coffeeClean

joined 1 year ago
 

There are apparently only two documented ways to reverse tether an Android via USB to a linux host:

OpenVPN dead
I really wanted the #openVPN method to work because I’m a fan of reducing special-purpose installations and using Swiss army knives of sorts. In principle we might expect openVPN to be well maintained well into the future. But openVPN turns out to be a shit show in this niche context. Features have been dropped from the Android version.

Gnirehtet dying
Gnirehtet works but it’s falling out of maintenance. ~~It’s also unclear if~~ #Gnirehtet really works without root. There is mixed info:

  • Ade Malsasa Akbar from Ubuntubuzz claims root is not needed (and devs agree).
  • OSradar claims root is needed. (edit: they are mistaken)

If anyone has managed to reverse tether an unrooted Android over USB to a linux host using free software, please chime in. Thanks!

update on Gnirehtet


Gnirehtet indeed works without root. But some apps (like VOIP apps) fail to detect an internet connection and refuse to communicate.

#askFedi

[–] coffeeClean@infosec.pub 1 points 7 months ago

They’re not at odds. We don’t have to choose between protecting UDHR Art.3 and Art.17. It’s foolish to disregard some portion of the UDHR needlessly and arbitrarily.

[–] coffeeClean@infosec.pub 8 points 7 months ago

The real problem with @Blaster_M@lemmy.world’s comment was to blame the victim. It may be sensible to blame the victim, but let’s not lose focus on the perp.

[–] coffeeClean@infosec.pub 1 points 7 months ago* (last edited 7 months ago) (2 children)

Don’t try to strawman this. Human rights are violated when someone is deprived of their property (their data in the case at hand). If food is withheld from starving people in Gaza, your argument is like saying:

“Claims human rights are being violated because someone failed to drive a truck”

[–] coffeeClean@infosec.pub 5 points 7 months ago* (last edited 7 months ago)

beehaw.org defederated from lemmy.ml. And I don’t blame them. I actually try not to post to lemmy.ml or any of the Cloudflare-centralized nodes (lemmy.world, sh.itjust.works, lemm.ee, etc) but it slipped my mind when I posted here.

(edit) sorry, i'm confused. I thought beehaw.org defederated from lemmy.ml, but both the post herein and the original are on lemmy.ml yet you can reach this one. So I’m missing something. I wonder if you are able to see infosec.pub-mirrored content and maybe the original community has no infosec subscribers? hard to say.

[–] coffeeClean@infosec.pub 2 points 7 months ago* (last edited 7 months ago) (1 children)

You’re very trusting of your corporate overlords. I’m sure they are grateful for your steadfast loyalty and trust.

[–] coffeeClean@infosec.pub 2 points 7 months ago* (last edited 7 months ago) (3 children)

No amount of money you pay for your phone up-front will make that malicious code magically go away. You can pay cash, and you can even tip the seller. The code that reduces your control remains in that device. If you don’t control it, you don’t own it.

[–] coffeeClean@infosec.pub 1 points 7 months ago

If you fail to use rights granted to you by free software licenses, you can blame yourself.

[–] coffeeClean@infosec.pub -2 points 7 months ago* (last edited 7 months ago) (5 children)

You’re not getting it. Again:

If you don’t control it, you don’t own it.

Buying something does not mean you control it. You might have bought an Amazon Ring doorbell but if Amazon does not like your behavior they can (and will) render it dysfunctional.

If you don’t control it, you don’t own it.

[–] coffeeClean@infosec.pub 1 points 7 months ago* (last edited 7 months ago) (5 children)

I guess a closer analogy would be rental storage. If you don’t pay your mini storage bill, in some regions the landlord will confiscate your property, holding it hostage until you pay. And if that fails, they’ll even auction off your contents.

So in the case at hand the creditor is holding the debtor’s data hostage. One difference is that the data has no value to the creditor and is not in the creditor’s possession. It would be interesting to know if the contracts in place legally designate the data as the creditor’s property. If not, the data remains the property of the consumer.

This is covered by human rights law. Universal Declaration of Human Rights, Article 17 ¶2:

“No one shall be arbitrarily deprived of his property.”

If the phone user did not sign off on repossession of their data, and thus the data remains their property, then the above-quoted human right is violated in the OP’s scenario.

[–] coffeeClean@infosec.pub 10 points 7 months ago* (last edited 7 months ago) (6 children)

If the creditor wants to collect on a debt, there is a court process for that. I’ve used it. It works.

Locking the phone is not repossession. It does nothing other than sabotage the device the consumer may need to actually make the payment. The phone remains in the buyer’s possession and useless to the seller.

Power is also misplaced. What happens when the creditor decides to (illegally) refuse cash payments on the debt? Defaulting is not necessarily the debtor’s fault. This in fact happened to me: Creditor refused my cash payment and dragged me into court for delinquency. Judge ruled in my favor because cash acceptance is an obligation. But this law is being disregarded by creditors all over. If the creditor had the option to sabotage my lifestyle by blocking communication and computing access, it would have been a greater injustice.

#WarOnCash

[–] coffeeClean@infosec.pub 2 points 7 months ago* (last edited 7 months ago) (2 children)

You’re still not grasping how free software works. Users have a right to see the code and the right to change it. They also have the right to redistribute the code. Your complaint is unfounded because not a single user of a fully free platform is forced to have remote management code installed.

[–] coffeeClean@infosec.pub 1 points 7 months ago

It should be regulated against by governments. The EU is slowly heading in the right direction. We’re letting these tech companies do whatever the fuck they want to.

I wonder if it already is illegal. Have you looked into that? Did they disclose this “feature” in any of the agreements or literature that came with the device so that you could return it for a refund? Maybe you have a good legal case here.

 

The technical mechanism:

https://play.google.com/store/apps/details?id=com.google.android.apps.devicelock

update


To be clear, I am not the OP who experienced this problem. I just linked them from here.

 

cross-posted from: https://infosec.pub/post/9936059

I would like to collect the scenarios in which people are forced to enter Google’s #walledGarden (that is, to establish and/or maintain an account).

If someone needs a Google service to access something essential like healthcare or education, that’s what I want to hear about. To inspire a list of things that are “essential” I had a look at human rights law to derive this list:

  • right to life
  • healthcare
  • freedom of expression
  • freedom of assembly and of association
  • right to education
  • right to engage in work and access to placement services
  • fair and just working conditions
  • social security and social assistance
  • consumer protection
  • right to vote
  • right to petition
  • right of access to (government) documents
  • right to a nationality (passport acquisition)
  • right of equal access to public service in his country

Below is what I have encountered personally, which serves as an example of the kind of experiences I want to hear about:

  • Google’s Playstore is a gate-keeper to most Android apps in the world and this includes relatively essential apps, such as:
    • emergency apps (e.g. that dial 112 in Europe or 911 in the US)
    • banking apps
    • apps for public services (e.g. public parking)
    • others?
  • (education) Google docs is used by students in public schools, by force to some extent. Thus gdocs sometimes cannot be escaped in pursuit of education. When groups of students collaborate, sometimes the study groups impose use of gdocs. Some secondary school teachers impose the use of Google accounts for classroom projects.
  • (education) A public university’s wi-fi network involved a captive portal and the only way to gain access was to supply credentials for a Google or Facebook account.

I’ve noticed that when creating an account for a public service I often have the option to supply credentials for Google or Facebook to bypass the verification process. In all cases of this kind of registration shortcut being used for public service, there was an alternative Google-free way to open the account. But in the private sector, I’ve seen this style of registration that absolutely required a proxy login via some shitty walled garden (like the university wi-fi). So I wonder if there are any situations where a government (anywhere in the world) requires a Google account in order to get service.

 

cross-posted from: https://infosec.pub/post/8864206

I bought a Silicondust HD Homerun back before they put their website on Cloudflare. I love the design of having a tuner with a cat5 port, so the tuner can work with laptops and is not dependent on being installed into a PC.

But now that Silicondust is part of Cloudflare, I will no longer buy their products. I do not patronize Cloudflare patrons.

I would love to have a satellite tuner in a separate external box that:

  • tunes into free-to-air content
  • has a cat5 connection
  • is MythTV compatible

Any hardware suggestions other than #Silicondust?

 

I bought a Silicondust HD Homerun back before they put their website on Cloudflare. I love the design of having a tuner with a cat5 port, so the tuner can work with laptops and is not dependent on being installed into a PC.

But now that Silicondust is part of Cloudflare, I will no longer buy their products. I do not patronize Cloudflare patrons.

I would love to have a satellite tuner in a separate external box that:

  • tunes into free-to-air content
  • has a cat5 connection
  • is MythTV compatible

Any hardware suggestions other than #Silicondust?

#AskFedi

 

“Only because of that official investigation did Canadians learn that ‘over 5 million nonconsenting Canadians’ were scanned into Cadillac Fairview's database”. Wow.

This Wired article is contradictory. The spokesperson says:

“an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface”

I suppose it’s possible that a sloppy developer would name an executable Invenda.Vending.FacialRecognitionApp.exe which merely senses the presence of a face. But it seems like a baldfaced lie when you consider that:

“Invenda sales brochures that promised ‘the machines are capable of sending estimated ages and genders’ of every person who used the machines—without ever requesting consent.”

Boycott Mars


I already boycott Mars because they are a GMA member and they spent ~$500k lobbying against #GMO labeling -- and they have been blackballed for using child slave labor -- and Mars supports Russia. This is another good reason to #boycottMars.

Update


Apparently a LemmyBug replaced the article URL with a picture URL. The article is here:

https://www.wired.com/story/facial-recognition-vending-machine-error-investigation/

The vending machine pic is here:

https://infosec.pub/pictrs/image/2041d717-7cd7-4393-94f3-96aa87817aa7.jpeg

view more: next ›