This is original content. AI was not used anywhere except for the bottom right image, simply because I could not find one similar enough to what I needed. This took around 6 hours to make.
Transcription (for the visually impaired)
(I tried my best)
The background is an iceberg with 6 levels, denoting 6 different levels of privacy.
The tip of the iceberg is titled “The Brainwashed” with a quote beside it that says “I have nothing to hide”. The logos depicted in this section are:
- Apple
- TikTok
- PayPal
- Google Chrome
- CashApp
- Samsung
- Steam
- Microsoft Windows
- Ring (Security Camera)
- YouTube
- Amazon
- Discord
- Gmail
- ChatGPT
The surface section of the iceberg is titled “As seen on TV” with a quote beside it that says “This video is sponsored by…”. The logos depicted in this section are:
An underwater section of the iceberg is titled “The Beginner” with a quote beside it that says “I don’t like hackers and spying”. The logos depicted in this section are:
- Telegram
- Authy
- Brave Browser
- Privacy.com (Virtual Cards)
- DuckDuckGo
- iMessage
- Proton Mail
- AdBlock (Browser Extension)
A lower section of the iceberg is titled “The Privacy Enthusiast” with a quote beside it that says “I have nothing I want to show”. The logos depicted in this section are:
An even lower section of the iceberg is titled “The Privacy Activist” with a quote beside it that says “Privacy is a human right”. The logos depicted in this section are:
- Monero
- GrapheneOS
- Vanadium (Web Browser)
- KeePassDX
- SimpleX Chat
- Accrescent
- SearXNG
- Aegis Authenticator
- OpenWrt
- Mullvad VPN
- An illustration of physical cash
The lowest portion of the iceberg is titled “The Ghost”. There is a quote beside it that has been intentionally redacted. The images depicted in this section are:
- A cancel sign over a mobile phone, symbolizing “no electronics”
- An illustration of a log cabin, symbolizing “living in a log cabin in the woods”
- A picture of gold bars, symbolizing “paying only in gold”
- A picture of a death certificate, symbolizing “faking your own death”
- An AI generated picture of a person wearing a black hoodie, a baseball cap, a face mask, and reflective sunglasses, symbolizing “hiding ones identity in public”
End of transcription.
Using basic things like Graphene OS and keepass shouldn’t be considered privacy activist
Pretty good!! I agree with 95%.
Loved the “As seen on TV” category!
I agree that Tuta is more secure than ProtonMail.
Some are blended like Tor, that should be in Activist if used in secured computer.
Was not aware of the existence of Coincarp (logo by GrapheneOS). Is a crypto price tracker used by Activists? I left crypto a couple of years ago but though Activists just don´t trade much and stick for the long haul and use Monero for purchases.
Was not aware of the existence of Coincarp (logo by GrapheneOS). Is a crypto price tracker used by Activists? I left crypto a couple of years ago but though Activists just don´t trade much and stick for the long haul and use Monero for purchases.
The logos next to it are Vanadium, which is a web browser made by GrapheneOS, and Aegis Authenticator, which is a time-based one-time password (TOTP) application.
Wow… I use Aegis exclusively as my authenticator since 2 years ago and completely did not recognize the logo by itself!!! I used Yandex image search and it told me coincarp… Sorry.
deleted by creator
Technically speaking is highly contested and you have arguments pro and con, one way an another. They use different technologies so it is hard to compare properly, specially since it depends on the users using it properly.
If the technology is good, it does not matter where it is located. Switzerland, specially since a couple of years, does provide more freedom guarantees than Germany but it is not immune at all, actually, the US had used the Alpine country to do operations due to its attractiveness to dissidents and criminals alike. However, for the overwhelming majority of customers, either option is fine for they privacy and security. Only metadata has been obtained in few instances in both companies and nothing else… at least no that was used in a court of law.
For ultimate targets, if they have to rely on email, that they should not, I would choose Tuta though. These are my reasons.
- It has a lesser footprint, so less likely intelligence agencies tried to infiltrate it.
- The people behind are there fro the very beginning and show their faces publicly (Many in Proton too like the CEO, but it is no so transparent with the rest)
- The people of Tuta are more ideological so it is a barrier for intelligent services to penetrate. Tuta has show however being anti the Russian government (rightly or not), so this point is not valid if you are in that side.
- Tuta has a very organic and progressive growth. Proton had an explosive growth. Of course, it could been good marketing, but still…
- Proton still today requires Google’s Push Notification servers, after years and years demanding a solution. Tuta had that solved since long, long ago.
- Recently a case came in Canada of a intelligent agent using Tuta since “it was infiltrate by intelligence agencies”… After a few hours going through the case, I read it the opposite, he used it because he actually considered it a better choice to cover his crime. He was not that high in the ranks, but I read that the he resumption o these officers.
- Nothing regarding security, but as a paying customer for both I was “tricked” far less by Tuta. Proton, for instance, does not refund you, only gives you credits. Even 20min after an accidental 2yr renewal I got stuck with them unwillingly. That practice should never be acceptable for a SaaS.
Now, Proton overall, for most is a bit more reliable and full feature and better put together so it is easier to recommend. Think of Proton as the Apple of emails, quite secure and miles away from Gmail, but security wise and ethically, of the two, my bet would be with Tuta.
Its not. They don’t even sign their releases or support PGP
Tuta is not a proton replacement
The CEO of Proton has tried cozying to Trump and any company led by a guy who does that is knocked down several notches for me
If any service is at the whim of someone’s emotions or opinions, it’s at the bottom, and it should stay there.
Let the program be the program, and if we can’t see how it’s written, assume the above is true.
Foss or die
I would probably argue they are the same in terms of security and privacy. Privacy communities tend to disfavor Proton because its all eggs in one basket, and also for political reasons. Both of those are subjective to your personal threat/privacy profile.
Its true that a single point of failure is more risk than separate services, but that fact doesn’t undermine their security on a technical level, and has nothing to do with privacy. As for the political, yes it’s something to watch but nothing wrong has been done. They are set up as a non profit with checks and measures in place to prevent corruption from happening. I’m OK with different points of view and having different points of view on a board is a good thing.
The problem with mullvad is a lot of its IPs are flagged as bots or denied around the web. Is there a good VPN that will still give access to most of the web?
I’ve been running into this a lot with Proton, too.
Gotta use less popular locations close to what you need. As a german I have mostly been using Finland and other smaller eastern European countries, those generally work just fine. Germany itself barely ever.
I’ve never had that issue with Mullvad unless it was for a streaming app.
Sometimes I get detected and it makes me do a cloud flare “I’m not a robot” page.
I just got Mullvad again and the main site I get flagged on is reddit. Which I wouldn’t care but the state of search is so abysmal that I still regularly have to query reddit to find what I’m actually looking for (for some types of info anyway). It’s fine though, there’s some mullvad servers that haven’t been flagged yet so I just server hop as needed. Less convenient, but not terrible
LibRedirect works for me
LibRedirect + Libreddit instances is fantastic.
Honestly, Reddit is one of the few services that can be redirected easily now. Invidious, Freetube, NewPipe, etc. is constantly being nuked by Youtube, and while Twitter redirects are still alive, they were dead for a short period, ProxiTok never works, nor does Proxigram instances…
Oh yeah! Reddit does that? But I just login with a throwaway account.
Sometimes after logging in, it will say there was a problem or just reload the login page.
If that happens just click login again and it will load normally.
Yeah, it’ll give me one of these screens with most mullvad servers. I don’t really interact on reddit anymore so I refuse to log in even with a throwaway (on my phone at least). Maybe there’s something to it, maybe it’s my own silly little battle against rude web design 😅
It’s so cringe how they make everything cutesy
when this happens, just hit “reconnect” on the VPN and refresh - usually after one or two reconnects Reddit won’t have blocked that IP yet, IME
Try a Reddit mirror like RedLib, i.e. https://redlib.privacyredirect.com/
deleted by creator
Interesting, I’ll have to try that out!
Those are mutually exclusive.
Just avoid those shitty websites that don’t respect their user’s privacy.
TIL I’m a privacy activist–who can help me get to the ghost mode?
(Do I even want to get there or is that limited to journalists who have entire states trying to unalive them?)limited to journalists who have entire states trying to unalive them. Don’t live your life in fear
Do I even want to get there
Only you can answer that.
or is that limited to journalists who have entire states trying to unalive them?
Pretty much, but if you want to give up all technology, work for yourself, and fake your death, then more power to you!
Seems like faking your death would cause more privacy problems than it solves. Why not just “stay alive” with a completely innocuous identity? Then adopt some new identity which cannot be traced back to the original?
If you’re alive, you are asked for documents such as property records, taxes, etc. and if you refuse then bad things happen. If you fake your death, no more questions are asked and you can take on fake identities. In essence, faking your death takes your identity out of “the system”
Easier than you think it is. Hard to keep at it. All you need to do is stop using a phone or computers. Death cert is only needed when you’ve been compromised and people are out to get you. Gold isnt really usable unless you stumble onto a secret underground society where all trade is done in gold. Realistically, you’d sooner be trading goods (or services) for other goods (or services).
This level technically shuns technology and that brings its own challenges. Its like saying you cant have privacy with technology. I dont necessarily agree with this statement so I’d say don’t go to this level.
There is this steadily growing activist group that you could join up with.
You should stage your death, like they tried to do on prison break and then move to Mexico or Columbia. Send me a DM for more information /J
As a US citizen your crypto transactions need to be individually listed in your tax returns. It’s the main reason I don’t use crypto, it makes my taxes super complicated.
I absolutely report all of my cryptocurrency that the government would need to break PKI to trace back to me. I would never violate laws that I could rely on never being caught violating.
Sorry, this post is a bit confusing…
deleted by creator
Ohh, gotcha! Yeah, I’m not messing around with taxes. That can get you in some serious trouble.
Unless it’s one of those cases that matters the most, like being wealthy.
Android missing?
Hi from near the top of the iceberg. I have five from the top and two from the next level down, plus two from level four. A balanced diet?
Depends what they are, I think a fair amount of people might be in the same boat, with a few services from different tiers.
Android missing?
I wasn’t able to fit everything, but I specifically excluded Android, because it isn’t inherently bad. GrapheneOS is based on the Android Open Source Project (AOSP), for example, so I didn’t want to give the wrong idea.
I’d put Android/iOS on top layer then AOSP on the 2nd layer then deGoogled Androids on 3rd layer then PostMarketOS on 4th or 5th layer.
Anyone else noticed you are descending and are dangerously low in the pic? I didn’t realize lol
Privacy isn’t dangerous unless it gets in the way of your life (your job, relationships, housing, etc.). As long as you maintain a good balance, more privacy is generally better.
Talk about high effort content holy shit
Also my toxic trait is that I use stuff from every single tier
I was at the bike shop a few weeks back and a ghost walked in. He came in wearing a medical mask covered by a bandana, sunglasses, cap. They wore gloves, long sleaved pants and shirt.
First question from staff, ‘this a robbery?’
Ghost, ‘no, I just need 27 2.5 tubes, miss.’
They get the tubes, he agrees. Staff asks if he has an account. Ghost says, “nope, why would I need one?” Staff says they do it for records, insurance claim assist, and discounts. Ghost goes with a John Doe, pays cash and peaces the fuck out.
Total King, but dude was given up a lot. Half of us were drinking beers enjoying a warm evening in spring. I hope he has had some good rides.
I can say with confidence thay he was a white male. In his 50s. About 5’10". 140 lbs-ish. If anyone wants to get any tips, good luck!
“No, no… the robbery’s far too far to walk”
Ha. The tubes were the final pieces to the getaway vehicle
I respect it but what’s the point? I kinda hope he’s some kind of super-criminal or as you say he’s given up a lot to hide from a state that probably doesn’t even care he exists even if they did know who he was.
I’m no ghost, not even close. Be careful though, “what’s the point?” Is essentially the question everybody asks at every phase of that iceberg diagram.
A possible answer to your question though, is that even if the state doesn’t know or care about him today that might change tomorrow.
That’s not my threat profile but it’s a valid one.
Probably an activist who isn’t just protecting himself
I’d have guessed white nationalist if it was anywhere but a bike shop
Don’t make assumptions. Privacy is a right for all
Exactly right. My bad. Thanks for the reminder. Geography and majority opinions in the area were coloring my perspective but are not relevant
I would drop off the face of the earth only to stash porn mags all over the woods.
Speaking as a former kid of rural america you would be doing the lords work, friend
Oh, am I that far gone?
spoiler
I don’t see Qubes, Whonix or Tails on there.
What is so bad about nordvpn? What makes protonvpn better?
Been a nordvpn user for around 4 years now. If I need to switch I’ll do it, this is just the first time I’ve heard it isn’t all that great.
ProtonVPN is open source, meaning the code running ProtonVPN can be inspected by anyone to make sure privacy is being upheld. ProtonVPN is also based in Switzerland, which has strict privacy laws. NordVPN has had many criticisms about their privacy and security practices. ProtonVPN also has a free tier.
Thank you. I remember back in the day hearing they didn’t keep logs and figured “well alright sounds good!” and that was the end of it.
I’ll give Proton a try when my current plan of Nordvpn ends. Didn’t know Proton was open source either, so that’s pretty cool! Wish I didn’t get downvoted to hell for asking a question, but it is what it is.
I’d put OpenVPN and WireGuard on the 5th layer.
On browsers, as you put Chromium then also put Firefox or deMozillaed Firefox e.g. WaterFox.
I’d put Brave back to the 2nd layer due to relying on Chromium and being heavily marketed while gathering data for its crypto scheme. I’d also put Firefox on the 2nd or 3rd layer.
FF doesnt deserve much better than Brave as it sends telemetry, so both on tier 2. LibreWolf would fit for tier 3 or maaaybe 4.
Do you trust this preference panel on telemetry? If not why not? If you do believe it is legit what do you believe it remains problematic?
Lol, no. Here’s a list of all the things that panel doesn’t account for.
Also, there’s nothing close to even attempting privacy without strong fingerprint protection anyway, which I should have also mentioned. Vanilla FF allows a bright shining canvas fingerprint that Brave and Librewolf disable.
I’m not sure what’s that’s supposed to show as “there are built in settings for some of this stuff, it’s not complete and many settings are abstracted away from the user. Enter about:config” since it might be hierarchical, i.e. disabling a single telemetry toggle, either via Preferences or
about:configmight disable all the other ones. I haven’t looked specifically at that part of the code of Firefox but I’d trust more a Wireshark analysis than this since it doesn’t actually show (unless I missed that part, quite possible as it’s relatively long) that information does actually go back to Mozilla even while one has disabled all telemetry option.Fingerprinting is fair, in the sense that yes, if you do broadcast your userAgent and other public information you do narrow the potential search space and thus expose you as an individual more, yet has nothing to do with Mozilla.
But we’re taking about this in the context of this infographic. So we have to distill this down to:
Should FF be with, or above, Brave?
I assume we’re also taking about relatively low-barrier changes that most users can implement. So vanilla FF vs vanilla Brave, there’s a difference. Can we harden FF? Sure. Will 95%+ of people do that with Librewolf or 3 dozen other forks out there? Why bother when there’s nuance to be gained with other forks? So now vanilla FF stops being relevant.
And to be clear, I don’t use Brave unless I absolutely have to. I don’t love it, but vs. normie Vanilla FF, there’s a slight edge.
Up to you and OP but the fact that there isn’t even Firefox or LibreWolf or WaterFox but there is Chrome, Brave and Chromium is problematic to me. At the very least Firefox should be there and IMHO below Chrome.
f-droid? the guardian project?
Can you explain why you would think Steam is so bad? I would argue they’re pretty fair, especially with the option to buy steam cards for cash to not disclose your personal data. Does the client do some unsavory shit?
Seeing steam at the top makes me question the list. Likely a hate of DRM rather than privacy
Their bottom line is gold, this should tell you everything you need to know about the creator of the meme.
it also has a log cabin… and Log Cabin is a maple syrup brand… and maple syrup is from maple trees… and maple leaves are on Canadian flags… so… a snowman?
Yeap, and Brave in the middle. They only pretend they are for privacy, but they are the very opposite.
They’re not the very opposite. They have done wrong things, just like Mozilla. Doesn’t make them Google though.
They are not “just like” Mozilla.
Yeah i hate when I see people using Brave, because they have been brainwashed.
Does anyone remember when they were injecting their own referral links into links for online stores (99% certain they did this pls prove wrong if you know better)? This alone leaves them with 0 trust in my books.
Brave is and always has been gross. Never understood how they’ve been so successful at tricking people into installing it.
OP replied in another comment its because “firefox is not secure” https://lemmy.dbzer0.com/post/43710170/18564861 :
[…] Chromium-based browsers aren’t all bad, such as Vanadium or Trivalent, so people sometimes feel more comfortable sticking with what seems familiar (coming from Chrome).
In another reply parents to this one:
LibreWolf is far from secure, as it is based on Firefox and so comes with the same security issues. If you meant to say privacy and not security, the reason nobody makes high threat model browsers for Windows is because Windows itself is not private and it would be a losing battle.
So OP is saying it’s not private nor safe? I get what some people are saying of Firefox constantly changing Terms of Services but that’d be in regard to privacy not security and OP tries to argue not being safe which his iceberg also implies in terms of privacy not being good too. Yeah, LibreFox’s ToS isn’t the same as Firefox’s ToS and his counterarguments to Firefox and Firefox-based on replies is Chrome-based browsers exclusive to niche OSes (also OP don’t even try arguing Brave on comments so probably just trying to rage-bait with every opportunity). I’d love OP to argue using the examples he used in the iceberg. So many discourse incosistencies along with the iceberg. Also OP FYI while privacy does not mean secure, lack of privacy could mean security risks in some cases.
No epic store and brave is not on the top…
and then Tor so high up, unless you’re hell bent on leaving 0 traces that thing is a pain to use, can’t have it maximalised, pages load sometimes minutes at a time, no addons, just suffering. nobody sane uses that thing for more than the occasional trip to whatever deep web market is not yet exit scamming
deleted by creator
afaik the client does collect a bunch if data, most (all, i think? but not a 100% on that) of which is opt-in.
they do need stuff like IPs for internet related features.
telemetry wise there’s the steam hardware survey, which is opt-in, and it asks every single time it attempts to collect your systems hardware and OS information. this could technically be identifying information, but since it’s opt-in it’s not a privacy violation and it’s entirely optional. (plus it’s super useful for all involved: users, devs, and steam. it’s kind of a win-win and straight up necessary info for devs to know which hardware they should optimize for)
they might be putting it at the top because steam has native support for DRM?
but that’s also weird, because DRM isn’t a privacy violation. it’s a shitty practice, barely does anything, barely works, and keeps breaking or hobbling otherwise perfectly good games, all of which is shitty, but it’s little to do with privacy. and the dev has to specifically opt-in and integrate it as a feature…unless they’re thinking of 3rd party DRM that can be waaay more intrusive, like Vanguard… THAT’S a privacy and security nightmare just waiting to blow up in people’s faces.
otherwise…i haven’t really heard anything bad about steam privacy wise?
doesn’t mean that there’s nothing to be concerned about, but i feel like there’d been some news about it if there was…
No. And also chrome is somehow at the bottom of this list, I don’t care if it’s chromium or vanadium, it’s still chrome.
Chromium-based browsers have arguably better security than Firefox. https://madaidans-insecurities.github.io/firefox-chromium.html
Vanadium further improves Chromium’s security by disabling the JS JIT Compiler, using a hardened memory allocator (GrapheneOS hardened_malloc) enabling ARMv8.5 MTE, and applying other hardening patches (https://github.com/GrapheneOS/Vanadium/tree/main/patches).
The securebuild project maintains a hardened Chromium build for Linux called Trivalent, which uses most of the patches from Vanadium, among others. You can get it from their repo: https://repo.secureblue.dev/secureblue.repo
I really wanted to include Trivalent, but I didn’t want to seem too Chromium-oriented and start a flame war.
You could add secureblue. I would put it in the same category as GrapheneOS and Vanadium.
An issue arises with that. Linux is fundamentally insecure, as you are likely well aware if you use secureblue. secureblue is designed to be as secure as possible while still being Linux, and so is still bound by the same constraints. Qubes OS is not a distro, so it (should be) more secure, but it is an absolute pain to use. Furthermore, Qubes OS emulates Linux distros, so the question becomes “Why not just emulate the most secure Linux distro?” which is either Whonix or secureblue depending on who you ask. Is that more secure than running secureblue on bare metal? What about GrapheneOS used in desktop mode? And what about emulating Linux inside of GrapheneOS using the Linux terminal? There are plans to use multiple distros inside of the terminal, so what about secureblue inside of GrapheneOS?
The whole situation spirals out of control. I know this iceberg chart isn’t ranking security, it’s ranking what software people generally use for each experience level, but neither secureblue nor Qubes OS would fit nicely in any category. You can read this post for more of my thoughts about this mess.
I know about the security issues in desktop Linux, but I still think secureblue fits that level of the iceberg pretty well. I would put Qubes there as well.
It’s Vanadium, a fork by the people from GrapheneOS. You could say the same about Graphene, that it’s still Android, but reality is more complex.
deleted by creator
It might be there because there is a lot of data associated with the steam account, especially the community part of it, e.g.:
- Recorded playtimes
- Times and dates when you are regularly logged in
- Possession of games which are precisely tagged by genre/interests/etc.
- On which time and date you spent how much money (participation in sales in the steam store)
- Timestamped posts and comments in groups based on various interests etc.
- Curators/devs/publishers you follow
- Your game wishlist
- Connection and interaction with other steam accounts (friends list, chat, trades, gifts)
All this can be used to create a very detailed behaviour profile and accurately deduce the social status of the real person who uses the account. Maybe the data isn’t misused and it’s just there so the features can actually exist.
Personally, I doubt Valve actually does this as expansive and invasive as other big tech companies. I’m pretty sure they at least aggregate anonymised data to measure how e.g. their sales perform, which game to promote on the store front page etc.
But we can’t be sure because it’s not public.
i don’t think valve does much with the data even internally. if they did at least the game recommending queue would be slightly accurate. instead i have to manually blacklist tags for it to stop showing me things i’m just deeply uninterested in. like yes Mr. Valve my steam library of RPGs, puzzle games, and open world sandboxes clearly profiles me as someone who’d be interested in the newest Fifa game every year, sure buddy
I think they changed the name in the newer versions so surely you’ll be interested now!
now you say it, maybe it’s my clicker games that make Valve think i’d like to buy a game where the point seems to be that the number in the title goes up by one every year
Yes but my point was that I believe they changed the name from FIFAYY to FCYY (and I think raised the price).
Agree. Steam doesn’t even save your birthday, and asks for it every time
They legally have to.
