Privacy

3230 readers
309 users here now

Welcome! This is a community for all those who are interested in protecting their privacy.

Rules

PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!

  1. Be civil and no prejudice
  2. Don't promote big-tech software
  3. No apathy and defeatism for privacy (i.e. "They already have my data, why bother?")
  4. No reposting of news that was already posted
  5. No crypto, blockchain, NFTs
  6. No Xitter links (if absolutely necessary, use xcancel)

Related communities:

Some of these are only vaguely related, but great communities.

founded 8 months ago
MODERATORS
1
76
submitted 5 months ago* (last edited 5 months ago) by llama to c/privacy
 
 

cross-posted from: https://lemmy.dbzer0.com/post/36880616

Help Combat Internet Censorship by Running a Snowflake Proxy (Browser or Android)

Internet censorship remains a critical threat to free expression and access to information worldwide. In regions like Iran, Russia, and Belarus, journalists, activists, and ordinary citizens face severe restrictions when trying to communicate or access uncensored news. You can support their efforts by operating a Snowflake proxy—a simple, low-impact way to contribute to a freer internet. No technical expertise is required. Here’s how it works:


What Is Snowflake?

Snowflake is a privacy tool integrated with the Tor network. By running a Snowflake proxy, you temporarily route internet traffic for users in censored regions, allowing them to bypass government or institutional blocks. Unlike traditional Tor relays, Snowflake requires minimal bandwidth, no configuration, and no ongoing maintenance. Your device acts as a temporary bridge, not a permanent node, ensuring both safety and ease of use.


Is This Safe for Me?

Short answer: Yes.

Long answer: pobably. Here is why:

  • Your IP address is not exposed to the websites they access. So, you don't have to worry about what they are doing either. You are not an exit node.
  • No activity logs. Snowflake cannot monitor or record what users do through your connection. The only stored information is how many people have connected to your bridge. Check docs for further info on this.
  • Low resource usage. The data consumed is comparable to background app activity—far less than streaming video or music.
  • No direct access to your system
  • No storage of sensitive data. Snowflake proxies do not store any sensitive data, such as IP addresses or browsing history, on your system.
  • Encrypted communication. All communication between the Snowflake proxy and the Tor network is encrypted, making it difficult for attackers to intercept or manipulate data.

You are not hosting a VPN or a full Tor relay. Your role is limited to facilitating encrypted connections, similar to relaying a sealed envelope.

Your IP address is exposed to the user (in a P2P-like connection). Be mindful that your ISP could also potentially see the WebRTC traffic and the connections being made to it (but not the contents), so be mindful of your threat model.

For most users, it is generally safe to run Snowflake proxies. Theoretically, your ISP will be able to know that there are connections being made there, but to them it will look like you're calling someone on, say, Zoom.

Historically, as far as we know, there haven't been any cases of people getting in legal trouble for running entry relays, middle relays, or bridges. There have a been a few cases of people running exit nodes and getting in trouble with law enforcement agencies, but none of them have been arrested or prosecuted as far as I know it. If you are aware of any cases, let me know so I can update this post.

Do not hesitate to check Snowflake's official documentation for further reference and to make informed decisions.


How to Set Up a Snowflake Proxy

Option 1: Browser Extension (Brave, Firefox, or Chrome)

  1. Install the Snowflake extension.
  2. Click the Snowflake icon in your browser toolbar and toggle "Enable Snowflake."
  3. Keep the browser open. That’s all.

Note: Brave users can enable Snowflake directly in settings. Navigate to brave://settings/privacy and activate the option under "Privacy and security."


Option 2: Android Devices via Orbot

  1. Download Orbot (Tor’s official Android app).
  2. Open the app’s menu, select "Snowflake Proxy," and toggle it on.
  3. For continuous operation, keep your device charged and connected to Wi-Fi.

Your device will now contribute as a proxy whenever the app is active.


Addressing Common Concerns

  • Battery drain: Negligible. Snowflake consumes fewer resources than typical social media or messaging apps.
  • Data usage: Most users report under 1 GB per month. Adjust data limits in Orbot’s settings or restrict operation to Wi-Fi if necessary.

Why Your Participation Matters

Censorship mechanisms grow more sophisticated every year, but tools like Snowflake empower ordinary users to counteract them. Each proxy strengthens the Tor network’s resilience, making it harder for authoritarian regimes to isolate their populations. By donating a small amount of bandwidth, you provide someone with a critical connection to uncensored information, education, and global dialogue.

Recent surges in demand—particularly in Russia—highlight the urgent need for more proxies. Your contribution, however small, has an impact.

By participating, you become part of a global effort to defend digital rights and counter censorship. Please, also be mindful of your threat mode and understand the potential risks (though very little for most people). Check Snowflake's official documentation for further reference and don't make any decisions based on this post before taking your time to read through it.

Please share this post to raise awareness. The more proxies, the stronger the network.

– llama

2
76
submitted 5 months ago* (last edited 5 months ago) by shaytan to c/privacy
 
 

It's hard to make the full switch towards a more private life, but switching your mail already fixes a big underlying issue: that being, Google or other companies having access to all your emails. So, I'll cover the basics of making your online mailing more private.

Switching Mail Providers:

Your email is a big part of your online footprint and helps you keep track of your online identity. So, in order to keep that to yourself, I encourage leaving services like:

"Gmail" or "Outlook",

for others like:

"ProtonMail" or "Tutanota".

This is already a big step towards keeping all your emails private and safe. Both of these are free and respect your privacy on their free tier, but expand in features with paid plans. This takes time, as you have to switch your email on most accounts to this new email.

For the best privacy, you should delete most accounts and create new ones with this new email or with aliases. Some people, like myself, prefer to have multiple emails over aliases. For example:

  • "something.banking11231@provider.me" -> For banking and finance
  • "something.social12312@provider.me" -> For social media
  • "general.use@provider.me" -> For casual and responsible internet use
  • "something.trash21412@provider.me" -> For crappy websites or similar uses

(Self-hosting your own mail domain is possible, but it’s a harder process, and custom domains are not always accepted or reliable.)

(You should keep your old email for a year or so to make sure no important service was left behind locked to that email. Once that's done, you can delete the account.)

Tips:

If you can, you should try expanding your protocol with this:

  • Adding 2FA to any online website, especially email. I use ~~"Authy" ~~for this. -> Better use Aegis, good app!

  • Switching your browser to something like "Librewolf".

  • Switching to a password manager like "Proton Pass" or "1Password".

  • Encourage your close family to do the same once you're comfortable with the process.

  • Switch social media to private alternatives.

  • If you take any efforts to switch browser or install Aegis, try to use "F-droid", or even better, "Droidify". These being a FOSS app store, and a good Material alternative frontend. For apps not in here, consider "Aurora store", a more private **"Play store" **alternative

This is about it for me, quick posts from class, feel free to add into this topic bellow.

Edit:

Important additions after reading the comments:

  • Proton is a bit disencouraged by some for some political views published by the CEO under proton's account and image. They backed down, and I believe it isn't something too bad as for users to leave such a good privacy oriented suite of apps. I encourage anyone who cares about this topic to research before making the switch.

  • Mail is not 100% private with any option, and shouldn't be used for highly sensitive information. For that use end to end encrypted apps well respected, like "signal". Still is best to just don't send very sensitive information online.

  • As a comment pointed, for a mail to be as private as possible, both the sender and reciever should have a private mail, otherwise you can be private but the other person would still be having your mail conversations stored under "gmail" or similar.

Sorry if this post didn't give the best newbie advice, I tried to track back some of my old knowledge, but I'll take more time to research the next time. Take care and stay private!

3
4
5
 
 

archive.today: https://archive.fo/e4y9t

I think it'd be an interesting insight for you, folks. The article as presented in russian news media Kommersant via automatic translation:

The State Duma has proposed to impose fines for searching for illegal content

On July 17, the State Duma plans to consider in the second reading amendments establishing criminal and administrative liability for a number of violations in the field of communications and information - from the organization of uncontrolled VPN networks to the transfer of SIM cards to third parties. The most resonant in them was the novelty on fines for citizens for the deliberate search for extremist materials, including using means to bypass blocking. Proving the fact of such a search may be problematic, experts say.

Initially, the bills tightening regulation of the Russian segment of the Internet concerned other issues - the activities of forwarders and foreign officials, but by the second reading, amendments were proposed to establish a number of new provisions of the Administrative and Criminal Codes of the Russian Federation. In particular, this concerns the criminalization of the transfer of Internet resource accounts and the provision of VPN access not controlled by Roskomnadzor, the recognition of the use of means to bypass blocking as an aggravating circumstance in the commission of crimes, the prosecution of companies and individuals for participating in the exchange of SIM cards and providing them to third parties, etc.

The most resonant amendment was the one on administrative liability for “searching for obviously extremist materials and gaining access to them,” including using VPN services (Article 13.53 of the Code of Administrative Offenses).

If the bill is adopted, citizens will face a fine of 3,000 to 5,000 rubles. In the document, extremist materials are those included in the relevant list of the Ministry of Justice, as well as those that meet this definition in accordance with federal law. In addition, if the amendments are adopted, advertising of “software and hardware for access to information resources with restricted access,” that is, VPN services, will be prohibited (Part 18 of Article 14.3 of the Code of Administrative Offenses of the Russian Federation). Citizens will face a fine of 50,000 to 80,000 rubles, officials - from 80,000 to 150,000 rubles, and legal entities - from 200,000 to 500,000 rubles.

A high-ranking source familiar with the development of the project explained to Kommersant that the amendments establish liability only for the deliberate search for and actual access to obviously extremist materials, “that is, to such materials that are clearly included by a corresponding court decision in the list of extremist materials published by the Russian Ministry of Justice, which he cannot help but know about.” “Visiting the personal pages of citizens, including those with a ‘dubious reputation’, is not regulated or limited by these amendments in any way,” the source assured Kommersant.

However, the initiative has already raised questions from the head of the "Safe Internet League" Ekaterina Mizulina, who came to the conclusion that she will no longer be able to pass on data on extremist communities to the police, since to do so she needs to "purposefully monitor such content." "And the activities of the Ministry of Internal Affairs employees on monitoring may also be recognized as illegal," Ms. Mizulina was indignant. She recalled that the list of extremist materials contains 5.5 thousand items - from "violent content with videos of migrant murders" to memes and tracks of foreign agents, and wondered whether every citizen should familiarize themselves with it: "How will they establish intent in searching for such materials?" The activist was answered in absentia by the deputy head of the State Duma Committee on Information Policy Oleg Matveychev, who allowed that an exception could be made for security forces who are looking for illegal content.

Ekaterina Mizulina’s concerns are shared by experts.

“It’s not very clear what kind of behavior the legislator expects from the user,” says Comply partner Maxim Ali. “It’s hard to imagine that an elderly citizen knows about the Ministry of Justice registry, will find it, and will check the material they are looking for in it before each search query.”

According to him, it is also not entirely clear how access to prohibited content will be proven: "I clicked on a prohibited link, but it is blocked. The moment of the request will be recorded, but if the page does not load, this should not be a violation."

Based on the design of the new administrative composition, it will be necessary to prove that a specific user, firstly, carried out a search, secondly, that the information sought is prohibited, thirdly, that he knew about it, says lawyer Andrei Grivtsov: "It is only possible to know in advance if there is evidence that you are familiar with the list of extremist materials." However, practice is moving towards a consistent reduction in the standards of proof, the lawyer notes. "It can be assumed that in practice they will hold people accountable if they simply find a search query on a phone regarding something extremist or a tab with open material," says Mr. Grivtsov.

Yuri Mirzoev, CEO of the law firm Mitra, does not rule out that complaints, user behavior analysis, monitoring of their requests through providers, as well as data from IT companies, may be used to detect the fact of searching for extremist content. According to Vasily Stepanenko, CEO of the cloud provider Nubes, the amendments are intended to make the user understand that their search queries may be revealed by both the prohibited resource itself and the VPN service they used to bypass blocking: “And thus reduce the desire to use them.”

They propose:

\1. Legal liability for sharing sim cards (and internet accounts) with third parties. In the system they built, where those are usually directly linked to internal passport, they became used as one of the major way to ID you and to log into any service, including government ones. Therefore they kinda locked themselves in the thinking framework where phone number IS identity, like SSN, in spite of them being sold like candies just 10 years before. And although they would have a hard time controlling it now, they roll out ways to punish at least those, sim-farms they'd find while following other crimes.

This, btw, got my normie peers pretty distressed because most of us gave dumb phones to our elderly with SIMs registered to us, not them. I'm sure that these cases wouldn't be targeted at all, but as many laws there does have this unnerving blanket nature you can persecute everyone with it.

\2. VPN ads are everywhere, and although they are for now in the gray, you'd be surprised how deep the untold divide lays: a lot of people either do have a free VPN or\and a subscription or feel proud they don't need it because local content is all they need. Suuuure. As proposed there, using them WHILE doing something questionable may factor into deciding ypur actions were intentional.

\3. Searching for the extremist content. This one is not well formulated, and that's the goal. While we have a list of extremist materials that is rather strict and sober, includes stuff like white pride, isis, other propaganda, we also have laws that promotes LGBTQ+ media as extremism, there are previously popular artists that are called extremists for their lack of enthusiasm in our war efforts. There's no solid explanation what of these are counted as extremism and how this would be decided if there was your intent to look for them - not even access, copy or distribute - but just search it. Yet, I see the monopoly of Yandex, our Google, being very handy at persecuting thought crimes against the Motherland.

P.S.: The notion I'd put there - Russia is a good, useful example of how privacy and the rule of the law (and logic) can be eradicated, the one europeans should be aware of when their own lawmakers try to pass e2ee ban or something similar.

6
 
 

Google is quietly rolling out its Gemini AI tool as the default assistant on Android, even on devices where users never explicitly enabled it. In many cases, Gemini replaces Google Assistant by default, making it increasingly challenging to disable fully.

This deep integration means Gemini can still be active in the background, accessing your apps, system features, and personal info.

Here's what Gemini can access:

Gmail 
Google Calendar 
Google Drive & Docs 
Maps, Keep, Tasks
Messages, Phone, and even WhatsApp

Even more concerning:

Your data is used to train Google’s AI.
Human reviewers may see your chats.
Data can be shared with 3rd parties.
As of July 2025, Gemini stays connected to apps even when activity tracking is turned off.

🛑 You can’t fully disable Gemini, but you can limit it:

How to limit Gemini on Android:

Turn off activity tracking
Revoke permissions
Uninstall it (if possible)

Further options, if you’re privacy-conscious:

Reduce your reliance on Google services or fully de-Google
Consider a privacy-first OS like GrapheneOS or CalyxOS

⚠️ Google is making Gemini the default assistant for all Android devices by the end of 2025.

Choose privacy over AI surveillance.

If you want tools that respect your data, ensure you use encrypted email, a private calendar, and a secure cloud, with no AI training or human review.

7
 
 

IronFox is Firefox ESR-based, completely de-Googled, has zero telemetry, and comes pre-hardened for privacy.

IronFox is a fork of Divested Computing Group's Mull Browser, based on Mozilla Firefox. Our goal is to continue the legacy of Mull by providing a free and open source, privacy and security-oriented web browser for daily use.

Version IronFox v140.0.4 released, .apk available for download here.

More discussion about the browser here.

Unfortunately, not available in FDroid yet.

8
9
10
 
 

cross-posted from: https://lemmy.dbzer0.com/post/49033194

Sorry if this is not the high brow discussion this com is for.

I travel a lot between different countries in the Middle East which have restrictive laws, and I live in one that is slowly becoming more competent technologically. I have to stay for an extended time in different places, so I’ve been connecting through always-on VPN out of the same place and it’s been working fine for now. But Digital ID laws are quickly going to close things off from me.

My risks that I’m trying to avoid are as follows:

Collapsed this part, it's not as important

Locally, I want to make sure my IPs aren’t connected to public accounts. I don’t say anything online that can put me in jail for the most part, but I don’t trust that this will always be the case. I also would appreciate being a bit separated from the local internet. Elsewhere, I also don’t want my traffic to be monitored or my accounts to be tied back to my personal identity. For example, I don’t want to land in Dubai and to have my Steam account permanently affected by having “Spec Ops the Line” (banned game there) in my account (silly thing to worry about, but this is one tiny example out of many small issues that pile up). Plus, a lot of the internet is not accessible from these places, and I don’t like that, regardless of whether or not I want to peruse inaccessible internet stuff from there.

This has come with some serious downsides (online services are more expensive in Europe, where I have historically exited from), but it was/is worth the cost for me. Ironic that many VPN users seem to be trying to connect in the opposite direction than me (out of rich countries rather than in).

I’ve just been permanently using a single reputable VPN and single exit city for all of my traffic for the past while. Digital ID laws in the UK and EU will make this increasingly infeasible and I will probably have to exit out of somewhere new like Switzerland. I don’t know if those servers might be more trouble due to increased abuse for example.

Just want to know how others are dealing with this. Is just stomaching the wave of verifications after logging into all my emails from a new country the only price to pay? Is the world going to shit and should I rethink “just” using a VPN? Is it VPS time now that more and more things are being blocked from VPN access? Do I give up on the internet a decade ahead of schedule and chop wood in the woods until Israel’s AI mistakes my shack for a children’s hospital and drops heavy munitions on me?

I’m really hesitant to start using two sets of devices, some for insecure local traffic and some for encrypted traffic. I don’t think carrying like four laptops through airport security would keep eyes off of me.

While most of the technical solutions suggested by the replies in my original thread are probably good for different use cases, I'm just chasing the original high of the anonymous internet of my childhood, I just want to blanket route all my traffic through one place and not have to think much about it. Too naive? I'm sure. But I have no big threat to worry about in my scenario, at least now. This is just basic I-want-to-network-out-of-view-of-ISPs.

My main exit nodes have been in the UK, since that was a good compromise between the US's wild west privacy/surveillance and not being blocked by US stuff that wasn't GDPR compliant. I know the UK was never the bastion of internet freedom, but it was a practical option. Especially getting English-as-default for everything, which is something I missed. When the internet went hyper-mainstream in the 2010s, I was no longer getting a standardized English internet like everyone else, I got a localized badly-Arabic-translated version that assumed I want the strictest filtering on everything. Moving over to always-on VPN has made me feel like I got something back. Especially now that ISPs around me are no longer as careless as they once were.

Now the UK is introducing digital ID, and services have started to comply. I'm not a regular Reddit user, but I still would like to access the site without sending them a selfie (or my ID, of course). Nexus mods is enforcing this now as well, and while I haven't used it in ages, it's still a big public repository of stuff I'd want to go through at some point. Digital ID really goes against everything I believe about the internet, this concept of me being on the same anonymous playing field is directly under attack from laws like this, and it is fueling a lot of tech doomerism thinking inside of me. The last thing I want is for an any account of mine, regardless of how infrequently I use it, to be permanently blocked for lack of ID. I know we love our piracy here, but I am a Steam user as well, and with the amount of money I've put into their service (and how much I use it), I would have no choice there. But that's the only one, I think.

Someone in the thread suggested Singapore, I was thinking Ireland or Switzerland, as good exit node countries. Ireland has only two Mullvad servers (which is a problem). Switzerland I'd think would be very popular with scammers. And Singapore would, if nothing else, make my terrible ping even worse.

There's also the fact that a lot of things are now getting blocked more often from VPN servers and it is pretty annoying. Random Imgur links and so on.

I know this is more of a meandering rant than a pointed question, but I just want to hear some of your thoughts on this.

11
 
 

A very detailed guide on the privacy implications of Mastodon (how it's better and what to look out for)

12
 
 

Cross-posted from "Reddit’s UK users must now prove they’re 18 to view many types of content" by @NotAnotherLemmyUser@lemmy.world in !reddit@lemmy.world


cross-posted from: https://lemmy.zip/post/43948771

Reddit hires company to verify user age with selfie or photo of government ID.

13
 
 

Axon Enterprise’s Draft One — a generative artificial intelligence product that writes police reports based on audio from officers’ body-worn cameras — seems deliberately designed to avoid audits that could provide any accountability to the public, an EFF investigation has found.

14
 
 

TLDR: Drug dealers in Catalonia have started to adopt GrapheneOS en masse leading to Catalan police suspecting anyone with a Google Pixel is a drug dealer

!graphene_os@lemmy.sdf.org

15
16
17
18
 
 

Or what do you use them for? Isn't it now quite easy for websites to track outside of just cookies?

19
 
 

OC by @Charger8232@lemmy.ml

I know there are plenty of software missing from here. This is just a fun infographic I made, no need to take it seriously :)

20
 
 

An arson attack in Colorado had detectives stumped. The way they solved the case could put everyone at risk.

According to court documents, the company uses a staged process when responding to reverse keyword warrants to protect user privacy: First, it provides an anonymized list of matching searches, and if law enforcement concludes that any of those results are relevant, Google will identify the users’ IP addresses if prompted by the warrant to do so. DPD’s warrant had gone too far in asking for protected user information right away, and it took another failed warrant 20 days later and two calls with Google’s outside legal counsel before the detectives came up with language the search giant would accept.

Finally, the day before Thanksgiving 2020, Sonnendecker received a list of 61 devices and associated IP addresses that had searched for the house in the weeks before the fire. Five of those IP addresses were in Colorado, and three of them had searched for the Truckee Street house multiple times, including for details of its interior.

In early December, DPD served another warrant to Google for those five users’ subscriber information, including their names and email addresses. One turned out to be a relative of the Diols; another belonged to a delivery service. But there was one surname they recognized—a name that also appeared on the list of 33 T-Mobile subscribers they’d identified earlier in the investigation as being in the vicinity of the fire.

Another warrant to Google yielded the three teens’ search histories since early July. In the days before the fire, Siebert searched for retailer “Party City.” On Party City’s website, Baker spotted masks similar to those worn by the three perpetrators.

In June 2022, just when it seemed like the prosecution could finally proceed, Seymour’s lawyers dropped a bombshell. They filed a motion to suppress all evidence arising from the reverse keyword search warrant that DPD had served to Google—the key piece of information that had led detectives to Bui and his friends.

After a five-month wait that Sandoval remembers as “gut-wrenching,” the court finally ruled in October 2023. In a majority verdict, four judges decided the reverse keyword search warrant was legal—potentially opening the door to wider use in Colorado and beyond.

21
22
23
24
 
 

Developer @blob42@lemmy.ml

I just released the first version of Gosuki, a multi-browser real time bookmark manager I have been writing on and off for the past few years. It aggregates your bookmarks in real time across all browsers and even external APIs such as Reddit and Github.

I was always annoyed by the existing bookmark management solutions and wanted a tool that just works without relying on browser extensions, self-hosted servers or cloud services. As a developer and Linux user I also find myself using multiple browsers simultaneously depending on the needs so I needed something that works with any browser and can handle multiple profiles per browser.

The few solutions that exist require manual management of bookmarks. Gosuki automatically catches any new bookmark in real time so no need to manually export and synchronize your bookmarks. It allows a tag based bookmarking experience even if the native browser does not support tags. You just hit ctrl+d and write your tags in the title.

Feature Highlights:

  • A single binary with no dependencies or browser extensions necessary. It just work right out of the box.
  • Use the universal ctrl+d shortcut to add bookmarks and call custom commands.
  • Tag with #hashtags even if your browser does not support it. You can even add tags in the Title. If you are used to organize your bookmarks in folders, they become tags
  • Real time tracking of bookmark changes
  • Builtin, local Web UI which also works without Javascript (w3m friendly)
  • suki cli command for a dmenu/rofi compatible output
  • Modular and extensible: Run custom scripts and actions per tags and folders when particular bookmarks are detected
  • Browser Agnostic: Detects which browsers you have installed and watch changes across all of them
  • Also handles multiple profiles per browser
  • Stores bookmarks in a portable sqlite database compatible with the Buku. You can use any program that was made for buku.
  • Can fetch your bookmarks from external APIs (Reddit and Github for now).
  • Easily extensible to handle any browser or API

It's open source with an AGPLv3 license, Checkout the README and website docs for more details.

25
 
 

cross-posted from: https://beehaw.org/post/20989376

Where Soatok goes over why checklists are meaningless when trying to figure out if something is private or just for comparisons in general.

view more: next ›