#Pii

Kevin Karhan :verified:kkarhan@infosec.space
2025-06-17

@Cappyjax IDGAF about "passion". All I care about is the security of users!

Requiring any #PII like a #PhoneNumber is inacceptable when it comes to #ComSec, #InfoSec & #OpSec, espechally given @signalapp is not only able but entirely willing to restrict service based off said numbers, making their "solution" insecure by design.

  • There's a reason why #XMPP+#OMEMO and #PGP/MIME [both each over @torproject / #Tor] is the evidently superior and more secure approach, as being unable to "#KYC" a user is a matter of security...

Espechally since obtaining a phone number anonymously is oftentimes illegal (i.e. #Germany made it illegal starting 07/2017, so using any service that demands a phone numner is out of question)

  • And even if one can get an anonymous #SIM (with a phone number) or god forbid #eSIM, (which is at best pseudonymous as tracking down users by virtue of matching ICCID, IMEI & IMSI to location and time) the chances are high that one ends up with recycled phone numbers that have already been used.

Obviously the devs of #Signal and @Mer__edith are well aware of this critical flaw, which is why I consider them to act as "useful idiots" or rather "controlled opposition" as #Signal could've been shutdown trivially by the #US Government or forced into banning users based off their #PhoneNumbers (they may call this "#sanctions #compliance" given they added a #Shitcoin - Wallet into Signal!)...

  • All the "but #Metadata" #FUD turns into #MarketingLies once put under the looking glass and examined against the risk of state-sponsored / -endordsed / -supported attackers.

Whereas with @monocles / #monoclesChat, @gajim / #gajim and @delta / #deltaChat and @thunderbird / #Thunderbird respectably I can not only use Tor, but do #SelfHosting for the entire #communications infrastructure (i.e. using an #OnionService = only reachable via Tor) and get the advantages of a self-routing, self-authenticating & battle-hardened against censorship proxy network that can't be shutdown!

ilga.org/wp-content/uploads/20
infosec.space/@kkarhan/1146976

2025-06-17

The truth about #captchas

They use multiple technologies such as #webgl and the #canvasAPI to identify your device.

Everywhere you go, they are right there, creepshotting your #PII to add to a database they sell to anyone that wants it.

Kevin Karhan :verified:kkarhan@infosec.space
2025-06-17

@derekmorr

Let it go, already. No one uses MobileCoin. You can’t even find an exchange to buy it.

Then why does @signalapp still have that shit in it? @Mer__edith could've pulled that #Shitcoin yet refuses to do do!

The Cloud Act is a non-issue. Signal doesn’t have data on users, so they can’t be forced to disclose it.

That's literally wrong!

  • #Signal not only collects #PII in the form of a #PhoneNumher but explicitly is able and willing to use that to dsicriminate against users and restrict app functionality based off their presumed juristiction. There is no "legitimate interest" for.doing so nor any legal mandate to do so (unless we excuse the ehole #MobileCoin-#Scam!)

It’s been 30 years, and no one uses xmpp. Let it go.

Wrong again. Otherwise there wouldn't be thriving ecosystems and Apps to this day. It's just that corporate shills refuse to acknowledge that Signal - like all centralized, proprietary, #SingleVendor and/or #SingleProvider kessengers before and after - will inevitably die as their business model is not sustainable. Sake with #ICQ really. The only exceptions are those that abolish #privacy for #profit, integrate actually working payments or sellout to a #cyberfacist #government (all those apply to #WeChat!)

It’s shocking that people who claim to care about security and privacy push niche apps with terrible UX and no PFS like Delta or XMPP instead of the only private messenger with any real market share, Signal.

You know what's shocking to me: People who are unable or rather unwilling.to acknowledge that Signal is garbage and it's requirement for a #PhoneNumber kills any #privacy benefits it may have on paper by virtue of being at best pseudonymous (assuming the userd don't live in a juristiction that demands "#KYC" for even prepaid #SIM cards (ime. #Germany) or god forbid even #IMEI|s (i.e. #Turkey has a literal allowlist that'll kick any device off it's MNOs after 90 days within 365 days.

  • The #UScentric approach to #privacy and #threats makes Signal absolutely useless in many cases, and I do speak here from experience.

I'd rather help people onboard #XMPP+#OMEMO like @monocles and/or @gajim or #PGP/MIME like @delta & @thunderbird (incl. setting them up with #Orbot / #TorBrowserBundle / @tails_live so their traffic gets through @torproject and doesn't provide any useable IP addresses.

  • I've literally been there and done that!

As for #Sustainability, providers like monocles.eu finance themselves by subscriptions (starting at €2 p.m.) which people can pay fully anonymous using #CashByMail and #Monero on top of common payment methods (i.e. SEPA wire transfer)...

  • So even if you think "#monocles is a #honeypot" that is mitigateable ciz unlike with Signal you can choose your own client, choose a different provider & exervise self-custody of all tue keys!
Kevin Karhan :verified:kkarhan@infosec.space
2025-06-16

@Mer__edith yet @signalapp still demands #PII and refuses to pull out of the #USA putting it's users at risk as per #CloudAct.

youtube.com/watch?v=0DSGq9FQKU4

Kevin Karhan :verified:kkarhan@infosec.space
2025-06-16

@markus_netzpolitik nein, weil @signalapp genauso shice ist da diese auch unter #CloudAct fallen und ebenfalls #PII wie #Telefonnummer verlangen.

Merke: Das Verlangen persönlicher Daten IST die falsche Handlung!

Bisafansbisafans
2025-06-10

Schlummertags-Event in Pokémon Sleep im Juni 2025 gestartet

Neue Schlafposen erhalten in den nächsten Tagen eine höhere Chance, aufzutauchen.

Zur News: news.bisafans.de/11678

2025-06-07

#data scraping by #databrokers and websites is just a corporate version of #creepshots

Nasty little #PII data thieves snooping on our connections and collecting our data to sell.

You can't say no because goolag doesn't give you the option. #recaptcha and #captcha collects data on you.

There's no #consent when it comes to these corporations.

Tell your local politicians that you don't consent to #google monitoring every thing you do online.

Tell them what is going on!

#fuckgoogle

Kevin Karhan :verified:kkarhan@infosec.space
2025-06-04

@arianvp and this is why you don't use #PushNotifications and espechally not @signalapp which can, has and will snitch on users!

2025-06-02

The AI That Whispers Errors: Securing Human-Friendly Feedback with Quarkus and LangChain4j
Learn how to build smarter, safer Java applications by transforming technical errors into human-friendly messages with built-in PII guardrails. myfear.substack.com/p/quarkus-
#Java #Quarkus #Langchain4j #PII

Bisafansbisafans
2025-05-31

Schlummertags-Event in Pokémon Sleep für Juni 2025 angekündigt

Neben verschiedenen Boni können neue Schlafposen mit höherer Wahrscheinlichkeit entdeckt werden.

Zur News: news.bisafans.de/11663

Dave MasonDaveMasonDotMe
2025-05-27

Data harvesting, data brokers, and the like are out of control in the U. S.

Other than you and me, there's very little standing in their way.




Dave MasonDaveMasonDotMe
2025-05-27

At the doctor's office today. (To be clear, the patient is me. )

They asked for my wife's birthdate. I asked why they wanted that info. They said they needed it because she's on my insurance plan.

I told them they were wrong--they most certainly do not 'need' it. I refused to give them the info.

The response was predictable. They acted like I was the unreasonable one.




Chum1ng0 - Security Research :verified:chum1ng0@infosec.exchange
2025-05-26

#Ecuador: The group claims to have negotiated with an agent. However, we cannot confirm the veracity of this claim, as these groups often lie to gain some benefit.

More details:

security-chu.com/2025/05/ranso

#ciberseguridad #government #cybersecurity #cyberattack #ransomware #Qilin #LATAM #dataprotection #PII #news #noticias

Chum1ng0 - Security Research :verified:chum1ng0@infosec.exchange
2025-05-24

#Ecuador:The Qilin ransomware group claims to have stolen 100GB of data from the Savings and Credit Cooperative of Public Servants of the Ministry of Education and Culture.

There is no information available regarding whether the members of the Savings and Credit Cooperative of Public Servants of the Ministry of Education and Culture of Ecuador (CACSPMEC) have been notified about the theft of personal data that allegedly occurred in this incident.

More details:

security-chu.com/2025/05/ranso

#ciberseguridad #government #cyberattack #ransomware #Qilin #LATAM #ciberseguridad #dataprotection #PII #cybersecurity #news #noticias

Kevin Karhan :verified:kkarhan@infosec.space
2025-05-23

@silhouette @richi @signalapp @torproject

1. You completely miss the points! There is no "#TechnicalNecessity" to demand #PII like a #PhoneNumber - espechally for a "#privacy"-focussed messenger!

2. & 3. #Signal is able and willing to comply with #Cyberfacism and pushing a #Shitcoin (#MobileCoin) makes it trivial to criminalize the App for "illegal & unregilated banking". If #Moxie or @Mer__edith cared they'd yeet that thing (or didn't even integrate it to begin with!) to avoid the attention. And yes Signal does restrict the App functionality when using a phone number from #Russia & #Iran (among other nations), thus affecting not only those in need of safe comms but by sending a verification code to them, earmarking them for police & intelligence. Which bings.me to the 1st agrument.

4. #Tor has a stellar record in terms of stability, integrity and censorship circumvention. DIY'ing something instead if following almost two decades of solid progress is absurd and violates "don't roll your own crypto" as a rule!

5. Only with #SelfCustody can you protect your own data. Or do you really expect Staff from Signal to not talk when facing lifetime in jail? If they have the keys, they can decrypt it, thus their #E2EE is just a "#TrustMeBro!" concept. I mean, what prevents them from being forced into backdooring all comms to @icij as per #NSL? Any "guarantee" without self-custody is worthless by virtue of being unenforceable!

Signal pushing #TechPopulism instead of teaching folks that their #ComSec is worth diddly-piss wothout.#OpSec, #InfoSec & #ITsec is dangerous!

  • And yes claiming "JuSt UsE sIgNaL!" is dangerous in the era of #Trump's #cyberfacist regime acting as it does (like with the #ICC)!

Not to mention there are better options that don't do that shite (i.e. demand PII) and just work. @monocles / #monoclesChat & @delta / #deltaChat for example can adapt way better to said risks and ain't run by a #VCmoneyBurningParty!

Dawiscodawisco
2025-05-23

Well... so this is happening

"...will include information deemed by the ODNI as highly sensitive, that which can be “misused to cause substantial harm, embarrassment, and inconvenience to U.S. persons.”

theintercept.com/2025/05/22/in

Kevin Karhan :verified:kkarhan@infosec.space
2025-05-22

@richi Except @signalapp is not "#Privacy-first" cuz if #Signal did, they'd not.demand #PII (#PhoneNumber) nor remain in the #USA (#CloudAct) nor peddle #Shitcoin-#Scams (#MobileCoin) and put their tech on @torproject / #Tor and fully #decentralized.with 100% #SelfCustody of all the keys!

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst