is no user-friendliness concern at the DNS level. If unblocking of pages by the user should be possible, that needs to be solved at other levels of the stack.
Even ignoring any privacy concerns, trying to serve landing pages just doesn't work properly with encrypted protocols without MITM, and for better or worse that's 99 % of what we're speaking today.
If MITM is an acceptable scenario, then yes there are fewer technical concerns and landing pages can be a solution.
@noa how do you go from "this site isn't available" to "please unblock this site"?
And, let's suppose you have a non-DNS level way of doing that. Where do you record that this specific user doesn't want that specific domain blocked?
At some point you have to save their IP and the domain.
@Edent @noa a third or so, according to
https://www.ssllabs.com/ssl-pulse/
We can discuss this, but IMHO the concept of inserting a page in between, is unreliable at worst, and harmful to teach users too.
And edit, as Schneier said, give the user a choice to see a pink elephant and they will select it, today we have taught people that clicking through will get on with their task
Unsure about the precise quote, but users don't read warnings and don't know how to react, so it is not helpful
You type in to your browser's address bar example.com and it automatically redirects you to the https:// version. How does your browser know that it needed to request the more secure version of a website? The answer is... A big list. The HTTP Strict Transport Security (HSTS) list is a list of domain names which have told Google that they always want their website served over https. If the user …
@Edent @noa asking for the web page and reading the answer in the headers IS the way.
Preload list is nice, but not really indicative of the use of HSTS
We have seen quite a shift into most sites being HTTPS today, and I imagine HSTS use will go up with it, as most testing sites like internet.nl etc check for it.
@Edent @echo_pbreyer in an era of Carrier Grade NAT, using the IP address to identify the user makes no sense
You could do DoH or DoTLS with a personal URL, but that is not something most users can configure on their systems.
@echo_pbreyer That doesn't seem to say that they log the IP?
It sounds like they keep your IP* in memory so you don't get reprompted about a site that you've chosen to bypass warnings on.
IMO, that's a *good* thing because it means average consumers won't simply switch away from the service if it accidentally overblocks
*In fact, not your IP, they've gone to quite extreme lengths to anonymise - they're not just masking octets, it all gets HMAC'd with a rotating key: https://142290803.fs1.hubspotusercontent-eu1.net/hubfs/142290803/DNS4EU%20Public%20DNS%20Resolver%20policy%202025.docx.pdf
What they're doing can only be achieved by storing some of kind of unique (and semi-persistent) identifier.
The only information available to them to identify the user is an IP, so whatever they do will always have to be derived from that - at a certain point, you're adding computational cost for no routine privacy benefit (where there is benefit though, is if that information somehow leaks).
I think they could do more, but they're also already well above most other providers
@puhuri @echo_pbreyer Yeah, that's a fair bit of pedantry.
Rolling the key passed into the HMAC daily is a nice touch too. Assuming that they don't keep a record of the key, that should help prevent correlation across days
I'm not sure I agree, depending on your threat model.
If its leakage/compromise then the keys covering the relevant timescale also need to be compromised along with the inputs to the modulo (which they claim is derived from the amount of traffic handled over the previous 24h)
If the model is *them* then they'd also need to be lying about not retaining keys, at which point they could just as easily be lying about the whole thing and storing in plaintext anyway.
@waldi @echo_pbreyer Admittedly, that does assume the key is being safely generated etc etc.
If they *were* malicious, it'd probably be easier for them to periodically resolve certain names to an IP they control (with a very short TTL) and see who connects there - correlation of real ip to psuedo-id would then be near trivial
Das mag ja sein, dass es technisch so abläuft. Aber bei diesem Dienst gilt immerhin die EU-Datenschutzgrundverordnung (DSGVO), so dass die kurzfristig gespeicherten Daten nicht verwendet werden dürfen.
Ich würde den guten Ansatz des Dienstes nicht gleich wieder verteufeln.
@DJGummikuh @Archaide @echo_pbreyer
Die reden von "technisch notwendig". Nein ist es nicht. Wenn klar ist was warum geblockt ist - transparente Blocklisten wie wenn ich selbst nen pihole betreibe - dann wird mit 0-Blocking geblockt, DNS auf 0.0.0.0. Statt dessen laden sie eine Seite (also gibt es positives Caching) was an sich schon Verstoß gegen DNS Grundsätze ist & loggen dann noch, wenn man trotzdem weiter will. Und natürlich nur dann? Sobald was geladen wird (wo ist das gehostet?) wird es
Meredith Whittaker
Anne Rabe
Guido Kühn
Jordan Maris 🇪🇺 🇺🇦 #NAFO
cR0w 
Dr. Amy, Psy.D.
taz
Heidrun Müller
jackcole
benny
Patrick Breyer
Frehi
Colm Donoghue
Osma A 🇫🇮🇺🇦
Speed demon 🇪🇺 🇳🇴🇺🇦
Henrik Kramselund - kramse 🍉
Malte Engeler
Ralf Bendrath
David Culley
Dave
miiko
Arthur van der Harg
Terence Eden
vekkq
noa
waldi
Fazal Majid
Seedymofo
Ronin Kensho
Marcel Bootsman
Martin Boller 🇬🇱 🇺🇦 
Ben Tasker
William Oldwin
Markus Peuhkuri
Mallory 🏳️⚧️
Fink 
KDSZ Bayern
Falk S. 🇨🇦🐕🔋 #ElbowsUp!
DJGummikuh
Archaide 
Jens