It’s a decent approach but incomplete. Couple problems:
- Lemmy would not host youtube videos. YT transcripts could (and should) be part of the post, but then there is the same problem as the next bullet:
- w.r.t text content, some people (very few people) indeed copy the content. It’s failing because people are lazy. Too lazy to check whether the link is in a walled garden; too lazy to warn people of the walled garden; also too lazy to copy the text. Sometimes it’s more naivety than lazy, but same problem: you are relying on the masses to make individual decisions that are wise, inclusive, and higher effort.
A good system is designed with the assumption that users are lazy. As such, Lemmy is poorly designed.
1 lazy author can inconvenience thousands of readers. Lammy’s design fails to address that.
Down-voting every youtube link is indeed the only individual action that can be taken in the current system. It could theoretically lead to a YT link being folded or sunk lower. Tricky though because people should know why their YT links get down-voted. Ideally you would be able to tell them in a response. But I think I know how that would go: people with digital inclusion principles have actually become a diluted small minority in the fedi. A flood of lemmy.world folks who would follow the crowd off a cliff would down-vote your reply and up-vote the YT link in solidarity of their favorite walled gardens.
You could DM the reason for down-voting. But then the problem does not get the exposure it needs.
The fedi has evolved like Burning Man. The movement was true to its founding principles early on but as the crowd grew over the years it became enshittified faster than a digital rights subculture could take hold.
BTW, I should mention that sh.itjust.works is also a centralised Cloudflare node.
My point still stands.
Of course it doesn’t. Your point doesn’t even grasp the problem. You think the problem is that fedi users have (or have not) entitlement to content. It’s a red herring. You cannot begin to solve a problem you do not understand. It does not matter who is “entitled” to the content. The content is exclusive; locked inside a walled-garden with a gatekeeper. The problem is that exclusive access content is being linked on an open content platform and shoved in the face of readers who do not have access to the closed content.
The moment you are using someone else’s platform
Again, you still fail to grasp the problem. Using someone else’s platform is not a premise. You can either be on someone else’s node or you can be on your own self-hosted node. Either way, exclusive links are in the reader’s face.
How can you get so many things wrong.. then you claim using one platform inherently revokes rights outside that platform -- of course not. Irrelevant regardless, but rights granted on one platform do not diminish rights on another.
you loose the rights to the content outside of that platform.
It’s not about “rights”. That’s a legal matter. It’s about digital inclusion (a technical matter). People don’t want to see links that exclude them. It’s just pollution.
To reach the particular law office which has become a specialist in this particular case, yes you are trapped because they use MS Outlook. There is no way to exchange email with them without involving MS.
Victims can use any lawyer, but any other lawyer will need to research the case (at the victim’s cost).
better than what? I’m not understanding your comparison here.
You’ve misunderstood the problem. It’s not a fix to access content that’s needed. The question is how to fix the pollution: exclusive walled-garden links appearing outside of the walled garden (where not everyone has access or is part of the special club of Google/Facebook/Cloudflare patrons). How did you misunderstand when I mentioned a toggle? And the title... how could I make the title more clear?
Links to exclusive walled-gardens pollute fedi nodes without restraint. What’s the fix?
Discuss. (But plz, it’s only interesting to hear from folks who have some healthy degree of contempt for exclusive corporate walled-gardens and the technofeudal system the fedi is designed to escape.)
And note that links can come into existence that are openly universally accessible and then later become part of a walled-garden... and then later be open again. For example, youtube. And a website can become jailed in Cloudflare but then be open again at the flip of a switch. So a good solution would be a toggle of sorts.
Google is blocking Tor and most (if not all Invidious instances) from reaching Youtube - how should the fedi respond to this DoS?
When Google sabotages network neutrality by blocking Tor and Invidious instances, is it wise for the fedi to facilitate the sharing of #Youtube links?
Fedi instance operators would probably not tolerate links into Facebook’s walled-garden if people were to start polluting an otherwise open community with them. So Youtube links should probably be treated with contempt during periods where Google’s DoS attack is underway.
But at some point to interact with any kind of large company .. You could also consider not interacting with large companies at all
Actually the large corps are more likely to hold the data in-house. Small companies cling to outsourcing. E.g. credit unions are the worst.. outsource every service they offer to the same giant suppliers. Everyone thinks only a small company has the data (and consequently that the small dataset does not appeal to cyber criminals) but it’s actually worse because they outsource jobs even as small as printing bank statements to the same few giants most other credit unions use. Then they do the same for bill pay with another company. It’s getting hard to find a credit union that does not put Cloudflare in the loop. So in the end a dozen or so big corps have your data and it’s not even disclosed in the privacy statement.
Of course it depends on the nature of the business. A large grocery chain is more likely to make sure your offline store purchase history reaches Amazon and Google than a mom & pop grocer who doesn’t even have a loyalty program.
Whether businesses get copies of information is usually included in a site’s privacy policy,
I have never seen a privacy policy that lists partners and recipients apart from Paypal, who lists the 600+ corps they share data with for some reason. Apart from bizarre exceptions privacy policies are always too vague to be useful. Even in the GDPR region. If you read them you can often find text that does not even make sense for their business because they just copied someone else’s sufficiently vague policy to use as a template.
If you really want to limit your information exposure, you either have to audit everyone you do business with this way (because most large companies do this) or hire someone (or a service) to do it.
The breach happened in a country where companies are not required to respond to audits. No company wants any avg joe’s business badly enough to answer questions about data practices. In the EU, sure, data controllers are obligated to disclose the list of parties they share with (on request, not automatically). And even then, some still refuse. Then you file an article 77 complaint with the DPA where it just sits for years with no enforcement action.
My approach is a combination of avoiding business entirely, or supplying fake info, or less sensitive info (mailing address instead of residential, mission-specific email, phone number that just goes to a v/m or fax). This is where the battle needs to be fought -- at data collection time. Countless banks needlessly demand residential address. That should be rejected by consumers. Data minimization is key.
In the case at hand, I’m leaning toward opting out of the class action lawsuit and suing them directly in small claims court. I can usually get better compensation that way.
data was exfiltrated from a corp I did not even know had my data; then they offer to have a privacy abuser (Cloudflare) MitM credit monitoring txns. WTF?
cross-posted from: https://links.hackliberty.org/post/2667522
> Apparently some company I do business with shared my data with another corp without me knowing, then that corp who I did not know had my data was breached. > > WTF? > > Then the breached corp who could not competently secure the data in the first place offers victims a gratis credit monitoring services (read: offers to let yet another dodgy corp also have people’s sensitive info thus creating yet another breach point). Then the service they hired as a “benefit” to victims outsources to another corp and breach point: Cloudflare. > > WTF? > > So to be clear, the biggest privacy abuser on the web is being used to MitM a sensitive channel between a breach victim and a credit monitoring service who uses a configuration that blocks tor (thus neglecting data minimization and forcing data breach victims to reveal even more sensitive info to two more corporate actors, one of whom has proven to be untrustworthy with private info). > > I am now waiting for someone to say “smile for the camera, you’ve been punk’d!”. > > (update) > Then the lawyers representing data breach victims want you to give them your e-mail address so they can put Microsoft Outlook in the loop. WTF? The shit show of incompetence has no limit.
data was exfiltrated from a corp I did not even know had my data; then they offer to have a privacy abuser (Cloudflare) MitM credit monitoring txns. WTF?
cross-posted from: https://links.hackliberty.org/post/2667522
> Apparently some company I do business with shared my data with another corp without me knowing, then that corp who I did not know had my data was breached. > > WTF? > > Then the breached corp who could not competently secure the data in the first place offers victims a gratis credit monitoring services (read: offers to let yet another dodgy corp also have people’s sensitive info thus creating yet another breach point). Then the service they hired as a “benefit” to victims outsources to another corp and breach point: Cloudflare. > > WTF? > > So to be clear, the biggest privacy abuser on the web is being used to MitM a sensitive channel between a breach victim and a credit monitoring service who uses a configuration that blocks tor (thus neglecting data minimization and forcing data breach victims to reveal even more sensitive info to two more corporate actors, one of whom has proven to be untrustworthy with private info). > > Cannot make this shit up. I am now waiting for someone to tell me it’s a prank.. “you’ve been punk’d!”. > > (update) > Then the lawyers representing data breach victims want you to give them your e-mail address so they can put Microsoft Outlook in the loop. WTF? The shit show of incompetence has no limit.
data was exfiltrated from a corp I did not even know had my data; then they offer to have a privacy abuser (Cloudflare) MitM credit monitoring txns. WTF?
Apparently some company I do business with shared my data with another corp without me knowing,
WTF?
then that corp who I did not know had my data was breached.
WTF?
Then the breached corp who could not competently secure the data in the first place offers victims gratis credit monitoring services (read: offers to let yet another dodgy corp also have people’s sensitive info thus creating yet another breach point). Then the service they hired as a “benefit” to victims outsources to another corp and breach point: Cloudflare.
WTF?
So to be clear, the biggest privacy abuser on the web is being used to MitM a sensitive channel between a breach victim and a credit monitoring service who uses a configuration that blocks tor (thus neglecting data minimization and forcing data breach victims to reveal even more sensitive info to two more corporate actors, one of whom has proven to be untrustworthy with private info).
I am now waiting for someone to say “smile for the camera, you’ve been punk’d!”.
(update) Then the lawyers representing data breach victims want you to give them your e-mail address so they can put Microsoft Outlook in the loop. WTF? The shit show of incompetence has no limit.
Exit nodes are temporary unless you deliberately pin them for a particular connection, which I have not done for the DNS servers. The problem manifests without exception for weeks now, so it could not be attributed to a bad exit node. The tor microdescriptor db tracks the perms of every node, so I don’t think it would create a circuit for disallowed traffic. There could be an inconsistency between the microdesc and reality, but it would have to be a replicated inconsistency for every connection attempted with torsocks and yet not replicated on any connection made using the torsocks alternative (which works).
Which torsocks version? Yours is probably newer than mine. It seems to be a problem with torsocks 2.3.0 and only with dig. And indeed there is nothing wrong at the network level because I was able to do an MX lookup over tor using a different method than torsocks. I'm also able to use other apps with torsocks, just not dig all of the sudden.
MX lookups over Tor no longer possible (edit: …with a particular tool chain)
To do an MX lookup over Tor, this command has worked for me for years:
$ torsocks dig @"$dns_server" -t mx -q "$email_domain" +noclass +nocomments +nostats +short +tcp +nosearch
In the past week or so it just hangs. My first thought was the DNS server I chose (8.8.8.8) started blocking tor. But in fact it does not matter what DNS server is queried. The whole Tor network is apparently blocking tor users from doing MX lookups.
Also notable that dig hangs forever. It does not timeout despite a default timeout interval of 5 seconds (according to the man page).
Dutch DPA imposes a fine of €290 million on Uber due to transfers of drivers’ data to the US
Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US.
The link is Cloudflare-free, popup-free and reachable to Tor users.
(edit) Some interesting factors--
from the article: > For a period of over 2 years, Uber transferred those data to Uber's headquarters in the US, without using transfer tools. Because of this, the protection of personal data was not sufficient. The Court of Justice of the EU invalidated the EU-US Privacy Shield in 2020.
Yes but strangely & sadly the US benefits from an adequacy decision, which IIRC happened after 2020. This means the US is officially construed as having privacy protections on par with Europe. As perverse as that sounds, no doubt Uber’s lawyers will argue that point.
> The Dutch DPA started the investigation on Uber after more than 170 French drivers complained to the French human rights interest group the Ligue des droits de l’Homme (LDH), which subsequently submitted a complaint to the French DPA.
Wow! I wonder what triggered so many drivers to consult a human rights group. I mean, consider that Uber users and drivers are all happy to run a closed-source Google-gated app.. this is not a demographic who cares about privacy. So what triggered 170 complaints? I wonder if the Dutch DPA would have taken any action had there not been 170 cross-border complainants.
The French DPA gives some interesting insight. Info to attempt to satisfy access requests were in English, not French, which breaks the accessibility rule. The French article gives more a feeling of not 170 proactive complaints, but maybe the human rights org complained on behalf of 170 drivers. I am quite curious from an activist point of view if 170 drivers proactively initiated a complaint.
The fourth breach is interesting: > by not explicitly mentioning the right to data portability in their privacy statement.
Is data portability even useful for Uber drivers in France? I’ve never used Uber (fuck Google), but I imagine drivers have feedback about how well they perform and maybe they want to port that data to an Uber competitor.. but there is no Uber competitor in France, is there? Is Lyft in France?
Youtube DL via Invidious onions killed off?
I normally grab a #youtube video via #invidious onion instances this way:
yt-dlp --proxy http://127.0.0.1:8118 -f 18 http://ng27owmagn5amdm7l5s3rsqxwscl5ynppnis5dqcasogkyxcfqn7psid.onion/watch?v="$videoID"
Now it leads to:
> ERROR: [youtube] $videoID: Sign in to confirm you’re not a bot. This helps protect our community. Learn more
There used to be a huge number of Invidious instances. Now the official list is down to like ½ dozen.
An email address you can distribute that is MS & Google dysfunctional
This email provider gives onion email addresses:
pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion
Take care when creating the username to pull down the domain list and choose the onion domain. That address you get can then be used to receive messages. Unlike other onion email providers, this is possibly the only provider who offers addresses with no clearnet variations. So if a recipient figures out the clearnet domain it apparently cannot be used to reach you. This forces Google and MS out of the loop.
It’s narrowly useful for some situations where you are forced to provide an email address against your will (which is increasingly a problem with European governments). Though of course there are situations where it will not work, such as if it’s a part of a procedure that requires confirmation codes.
Warning: be wary of the fact that this ESP’s clearnet site is on Cloudflare. Just don’t use the clearnet site and keep CF out of the loop.
Self hosting would mean I could control account creation and make many burner accounts. But there are issues with that:
- If there are several burner accounts then the admin would have to make it easy for others to create burner accounts or else it would be evident that all the burner accounts are just the admin’s, which does not solve the aggregation problem. It introduces complexities because the DNS provider and ISP would have the identity of the self-hoster. One could onion host but that greatly narrows the audience.
- It does not solve the problem for others. Everyone who has the same need would then be needlessly forced to independently solve all these same problems.
- I do not have high-speed unlimited internet, so I would have to spend more on subscription costs.
I think it complicates the problem and then each author has to deal with the same. If it’s solved at the fedi API level, then the existing infrastructure is ready to work.
(edit) I recall hearing about a fedi client application that operates in a serverless way. I don’t recall the name of it and know little about how it works, but it is claimed to not depend on account creation on a server and it somehow has some immunity to federation politics. Maybe that thing could work but I would have to find it again. It’s never talked about and I wonder why that is.. maybe it does not work as advertised.
Those do not obviate the use cases I have in mind. Secure drops are useful tools for specific whistle blowing scenarios. But they are not a one-size-fits-all tool.
I routinely use framadrop and then transmit the links to regulators or whoever I am targeting to act on a report. But what if the target audience is not a specific journalist or regulator but rather the entire general public? The general public does not have access to reports submitted to the Guardian’s dropbox or NYTimes’ dropbox. Those are exclusive channels of communication just for their own journalists. The report then only gets acted on or exposed if the story can compete with the sensationalisation level of other stories they are handling. If I’m exposing privacy abuses, the general public does not give a shit about privacy for the most part. So only highly scandelous privacy offenses can meet the profitable publication standards of Guardian and nytimes. The reports also cannot be so intense as to be on par with Wikileaks. There is a limited intensity range.
The fedi offers some unique reach to special interest groups like this one without the intensity range limitation.
NYtimes is also a paywall. So even if the story gets published it still ends up a place of reduced access.
They are great tools for some specific jobs but cannot wholly replace direct anonymous publication. Though I must admit I often overlook going to journalists. I should use those drop boxes more often.
(edit) from the guardian page:
Once you launch the Tor browser, copy and paste the URL xp44cagis447k3lpb4wwhcqukix6cgqokbuys24vmxmbzmaq2gjvc2yd.onion or theguardian.securedrop.tor.onion into the Tor address bar.
That theguardian.securedrop.tor.onion URL caught my attention. I did not know about onion names until now. Shame it’s only for secure drops.
Fedi design needs to evolve for privacy -- for anonymous posting
I have lots of whistles to blow. Things where if I expose them then the report itself will be instantly attributable to me by insiders who can correlate details. That’s often worth the risks if the corporate baddy who can ID the whistle blower is in a GDPR region (they have to keep it to themselves.. cannot doxx in the EU, Brazil, or California, IIUC).
But risk heightens when many such reports are attributable under the same handle. Defensive corps can learn more about their adversary (me) through reports against other shitty corps due to the aggregation under one handle.
So each report should really be under a unique one-time-use handle (or no handle at all). Lemmy nodes have made it increasingly painful to create burner accounts (CAPTCHA, interviews, fussy email domain criteria, waiting for approval followed by denial). It’s understandable that unpaid charitable admins need to resist abusers.
Couldn’t this be solved by allowing anonymous posts? The anonymous post would be untrusted and hidden from normal view. Something like Spamassassin could score it. If the score is favorable enough it could go to a moderation queue where a registered account (not just mods) could vote it up or down if the voting account has a certain reputation level, so that an anonymous msg could then possibly reach a stage of general publication.
It could even be someone up voting their own msg. E.g. if soloActivist is has established a history of civil conduct and thus has a reputation fit for voting, soloActivist could rightfully vote on their own anonymous posts that were submitted when logged-out. The (pseudo)anonymous posts would only be attributable to soloActivist by the admin (I think).
A spammer blasting their firehose of sewage could be mitigated by a tar pit -- one msg at a time policy, so you cannot submit an anonymous msg until SA finishes scoring the previous msg. SA could be artificially slowed down as volume increases.
As it stands, I just don’t report a lot of things because it’s not worth the effort that the current design imposes.
That story is focused on #CloudSTRIKE but the bigger more remarkable demon here is #CloudFLARE.
This story demonstrates Cloudflare acting as a proxy bully of their own customer, on behalf of CloudStrike by pushing a frivilous #DMCA take-down demand. CF took the spineless route as it sees CloudStrike as having more muscle than their customer. After CF joins the Goliath side of the David vs. Goliath battle, CF ignores Senk’s responses and keeps proxying threats.
Senk bounced from Cloudflare and went to a provider who has his back. #ArsTechnica publishes Cloudflare’s conduct. As embarrassment hits Cloudflare and David (Senk) starts winning against Goliath (CloudStrike), CF changes their tune. Suddenly they are on Senk’s side, saying “come back, we’ll protect you -- we promise we didn’t get your messages”. LOL. Senk should do a parody site for Cloudflare too.
Senk’s mistake: leaving CF. He should have waited until CF actually booted him. Then that would have more thoroughly exposed CF’s shitty actions. Senk gave CF an easy out.
Interesting to note how a human on the side of civil rights who advocates decentralisation was treated with hostility by Cloudflare. Yet CF is fine with sheltering actual criminals.
Customers should take several proactive steps to protect their personal information and reduce potential risks: Be Wary of Phishing Attempts
Customers should rethink their stupid ass decision to use AT&T in the first place since it has been known for over a decade that AT&T is the most privacy abusive of all US telecoms, most notably their role in project Fairview (archive for clearnet users and wikipedia).
AT&T customers don’t give a shit about privacy. But I do have some sympathy for all the non-AT&T people who communicated with AT&T pawns.
BTW, the OP’s link avoids reclaimthenet’s shitty popup if proxied through 12ft.io:
https://12ft.io/https://reclaimthenet.org/nearly-all-at
Not sure it matters since the text is in the OP anyway.. guess if someone wants to share it around.
Are there ATM fee shenanigans in France w.r.t non-EU cards or is my bank playing games with the FX rate?
EU-based ATMs tend to charge a fee of ~€4—6 on non-EU cards. I’m fine with that because my bank rebates those fees anyway. However something seems off with some French ATMs.
France has a reputation for having the highest banking fees in Europe and their ATMs seem consistent with that reputation. Some French ATMs charge €6 and that gets printed on the ATM receipt. As expected my bank sees the fee on their side in that case and they credit it back to me -- so no problem there. But then other ATMs in France do not print any fee on the receipt. Consequently my bank sees no fee on the transaction so they rebate nothing back to me. Are those ATMs reeaaally giving up the opportunity to charge a fee to non-EU cards? Certainly no Dutch ATMs ever pass up that opportunity. When calculating the xe.com rate of that day and comparing to the money drawn from my bank account, there is a discrepancy of ~$5.50 USD.
So it looks like the ATM is adding their fee into the euro amount. E.g. I pull out €400 & decline DCC, and the ATM prints a receipt showing €400 but then draws something like €405. In principle it should be evident from the bank statement. But my bank lacks transparency and omits from the statement the euro amount and also withholds the exchange rate they applied (which the contract says is the straight interbank rate with 0% markup).
I see two possible theories here:
- my bank’s so called fee-free FX rate is really ~1%; OR
- the French ATMs add the fee to the amount charged and hiding the fee. They do not benefit from it but could be sloppy programming. Maybe they think it does not matter because they are still charging whatever the customer agrees to anyway.
While I struggle to believe that 3 different French ATMs would pass up the chance to take a fee, I ran the numbers on a transaction that actually does transparently take a fee and result in a rebate. I still paid almost 1% more than the xe.com rate.
All fees must be disclosed on the ATM screen by law. But my memory is not so reliable.
Folks, FedEx has always been on the extreme right. Some basic facts:
- FedEx is an ALEC member (extreme right lobby and bill mill), largely as an anti-union measure
- FedEx founded by an ex military serviceman
- FedEx gives discounts for NRA membership (though I heard this was recently discontinued). NRA is obviously an extreme right org who also finances ALEC.
- During the NFL take-a-knee protest, FedEx is one of very few die-hard corps that refused to give in to the boycott. FedEx continued supporting the NFL against all the Black Lives Matter athletes taking knees and getting punished.
- FedEx ships shark fins, slave dolphins and hunting trophies. Does not give a shit about harm to animals (even when endangered) or environment.
I have been boycotting FedEx for over a decade. Certainly being pro-surveillance is fitting with their history and should not be a surprise to anyone who is aware of this background.
The only moral inconsistency is that FedEx has a reputation for not snooping on your packages and seems to be favored by people shipping contraband. But to find the consistency it’s just about the bottom line. They make no money by ratting out their customers who break the law. But installing a surveillance system on their trucks is probably yielding revenue for FedEx.
Sounds mostly reasonable.. but I don’t see the alternate citizenship helping, unless you mean to go as far as renouncing because all FATCA regions (~130+ countries) look at the birthplace, not nationality, and you can never get a new birthplace. It’s probably hard to find a non-FATCA region where you can trust the banks. But indeed.. getting your 4th amendment rights has come to extremes.
That makes some sense.
In my case I think I have credit that I’ve never actually used; and I think I’ve also put on their file that I am unemployed. So in principle consumers who either don’t care for the credit, or are happy to be in the highest risk category, they should not be harassed with this. I will just ignore it and see what happens.
In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops – to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway. So I’ve been boycotting PayPal ever since....
(cross-posting is broken on links.hackliberty.org, so the following is manually copied from the original post)
---
When your bank/CU/brokerage demands that you login to their portal to update KYC info soloActivist to [email protected] ·
In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops -- to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway.
So I’ve been boycotting PayPal ever since. Not worth it for to work hard to find out why they kept my account frozen and to work hard to twist their arm to so that I can give them my business.
Now an actual financial institution is trying something similar. They are not as hostile as PayPal was (they did not pre-emptively freeze my account until I dance for them), but they sent an email demanding that I login and update my employment information (even though it has not changed). Presumably they will eventually freeze my account if I do not dance for them to satisfy their spontaneous demand.
I just wonder how many FIs are pulling this shit. And what are people doing about it? Normally I would walk.. pull my money out and go elsewhere. But the FI that is pushing KYC harassment has a lot of power because they offer some features I need that I cannot get elsewhere, and I have some stocks through them, which makes it costly/non-trivial to bounce.
I feel like we should be keeping a public database on FIs who pull this shit, so new customers can be made aware of who to avoid.
When your bank/CU/brokerage demands that you login to their portal to update KYC info
In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops -- to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway.
So I’ve been boycotting PayPal ever since. Not worth it for to work hard to find out why they kept my account frozen and to work hard to twist their arm to so that I can give them my business.
Now an actual financial institution is trying something similar. They are not as hostile as PayPal was (they did not pre-emptively freeze my account until I dance for them), but they sent an email demanding that I login and update my employment information (even though it has not changed). Presumably they will eventually freeze my account if I do not dance for them to satisfy their spontaneous demand.
I just wonder how many FIs are pulling this shit. And what are people doing about it? Normally I would walk.. pull my money out and go elsewhere. But the FI that is pushing KYC harassment has a lot of power because they offer some features I need that I cannot get elsewhere, and I have some stocks through them, which makes it costly/non-trivial to bounce.
I feel like we should be keeping a public database on FIs who pull this shit, so new customers can be made aware of who to avoid.
I doubt it. It will probably show the clearnet address. I just now logged in via the onion, so this reply will be a test.
Replacement link to a privacy-respecting host:
This article seems to suggest the KYC rules only apply to foreign customers:
https://www.bankinfosecurity.com/commerce-proposes-rule-to-fight-foreign-cloud-cyber-threats-a-24219
but then you have to wonder how they will know you’re domestic without a bit of KYC on Americans as well.
BTW, a good way to find privacy-respecting links is to search using this service:
https://ombrelo.im5wixghmfmt7gf7wb4xrgdm6byx2gj26zn47da6nwo7xvybgxnqryid.onion/
That search tool will not return Cloudflare MitMd links.
(US) KYC rules coming to an internet service provider near you
The U.S. Department of Commerce (“Commerce”), Bureau of Industry and Security (“BIS”), recently issued a proposed rule aimed at preventing foreign actors from utilizing U.S.
Pushover consumers accepted “Know Your Customer” abuses to their 4th Amendment rights in the banking sector, so why wouldn’t the same work when it comes to internet service? I have no doubt that the privacy apathetic masses will accept this in a heartbeat.
what happened here? Looks like you tried summons an autotldr bot, but it did not do its job, correct? That’s kind of a shame. Indeed theregister.com is an exclusive website and direct links to it should not be shared. A privacy-respecting infrastructure would block such links or replace them with archive.org variants.
I’m not on a good enough connection to watch videos but when I read “How the Religion called Atheism…” I know it cannot be coming from any sort of credible source. Atheism is absence of religion, not a religion in itself. It includes both agnostics and gnostics (both those who are convinced there is no god and those who are unconvinced either way). So I don’t suppose it’s worth it to note the URL and try to fetch the video when I have a good connection.
When banking via phone app, this is the compromise
The bank requires customers who use their phone app to:
- buy a new recent smartphone, repeatedly (because the bank’s app detects when it is running on an Android emulator and denies service)
- subscribe to mobile phone service (which also costs money and also in some regions requires supplying national ID to the mobile carrier to copy for their records which customers then must trust them to secure)
- share their mobile phone number with a power abusing surveillance capitalist who promotes the oil industry (Google / Totaal)
- create a Google account and agree to their terms (which includes not sharing software that was fetched from the Playstore jail)
- share their IMEI# with Google
- share all their app versions with Google, thus keeping Google informed of known vulns for which they are vulnerable
- share with Google where they bank and trust Google not to sell that info to debt collectors
- install proprietary non-free software and trust the security of non-reviewable code
- share the mobile phone number with the bank
Why are so many people okay with this?
Doctor wanted to send me test results via e-mail (Microsoft!)
cross-posted from: https://links.hackliberty.org/post/1028406
> The state of medical privacy has become quite appalling lately. I started using a young doctor in a new office and they are gung ho on modern tech. That’s fine to some extent but they want to send me invoices and all correspondence via e-mail. No PGP of course. I did an MX lookup on their vanity email address & it resolves to an MS Outlook server. > > I asked them for my test results. They offered to email them. > > My response: I do not want sensitive medical info coming by e-mail via Microsoft’s servers. I did not give you a copy of my email address for that reason. It needs to be snail-mailed to me. > > Perhaps of greater concern is that the receptionist acted like I am making a unusual request, and that they do not mail things. Apparently I am the only patient who has a problem with sensitive medical info going to Microsoft. So the receptionist is investigating whether she can get approval to mail me my results by post. > > I wonder if someone in that clinic will have to run out and buy stamps because I have a problem with Microsoft.
Doctor wanted to send me test results via e-mail (Microsoft!)
The state of medical privacy has become quite appalling lately. I started using a young doctor in a new office and they are gung ho on modern tech. That’s fine to some extent but they want to send me invoices and all correspondence via e-mail. No PGP of course. I did an MX lookup on their vanity email address & it resolves to an MS Outlook server.
I asked them for my test results. They offered to email them.
My response: I do not want sensitive medical info coming by e-mail via Microsoft’s servers. I did not give you a copy of my email address for that reason. It needs to be snail-mailed to me.
Perhaps of greater concern is that the receptionist acted like I am making a unusual request, and that they do not mail things. Apparently I am the only patient who has a problem with sensitive medical info going to Microsoft. So the receptionist is investigating whether she can get approval to mail me my results by post.
I wonder if someone in that clinic will have to run out and buy stamps because I have a problem with Microsoft.
If boycotting Israel, include Microsoft in your boycott
Microsoft faces criticism for funding Israeli facial recognition company AnyVision, reportedly carrying out surveillance on Palestinians and working in Hong Kong and Russia.
cross-posted from: https://links.hackliberty.org/post/984895
> Microsoft finances #AnyVision to produce facial recognition technology that the Israeli military uses against the Palestinian people. > > So if you oppose Israel’s brutality then #Microsoft should be on your boycott list. > > If you are undecided, these stories might help with your decision: > > * snipers target a red-cross medic for execution (2018) → https://edition.cnn.com/2018/06/03/middleeast/razan-al-najjar-gaza-nurse-killed/index.html > * Hind Rajab (6 year old; 2024) → https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onion/world/2024/feb/10/im-so-scared-please-come-hind-rajab-six-found-dead-in-gaza-12-days-after-cry-for-help > > For Hind Rajab, my boycott is on until I die.
If boycotting Israel, include Microsoft in your boycott
Microsoft faces criticism for funding Israeli facial recognition company AnyVision, reportedly carrying out surveillance on Palestinians and working in Hong Kong and Russia.
Microsoft finances #AnyVision to produce facial recognition technology that the Israeli military uses against the Palestinian people.
So if you oppose Israel’s brutality then #Microsoft should be on your boycott list.
If you are undecided, these stories might help with your decision:
- snipers target a red-cross medic for execution (2018) → https://edition.cnn.com/2018/06/03/middleeast/razan-al-najjar-gaza-nurse-killed/index.html
- Hind Rajab (6 year old; 2024) → https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onion/world/2024/feb/10/im-so-scared-please-come-hind-rajab-six-found-dead-in-gaza-12-days-after-cry-for-help
For Hind Rajab and her mother, my boycott is on until I die.
When European airlines share my itinerary with my bank, is it a GDPR violation? Any travelers switching to cash?
cross-posted from: https://links.hackliberty.org/post/125466
> My credit card issuer apparently never gets to know what I purchased at stores, cafes, & restaurants -- and rightfully so. The statement just shows the shop name, location, and amount. > > Exceptionally, if I purchase airfare the bank statement reveals disclosures: > * airline who sold the ticket > * carrier > * passenger name > * ticket number > * city pairs > > So that’s a disturbing over-share. In some cases the airline is a European flag carrier, so IIUC the GDPR applies, correct? Doesn’t this violate the data minimization principle? > > Airlines no longer accept cash, which is also quite disturbing (and illegal in jurisdictions where legal tender must be accepted when presented for PoS transactions). > > Has anyone switched to using a travel agent just to be able to pay cash for airfare? > > UPDATE > > A relatively convincing theory has been suggested in this other cross-posted community: > > https://links.hackliberty.org/comment/414338 > > Apparently it’s because credit cards offer travel insurance & airlines have incentive to have another insurer involved. Would be useful if this were documented somewhere in a less refutable form.