Kyle Rankin @kyle@librem.one

I love this post:

"When we first approached hardware manufacturers almost two years ago with this project most of them instantly said “No, sorry, impossible, we can not help you.”. Others warned us, that it could never work, that it was too complicated, “the industry does not do that” and so forth.

And yet here we are, later than we wanted, but we are actually shipping first hardware! It is possible but it comes at a price." #Librem5

https://puri.sm/posts/breaking-ground/

I shared some of my thoughts on this mentality and how it harms people in this post for @purism https://puri.sm/posts/consent-matters-when-tech-takes-remote-control-without-your-permission/

Many tech companies tout #privacy and security features that coincidentally also increase their own control and your dependence on them.

In this case, the feature protects user location data from competitors but not from Apple:

https://www.washingtonpost.com/technology/2019/11/26/apple-emphasizes-user-privacy-lawmakers-see-it-an-effort-edge-out-its-rivals/

This opt-in clause is the critical reform we need. As in California, tech companies will lobby to remove it.

"Companies further would have to obtain a person’s permission to collect and share their sensitive data." #privacy

https://www.washingtonpost.com/technology/2019/11/26/top-senate-democrats-unveil-new-online-privacy-bill-promising-tough-penalties-data-abuse/

Et tu, DMV?

"The California Department of Motor Vehicles is generating revenue of $50,000,000 a year through selling drivers’ personal information, according to a DMV document obtained by Motherboard." #privacy

https://www.vice.com/en_us/article/evjekz/the-california-dmv-is-making-dollar50m-a-year-selling-drivers-personal-information

This opt-in requirement is critical, and the precise thing tech orgs successfully lobbied to remove from the CCPA:

"As a first step, governments must enact laws to ensure companies including Google and Facebook are prevented from making access to their service conditional on individuals “consenting” to the collection, processing or sharing of their personal data for marketing or advertising."

https://www.amnesty.org/en/latest/news/2019/11/google-facebook-surveillance-privacy/

I wonder how many people reprogrammed their Google Assistant trigger phrase to "OK Boomer"

I mentioned the other day that health care data is one area where people who "have nothing to hide" still care about #privacy.

Personal finances is the other area and it looks like Google's going there too.

https://www.washingtonpost.com/technology/2019/11/13/google-eyes-banking-it-widens-its-reach/

We've gotten some questions as to whether @purism laptops are vulnerable to TPM-Fail. We use a different chipset for our TPM so our laptops don't appear to be vulnerable.

This article about Google's project to store and analyze millions of Americans' health care data confirms my suspicions about the Fitbit acquisition.

Many people who don't care about mass data collection because "I've got nothing to hide" change their tune when it's health care data. #privacy

https://www.wsj.com/articles/google-s-secret-project-nightingale-gathers-personal-health-data-on-millions-of-americans-11573496790

It's not every day you get to expense a big box of glitter nail polish to your company. #security #tamperevident #antiinterdiction https://puri.sm/posts/anti-interdiction-services/

Even though the magazine folded months ago, something about the Linux Journal website going offline makes everything seem so much more final. #RIPlinuxjournal

On one hand, tech companies violate our #privacy, capture massive amounts of data without consent, and process and categorize it w/ ruthless efficiency to ever-more-precisely target us with ads.

On the other hand, AARP keeps trying to sell my deceased dad life insurance.

Opt-out by default would be huge:

"Under the terms of the OPA, individuals would have the right to obtain, correct, and delete data collected about them by covered entities, as well as to request "a human review" of automated decisions. Users would also have to opt-in to having their personal data used for training machine learning algorithms." https://arstechnica.com/tech-policy/2019/11/new-bill-would-create-digital-privacy-agency-to-enforce-privacy-rights/

The 4-day work week is the headline, but I suspect the main productivity gains came from halving meeting times to 30 mins, limiting attendees to 5 people (with single representatives for each team), and encouraging chat for collaboration:
"Microsoft Japan Says 4-Day Workweek Boosted Workers' Productivity By 40%" https://n.pr/2qqT8m3

New book! I'm reading Poisoner in Chief, about the `50s CIA MK-ULTRA mind-control program. It references a manual CIA commissioned Mulholland, a Houdini protégé, to write. It documented slight of hand techniques to deliver poisons, etc. All copies were thought destroyed until one surfaced a decade ago.

Any kid who's successfully forged their parent's signature on school forms has demonstrated the flaws with biometrics as single-factor auth.

A reminder that biometric auth security is not based on secrecy (#biometrics aren't secret), but on the difficulty of making a copy that can trick a sensor. Now there's an app for that. #infosec

https://fossbytes.com/a-new-app-can-scan-fingerprints-from-drinking-glass-to-unlock-your-device/