[HN Gopher] Privacy and control. My tech setup
___________________________________________________________________
Privacy and control. My tech setup
Author : todsacerdoti
Score : 114 points
Date : 2025-12-31 18:39 UTC (4 hours ago)
(HTM) web link (toidiu.com)
(TXT) w3m dump (toidiu.com)
| jumpingpants wrote:
| > Instead of "privacy" we really should be talking about
| "control".
|
| Fantastic. This is what I have been shifting towards these past
| couple years. Hardly anyone likes to be controlled, right?
| kgwxd wrote:
| I don't but it seems a LOT of people do. They even seem to
| prefer it.
| sfRattan wrote:
| Control means ownership. Ownership means work.
|
| Until they've been burned by unspoken realities of not owning
| some piece of their own digital lives, most people will
| continue to prefer being tenants, rather than owners.
|
| Technology is only the most recent domain in which we can
| observe _the human tendency to prefer the short term,
| incurious ease and license not to think that tenancy provides
| over the long term, ongoing work and thorough understanding
| that ownership demands_. To become an owner you need some
| deeper intrinsically cultivated reason to desire it.
| bstsb wrote:
| excellent article, you've inspired me to get off Gmail finally
| (Google's been sending me angry emails about hitting my storage
| limit for ages anyway).
|
| side note, your link to Tuta is broken - think it's an internal
| link by accident
| HelloUsername wrote:
| They also wrote "Messanging"
| riskeet wrote:
| The average person won't go through even 2% of the trouble. Your
| self inflicted lockdown is a niche within a niche. I respect it
| though!
| dinkleberg wrote:
| Who cares what the average person will go through and do
| though? We're each responsible for ourselves and how we choose
| to go about life, even if vastly differs from the general
| population.
| ismailmaj wrote:
| Ironically, if your setup is too niche (e.g. browsing privacy
| configuration) you can be easily tracked, though no one will
| bother, but captcha's will certainly not miss you.
| myvoiceismypass wrote:
| I mean this article is the spirit of hacker news to me.
| afarah1 wrote:
| FYI: NetGuard is an open source rootless firewall for vanilla
| Android which also allows per-app network access control, for
| those unable or unwilling to go with other OSs. Works by
| leveraging Android VPN to block instead of tunneling packets.
| yjftsjthsd-h wrote:
| Doesn't running as a VPN mean it's incompatible with running an
| actual VPN at the same time? That's a pretty big caveat.
| 867-5309 wrote:
| pretty sure by design only one vpn can be running at a time
| per OS
| OGEnthusiast wrote:
| What's the story for maps and POI search on GrapheneOS? I'm
| assuming using Google Maps is a non-starter since that defeats
| the whole point of all these privacy protections in the first
| place.
| mikeyouse wrote:
| Yeah I think most people use Organic Maps or Magic Earth (with
| the latter being closed and not as privacy-respecting as the
| former).
| nextos wrote:
| OSMAnd and others can do offline maps and POI search if you
| want.
|
| You could also run Google Maps web through Tor if needed. Tor
| is easy to use on Android.
| miroljub wrote:
| Take a look at CoMaps. It's fully open source with open
| governance model.
|
| It reached the level of being usable for general population and
| it improves rapidly due to gained momentum.
| getpokedagain wrote:
| I use organic maps. I also have a seperate user profile that
| can not run in the background that has Google maps installed
| and use that sparingly. I've used it once in the last 6 months.
| nyx wrote:
| Agree that "control" is a much better framing, since it doesn't
| suggest a need for secrecy and therefore
| embarrassing/unacceptable/untoward behavior that needs to stay
| behind drawn window blinds. I'm also fond of "agency" and
| "digital self-sovereignty" as alternatives.
|
| But fine, I'll be the one to say it: Cloudflare isn't one of the
| good guys here and as an entity it shouldn't be trusted. It
| doesn't matter how pure their stated motives appear to be now, or
| how unmarred their track record is so far. It's a corporation
| that has control over an ever-increasing share of internet
| infrastructure, and is susceptible to the same risks as any other
| tech monopolist basket that we all decide to put our eggs in.
| Maybe more risky than the others, given how deep in the stack its
| influence is buried.
|
| What happens when a government forces it to NXDOMAIN porn or put
| nuisance captchas in front of dissident blogs? Is there some
| reason people think this one is different?
| ccakes wrote:
| > Cloudflare isn't one of the good guys here
|
| Came here to say the same thing, post was interesting until I
| got to that point.
|
| > nuisance captchas
|
| Try using the internet outside of the western world and major
| hubs. Cloudflare make it so painful with captchas and browser
| integrity checks
| arionmiles wrote:
| As much as I'd love to daily drive an OS like GrapheneOS, the
| risk of running into apps that use Google Integrity API thereby
| making it impossible to run those apps on Graphene is too much of
| an inconvenience.
|
| I took a look at this curated list of bank apps[1] supported on
| Graphene OS and I'm glad that a large majority of them work on
| Graphene. However, just my luck that one of the banks I use on
| this list isn't supported.
|
| In my country, the state is enforcing a lot of essential
| workflows to be digital-first (and in extreme cases digital-
| exclusive) and I dread to think needing these services at a
| critical moment and the choice of my OS making it impossible for
| me. This is more of a commentary on my government's choices but
| it's a reality for me.
|
| In any case, I don't think it's practical to go cold turkey and
| switch to a privacy focused phone without testing waters first to
| see which of your of workflows break and then reason about the
| tradeoffs/workarounds.
|
| I do admire folks who use GrapheneOS as a daily driver, I'd like
| to chat them up if I find them in the wild.
|
| https://privsec.dev/posts/android/banking-applications-compa...
| delichon wrote:
| I worried about that too, but jumped in and it hasn't been an
| issue at all in two years. Including three bank apps. And it's
| usually so easy to reset to vanilla Android if you need to that
| it shouldn't be your moat.
| zackify wrote:
| Same. No issues on any apps for me.
| dangus wrote:
| Also, there are almost always alternatives, like the mobile
| website.
|
| Things like Apple/Google Wallet aren't significantly superior
| to a contactless credit/debit card.
|
| About the only bank thing I can think of that actually
| requires an app is check deposit, which is super rare.
| bitwize wrote:
| I've seen a couple of apps try to use Play Integrity, get
| blocked by GrapheneOS, and keep on running. Maybe I'm being
| locked out of something, but it's not something I use anyway.
|
| Note that I don't use banking or government apps. If I bank
| online it's via the web.
| sfRattan wrote:
| It does seem like a lot of apps continue to function on
| GrapheneOS after the "Play Integrity" check fails (or at
| least after Graphene notifies the user that the Play
| Integrity API has been called). I suspect either:
|
| A) These apps have implemented only the check so far, and
| will eventually refuse to run or limit functionality _at some
| point in the future_.
|
| B) These apps have noted the failure and certain
| functionality, especially communicating with servers to load
| "protected" content, will fail _even if the app otherwise
| continues to run_.
| kgwxd wrote:
| Is the app the only way to access what you need? I've never
| once install the app of any bank I've ever used (10ish) and
| never found myself wishing I had.
| jazzyjackson wrote:
| Same, mostly, one bank I keep an account at to support Zelle
| payments which they only offer through their app
| ignoramous wrote:
| > _As much as I 'd love to daily drive an OS like GrapheneOS_
|
| The Play Integrity shenanigans is mostly on app developers.
|
| That said, good thing GrapheneOS will launch its own Android
| phone: https://discuss.grapheneos.org/d/27687-new-manufacturer-
| theo... / https://piunikaweb.com/2025/10/13/grapheneos-ending-
| pixel-ex... / https://www.androidauthority.com/grapheneos-
| phone-wait-or-bu...
|
| Provided GrapheneOS is cleared by Google to launch it as an
| "Android" device. Given the kind of changes GrapheneOS packs,
| it may or may not meet Android's mandatory CCD (compatibility)
| requirements.
| fuzzzerd wrote:
| > The Play Integrity shenanigans is mostly on app developers.
|
| I completely agree, but as a user I'm the victim of the
| developers choice.
| closuregarden wrote:
| I run GrapheneOS as a daily driver and slowly removed all
| proprietary software from my device by looking for FOSS
| alternatives on F-Droid. Luckily, I'm able to access banking
| and government in a web browser on a dedicated profile.
|
| I do have a second Android device with a stock ROM that I keep
| turned off in a drawer in case I ever need to use an app that
| requires Play Integrity in an emergency.
| fylo wrote:
| I believe there is some support for the API although its not
| perfect.
| iamnothere wrote:
| > In my country, the state is enforcing a lot of essential
| workflows to be digital-first (and in extreme cases digital-
| exclusive) and I dread to think needing these services at a
| crticial moment and the choice of my OS making it impossible
| for me. This is more of a commentary on my government's choices
| but it's a reality for me.
|
| If my country did this I would get a cheap used device for this
| purpose and keep it powered off. I refuse to carry a pocket spy
| for the sake of convenience. I find that it's rarely an issue.
| jstanley wrote:
| As someone who daily-drives GrapheneOS, there isn't a single
| app that I want to use that is broken. I don't see any reason
| to use regular Android.
| Lapsa wrote:
| reminder - there's tech out there capable of reading your mind
| remotely and non-invasively
| netule wrote:
| Care to elaborate?
| navigate8310 wrote:
| The only thorn in the opine is Cloudflare. Everything looks
| reasonable but CF. I get that DNS is free, it is OP's employer
| and registry being offered sans margin but it doesn't make up for
| the fact that CF is on its way to become the biggest gatekeeper
| and strangle the freenet if it wishes to do so.
| OGEnthusiast wrote:
| Them being employed by Cloudflare means you should take the
| article with a grain of salt IMO.
| 65 wrote:
| This reminds me of the old meme:
|
| > Tech enthusiasts: My entire house is smart.
|
| > Tech workers: The only piece of technology in my house is a
| printer and I keep a gun next to it so I can shoot it if it makes
| a noise I don't recognize.
| barishnamazov wrote:
| One of my computer science professors from MIT has installed a
| smart home. I was over for a dinner and he told me a story
| about how he hit a third-party API rate limit on opening his
| garage door. Apparently, these things aren't self-hosted for
| the most part.
| ignoramous wrote:
| > _Domain: I switched to Cloudflare Registrar recently because
| they offered a lower price ... I don 't think Cloudflare really
| cares to make money on domain registration._
|
| Well, they don't today.
|
| Speaking of "control", it is bad form to keep both the
| nameservers and registrar with the same company (think takedown
| requests / account lockout / etc).
| 50208 wrote:
| The ad blocker is uBlock Origin ... the blog misstates it as
| uOrigin.
| zikduruqe wrote:
| Finally. Someone in the wild that runs passwordstore.org
|
| I thought there was only a couple of us.
| barishnamazov wrote:
| > "I don't need to care about privacy because I have nothing to
| hide." is an argument that I have heard countless times. I found
| this argument difficult to counter in the past, yet deep-down I
| knew the reasoning was flawed.
|
| This one is pretty easy to counter. Just ask the person to hand
| you their phone and go through their messages and photos. There's
| no one that wouldn't feel restless about it.
| zikduruqe wrote:
| I usually ask if they poop with the door closed. We all know
| what you are doing in there, and we do the same thing. No need
| to hide.
|
| Or, why do you get your mail in an envelope? I can see that it
| is your financial statements.
|
| Why do you have curtains on your home? I can go to Zillow and
| see the interior of your house from years ago.
| barishnamazov wrote:
| I think the better argument is (of course, a wrong one), "I
| trust that big companies won't share my stuff publicly".
| ismailmaj wrote:
| My next low hanging fruit is certainly to make my LLM usage
| local, my queries contain much more sensitive information than
| what is mentioned by this post.
|
| In the past I dropped off privacy when it was too inconvenient.
| For example I dropped protonmail because of bad search, left
| Linux desktop for Windows due to missing software, etc, I still
| haven't found the sweet spot for LLMs yet.
|
| For the rest, I'm currently running the full macOS, iOS, safari,
| Apple passwords and I'm decently happy with this middle ground.
| omnifischer wrote:
| For you
|
| - WhatsApp is an exception
|
| For others
|
| - Google is an exception
| newuser999999 wrote:
| > I use Cloudflare's DNS because I trust them more than other
| companies; purely based on their business and how their
| incentives align
|
| The author fails to mention that they are currently working at
| Cloudflare, I think that should be made clear otherwise I see it
| as misleading to the reader, like so many pointed it out,
| Cloudflare is just a corporation like any other corporation out
| there...
| beached_whale wrote:
| At least of now, they do when around when they talk about DNS
| motohagiography wrote:
| the conversation about what a privacy enhanced way of relating to
| tech is hasn't really matured much.
|
| on one hand its being relative to a list of specific threat
| actors you avoid. on the other, its maintaining a role with
| leverage vs your devices and services.
|
| privacy doesnt catch on as product because you have to navigate
| an inferior relationship to those threat actors first, and nobody
| aspires to that unless they already have a kind of alt cyberpunk
| underdog mentality and attitude.
|
| the non-punk or normal, leveraged position is like a business or
| first class lounge for tech. calm, negotiable, amenable, hidden
| and exclusive power, craft, affiliation and signalling.
|
| most privacy tech and apps are still in the mall ninja cyberpunk
| mentality, with some slightly self important NGO/public sector
| affilation signalling with Signal. The aesthetics of privacy need
| to evolve to drive more meaningful tech imo.
| nalekberov wrote:
| > I use Cloudflare's DNS because I trust them more than other
| companies; purely based on their business and how their
| incentives align
|
| It's a very naive way of thinking about some businesses. What did
| Cloudflare do to earn this trust? It's just another VC-backed
| company and 1.1.1.1 is a free service. So Cloudflare is going to
| lose money just to protect my privacy? I don't think so.
___________________________________________________________________
(page generated 2025-12-31 23:00 UTC)