maxo133

Google is probably the most aggressive anti-privacy big tech company currently operating.

No other big-tech company goes to such great lengths to deanonymize users and make its services difficult to use, especially during account creation.

The requirement to have a mobile device to scan a QR code to verify that you're human. Reverse SMS verification, where you have to send an SMS rather than receive a verification code. You think of signing up using a VPN server in another country? The phone number you use to send the SMS from must also be from that country.

Not being able to watch YouTube videos when using VPN - without signing in to a Google account, all under the guise of "bot protection."

Gemini not working in 3/4 of cases when using VPN.

It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.

I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities.

PS. The first company federal investigators often go for data is often Google

exactly this. and their autofill sucks so much on chrome desktop. It's bloated and slow. Even lastpass has a better and faster extension

Try to bring it up on bitwarden reddit sub, they will eat you alive

They are not.

Developing modern 0-day zero click RCE exploits chains like those developed for iOS is far more complex than hacking to generic company servers

It's completely different scale of difficulty factor. Not a single documentated case of of any AI tool developing such exploit exists

There is a reason why those mobile 0-day exploits are sold and bought on exploit gray market for as much as 10-20 million dollars each

Funny to read this, but google is currently number one anti-privacy big tech company. No other company makes it as difficult for its users using anonymization/privacy software to access their services

I completely disaggree with this take. Modern AI is not yet capable of finding multi-component bugs as advanced as those produced by firms like NSO.

100% agree with your statement that gemini models have most knowledge in domains. They shine in so many generic topics

Windows GDID Changer:

https://news.ycombinator.com/item?id=48818707

Windows GDID Changer:

https://news.ycombinator.com/item?id=48818707

Windows GDID Changer:

https://news.ycombinator.com/item?id=48818707

A script that requests the generation of a new GDID from Microsoft servers and assigns it to the Windows installation. GDID tracking variable became publicly discussed after it was mentioned in the Peter Stokes indictment

Further research how GDID works:

1. You install windows 2. Windows performs online device registration via call to live.com/ppsecure/deviceaddcredential.srf it submits hardware information about your computer 3. Microsoft SERVER generates Global Device ID also known as GDID 4. This GDID is persisted on your computer as part of the session permanently

How to change it? Perhaps only way is to change hardware details and somehow invalidate the session to force device registration again

Install mitmproxy on your router and you can see the whole flow

AI-generated "research" once more. How can anyone call it full writeup?

As someone pointed out in the X argument comments, this is unconfirmed and most likely NOT how the actual GDID being sent to microsofts servers looks like.

1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService\IrisActionCreatives, which starts with the "g:" prefix and is explicitly called GLOBALDEVICEID. This keys holds cached response from microsoft servers and this is value microsoft servers consider a "GDID"

2. According to the research, a Microsoft account is required. No, it's not necessary. Whether or whether you are not logged into your Microsoft device, GDID is being filled in. Did AI forget to check that?

3. How can author claim this is full writeup of GDID, when you did not verify whether the value your AI found, is the one being sent along with telemetry network requests? Author did not even verify whether he found the right thing

I also verified the value computed as suggested by the repository's creator and it is different from the value discovered inside the Iris registry key that begins with "g:".

Summary: The value author of repo claims is a GDID, is not the same as saved on microsoft servers as GLOBALDEVICEID.

The fact that graphane is getting attacked speaks enough for it's relability. First in france now in Wired.

I'm more concerned that Signal incorporated in US is having easy life.

I can completely believe this.

I was always convinced that Skype was bought by microsoft so CIA/US intelligence agencies to have listening capabilities.

The first thing Microsoft did after the Skype purchase was making it easier to tap into the calls by removing p2p calling and routing calls using centralized servers.

You are right, but i still have no idea what is the point of this article.

The guy unlocked the bitlocker, then restarted PC just before login screen appeared. He said that's when he had most success. What sense does it make to restart and start looking for key in memory, when bitlocker has been just unlocked.

Too bad the author did not provide hardware specs. Such attack is even harder on DDR4 and DDR5 memory and most publications refer to legacy ram such as DDR3

> In my experience I have had the most success restarting the system while Windows is loading but before the login screen has appeared, at least in the case of finding FVEK keys.

So what is this? It was supposed to be memory attack and he's dumping the keys after someone unlocked it and it's booting?

So this is just another theoretical attack where perfect conditions must be met.

Yes and the DGSE agents visiting every week or so giving him an release offer you can't refuse.

CEO getting arrested does not mean telegram will go down.

Direct involvement with scams? You got to be kidding me. This guy is worth 15 billion USD, he does need to do anything.

It's about lack of cooperation in censoring content.

This is a good point. It doesn't have to be Mullvad but it's almost guaranteed based on what we've seen in the history (see CIA + swiss crypto company) that some of the major VPN providers are managed by intelligence agencies. Either VPN companies were bought via shell companies after reaching certain market share or they were even developed from the scratch.

This is step closer, after few more steps they'll make sure only those "approved" companies can operate email server... leading to more internet centralization.

this is most interesting piece of entire presentation.

They can query location remotely using GPS and likely turn on microphone too.

Dont worry, registrants will move to offshore locations and that's how it's gonna end.

Today, i read somewhere while watching protonmail case comments, that switzerland has quite extensive surivellance laws which include possiblity of logging whole country inbound and outbound traffic for period of 6 months.

If they really cared about anonymity ProtonMail would ship their mobile app with bundled TOR. Especially the mobile version, since plenty of non-tech savy people use mobile only.

Nothing stops them from deploying malicious javascript code to comply with court orders.

Nothing stops them from logging user password either, then the entire mailbox contents is compromised

Many good points + 1.

So... if they receive valid swiss court order they can be forced to log user passwords on demand and their entire service is then useless? As when you have password you can decrypt entire mailbox content.

They market their service to journalists and activists, which are often targetted by their own governments. Seems that they cannot protect any of them.

So right, people just dont get the big picture.

If they were forced to log the IP address, they can be forced to log user password. This makes entire encrypted mailbox useless.

Isn't DMCA working the way that if you disagree with dmca takedown and fill certain form, the side asking to take down content (RIAA) needs to get court order?

That's the way how it works with google search.

How can you advise synology when their system doesn't even have FULL DISK ENCRYPTION? As longas it doesn't have it, i wont be even interested looking at their platform.

Can you imagine it? NAS'es usually are targeted for business users, yet they dont have full disk encryption...

For now i'm using QNAP, in terms of possible features i believe QNAP is little ahead (x86 cpu, virtualization, containers, fde). It has all what synology has + more.

However their platform is badly constructed, most processes are esentially running as root user... You get like firmware update every 2 weeks. It doesn't mean that there are bugs tho. I'm running it for 2 years and never had a problem.