Jul

It’s more private than something like Facebook Messenger or most other popular chat apps, that’s not it’s primary purpose and again, it does not purport to 100% privacy as it does to 100% security of messages. Anonymity is one way to achieve privacy, but it isn’t the only way. Unfortunately, it’s the only way if you want to obey laws in most countries, basically privacy by making it impossible for the company to give any information to police, courts, etc.

The OP though is primarily complaining about privacy and not security and that’s what I’m trying to differentiate. It’s never ever said it gives a 100% private experience but does purport to making messages content as secure as possible.

One thing to note, Signal has never purported to be “private”. It is “secure”. There’s a huge difference. Everyone has to find a balance between privacy and usability. Not having phone ID means no way to reduce the chance a user is bot as well as if you don’t register a personal name or phone number or anything else traceable, it makes it difficult for users to find eachother. And as for tracking the source and destination of messages, again if those are random destination routing IDs for a particular conversation, it makes it difficult to route to multiple devices. And if you don’t include source identifiers then there’s no way to block a spammer or other hostile user or provide delivery receipts to the sender. If you eliminate the storage of messages on the centralized server entirely and have it just be for routing, then if a device is offline at the moment a message is composed, it can’t be sent. These are just some examples of privacy vs usability. I won’t go into real-time video and audio as they are even more complex.

What signal is, is a system that does not store the keys for the messages themselves, thus as long as all user’s devices are secure, the messages are secure. This it does very well.

If you want a private messaging system, there are many options out there, but Signal needs to be usable for the masses of technically illiterate as well as secure. These are more for things like journalist who need privacy for whistleblowers. In that case the lack of usability is a reasonable tradeoff.

Of course I’m oversimplifying some things, but the basic idea is that Signal is not a private messaging app, it is a secure messaging app.

Biggest issue with LLM “AI” that most people like to ignore is that all current models are created with extremely unethically practices like using unauthorized data, pollution, causing people to go without power for heat/cooling/food refrigeration/etc. due to power demands, etc. Regardless of how ethically/responsibly you might use the technology, the models are not ethical to use. Sure most software has a lot of ethics issues, but LLM model generation is extreme.

I did not, but I also didn’t trust any info in the OP, but used all the links to Netherlands based sites. I do know some Dutch, so I was more saying I don’t have time or energy to translate and summarize those linked articles either.

Also, I just realized there were 2 links in the OP. I was digging more into the grapheneos.social link and some of the articles linked there and then down the rabbit hole from there.

And I also now realized my reply might have sounded dismissive, I definitely didn’t intend it that way, but it was early morning when I wrote it and it’s a busy one, so I seriously only meant that to be literal and to say I couldn’t help too much with digging, but everything I read originated from that OP and drilling down into it. Also, my brain tends to ignore the stuff that sounds like trolling or disinformation by default since I just assume everything on the internet is that these days.

There are no “trustworthy” sites for me, so while there was definitely some exaggeration and leading comments in there, I wasn’t really commenting on that, only on the facts of how the Dutch government is seemingly purposely linking all GrapheneOS to this fork, then implying that the fork was meant for pedos, etc., and then further implying that all use of GrapheneOS is for pedos, etc., rather than ordinary privacy.

Most governments have been doing this a lot lately of implying that trying to keep your info private implies you “have something to hide” and then giving some small extreme examples of when that was true and implying everyone who wants privacy is like those extreme examples. There will always be criminals trying to hide things, but that’s not an excuse to go after the ability to maintain privacy.

But yes, always verify, and sorry for the initial abrupt comment and this info-dump comment. It’s just a crazy day and I don’t have time to be a better writer…it’s not really my thing. LOL

It’s in the OP. I unfortunately don’t have time or energy to make a more detailed summary. You’ll have to read the OP.

They’re implying that all GrapheneOS is bad and then saying they’re raiding some people with GrapheneOS phones. How many people understand what GrapheneOS is much less what a fork of it is and how to differentiate the two. It’s designed to be confusing as is most propaganda.

Yes, but it should be noted that the disinformation campaign is originating from the government and confusing users to believe all GrapheneOS is bad and being targeted. Agree that the title of the post is misleading, but it’s probably at least in part due to the governmental misinformation.

Pop is download only (and optionally delete on server when downloaded), IMAP is sync so read states, moves, deletes, etc., will sync to the server and between all clients.

But both exist still, just most email providers want you to leave your email on their servers so they can charge you for storage, scan it for advertising, etc., and most people want the state to sync across devices, so a lot of places just don’t implement it anymore and just allow either web-only or IMAP-only (usually paid since they don’t get to show you ads).

And yes you can set up a local software to download email from another server offering POP or IMAP and then either use a client application or self hosted web application to view them. This is not too common so it might be harder to find instructions, but it’s doable.

Which part are you concerned with. The biggest issue with email servers is trust. Many companies will refuse to connect to your SMTP server to send you emails or reject your emails your SMTP server is sending to them if you aren’t on a whitelist or if your IP address has been used for spamming in the past and it’s on a black list. The easiest way to get around this is to subscribe to an SMTP proxy service.

The other issue you may find will happen no matter if you selfhost or not. When using a custom domain, some servers have whitelists of domains in addition to IP addresses and if you aren’t on it they will silently reject emails you send or that they were supposed to send to you. I have a couple of places (health care and financial companies mostly) who do this, so I have to use gmail, which ironically means the email is less secure, especially with Google’s recent changes in policy about reading your emails.

Even used responsibly, the fact that LLM “AI” is trained extremely unethically means that any model that isn’t a custom, ethically trained LLM is very unethical to use. I know ethics aren’t popular these days, and I say this as someone who ran a nonprofit for ethical software development before Google helped make it quite so clear that being “Evil” won’t cost a company any money anymore.

I have all of my email clients set to not load internet content. Probably why one of my banks, Navy Federal, keeps saying my email address is invalid despite the fact I get their emails.

OK I see why you call yourself TrollAccount, guess I should have take a hint and not engaged. All of this is so off topic from why using a VPN is not going to be secure on an insecure device or one that the manufacturer can get the keys from the device directly or from a backup of those keys loaded on the Apple or google servers.

I guess when you say backdoor you’re implying something nefarious to capture data in motion on the internet. There’s no need to backdoor the encryption of data in motion if you have access to all data at rest on both device and server side for a majority of users. Plus the fact that their services can directly interact with other apps, even commercial apps have some limits. Then combine that with the data they do capture mentioned in this and many other research articles and there’s a lot they can access and compile about you that GrapheneOS users (with default settings) no one can.

From the top result of searching online, but it’s just one of many you can find easily enough: https://pwn-all.com/blog/2026/07/28/iphone-telemetry-in-2026-what-apple-knows-about-you.html

And that doesn’t cover the data that gets processed and stored by servers rather than on device. Just like Google and most others, Apple holds all the encryption keys for the data at rest for “convenience”. And this includes app backup data which would include encryption keys for any true end-tp-end encrypted services if you choose to backup that data to your account. Not going to speculate on whether or not they regularly use or sell that data, but they definitely give it to any government agencies or copyright enforcement agencies that properly request it.

Definitely no surprises there except that they even bothered to add that plastic camera plateau and move the flash a tiny bit. Wouldn’t have been surprised if they were just overstock or refurbished phones that were just painted. I bet they spent an extra $.01 per phone to have a Chinese factory make that change.

My issue has been places that have made it hard to get a physical card, like transit cards can be a pain to get to an office during the hours they’re open and wait in line forever. You either have to pay cash or use Google Wallet/Apple Pay but credit/debit cards aren’t supported. It seems like it’s becoming less common, thank goodness. But still run into it here and there. I’m glad both Seattle and San Francisco transit systems now all accept credit/debit cards, though I don’t really trust the security of those transactions as much, so I still kept my transit cards. Also, though, it makes a big difference that at least those two systems will just wave you on in case the system or your card is not working properly. Some cities the drivers still have to enforce and will turn you away if something technical goes wrong and you don’t have cash.

Definitely agree on that part, if only the tools themselves weren’t so unethically created and a continual heavy drain on so many aspects of society I might consider using them for small, tedious tasks outside of work where I’m forced to.

Also, they don’t do much to aid my work and actively slow me down quite often since I don’t think in words, so I have to translate my logic into a conversational essay for the AI to understand and then debug code someone else wrote. It’s so much faster for me to translate my logic into programming languages directly which follow logic, not conversational norms. I see how it’s useful for people who can’t think in logical steps, though.

I think I tried that one when I was evaluating a few. I really like that Keycloak makes it really easy to configure custom workflows inside the web UI. I have custom user/group permissions flows and some other more complex logic for assigning specific permissions for specific apps built into workflows over the years. So I definitely don’t want to switch, but yeah, I’d like a read-only LDAP system that just generates LDAP responses using the existing user data basically like Authentik does. But Authentik was too unstable for my tastes when I tried it for a few months so I ended up back on Keycloak. It was down way more often than it was working and that was without any real major customizing. Plus it wasn’t well documented with examples for more complex setups.

I like Keycloak. It is very configurable, easy to set up, has lots of available examples of configs out there, and has been the most stable for me of any I’ve tried.

I only wish it had mock-LDAP so I could use it with things that don’t do OIDC like OpnSense. Keycloak can use an LDAP server as a source and sync with it, but I don’t want want to run a separate LDAP server for one or two systems. They’re too much trouble to setup and manage.

I mean, yeah, it was never designed to protect children. It’s designed to increase the ease of surveillance of adults. Otherwise, the corporations would have been fighting against it. They don’t make profit from protecting children, but they do from the excuse to get truly unique identifiers for people so they can track them and integrate and/or sell the more detailed data for each user.

Yeah never give your credentials to an LLM. If you must use one to help with finances, then download your statements and give it those.

But be warned that they aren’t great at giving sound financial advice since they aren’t trained 100% with sound financial advice alone, but the near entirety of the internet including satire, scammer advice such as MLMs, and just plain risky plans and they have not been taught what information falls into which of those categories, so it’s all about luck on which of that advice it will give you.