I think that it works, but for it to work you need to enable Google Play services. From what I understand, this is done in a sandboxed manner simulating a fake identity, so it is possible to do this while isolating Google from your phone to an extent. But I think that WhatsApp is in itself problematic and one of the direct offenders that I want to avoid, regardless of its reliance on Google Play services, and so I have not gone through this effort myself.
I made the switch when I got a new phone. So I kept both the old phone with android and the new phone with GrapheneOS. There was a transition period when I would bring both phones with me, just in case. Now my old phone is my “whatsapp” phone which I keep at home and turn on rarely. During the transition period I used my old phone number whenever I needed to provide my phone to use a service, but eventually I transitioned that to a VoIP. But, even then, many services will reject VoIP phone numbers, so I still make use of the old one.
I had to request a special scanner from my bank because the banking apps do not work with GrapheneOS. And I had to make sure that nothing important goes into my gmail anymore because google would request that I used my old phone 2FA in the most inconvenient moments, and also I don’t want to access google from my GrapheneOS phone.
I think that there are many annoyances that can and probably will happen if you try to jump right into GrapheneOS after having previously relied in the google/meta ecosystem. If you attempt to switch too quickly you might inadvertently lose access to your bank, and you might become suddenly unable to communicate with family and friends. My government’s online identification system requires that I use their app, which runs on google services, so I still have to use my old phone for that. And I have encountered situations in which the only reasonably convenient way to proceed is to download an app. For example, recently I registered for a gym that would then require me to use their google-store app so that I could identify myself when purchasing a physical card.
A botnet could have many unique accounts, and some could even appear like users. So I can’t rule it out. I also haven’t done a deeper dive into the accounts.
But when a post gets popular I would expect it to get at least a few downvotes, regardless of what it is.
There is one account that has a single comment from 5 months ago that is downvoting most posts and comments. That one is very suspicious
Other than that… No other accounts are as obvious. A few do have some reoccurrences but most of those votes do seem organic on first inspection.
Yes, you are right. If a mod wants I can send them the username and they can ban them from the community. I can see it as an admin from my instance but I can’t take action.
Woah. That is a lot sooner than I had anticipated.
Yeah, I still see the line now. I am not sure if this was a one-off, maybe the edit occurred when I rebooted the instance for a moment and the edit fell through the cracks… Or there might be an actual issue federating edits.
I think you left this line behind by accident:
l = Lemmy(INSTANCE_URL)
I would kill. 2X growth rate is too fast, and it is easily better 100 random people now than 200 immediately after.
What about these rules?
The group of people in the tracks is randomized every time.
The group always includes the person that the current decision maker loves the most.
The choice is to kill, or to increase the number of people in the kill group by one.
If the number of humans available reaches the population number, everyone dies.
The list of every decision made by every decision maker is public knowledge.
You are the first decision maker.
Ohh, I did not know that! I should add a Matrix handle then
Yeah, that is true. But:
A large site often collects a lot more sensitive data about a users such as phone numbers, ips, devices, activities, browser fingerprints, and even correlates accounts
Because of the value and quantity of the data, large sites will be attacked more often
However, a large enough data breach to be publicly exposed is not the only concern. I think that large sites pass their un-encrypted communications through filters to detect ‘illegal activities’, and in some countries ‘illegal’ can mean simply criticizing a powerful individual. Companies also use unencrypted communications to mine information that may be valuable to advertisers.
I would not be surprised to learn that an intelligence agency has the ability to search through the plaintext of all of the DMs from a big site. Sites may give this ability to intelligence agencies in oppressive governments to track the activities of politically inconvenient journalists, for example. Laws can also change, and at some point it could be made legal to search through messages to detect even minor crimes. This may be unlikely, but it is possible.
The pressures and stakes are different, but I wouldn’t trust either a big company or two guys. If it is important for you that your DMs remain private, then you should generate your own keys, encrypt messages yourself, and keep the keys safe.
Yeah, at least Lemmy tries to warn users not to use the DMs to send sensitive or private information, and suggests using a dedicated encrypted messenger instead:
The developers are very busy developing lemmy-specific features and encrypted DMs would be a lot of work to create something that is a bit redundant. But I am sure that if someone would want to make that, they would appreciate that help.
Not that I particularly trusted reddit, but at least it was 1 corporation with (hopefully) some solid security procedures in place, and potential penalties for data breaches. Whereas in Lemmy, it might just be 2 random guys.
Personally I wouldn’t trust 2,000 random guys any more than 2 random guys. I assume any of my unencrypted communications are public.
You can create a one-person instance and hold your identity there.
If you what you want is for every server to hold your identity, you have to trust all servers. I think that an evil admin would be able to impersonate any user from any instance if that were the case. How do you delete your account? Can an any admin delete your account everywhere? Which one is the real “you”?
Thank you! I will look into cloudfare, what people say about it, and what resources are necessary to avoid DDoS attacks without it!
Better delivery and avoids exposing your IP via emails, although it’s best to setup a some sort of tunnel to avoid having that problem altogether.
Is it possible to have a public-facing instance without exposing your IP? I am not sure I understand that part, and I am very interested in understanding how to achieve that.
consider using an email delivery service like jetmail instead of sending mail directly from the instance
Why is this better? To overcome spam filters, or is there some security risk associated with e-mails?
A few years ago the plain text passwords would show up in the logs. That has been changed since then, but a malicious instance admin can easily revert this change and keep a log of plaintext passwords.
A developer explained to me that adding client-side hashing would be problematic because different clients might do the hashing in different ways, and that the desired solution is to add OAuth at some point. There is also a bit more discussion about this in that thread: https://lemmy.ml/comment/97830
I lack the technical knowledge in client-side hashing to explain why this is the case, but as far as I can tell client-side hashing is not common at all. The standard is to hash the passwords server-side.
I do think that it is important to be aware of what a malicious instance admin can potentially do: they can log your plain-text password, see your e-mail and correlate it to your IP, look at what posts you like/dislike, and read your non-encrypted private messages. But these are not “Lemmy” problems, as these are general issues when it comes to trusting the servers of the sites that you create an account in.
An important benefit of Lemmy is that you can actually set up your own server or use the server of someone who you really trust, and you can use it to interact with the rest of the instances. It is also possible to create an account without providing an e-mail, a phone number is not required, and you can usually access instances via a VPN or Tor. These are not a common luxuries when it comes to other sites.
Using unsafe passwords is dangerous in a lemmy instance, but it is dangerous anywhere.
I am not sure as I did not test this one. Maybe you can go in person and get a worker to get you access to the kiosk through your account to print the card. It is one of those massive chains with gyms in every corner. I think that by now they rely on their digital infrastructure and many of their workers are not trained to handle uncommon situations. At least I get that from some of my experiences, but I could be wrong, maybe if I would have called them could have helped me with this. It was just easier to get the app into my old phone, print a card, delete the app.