And so they double down… These regulations won’t stop until the open internet has been reduced to toddler content only, and all users, regardless of age, being required to compromise on their psuedonymity; in order to get some use out of it. Because surely an iPad kid playing a PEGI 18 game (“Call Of Duty”) should be able to expect an age-appropriate experience…

Be subtle about it, free of judgement. Don’t lecture them on something they likely know already, and (semi)consciously ignore to maintain an unhealthy, yet comforting pattern. It’s rather about planting seeds, than doing the thinking for them: let them come to their own conclusions next time they use it.

It’s all about predatory dark patterns, that deliberately exploit human psychology; so gear them up to recognize these abusive mechanisms. Not in a direct way, but just by casual conversation about content on their timeline, with some observation woven into it, like: quite some advertisements, huh? What does that little text say? Oh, “sponsored content”. Do your friends still post things? Because I haven’t seen any on your timeline. Shouldn’t that be the entire purpose of this platform? They give you notifications about friends liking other’s posts now? That seems a little excessive.

My mom has been using the platform a lot less since I did, and she even has opened up to the concept of disabling Facebook push-notifications. The latter needing some more time, because she’s struggling with a fear of missing out. I once disabled push-notifications for news applications too without asking, so perhaps I should do the same for Facebook (Messenger being a different application anyways).

The main problem seems to be that users have, successfully, been conditioned into wanting anti-features. My mom actually clicks personalized advertisements, and I have no clue how to cure her from that; other than to joke about a particular shoe brand always being featured. I already substituted her ad-ridden weather app for a Firefox (with uBlock) shortcut, which she has really come to appreciate. So there’s progress to be made: it just requires the right approach, and a lot of patience; which is worthwhile for loved ones.

Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn’t Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).

But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator…

We’ve been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for “security”?

It seems perfectly in line, and I think this article draws all the right parallels.

For me it’s their ransomware-like business model of: attracting new users with free accounts, incentivizing them to migrate their Gmail inbox to Proton (Easy Switch), encrypting the content (“for security”), and then letting them find out that a paid feature (Bridge) is necessary to integrate the mailbox into a third-party client like Thunderbird (as a decryption layer in between); well, unless you want to manually export the mailbox using their Mail Export Tool. I’m not opposed to paying for a service (I also donate to Disroot), but I dropped them like a hot brick when I found out: thankfully not the hard way (I tested integration before migration).

I’m not going to waste more of my time on this “project”, because it screams AI (just like the linked video). It effectively appears like a GrapheneOS rip-off, with some pre-configured applications bundled. All for a modest $299 for just the software, or a full package for $999… Absolute leeches. And how does one even find a video like this? I doubt I could, even if I tried.

Or certificate providers are ordered to provide a false certificate; or in case of Europe (thanks to the GDPR), the “data protection officer” that larger services operating in the Union (including cloud- and hosting-services: hosting most of the modern internet), are forced to employ and provide with unrestricted access (supposedly “to monitor compliance”), may be ordered to do additional processing (including that for which their “employer” has no legal basis), whilst being gagged by “professional secrecy” (including towards this “employer”); and the NSA also has a program that seeks to weaken TLS standards (at least by pushing standards for post-quantum encryption (PQE) only, instead of AES + PQE).

On devices I use personally I haven’t encountered such examples for years, because the first thing I do is substitute first-party apps with FOSS alternatives. My mom does however, and her Samsung’s camera app for example, won’t function unless you give it permission to scan for nearby devices; among others, which I can’t fully remember. So the stock Android experience seems similar to what you’re describing for iOS.

Last time I removed malware from my grandma’s smartphone, I made sure to install Signal to it. Sometimes you just got to demonstrate to them how low impact a change is. Many elderly are frightened by the idea that their experience changes, on a device they depend on but hardly understand. So demonstrate, rather than trying to convince them of something they fail to understand. The worst that can happen is that they tell you to remove it again, but in case of my grandma, she comfortably uses Signal. Just make sure you send some example messages back and forth, so they understand how similar the workflow is.

I never give apps I distrust permission to my photos, I instead select the photos in my gallery app and share them with the app. And as a side note, many users have cloud backups enabled, whether intentionally or accidentally (having clicked “accept” once, instead of “ask me later”); so big-tech likely stores a copy of the actual pictures, and depending on how lackluster the defaults are regarding privacy, have full access to it.

If you leave them to choose between WhatsApp and Signal, they’ll pick what they already have and what they’re familiar with. I deleted WhatsApp after they introduced MetaAI, and told people close to me, that they could only message me using Signal going forward. Just make sure you support people that have difficulty installing and using the app. When removing malware from my grandma’s smartphone, I also made sure to install Signal, and she now comfortably contacts me through it for minor things. It’s not like you’re inconveniencing them much: it’s just an app installation and basic setup, while the workflow is nearly identical; especially if you allow them to find you through your phone number (which I have disabled).

I’m not familiar with UK legislation in particular, but considering approaches taken by other legislative bodies, their works effectively require online services to serve “age-appropriate experiences” based on age signals; which includes websites, applications and application stores. So unless an adult is content with just experiences deemed “appropriate” for all users (even children under 10), the user is extremely limited in their access. So I don’t think “bricked” is necessarily an overstatement.

It appears Google tries to degrade alternative application stores to just another app offered through the Play Store, and therefore subject to Google’s policies (including an annual $5,000 fee for policy and security reviews). So I wouldn’t be surprised this is very much intentional: as to force application stores through a channel controlled by Google, to technically allow competition (at Google’s discretion) while ultimately killing “side-loading” through other sources.

Come on guys, have a little faith in the Union… If we would all just give up on privacy, and blindly trust an international intelligence apparatus with our most intimate data, perhaps then they’d finally have enough privileges; at least for another year. We shouldn’t take steps to protect ourselves, instead the Union will act in our best interest and do it for us!

“This matches my experience exactly.”

Did you really get raped, or did the roofie I put in your drink do its job?

I used to just have a silicon case around my phone, with the banking card clamped between it and the phone: functionally the same, without any technical dependencies.

Practically all modern vehicles are privacy nightmares on wheels. They have identifying sensors all over the vehicle, on both the exterior and interior. And all ECUs (monitoring and controlling sensors and actuators from a vehicle’s particular subsystems) are (indirectly) connected to a cellular modem, which is likely to support ‘vehicle to everything (V2X)’ communications: where the vehicle exchanges sensory data with external networks (primarily the manufacturer’s), road infrastructure and other road users nearby.

Your most effective remedy is to hamper the functioning of the modem, that is if the manufacturer doesn’t throw an error code as a result of it. If that isn’t an option, check if it allows you to physically disable sensors (taping off, or limiting the FOV of cameras, or unplugging microphones). And lastly, if even that isn’t an option, disable as many “features” as you can; even though some may require you to manually re-disable them, every time you restart your vehicle…

Keep in mind that in doing so, you might also disable actual features (ones you might find genuinely useful). Mozilla’s somewhat outdated reports of manufacturer’s privacy statements might give you some idea, of which brands could be considered the lesser of evil. But these are subject to constant change, as are the over-the-air updates of vehicles in their fleet, and their dynamic user manuals…

All the time. There’s occasionally even websites that outright block me without challenge, run many iterations on my machine, or present a tiresome amount of CAPTCHAs (Waymo machine vision must be trained pretty well, from me labeling goddamn traffic lights, motorcycles and stairs throughout the day). Especially CAPTCHAs that load new pictures with an infuriatingly slow fade animation drive me up the wall; one of which possibly not even sufficient.

But I take it as a compliment, as it might mean my browser profile is minimal enough to trip these systems into thinking it’s a headless browser (typically used for bot traffic).

Authentication of users seems to be outsourced to ‘identity providers (IdPs)’ (primarily: Google, Facebook, Apple, etc.: “login with…”); that manage access to a service’s resources, which are increasingly distributed throughout various cloud-based services. A service’s chat application might be hosted at provider X, whereas its website at provider Y; so managing access to these resources from a centralized identity pool is convenient. Well, unless you value you privacy, but that’s the end-user’s problem…

At least that is the impression I’ve gotten from my limited research on Amazon Cognito: required for contacting my doctor’s office through their forced chat application (automatic account creation, no longer a phone line for uses outside of emergencies). And yes, to anyone wondering: I am going to look for alternatives, because this should not be acceptable, at least for a doctor’s office of all places.

Every social media platform, having a business model where the customer is the product, will put measures into place to avoid liability on the basis of hypocritical, age-dependent requirements (additional protections for children in case of the GDPR or DSA for example). So although ordering the platforms to “age”-gate might be unconstitutional, forcing them to choose between abandoning their business-model or age-gating their platform, likely results in the latter while bypassing said constitutional protections. But on a national level this should be considered a (temporary) win.