I’m self hosting both too. MollySocket’s docs are pretty clear that it never gets an encryption key for your account, so it can’t read your messages. It only gets/forwards alerts that something happened on your account AFAIK. So I’m not sure what data it has that’s worth encrypting.
For Signal/Molly, it’s less that the notification is encrypted as I understand it. It’s more the notification content is just “Hey! Stuff happened” for Signal. The app then reaches out directly to the Signal servers to see what’s new. So the message content is never sent via the push notification service (UnifiedPush or Google’s service).
I’ve got a few old PCI cards around somewhere. I should pull one of them out and give them a try at this.
That would require a lot of data privacy concerns to be addressed. Even if it’s an explicit opt-in. The current method uses sample text which can’t include PII. Using user supplied text would almost guarantee they’d get names and other PII in their data set.
I also imagine it’s harder to train the model when you don’t know exactly what the user was trying to type. I.e. Was the swipe detection wrong, or did the user delete the word because they changed their mind on what to write?
The issue isn’t a big deal for the average user. The vulnerability required them to first get your username and password, physically steal your Yubikey, spend half a day using $10-15k worth of electronics equipment to repeatedly authenticate over and over, they then could potentially make a clone of the key.
When I migrated emails last time, I setup my old email to automatically forward to the new email. Then on my new email, I setup an automatic label for any email that was addressed to the old address. Every week or two I’d review what was sent to it and either update the email address used or unsubscribe. Eventually it got to a level where I wasn’t getting much at the old email anymore and finally deleted it.
I haven’t played it properly either. But there’s a community mod called Deus Ex Revision (It’s also on Steam). Which improves some of the graphics, and looks to include a bunch of QoL features.
Bridge doesn’t support the calendar yet from what I’ve heard.
It’s not that it’s closed, it’s more that none of the exiting email protocols support a server which can’t read your email (as it’s all encrypted). They do offer Proton Bridge which you can run locally which will handle all the decryption and local mail clients can talk to that as the would any other mail server.
I don’t know off hand if it supports calendar syncing though.
I’d say the main benefit Futo has over Heliboard is that it has native swype typing with its own model (and also own voice typing model).
Still a bit light on customisation (certainly compared to Heliboard), but a nice first release certainly.
It’s not about it being locked. It’s being able to re-lock it after unlocking. You can unlock it, flash something like GrapheneOS on to it and then re-lock it. If it’s left unlocked, then anyone with a few minutes access to your phone could flash anything over the top allowing them to bypass the standard protections, install any app as at the system level.
I’ve tried a few of them now and have settled on Eternity.
FYI, last week someone saw that Signal merged in code for username (no phone number) support. So it might not be long until you see a beta release which allows you to sign up without a phone number.
Yeah, I’ve always expected they reserve it for people mass buying games from other regions. Or at least some legal defence if someone complains about people playing games that aren’t allowed in their region.
It’s certainly against one of Valve’s rules to use a VPN to access Steam. I’ve never heard of anyone getting banned for it though.
That’s not entirely true. It’s only very recently that browsers have started using a new system called Encrypted Client Hello which hides the domain of the request. Prior to this all requests needed too have the Host field unencrypted so the receiving server knows which certified to respond with. I imagine there’s still quite a few servers which don’t support the new setup still.
In that case Proton wouldn’t be providing the data, the user would be. Proton can’t provide what they don’t have.
That doesn’t hold up against the publicly available source code for their applications, white papers on their security and encryption, and multiple independent security reviews. And again, they are legally required to ignore US court orders. Only a Swiss court order can compel them to provide user information.
Got a source for that? Proton isn’t able to access to any user emails. I believe Swiss law also makes it illegal for them to provide user information without a (Swiss) court order.
The only case I’ve heard of that was similar was when the Swiss court ordered them to provide all the info they had on a user. This was the last IP address they logged on from and a recovery email the user had entered. The recovery email is an optional thing the user had set up on their account. They also used this same email address to sign up for a Twitter account. They were able to get enough data from Twitter to identify the person.
The UnifiedPush server is intended to be a single source your phone can keep a persistent connection open to, rather than needing a connection per service/app (this is how Google’s Firebase notifications work too).
As Signal doesn’t support UnifiedPush, MollySocket keeps a permanent connection open to Signal’s servers to listen for new activity and forward them to your UnifiedPush server. This saves your phone keeping a permanent connection open to Signal’s servers and draining your mobile battery more.