Why Did Google Disable this Security Feature?

Google removed a critical security feature

from the Pixel XI,

California's operating system level age

verification bill has passed,

and another controversy from a renowned

name in the privacy space.

All this and more coming up on This

Week in Privacy, so stay tuned.

welcome back to this week in privacy our

weekly series where we discuss the latest

updates with what we're working on in the

privacy guides community and this week's

top stories and data privacy and cyber

security while answering viewer questions

i am nate back from a couple weeks

off and with me this week is jordan

how have you been jordan being good really

excited to dive into some stories this

week we've got uh some very interesting

topics to discuss this week

Yeah, for sure.

It's a little bit of a shorter week,

but some pretty big stories along the way.

I guess we'll jump right into it.

We'll start by talking about Graphene OS.

Man,

this was a roller coaster of a story

this week.

So we mentioned a few weeks ago,

right here on This Week in Privacy,

that the Pixel XI had launched.

And the big question at the time was

like, will it support Graphene OS?

And I'm actually in love with you guys.

When we asked that question,

I think we kind of...

At least for me,

it was kind of like, yeah, of course,

it's almost certainly going to support

Graphene OS or vice versa.

Graphene will support the Pixel XI.

Like, I don't see why it wouldn't.

And, you know,

it was just kind of like something to

talk about, really.

But to our surprise, earlier this week,

Graphene posted that...

They had,

I'll scroll down here so you can actually

see the tweet.

They said,

we have a partial port of Graphene OS

to the Pixel XI series complete after a

week of working on it,

but we're unable to complete the port due

to a lack of support for ARM hardware

memory tagging in software, firmware,

and near certainly hardware.

It appears Google cut an important

security feature.

And then there's a whole thread,

of course,

that you can access on Blue Sky or

Mastodon or Twitter,

whatever your social media of choice.

And...

We have this excellent write-up here from

Fria that we're referencing that kind of

offers context and stuff like that.

So what they're referring to is something

called MTE,

which is memory tagging extension.

And it...

It says here, Fria says that,

so the way it works is it detects

and prevents memory violations.

It decides a random tag to each location

of memory.

And then if the memory is accessed,

but the tags don't match,

it will detect that.

And then it'll block the program

basically.

And this used to be a really big

deal.

At one point,

even Google themselves said it was like,

seventy six percent of all vulnerabilities

in Android.

and therefore eliminating this, I mean,

means getting rid of a whole class of

vulnerabilities, right?

And, uh,

this is one of the rare moments where

Google be Apple to something, um,

a little bit of an arms race between

the two,

but Google rolled this out first with the

pixel eight.

And, uh, at this time,

pixels are still the only Androids that

actually have MTE.

Apple rolled out their version called

memory integrity enforcement on the iPhone

seven series and max with the M five

chip and above.

And, uh,

graphene did actually say in their,

their threads that, uh,

Apple's implementation was really good for

the record.

But Graphene considers this an essential

part of their requirements.

Like, again,

if you go read that thread that I

referenced,

they –

they basically say that like MT is now

at this point really deeply integrated

into graphene OS.

So, uh, that's one of the requirements.

So that's one of the reasons they support

pixel and with the upcoming Motorola

devices,

that was one of the requirements is you

have to start supporting MTE.

So, um, yeah, it's, uh,

it was really weird that Google got rid

of this thing.

Um,

at the time graphene was saying to just

like stick with the pixel eight,

the pixel nine, nine and ten for now.

But like I said,

bit of a roller coaster of a week

because there was actually an update a

little later in the week.

And I'm going to turn this one over

to Jordan to give you guys the update.

Yeah,

so this week has definitely been quite a

roller coaster, like Nate said.

After Graphene OS had previously hit a

roadblock porting to the Pixel XI due to

that missing security feature,

they found that the hardware does at least

have bare minimum support for MTE.

And, you know,

they say that memory safety bugs made up

around seventy six percent of

vulnerabilities in Android at one point,

according to Google's data and switching

to memory safe languages like Rust helped

them reduce that number significantly.

So.

With the release of Android,

QPR two beta four,

it appears support has been added back

into the firmware.

MTE support is still completely disabled

in the OS.

And the arm-sxty-four.no-mte is

unconditionally passed by the firmware to

the kernel according to Graphene OS.

So this is kind of strange, right?

Like Nate was saying,

this is like it was originally completely

missing and then suddenly it's being added

back in this beta four release and

permanently disabled by default.

So this is kind of a strange thing

for Google to be doing.

It's

Kind of also like touching on this as

well,

GrapheneOS did say that they did some

initial testing and they found that there

was no significant performance decrease

from enabling this.

They did say they did some preliminary

testing.

So we don't really know the specifics of

this.

And some people in our forum were actually

discussing and saying, like, you know,

could this have been disabled because of

something more significant?

Could this have been disabled because

there's a...

significant vulnerability in how this

works or that this doesn't work correctly.

And that's the reason why Google has

disabled it.

So there's definitely some interesting

things being discussed there.

I guess I'll throw it back to you,

Nate.

Like this is sort of an ongoing story,

but it's interesting that this is being

disabled,

especially when Google is pushing for

these new security chips,

like the Titan M three, right?

Yeah, definitely.

Like we mentioned in the past surveillance

reports,

the Titan M three seemed really cool

because it comes with this like post

quantum secure boot and just kind of,

you know,

a lot of companies now are bracing for

like the post quantum encrypted future.

Apple's done a lot of work to upgrade

like iMessage and stuff like that.

So it just seems really weird that they

like rolled out this new, which I think,

I don't know if you mentioned this,

but Graphene mentioned in their thread

that I referenced that,

basically mte like the support is there

but the apps have to opt in opt

into it it's uh it kind of went

a little bit over my head but basically

they were saying like for the most part

it's not really like widely used but

graphene enables it anyways which is also

why graphene has the option to like you

can go per app and like disable the

mitigations because every once in a rare

blue moon it will break an app here

and there so you can go disable it

but um but the point being is like

it's not like um

Like this was already something that was

not heavily adopted.

And it seems weird that Google wasn't,

instead of like pushing for more people to

require it,

which is usually what companies do in

these kinds of situations,

especially like Google,

where they control the Android platform

and they can kind of pressure companies

into doing that through some means or

another.

Instead of doing that,

they just rolled it back completely,

which yes,

it's weird that they added some security

and then rolled back others.

They mentioned that the lack of MTE makes

after first unlock state significantly

less secure.

So like the post quantum secure boot makes

before first unlock better,

but it was kind of a trade off

and it was super weird.

But I had a thought written down here.

I'm not sure if you know the answer

to this,

but it seemed when they updated and they

said that they did find support in the

beta,

it almost sounded like it was something

that was going to be coming back to

all pixels.

Like maybe they temporarily disabled it

for some reason.

And then now they're going to add it

back in.

Do you know anything about that?

Or am I just reading into it too

much?

I don't exactly know what you mean.

From what the GraphiNoise team said,

I believe,

if we just read directly what they said

in the master,

like they posted stuff on Blue Sky Master

and Twitter.

I think, what did they say?

While I'm looking for that,

you can maybe discuss something.

We have talked about it before,

but this is also another reason why

GraphiNoise is moving away from pixels

entirely, right?

Yeah.

Yeah, for sure.

So originally,

the original first thread they posted

where they're like, hey,

there's no MTE support,

they kind of ended it by saying, like,

we haven't decided what to do.

We're still kind of figuring it out and

researching.

And one of the things they said was

they might just have to skip the Pixel

XI series altogether.

because again,

it's like MT is now such a vital

part of the graphene code base.

And, um, but they did mention it's,

you know, they've, uh, and again,

we announced that on the show as well.

So stay subscribed everybody.

But we announced when graphene was

working, uh,

announced their partnership with Motorola

and they would be working with Motorola

to, um,

to make their own phones,

basically to like have phones that were

designed from the ground up.

And they have a lot of say in

how the phone gets designed and they have

access to the code.

So it's a lot easier to support it.

And yeah, it's just, I don't know.

I guess that's the good news is we

do still have the Motorola phones that

should be coming out.

I believe,

I didn't put it in the notes here,

but I believe next year, early next year,

they're still on schedule.

The only drawback is we did cover,

I think you guys covered a story last

week, like a last minute story that,

The Motorola phones are expected to cost

more than the Pixels,

probably starting over a thousand dollars.

So pretty hefty phones.

Hopefully the specs make it worthwhile,

but yeah.

Did you find what you were looking for

there or?

Yeah, I'm not seeing any,

I'm not seeing anything that directly

calls that out.

I will say that like the GrapheneOS team

has been trying to contact Google and

trying to get information about what

exactly is happening here.

And basically everything they've gleamed

so far is basically just been relying on

leaks and insider info basically that

they've been able to get.

So

It's a little frustrating that Google

seems to just be kind of dragging their

feet on responding about this and not

really wanting to comment,

which I guess it probably would look

pretty bad if we found out that they

purposely broke it or it's not functional

on their devices now.

It's pretty strange.

But I think we should also just mention

there's people commenting here.

So do you guys read the YouTube comments?

Yes, we do.

We just try to cover the story.

first but after after each story story we

usually try and answer comments um there's

a comment here from david good morning

from melbourne australia good morning yes

it is quite early in australia at the

moment especially on the east coast so so

nice to have you today um yeah so

we got a comment from lulu cuckoo but

surely this is done in an attempt to

stop graphene west possibly under the

guise of saving money

Yeah, that's not super clear yet,

actually.

Personal opinion,

I don't think that's the issue.

I don't think there's enough Graphene

users or custom ROM users in general for

Google to care.

And there'd be so many other ways.

They could just stop supporting bootloader

unlock.

There's a million other ways that they

could stop Graphene.

I don't think Google really cares that

much.

Maybe if it keeps growing,

they might worry about stealing their user

base.

But I don't know.

Personally,

I don't think that's the issue.

Yeah, another comment here from Rastanuka.

Hi from Guatemala.

Hello.

We've got viewers all over the world

today.

Awesome.

I did find it here on Blue Sky.

It's the second thread where they

announced that they did find MTE support.

Basically,

they said it was forced disabled when

Android SEVENTEEN originally launched,

but it's not disabled anymore in the new

beta.

So yeah, I guess it'll,

and it says Google originally claims,

or there were leaks that claim that they

cut MTE because of performance issues,

which is weird because like you said,

they said it was a, like what,

a five percent performance hit so far.

So I don't know.

Yeah, that's strange.

I don't know.

I hope it does come back for stock

Pixel users as well, just because...

It is a good security feature.

It's one of those like behind the scenes

invisible things that protects everybody.

And I just,

I hope it'll come back for stock users

too.

So, but I don't know.

We'll see, I guess.

Let's see,

unless you had any more thoughts on that.

I think, well, let's see.

David here says there are twenty million

people in Australia and yet estimates only

five K graphene OS users.

Yeah, the last estimate I heard,

I think they said that based on because

obviously graphene doesn't like keep

statistics,

they don't ask you to register or

anything,

but they can kind of take an educated

guess based on how many update pings they

get from the server.

And the last estimate I saw,

this was years ago, was like,

thirty thousand users,

which is still globally not that much.

So, I don't know.

Braden here said,

Jonah is the one that's been using Zen.

I've been more interested in as of late.

It seems like the forum people were saying

was a honeypot.

I have not seen that thread.

I have not been keeping up on Zen.

That would kind of be news to me.

I don't know if you've heard anything

about this.

I would say that's not something that I've

heard it claimed,

but I would say just take that with

a pretty large grain of salt.

As far as I know,

there's no evidence of that being the

case.

I think there's some people who might be

unhappy with the amount of connections

that Zen makes by default,

but they're sort of people that would be

like,

any single connection without my

permission is a honeypot.

And I'm like, well, I think, you know,

we have to have

You have to have reasonable expectations.

It's not really a privacy browser.

It's just a browser that has these

features.

And Oddbite said,

everything is a honeypot, lol.

Yeah, I mean,

it is kind of a thing in this

community.

Like a lot of times people just call

things a honeypot if they don't like it.

So unless there's actual proof that that's

the case, then I just...

I'm not sure if that would be applicable.

I use Zen.

I've never had any issues with it.

I don't think there's any evidence that

that's the case.

It's definitely beta software.

It definitely is...

There's issues with it that are very minor

issues,

but it's definitely not a stable piece of

software at this point.

It does have issues,

but they're mostly being worked out.

So if you do want to try it

out,

it's definitely worth giving it a shot.

If you need a good vertical tab

integration, because, yeah,

there's not really that many other

options.

Yeah, I think...

personal pet peeve is i think it annoys

me when people don't understand

circumstantial evidence and so they'll be

like oh like signal is a big one

right everybody's like oh it's it's owned

by the u.s and i think way back

or owned by someone in the u.s and

i think way back in the day they

got a little bit of funding from incutel

or maybe that was proton and but you

know they like they draw these red strings

and they're like therefore signal is a

honeypot and anyone who disagrees with me

is either in on it or just doesn't

understand and it's like no it's

You're welcome to think that it's a

honeypot, but you also need to understand,

like, look, I don't have a smoking gun.

Here's all the reasons I think it.

But I don't know.

I think people are just a little bit

too quick to be like, no,

I know this for a fact.

And it's it's I don't know.

I think we all need to be a

little more open minded sometimes when it

comes to that stuff.

But I don't know.

I'm probably rambling already.

It's a little too early in the show

for me to be rambling.

No, Nate, I think you've got to,

I think you've got to move on to

more rambling.

I think you've got to talk a bit

about this next story here.

One password, unfortunately.

Oh, nice transition.

I love it.

I love it.

Yeah.

So, uh, this, this is a forum update.

Um, for those of you who didn't know,

we,

we have a forum at discuss at privacy

guides.net and, uh, yeah,

people are always asking questions,

sharing articles, um, really good stuff.

A great forum for sure.

And, um,

This was posted a little bit earlier this

week.

This kind of comes from a blog post

that went viral and then got written up

in The Verge.

And I'll quote The Verge headline.

It says,

one password wades into right-wing mess

after funding a Linux project.

So basically what happened is one password

pledged three hundred thousand dollars of

support for a Linux distro called Omarchy,

which is overseen by a nonprofit called

Omacom.

And

OnePassword pledged that money to Omicom,

to be fair.

Omicom and Omarchy are headed up by a

guy named David Heinmeier Hansen,

who I believe is called DHH for short.

And let's see, I did my research.

He is best known for creating Ruby on

the Rails, Basecamp,

and the Hey email client.

And Omarchy is basically DHH's version.

I'm just going to call him David.

It's basically David's version of Linux.

And it's a base of Arch Linux.

And apparently is like one of one

passwords, biggest customer environments.

Like apparently a ton of one password

users are using this distro.

Um, so yeah,

This kind of went a little bit viral

in our community, or I should say,

I was interested in this post when I

was reading through it.

Because obviously the first thing that

came to mind, I shouldn't say obviously,

but for those of you who were here

a couple months ago when we talked about

Mulvad's CEO donating to a political party

in Sweden,

that was also very heavily right-wing,

and they had a lot of... Oh, yeah,

sorry, I skipped over that part.

Um...

this David guy, DHH,

the reason this is so controversial is

because this dude's been very open for

years.

Um,

at least going as far back as twenty

twenty three,

where he's been writing very,

I would say very overtly racist blog

posts.

Um,

Like, what is it here?

He wrote something.

Okay.

So back in twenty twenty three,

Duke University Libraries dropped one of

his products, citing, quote,

harms we see perpetuated by the leadership

of Basecamp's parent company,

Thirty Seven Signals,

which is co-owned by DHH.

At the time,

they noted DHH's attacks on DEI programs

and that Basecamp had banned societal and

political discussions at work,

which basically

I don't know, to be fair, maybe,

maybe work isn't the best place to talk

about that.

I don't know.

Um,

but this year he published rants and blog

posts that call for ethnic cleansing in

Europe.

In July, he posted a blog titled wolves,

sheep, and gypsies,

where he implies the immigrants are wolves

and his solution quote,

when wolves get out of control,

you shoot them.

When gypsies take over public spaces,

you deport them unquote.

And, uh, for the record, um,

I'm actually told that gypsies is kind of

a racial slur and I should probably stop

saying that, but, um, uh,

So one password kind of defended this.

One of their co-founders played it down by

basically saying like,

everybody's entitled to their opinion.

Actually, I'm going to read what he said.

I'll let him hang himself with his own

rope.

As I said,

people have different personal...

This comes from my internal Slack

messages.

As I said,

people have different personal opinions.

You believe in your heart that DHH is

evil and you have the moral high ground

and nothing will change your mind.

However, not everyone believes that.

It is not fair to claim a monopoly

and ostracize team members who might

disagree with you.

There are people who are afraid to speak

up simply because they will be personally

attacked.

in which case maybe stop attacking your

employees.

But the actual CEO was a little bit

more diplomatic.

He said,

one password does not endorse hateful

dehumanizing or exclusionary views,

including those shared publicly by DHH.

And the article goes on to note that

Omicom has been funded by twelve other

patrons, including Michael Dell,

Jack Dorsey, Shopify's Tobias Lukey,

Stripe CEO Patrick Collison.

And the Shopify CEO recently endorsed the

idea that wealthy Canadians should have

more voting power than poor people.

So yeah, really,

really great ideas going on there.

But no,

the reason I said I was a little

bit –

I found this discussion interesting

because in the forum,

the first thing that came to mind was

everybody thought about Moldad.

And everybody seemed to kind of agree that

this is a little bit different because in

Moldad,

it was the case of the CEO donating

directly to a political party.

And in this case,

it's more of the company donating to a

project that happens to be headed by

somebody who has not great political

views.

I will say –

I guess this might be me getting on

a soapbox a little bit.

One thing that really bugged me with the

Mulvad controversy is I saw a lot of

people attacking each other in the sense

of like, oh my god,

you're so dumb if you care about this.

Who cares?

Mulvad's a good VPN.

And it really kind of bugged me that

it's like, man,

even if you want to keep using Mulvad

VPN,

I think you should have a little bit

of sympathy for people and understand that

maybe they don't want to be giving their

money to this person.

And I feel like I didn't see that

as much this time around.

I feel like the discussion was a lot

more civil, a lot more open-minded, but...

the other thing that I thought was

interested was this kind of shifted to a

discussion about Oh Marky,

which was kind of my thought.

Cause when I first saw this story,

I was like,

I've never even heard of Oh Marky.

And I looked it up and granted,

I'm not super technical,

but I skimmed the Wikipedia page and I'm

like, why are they even donating to this?

This doesn't seem like there was nothing

in the description that I looked at.

And I'm like, Oh,

it makes sense why one password would be

interested in that.

But yeah,

that's kind of what the discussion turned

into from there is everybody talking about

like,

what does Oh Marky bring to the table

that, you know,

other things don't do better.

Why are they giving their money here?

But yeah,

I don't know.

I'm not super, like I said,

I'm not super technical on this stuff and

I've never heard of Omarky before,

but I see you made a couple posts,

I think, in this forum thread.

Do you have any additional thoughts or

context that I missed or anything like

that?

Yeah, so over the last week,

we had an issue actually opened quite a

long time ago by someone called Cynthia on

a GitHub page.

And basically,

she just put together a list of a

lot of issues with this distribution.

So firstly,

this is probably one of the worst Linux

distros I've ever seen.

It's basically,

it goes against almost everything that I

think a lot of people that use Linux

use Linux for.

And that is, it's,

it bundles a lot of privacy invasive

applications by default.

Like it includes a bunch of Google apps.

It includes AI integrations by default.

So on top of all that weird stuff,

It also does some pretty bad stuff from

a security perspective too.

So it uses outdated packages.

It actually holds packages back for twice

as long as Manjaro.

Manjaro already had this problem and

somehow they decided to make it even

worse.

So I'm not sure why they did that.

They also use blindly built AUR packages.

If you're not really aware of AUR

packages,

it's basically a

it's a file that has instructions for your

operating system to build a package for

your operating system.

Right?

So basically anyone can upload these to

the AUR and

It also kind of increases the chances of

someone maliciously changing one of these

package build scripts to include malware

and stuff,

which we have seen in the past.

So blindly building from a package build

is extremely dangerous,

and you probably shouldn't do that.

You should be reviewing the package build

every single time you build the package.

So they're blindly building them and

deploying them to people's devices,

which...

all it takes is one person to basically

just modify one of those packages.

And now every single person that's using

it is now infected.

So that's kind of a massive problem.

It used to rely on the chaotic AUR,

which is basically means that it's

even less of a requirement to actually

commit to it.

They also migrated to their own package

repository,

which automatically builds package builds

again, which just has the same problem.

And yeah,

there's a lot of other issues as well.

They have a very strange security posture

here.

they decided to disable package

signatures, which the AUR,

like the Arch Wiki specifically says,

do not disable this unless you absolutely

know what you're doing.

So basically you could, you know,

build a pack,

like you could maliciously install a

package because it doesn't check against

the PGP key of the package.

So that's already kind of concerning that

they would allow that.

And then also what Nate said is this

whole thing surrounding this DHH guy.

It's a terrible Linux distribution that's

getting money from one password.

And the guy that runs it is an

asshole.

So, like, this is just, like,

every single possible bad thing all in

one.

And one password is giving them money.

So I think just from a technical aspect...

even if you don't care about this DHH

guy,

even if you agree a hundred percent with

everything he says,

this Linux distro is bad.

It's not a good Linux distro.

They should not be getting money.

They don't know what they're doing.

There was even another post that I saw

here, basically,

which allowed anyone on a Omaki Linux

system to gain root access because they

allowed the Docker group to have access to

root so basically docker would always run

as root so you could run any command

as root without any authorization so you

know this is like basic stuff um this

is basic security stuff that you know i

think a lot of times this this this

this linux distro seems to be quite

focused on vibe coding quite focused on ai

stuff

Maybe not the best idea from a security

perspective.

They're probably using it in the

development process too.

But yeah, in other words,

you can basically compromise a normal user

application could basically just gain full

root access on, on Omaki Linux.

So if you are using Omaki Linux,

I would suggest not doing that.

Um,

cause they don't seem to have very good

security practices.

Um, and so, yeah,

we're not going to recommend using that,

but I think the main thing here is

one password giving money to such a

terrible project.

And then also like Nate said,

this guy has like pretty,

pretty ad abhorrent views on a lot of

things, which,

Obviously,

that's up to your own political

orientation,

but I think it's definitely a good thing

to note and an ethical concern for a

lot of people.

yeah for sure that's uh what a lot

of people were saying like towards the end

of the thread here um one user said

it's really frustrating to see the wrong

things getting rewarded in what universe

is the work of omarkey worth thirteen

million dollars i think he's talking about

all the other people that have donated as

well he said there's better places for

that money to go like kde sfc hyperland

etc um

Um, he's like, I think,

I think less of one password now,

and that's putting aside all the

horrendous political stances at issue.

Somebody else had said,

imagine XIII million going towards wine or

steam proton prime Linux gaming,

maybe even wine getting more improvement

to allow a solid transition away from

windows.

So yeah,

that seems to be a popular take.

Like you just said is it's just even

putting aside the political stuff.

Like this is just not a very solid

distro and it's super weird.

So unfortunate,

but really quick before we do move on,

I do want to share, you know,

some people are still, as with anything,

some people are like, Hey, whatever.

It's still like one password,

still a good password manager.

I'm still going to use it.

Some people are just kind of like that

one guy.

Like,

I don't know if I trust one password

anymore.

So at this time, our recommendations,

we do recommend proton or yeah.

Proton pass.

We do recommend bit warden at this time.

We do still recommend one password.

We recommend persona.

And we recommend KeePassXE as well as

KeePassium, GoPass,

and KeePassDX for Android.

I was skipped right past that, my bad.

So yeah,

check out the website if you want some

other recommendations,

if you're interested in getting away from

one password.

If you care, if you don't care,

then hey, we still recommend it.

Yeah, on that note,

we did actually have some updates

pertaining to Arch and one password.

But real quick,

I think I flagged a couple of questions

here in the chat.

Yeah, somebody asked here,

recently heard about Kagi search engine

rejected as a tool suggestion on the

forum,

but that was back in twenty twenty three.

Any more recent thoughts about it?

I would have to go look up why

it was rejected to have thoughts,

to be honest.

I don't know if you have any thoughts

on that.

Um,

I think there was a response here from

Jonah.

So I'll just read what Jonah said and

the reasoning behind what happened,

like why it was marked as rejected.

Um, so Jonah said,

given that four search engines,

which meet our existing criteria and also

are quite good, um,

give you the option to disable ads

natively for free.

Um,

Basically,

that's what is excluding Kagi from being

included in our criteria at the moment.

So, yeah.

There's some interesting stuff in this

thread.

I would say, you know,

if you're considering it,

we can always come back to this again.

I think...

They've definitely made some progress on

things.

And if you do think that maybe we

can...

have a further discussion about this.

There was someone from Kagi who joined the

forum and answered some of the questions.

I think they have improved the privacy of

the product a bit more,

but the issue I think was using an

account,

linking it back to your identity is a

little bit of an issue.

I know they've worked pretty hard on

trying to protect that information,

but it does kind of happen when you

when it requires an account,

it becomes a privacy issue.

And especially when we have all these

other free options that don't require

that, it becomes tricky.

I don't think just because we don't

recommend it doesn't mean you shouldn't

use it.

You should weigh up if this is reasonable.

Oh, yeah,

Oddbyte says there is the privacy pass.

Yes.

So they do have, like,

a way of protecting that information.

But I think...

It's, it does make it a little bit,

I'm not sure if that would still fit

our, our requirements though,

but we can revisit this.

We haven't really had much like movement

on this really.

So I'm not really sure if it's sometimes

it's just like people in our community are

not like pushing for it super hard.

So if people aren't pushing for it,

then it doesn't get updated and it doesn't

get added.

So if this is something you want to

see,

you have to really make your voice heard

on the forum.

Yeah, looking at the minimum requirements,

it says must not require users to create

an account for search engines.

So if you believe that Kagi should be

eligible,

then I guess that would be the argument.

Like, why is that OK?

But like you said, yeah,

I don't think any of us recommend against

Kagi.

It's just we've already got several other

options listed.

And yeah, I don't know.

I guess I got nothing else on that.

What else here?

Somebody on the graphene topic real quick,

they said,

sorry to bring it back to graphene,

but I lost it.

Where'd it go?

Could it be that Google may want to

backdoor on pixels?

I don't know.

I don't think so.

I feel like a lot of phone providers

are actually being pretty adversarial with

police and making life harder for them.

Like, you know,

iPhones rolled out that thing where they

automatically reboot after three days now.

So I don't, I'm also, again,

I'm not sure if getting rid of MTE

was necessarily the best way to do that,

but.

I could be wrong.

I'm not an expert on that kind of

stuff.

The last one I had here,

Jan Modal said,

any thoughts on the proposed takeover of

Hugging Face by NVIDIA?

Seems like a threat to open source weights

and local AI.

I mean, me personally,

I don't really have too many thoughts

because I think, again,

this is another technical thing that goes

over my head,

but I don't think AI is really open

source enough anyways.

Yeah.

Like,

I don't know if open sourcing the models

like that really counts.

And also like our old coworker M really

made a good point that I think about

a lot now that like,

there's kind of two sides of AI when

we talk about privacy.

There's the privacy of the end user and

using open source models and open source

clients and stuff like that.

But then there's the fact that all this

training data was taken from people who

didn't consent to it,

who can't opt out of it.

So there's kind of the argument that AI

can't be private in the first place.

I don't know.

To me,

it's very low on my list of priorities

when it comes to AI.

I don't know if you have any better

insights.

Yeah,

I think we're kind of pushing for people

to use local AI instead of these cloud

providers.

If you do check our recommendations,

we do recommend some stuff that's like

using these

I guess like local,

like open weight models, I suppose.

And, you know,

we've got some recommendations.

We recommend Kobold, CCP, CPP, CPP, CPP,

Olamer, you know, stuff like that,

Olamer file.

So, you know,

we think people should be using these from

a privacy perspective, but like Nate said,

and like what Em has kind of,

if you follow Em on Mastodon,

you'll know that she's like,

very outspoken against this ai stuff um

and she has really good opinions on this

sort of thing um the the data that

is getting scraped up by these ai models

is gargantuan it's non-consensual it's

it's not great so i think we have

to also think about the privacy of you

know all those people as well uh when

you use these models i think you are

kind of

I guess using all that data that's been

scraped up by these AI companies.

So, you know,

I think that's a little bit morally,

it's a moral issue,

but I think if you just want privacy

for yourself,

you should be running these local models.

But I think, you know,

The takeover of Hugging Face by NVIDIA,

I don't think it's going to have that

big of an issue because there's so many

other companies that have and host these

models too.

So I'm not really sure if that's going

to have a huge impact in my opinion.

Yeah.

I know we're getting some other questions,

but we'll save those for a little bit

and we'll move on to some of the

site updates.

And I think I'm going to turn it

over to you, Jordan,

because we were talking about Moldad and

Arch,

and I know we have some updates pertaining

to that stuff.

yes so um i've been i've had a

little bit of extra time this week so

i was going through some of the pull

requests that we needed to get um put

through so i guess the first one is

fixing some dead links on the site there

was a bunch of stuff that was like

originally linked to the original page and

the link became dead so we've had to

archive those um

So those have been updated to actually

include archive links instead.

And like I talked about before,

we were talking a bit about Omaki Linux.

And it was because we had suggestions to

recommend against Omaki Linux because we

recommended against Garuda and Manjaro

before.

But that was, as far as I'm aware,

I could tell was those were old

recommendations from privacy tools.

So we kind of don't do

anti-recommendations anymore.

We don't recommend against anything.

We just make suggestions that people

should use something.

So we kind of had a bit of

a discussion between some team members and

also some community members as well about

this.

And we kind of came to the consensus

that we shouldn't be recommending against

specific arch derivatives.

And instead we should just be making

suggestions such as, you know,

being careful about using the AUR and

suggesting that people use only the

mainline arch

distro so yeah we are trying to move

away from anti-recommendations because I

think if we did include

anti-recommendations the entire site would

have it would be so bloated there would

be so many things everywhere about not

what we what we don't recommend what we

do recommend it would just be not great

and I think that's

kind of been something we've been pushing

for for quite a while to update that.

So that has been updated.

And there was some work there from Daniel

and Freya who both worked on that.

I also did a little bit of work

on that pull request too.

And there was another one here and that

was removing Molvad DNS because

The writing has been on the wall for

a while,

but Molvad's public DNS provider is not

available anymore.

So I guess this is something that we've

known was going to happen for a while.

There was information about that happening

for a little while,

but we removed every mention of Molvad's

DNS service from our website because we

did used to recommend them.

So their encrypted DNS providers are no

longer operating.

There was a forum discussion about this as

well.

It's kind of been sad because we've seen

quite a lot of DNS servers being shut

down as well.

But it looks like Molvad made a blog

post here and they're sponsoring QuadNine

instead, which I think makes sense.

QuadNine is a great project.

They've also been super reliable when it

comes to

public DNS servers.

So it's definitely interesting.

I guess I'll read a little bit from

Malvad's blog post for why they're doing

it.

Malvad has operated public encrypted DNS

service since twenty twenty two.

They are unnecessary when using Malvad

VPN.

Traffic is already encrypted and Malvad's

VPN internal DNS handles all queries

outside the VPN.

They serve two purposes.

Malvad browser uses them by default when

you're not on Malvad VPN,

preventing your ISP from seeing the

domains you visit and anyone can use them

as a free public service to protect their

DNS queries.

We want

A public service to be available going

forward will support Quad Nine instead of

running it ourselves.

Running a privacy focused public DNS is

highly specialized undertaking and the

Quad Nine Foundation is the undisputed

leader in the field.

Rather than duplicating their efforts to

achieve only part of what they do,

we're putting resources towards

financially supporting Quad Nine instead.

So, yeah.

You should be good if you're migrating.

If you're manually selecting the server,

you'll need to update that.

And if you use iOS or macOS profiles,

you'll need to delete those and replace

them with the quad nine ones.

So, yeah,

very interesting stuff going on with site

updates this week.

Lots of changes.

I guess I'll throw it back to you,

Nate,

for we've definitely been having a lot of

news briefs going up this week.

So definitely a big week.

Yeah.

For sure.

I'll just say I'm sad about them shutting

that down because Quad Nine's great,

but they don't do any ad blocking or

anything.

And I think I was using Mulvad's DNS

on my TV,

so I need to go check that after

this.

But yeah,

I guess we'll find out when the TV

just stops resolving.

Um, but yeah,

you guys saw on the screen I was

sharing, we,

we do have other recommendations,

add guard control D quad nine cloud flare

next DNS.

So if you're, you were using mall bad,

go check that out.

Um, in the meantime, yeah, we did have,

uh, quite a few, um,

privacy and security news i uh i normally

don't toot my own horn about the data

breach roundup but i do want to give

it a shout out this week because there

was actually a major id uh identification

driver's license driver's license breach

that's actually still ongoing i think that

brian krebs wrote about it and then like

several other major outlets wrote about it

um so it's it's pretty big scope i

think they said they have like

Um,

it's a vendor who works with age

verification stuff.

So, uh,

definitely check that out and just kind of

get the, the basics.

If you're haven't heard that story,

cause it is a big one.

Uh,

the signal Android beta has support for

numberless accounts, uh,

thought about covering that this week,

but I think we'll wait until it's fully

launched.

Cause right now,

like we don't know how the payments are

going to work still.

So there's not a lot to talk about.

Google had a crazy bug where the messages

app was sending old texts to random

people,

a router manufacturer found with multiple

backdoors in the product.

And of course the headline story was

discussed, uh,

as it happened this week.

You know, if you're watching the video,

you can see here's Graphene OS unable to

complete the Pixel port and then Pixel XI

hardware MTE support may still be usable

for Graphene.

So definitely subscribing to our new

section is a great way to stay updated

on things as they happen.

And the last thing to mention is we

do have some new videos coming out.

We had our password manager tier list

video, which got a lot of views,

got a lot of traction.

People had a lot of opinions.

That's super cool.

So if you haven't seen that,

check that out.

And we have an interview coming up with

someone who works on the

the more like corporate side of things in

privacy.

I don't really know how to describe it,

but yeah,

it's gonna be really interesting.

We talk about a lot of how do

you figure out what marketing is legit and

what's not,

how do you read your privacy policy,

all kinds of cool stuff.

And we just started editing,

Jordan just started editing a video about

Apple versus the FBI.

For any of you who were around and

old enough to have memory in twenty

fifteen, twenty sixteen,

that was a really wild story.

And we got to dive into how it

worked.

And I think that one's going to be

pretty cool.

I'm excited about that.

So, yeah.

All this is made possible by our

supporters.

You can sign up for a membership or

donate at privacyguides.org or pick up

some swag at shop.privacyguides.org.

Privacy Guides is a nonprofit that

researches and shares privacy-related

information and facilitates a community on

our forum and on Matrix where people can

ask questions and get advice about staying

private online and preserving their

digital rights.

And I think now we're going to talk

about a story that illustrates how much

control certain governments can exert over

the internet.

And again,

remember to leave your comments and

questions in the chat,

and we will get to them in between

stories.

Yes,

so this week there was something that

happened that involved the current United

States administration, let's just say.

Trump goes after anonymous email provider

in Italy.

The real target is free speech in the

US.

So Secretary of State Marco Rubio and

Treasury Secretary Scott Besant

announced Wednesday that they were

targeting the Italy-based Autistici

Inventati Collective with terror

sanctions.

A wide array of anarchist, anti-fascist,

and far-left groups in the US and abroad

use the privacy-minded collective's

offerings,

including an anonymous email service and

its popular NoBlogs.org blogging platform.

The practice of designating an internet

platform and service provider as a terror

group

rather than those pursuing violence

themselves,

has huge implications for the future of

free speech on the internet,

warned Gillian York,

the Director of International Freedom of

Expression at the Electronic Frontier

Foundation.

They're going after the messenger,

York said.

I don't think that the members of the

group would necessarily condone the

actions of people that they hosted.

What they do condone is the freedom to

host, the ability to be anonymous,

and the ability to be private.

The AI collective told The Intercept that

it is exploring its legal options to fight

the sanctions which blocks US citizens and

companies from providing the group with

financial support.

Anti-fascism and anti-capitalism are not

terrorism.

The group said protesting is not terrorism

and everyone has the right to speak out

and to struggle for humanity.

And the state and Treasury departments

justify the designation by alleging that

the Autistici Inventati Collective,

also known as AI,

has provided services to foreign terror

groups,

including anarchists who have launched

attacks on railroads and pipelines in

Europe and by domestic left wing groups

that have employed violence.

So I guess we will start by saying

This is, well, okay, I'll just,

I'll pivot to this other article here.

This is from the EDRI,

their European group that basically

supports digital rights.

And it says,

EDRI stands in solidarity with Autistica

Inventati after terrorist designation by

the US government.

And basically,

their stance on things with how this works

is that

this is an attack on decentralized

nonprofit communications providers.

And that if this was to be,

you know, if they were,

if they were to do this properly,

they should have gone after the specific

posts and gotten those removed instead

through, you know,

legal means instead of just blanket

labeling this entire organization as

terrorist group.

That is usually how things work.

Imagine if, for instance,

Signal was designated a terrorist

organization and just because there was

people using it who were, you know,

using it for supposedly nefarious purposes

which, you know,

I think even then we don't really know

how accurate a lot of these claims in

the press release from the US government

were.

I think, you know,

that's a lot of loaded language in there.

It's definitely like, you know,

we're not a hundred percent certain that

those things are actually true.

So I think it's definitely an attack on

free speech.

It's an attack on...

freedom of expression.

And one issue that happened with this was

that the public interest registry,

which is based in the United States,

they disabled Autistici's main domain,

Autistici.org.

And, you know,

their PayPal account got seized.

Their bank is like almost,

it's possible their bank account might be

closed due to these sanctions by the

United States government.

And it's kind of showing, you know,

a lot of people think, you know,

the United States are the good guys,

but what happens when they're not the good

guys?

What happens when the United States

government doesn't,

isn't on the right side of history?

What happens when that happens?

And it's,

It's not good.

They have too much control over...

This is an Italian hacktivist group.

Like,

they shouldn't be able to have their

domain seized by a foreign country.

That's a little weird.

So anyway,

kind of been rambling a little bit,

but hopefully I've kind of shared enough

about the situation.

Do you have any thoughts, Nate?

Uh...

Sarcastically,

my first thought is I am an American,

born in Texas,

several generations of American,

and I approve everything you just said.

And a veteran.

No, yeah, it's really unfortunate.

You and I were talking about this a

little bit prior to hopping on the call

here.

It's – I don't know.

To me, this is such an obvious –

attack on free speech and it's so like

the the thing i haven't seen anybody

talking about is exactly what you

mentioned and you brought up where it's

like it shows in this case america but

i'm sure america is not the only one

like some of these countries can just

exert way too much control over um

over technology.

And I know I've,

I've personally been harping on this quite

a bit lately, but there's, um,

there's like an overlap, you know, we've,

we've criticized that.

Some people are just like, Oh, you know,

I stay out of politics.

All politicians suck,

which for the record,

a hundred percent with you on that one.

Um,

but like all politicians suck and like,

just, it's, it's all about the encryption.

It's all about the tools.

Cool.

And what happens when the government comes

in and shuts down the servers or makes

that tool illegal and they have other ways

of pressuring?

Because even with the decentralized stuff,

it's easy to sit here and be like,

oh, well, yeah,

they could shut down Signal,

but they can't shut down Session,

for example.

There is not a doubt in my mind

that they can find a way.

They can start – or at the very

least,

they can make it such a pain in

the ass like –

I wrote a personal blog post a few

weeks ago about signing in over Tor and

when it's a good idea and when it's

not.

And I mentioned that websites that block

Tor, known Tor exit nodes,

like banks and stuff like that,

doctor's offices,

there's not really a point in doing that

because most of them are already, again,

they're banks, they're doctors,

they know who you are.

But on top of it, yeah, sure,

you could sit there and refresh Tor five

hundred times until you get an exit node

that's not blocked.

But me personally, after a while,

it just becomes such a pain in the

ass.

It's like, I don't even care anymore.

I'm just going to do it with Brave

or Moldat or something with a VPN.

And so, I mean,

that's kind of the thing is like, yeah,

they may not be able to block a

hundred percent of the session nodes,

but maybe they can block enough of them

that it's effectively useless.

And my point being is just, it's all,

it's everything matters.

It's like the technology matters.

The encryption matters.

The like taking away their ability to

recover the data or spy on the data,

but also the politics and having good

privacy laws and voting in politicians who

are not completely insane and understand

how technology works.

And yeah, it's just not great.

Not great.

Not a fan of this.

So.

I also think this is another thing that,

you know,

this is a platform that supports

grassroots activism.

This is like one of these things that

we really harp on to people,

like grassroots activism is really

important,

like getting your city council to get

these flop cameras down, to get, you know,

all these laws pushed through, right?

It's important stuff that

uh, that these organizations are doing.

Um, I'm sure, you know,

we don't agree with everything that this,

uh, organization has, you know,

hosted on their platform.

I'm sure the people that host, um,

Autistic Inventati don't agree with

everything that everyone posts on their

platform,

but that's like not really that relevant.

I think it's,

it's just a platform for people to

organize

grassroots campaigns.

And I just think that's really important,

but also there's other organizations that

do a very similar thing to, um,

to order Stacey,

like rise up.net is another one that does

a similar thing.

And that's a U S based one.

And I think this also pushes us towards

this idea of, you know, I know,

I don't want to bring it up,

but like slippery slope,

like if this is the first,

if this is the first platform that gets

taken down, um,

what could be next?

What could be the next platform that gets

taken down?

And I think anyone that's super familiar

with the United States sanctions will know

that it is very brutal.

It basically can destroy an entire

country.

It can destroy an entire project.

So

I think it's definitely not great,

but it seems like Autist DC is still

surviving.

Their main domain got taken down,

but all their other domains are still up.

So yeah,

you can still visit their website and

everything seems to be rolling along

pretty well still for them.

So it'll be interesting to see what

happens on September,

which is when it's the deadline for

basically all U.S.

entities to basically drop any sort of

support for the organization.

So it'll be interesting to see what

happens by September, September,

and EDR is calling upon basically a bunch

of organizations to reverse that course on

this.

They're saying the United States

government needs to reverse its decision.

The EU needs to actually make a move

on this.

The government of Italy needs to publicly

defend

Autistici.

Financial institutions,

internet registrars and infrastructure

providers need to refuse to act on third

country designations that have no force in

European law.

Yielding to financial pressure when no

legal obligation exists is a choice and

not a necessity.

And also digital social justice and other

civil society organizations and

collectives need to stand in full

solidarity with Autistici Inventati.

And yeah,

acknowledge the key role that safe and

secure decentralized digital

infrastructure plays in our collective

strive for justice.

So yeah, this is really worrisome.

There's already been a lot of

organizations that have already signed on

to the EVRI's statement.

Lots of important organizations have

already signed on.

So it's really important that we do stand

for free speech and

against this unjust restriction of an

internet service provider.

So yeah, it really sucks.

I think it just shows the vast reach

that the United States has over the

internet in general,

and it's definitely a scary time for the

internet.

Yeah,

I don't have anything to add to that

that you didn't already say very well.

So let's take a couple of questions.

This one came in right before we went

to site updates, but Hair Elite says,

any thoughts on the minimal phone two now

offering an OEM de-Googled ROM option?

It's not graphene,

but it's a step in the right direction.

I don't know much about the minimal phone.

I actually looked it up just now.

I guess I will say me personally,

I like the ethos, you know, distractions,

free smartphone.

Oh, wait a minute.

No, I'm looking at the pictures now.

And I think I have seen this thing

before.

I don't know.

I don't think it would be right for

me,

but I think it's a pretty cool idea.

I don't really have any thoughts on the

OS itself because I don't know much about

it.

Are you more familiar with this, Jordan?

It does look like it's based on the

MPO two phone model,

which I believe is like a

It's a design that other devices also use,

it looks like.

I'm not entirely sure.

Yeah,

it's not really something that I've looked

into too deeply.

I think it definitely looks interesting.

I kind of like these small form factor

devices.

It kind of sucks no one's really making

any of these.

I mean, it looks interesting,

but I guess we don't really know too

much.

It looks like it might still be...

Is it available right now?

I'm not sure, but it looks cool.

I think I would be interested in trying

it out, but it's like, yeah,

it's definitely a more niche product,

I think.

Should be available.

I'm looking on the page here and I

see a buy now button.

It says expected to ship in ten business

days, free worldwide shipping.

Looks like their Kickstarter campaign has

got four days left.

So, yeah,

it looks like it might be coming soon.

That's interesting.

No, it's interesting.

I don't know.

I don't really have too much to add.

We would have to, like,

there's so many things that we have to

review.

Like,

we're reviewing so many different products

at the moment.

Like,

I know there's security keys and there's

hardware wallets and there's all sorts of

stuff.

And it's, like, another phone.

Like, yeah, it's tricky.

I know Jonah does a lot of that.

So maybe Jonah...

Might have an opinion on this device,

but he is not here this week.

So, yeah,

if you do want to get his opinion,

maybe ask next week when he's around or

the week after.

Yeah,

that's kind of all I have on that

one.

But Lulu Cuckoo says...

I just want to say thank you so

much for all your work.

You guys are really doing necessary work

letting and helping the average Joe like

myself know of genuine and true dangers.

You're awesome.

Thank you so much for like such a

sweet comment.

That is, that is really nice.

Yeah.

I hope we, we can provide some,

some good information and yeah, it's,

it's awesome.

I love doing this work.

It's really, it's really rewarding stuff.

So I'm sure Nate feels the same way.

I do, yeah.

Thank you so much.

The human brain is wired to remember

negative stuff more than positive stuff,

which is an evolutionary advantage.

If you walk through the forest a thousand

times and nothing bad happens,

then that's fine.

If you walk through it once and a

tiger almost kills you,

you need to remember that.

But unfortunately,

in this modern digital age where we're

online,

it just means that one person leaves a

bad YouTube comment.

It's just like all your brain thinks

about.

It is nice to get the

The nice comments like that,

my brain is blanking on words right now,

but it is helpful.

It's very motivating and it is appreciated

to get that kind of stuff every now

and then.

So thank you.

Real quick,

Skin Compile talking about the Italy

story.

He said,

this is another reason why I have nothing

to hide is invalid.

Yeah,

it's nothing to hide is a very

self-centered argument for sure.

And usually not true, but...

On that note,

speaking of having nothing to hide,

we're going to talk about California's age

verification bill that has passed with a

Linux exemption.

So a lot of you guys,

I think you've heard of this.

This is kind of an update, really.

So California proposed this law that would

require age verification to be done at the

operating system level.

So...

I don't really know how to explain this.

Basically like when you set up windows or

Mac or at the time, even Linux, uh,

you know,

it would ask for your birthday or

whatever.

And, um,

I will say I have not read the

bill itself, so I don't know.

Um, yeah.

Uh,

when an operating system runs on a device

and includes an account setup feature,

it must offer an interface that asks for

the account holder for the date of birth

age or both of the devices,

primary user during account setup.

Um,

I will say from my reading of this

again,

I haven't read the bill itself or the

text of the bill.

I don't think they force you to turn

over ID.

They just ask you to put in a

birthday or an age.

Um,

and then it's supposed to provide an age

range.

One of four under thirteen,

thirteen through fifteen,

sixteen through seventeen or eighteen and

older.

Um,

Yeah, I mean,

we've we've railed against age

verification so much here.

I'm not even going to bother getting on

that soapbox.

But a little while ago,

I think it was California or Colorado,

because that's where Systema Seventy-Six

is from.

The team at Systema Seventy-Six went and

talked to their politicians who were

considering a very similar bill.

And basically they pointed out that like

the way these things are worded.

you basically described everything as an

operating system, you know, the,

the firmware that runs on my fridge or

my router, um,

which my fridge shouldn't have firmware,

but here we are.

And, uh, they point being,

they successfully got Colorado.

I think it was Colorado.

Cause I know this one was largely modeled

after Colorado,

but they successfully got them to

introduce like an open source exception.

And it looks like California has now done

the same thing.

So this hasn't been signed by the governor

yet, just to be clear.

It hasn't technically passed,

but I do seem to remember him saying

he was going to sign it.

So now there is this exemption for Linux.

Where is it?

It's a very specific...

Hold on,

let me just check the show notes where

I have it written down.

The definition of an operating system

provider explicitly excludes an entity

that distributes an operating system or

application under license terms allowing

recipients to copy, redistribute,

and modify the software.

So it says most traditional open source

operating system, including Linux,

are outside the scope.

So Linux does not have to do this

in California.

Which is smart,

because how are you going to enforce that?

That would be such a nightmare.

And there's already been several operating

Linux developers who are just like, yeah,

I'm not doing that regardless.

But I will say,

this is my personal take,

is I do think this is less bad

than just a blanket,

like the original version of the bill.

But I personally still don't really see

this as a win.

This is just my personal opinion,

because...

first of all it still screws over so

many people who are using mac and windows

and you know it if privacy really is

a human right which i think all of

us agree with you can't pick and choose

your human rights like either everybody

has them or they don't so people on

windows deserve privacy even if windows is

garbage that's microsoft's fault not their

fault

People on Mac deserve privacy.

We shouldn't be gatekeeping privacy.

So I'm really not a fan of that.

And then my question is, okay,

what if logically this pushes everyone to

go to Linux?

You think the lawmakers are just going to

sit back and be like, damn,

they thwarted us.

That's not what happened in the UK, right?

In the UK,

everybody started using VPNs and the

lawmakers were like, well,

now we need to ban VPNs.

So if Linux becomes so popular,

they're just going to change the law and

say, well, now it applies to Linux too.

So-

I don't know.

I think this is definitely better than,

again,

the original version where it's just

blanket.

Everybody is included,

but I have my reservations personally that

I hope I'm wrong about.

But I don't know if you have any

thoughts on that story, Jordan.

It's kind of a quick one.

Did I miss anything?

No, I think you covered everything.

I mean,

there was like a discussion topic here.

Is this really a win?

What if Linux becomes so popular that they

simply change the law?

I mean, yeah,

I think that is also another thing that

you should...

kind of think about when these laws pass,

it's like, now it's not including Linux,

but like, what if it's?

It can always change.

Now that it's passed,

it's probably a lot easier to change it,

right?

Actually, I don't know.

Would that be the case?

Maybe not.

So I think California specifically,

it's actually really hard to change laws

because I remember the EFF talking about

the California Consumer Privacy Act.

They actually opposed it strictly because

they were like,

we don't think this goes far enough.

And normally in most states, it's like,

hey, this is better than nothing, right?

We have to take our incremental wins and

this is a step forward.

But in the case of California

specifically, they were like,

it is such a pain in the ass

to change the law here that we would

rather just not pass this and try again,

which unfortunately that's not what

happened.

Well, double-edged sword,

that's not what happened.

But yeah,

so I guess that's kind of an argument

against my point is like,

at least in California, it's like, yeah,

changing this to include Linux would

probably be an uphill battle,

but I don't know.

I still have reservations.

Our politicians have proven they can get

shit done when they want to.

They just don't usually want to.

Yeah.

It's always for the wrong.

It's always for the wrong things.

They can get something like a surveillance

law passed in like one day,

but then when it comes to like privacy,

a national privacy law or something,

it's like they just drag their feet for

centuries.

So it is what it is.

I think you've kind of covered that really

well.

So I don't think I have any more

to add on that.

Alrighty.

Well then how about you tell us about

this new offering from brave here?

Yes.

So this is a new feature that's being

added to Brave browser.

Brave launches email aliases to keep your

personal email address private from

websites.

This was published on August,

integration with the browser itself.

Just to make that clear from the very

start,

starting with today's desktop version,

one point nine point four.

So this is released and available now.

The Brave browser is offering email

aliases to allow you to sign up for

online services without revealing your

personal email address.

Email aliases are integrated into Brave,

which means you can generate privacy

protecting email addresses right from a

website's signup form.

These aliases then forward to your real

primary email address.

This remains hidden from websites,

thus breaking the cross-website tracking

link.

The feature can also prevent spam,

since you can easily deactivate your email

alias and create a new one in order

to create an email alias you'll first need

to create a brave account with an email

address and password note that this

account is separate from your brave

premium account which premium users use

for managing subscriptions to some of

brave services such as the brave vpn

And they also have a blog post with

more information on the privacy of these

accounts as well.

They say emails are scanned for spam and

viruses but deleted from their servers

within seconds after forwarding and notes

on an alias are stored locally on device.

So in this initial release,

they are offering everyone the option of

five free email aliases running a mail

forwarding service has ongoing costs.

So they're starting small and they're

trying to gather some feedback and they

are also working hard to bring email

aliases to mobile.

So it's not available on Brave on mobile

yet,

but they plan to offer a premium version

of the feature in the future.

So I guess throwing it back to you,

Nate, what is this?

This is kind of interesting.

This is another email releasing service.

It feels like we've gotten quite a few

of these at this point.

What are your thoughts?

Yeah.

I think,

I can't remember who presented this idea

and put it in my head,

but I think the promising thing there is,

you know, yeah, we've seen, I mean,

obviously things like temp mail and

gorilla mail have been around for a long

time,

but we've got things like simple login,

Addy.io, Firefox relay,

AdGuard spinning up their own thing

recently.

And I think it shows that there's a

demand for this stuff,

which is really interesting.

I feel like I don't,

run into a lot of people who are

using any sort of email aliasing thing,

not even like the Gmail plus trick,

but yeah, I mean,

I guess it's really cool to see.

I feel like there wouldn't be so many

companies breaking into this if there

wasn't a demand for it, I think.

So I guess that is kind of cool

to see that people are trying to do

that.

Cause I feel like email aliasing is a

very,

A very underrated technique.

It's super useful for managing spam and

helping to break up your profile online.

I guess it's really cool to see that

growing, personally.

Yeah,

I think it's definitely interesting to see

Brave moving more into these...

We're going to go back to Mozilla again.

All roads lead back to Mozilla.

But every time we see all these browser

companies,

like Mozilla has been trying to do this

similar as well.

They've got their own email aliasing

service.

They've got their own VPN.

Brave is doing a similar thing.

It's like, you know,

I think it's good to see alternatives to

services that we do recommend.

But I think a lot of times these

services that these browser companies

make,

they're not really on par with

um, the dedicated services such as like,

like Nate mentioned, like Addy,

like simple login,

like proton pass and stuff.

So I think it's, it's always good.

Um, I guess we could kind of cover,

we do recommend some email aliasing

services.

We do recommend Addy.io and we do

recommend simple login as well.

So I think that's,

Basically the two that we do.

Yeah, that's the two we recommend.

So yeah,

it's going to be interesting to see how

this goes.

I think one limiting factor of this that

we mentioned at the start of this article

was this is limited to the Brave browser.

So that's where these other,

these other platforms are more agnostic.

And I think Brave kind of has a,

it would be pretty weird if they're like,

it's an extension,

you can add it to any browser.

It just,

it just wouldn't really make that much

sense because they have, they have a,

a need for you to keep using their

browser because they want to, you know,

They want you to keep using their browser

instead of other people's browsers.

So it kind of makes sense why they

would limit it in such a way.

Um, whereas as far as I know,

Mozilla has made it a little bit more

platform agnostic.

So it'll be interesting to see if maybe

they add like a webpage where you can

manage this instead as well.

Cause I think that would be a good

middle ground option for people.

Um,

So that's also,

I don't know if you saw,

but there was possibly some limitations on

this as well.

So do you wanna maybe talk about that?

So I didn't see,

it's more just in my personal

investigations with a lot of these

aliasing services,

even the well-established ones is like,

you have to really dig into like,

what do you need out of an aliasing

service and what does it offer?

Like a lot of the,

like SimpleLogin and Addy.io are

definitely the best two right now.

I want to say IVPN's MailX or whatever

they call.

I think it also has all the features.

But a lot of the newer ones like

AdGuard, Firefox Relay,

a lot of them have limitations like you

can't initiate an email.

So if you have to say you want

to reach out to a new doctor's office

or whatever and you want to ask if

they have any openings for new patients,

you can't email them from a forwarding

address

they have to email you first and then

you can reply to it.

Or I know, I think,

I think they got rid of it on

the paid plan,

but I think one of the cheaper Addy

plans has like a bandwidth limit.

A lot of them have like a daily

send and receive limit that at very least

on the paid plans is like so high.

You're probably never going to hit it.

But for a lot of the free plans,

it's like, Oh,

you can only send like five emails a

day or something.

So just if you are interested in this,

just definitely try to do your research

and try to get that information.

Yeah.

Unfortunately,

I did not see it listed here in

this menu or this blog post,

but just things to keep in mind.

But yeah,

that's one of my few complaints with Brave

as far as technical stuff goes is they

have really cool products,

but so many of them require you to

use Brave.

Like Leo is Brave only.

Now this is Brave only.

I think there's something else I'm

forgetting that I think is kind of neat,

but is Brave only.

So it is a bummer that it's not

more cross-platform, but like you said,

it makes sense.

Yeah, I think it'll be interesting.

And we're keeping an eye on these new

services that do come out as well.

There was discussion on the forum as well.

So if you want to weigh in,

maybe let us know a little bit more

about the service because we have limited

time.

We don't have time to be covering every

single product and trying to work out the

limitations and such.

But I think

It'll be interesting to see where this

goes,

considering they're only rolling this out

as a free thing for now.

But yeah,

definitely interesting story to keep up

with over the next couple of months.

For sure.

And on that note,

we talked about Mozilla quite a bit.

We're actually going to jump over to a

story from Mozilla.

Some good news.

Mozilla is adding ad blocking for Firefox

on iOS.

At least I think that's pretty awesome,

personally.

Yeah, so I mean,

it's pretty straightforward.

This is a brand new feature that is

opt-in right now.

I think they said that in the future

it's going to be... Actually, hold on.

I have it pulled up here.

Let me see.

Yeah, once the rollout is complete...

There was actually a comment on our forum

about how this works.

You have to enable allow remote

improvements in the Firefox app on iOS to

get access to this feature.

Just thought I'd quickly jump in and say

that it's not going to be available by

default right now, but it will be.

Sorry.

No, you're good.

I was actually going to mention that.

But yeah,

I'm looking at that blog post right now.

So yeah, it will be...

They say once the rollout is complete and

the feature is stabilized,

it can be enabled by default.

And yeah, they also claim...

This is actually somebody from Mozilla

responding here in the forum,

which is another reason you also check out

the forum.

We get a lot of people who work

for these projects come and answer

questions a lot of the time.

Can't make any promises,

but it does happen quite a bit.

And they basically said this whole like...

it does kind of suck you have to

allow remote improvements and in order to

do that according to this user you have

to turn on like send technical information

um but they say that this is basically

only specifically like they're only trying

to gather information on this particular

feature is what this person says it's this

is an ongoing discussion and we're

actually waiting for the mozilla person to

respond to additional follow-up questions

but they basically say like we're just

trying to get information about this

feature to make sure it's stable and

They said we can pause or roll back

the feature without requiring users to

install another app update.

But yeah, beware.

If you're absolute maximal privacy,

you may not want to enable this thing

yet.

You may want to wait for it.

A question that I saw when this thing

first started popping up was,

why don't they build in an ad blocker

on Android and desktop?

So their answer basically is on desktop

and Android,

Firefox already supports a strong

ecosystem of ad blocking and privacy

extensions, such as uBlock Origin.

But on iOS,

extensions are not available in the same

way,

and they had to build it directly into

the browser.

So that's why, although I do remember...

I remember a couple months ago,

we covered a story about how somebody

spotted some code in Firefox to like,

there's like an about config where you can

enable like a beta easy list blocker from

uBlock origin.

So there may be a very basic ad

blocker in future versions of Firefox.

We're still kind of waiting for that to

shake out, but.

Um, real quick,

y'all shall know here said iOS is not

a good idea for privacy.

I mean, yes, we, we recommend graphing OS,

but there's a lot of reasons somebody

might be on iOS.

It might be a work phone.

It might be, um,

like I know me personally,

when I got into privacy,

I had just bought an iPhone like a

year before.

So I'm like, dude,

I'm not going to throw away a perfectly

good iPhone just to run out by,

by an Android.

Um,

there's actually places where pixels are

not for sale that iPhones are, um,

that may have changed.

I,

that I did that research years ago for

an older video, but, um,

Yeah,

we definitely recommend people go to

Graphene OS wherever possible.

But again, privacy is a human right.

People deserve it no matter what operating

system that they're on.

And then I think the last thought that

I had was, Jordan,

do you think this might change our

recommendations for,

because right now we don't recommend,

we only recommend Brave and a hardened

version of Safari, basically.

Do you think this might change our

recommendations?

We might add Firefox potentially or?

I would say no.

Uh, well, I guess this is my opinion,

obviously, like, you know, this,

the privacy guides community is like kind

of big.

We all have different opinions on things

and it's not down to me, Nate, Jonah,

some,

some random person dictating whether

something is going to be added or removed.

But I think like the, the, the,

the benefits that Safari gives you versus,

uh,

versus like Firefox is greater so the

issue with iOS is that you can't install

extensions for third-party browsers and

you can install extensions for Safari

which is huh that's a little that's a

little wacky Apple what's going on there I

mean well I guess the lawsuits will come

eventually um but I think it's it's it's

the issue that we have here right like

you can install an ad blocking extension

on Safari that has actually good coverage,

that actually blocks a lot of stuff.

And like Nate was saying with this Firefox

ad blocker, it's really not...

It's really not that it's not a wide

spectrum ad blocker.

It's just a very basic filter list,

easy list blocking.

So it's not really going to block all

that much.

Whereas, you know,

if you use something like AdGuard and you

use that in conjunction with Safari,

which Safari has fingerprint protection,

it has some extra privacy features that

these third party browsers don't have

access to.

And I think that's going to still beat

out Firefox or Brave browser on iOS.

So I think Safari is still the better

option, in my opinion, over this.

I think it is kind of down to

Apple, though.

We talk about this quite a bit when

it comes to iOS.

Every browser on iOS is kind of limited

by Apple because they control all the

entire platform and

everything is based on webkit if we had

you know a gecko browser on ios i

think that mozilla would have a lot more

control over how it works and the amount

of blocking that could be done but since

it's all by apple it's a lot harder

for them to make much more sweeping

changes which kind of sucks but that is

kind of the situation that we're in with

apple at the moment

Yeah, for sure.

I forgot about the whole third-party

extensions thing.

That's true.

I haven't been on iPhone in a little

while myself.

Yeah,

we can only hope Apple gets forced to

shape up.

That was actually all of our stories this

week.

I think we'll give it just a minute

in case anybody has any last-minute

questions.

Otherwise,

it was a little bit of a lighter

week.

Not as many big stories,

but the stories that we did cover,

I think, were pretty important stuff.

Hoping...

It's nice when we have good news.

We can talk about, like,

the Firefox getting an ad blocker and

Brave, you know,

adding this aliasing thing.

And it's just nice to have good news

sometimes.

Some weeks we don't have it.

No, it's good.

So I missed this comment here from Lucas.

I like your haircut.

Oh.

I mean, it's not real, but thanks,

I guess.

I saw that, too,

and that was my thought.

I'm like, I can't tell if they're joking.

Believe it or not,

my head doesn't actually look like this.

Okay.

Let's see.

People are saying, oh,

Addy.io is pretty good.

Yeah, I've had a good experience with it,

too.

I think any of the recommendations that we

have, you're going to have no issues.

Yeah, I don't know.

There's not too many questions.

I'm not seeing any questions here and on

the forum.

So I feel like maybe we can start

rolling out into the outro.

Next time I'll have black hair.

I mean, I can change it easily.

So I mean, yeah,

maybe next time I'll have black hair.

Maybe I'll have orange hair.

I was going to say, just shuffle it.

Yeah, just shuffle it every week.

You'll never know what I really look like.

People can place bets on what hair color

you're going to have every week.

That'll be fun.

All right.

Yeah.

Well, on that note,

all the updates from This Week in Privacy

will be shared on the blog every week.

So sign up for the newsletter or subscribe

with your favorite RSS reader.

If you want to stay tuned for people

who prefer audio,

we also offer a podcast available on all

podcast platforms and RSS.

This video will be synced to PeerTube.

Privacy Guides is an impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

you can make a donation on our website,

privacyguides.org slash donate.

To make a donation,

you could also anywhere else on the

website,

click on the red heart icon located in

the top right corner of the page.

You can contribute using standard fiat

currency, such as a debit or credit card,

or you can donate anonymously using Monero

or your favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content.

Sometimes we even have bonus content,

priority during the live stream Q&A,

and a cool badge on your forum in

the Privacy Guides,

in your profile in the Privacy Guides

forum and the warm,

fuzzy feeling of supporting independent

media.

Thank you so much for everyone that tuned

in and we'll be back next week.

See you next week.