Unlocking the Bootloader: A Critical Step for Effective DMA Enforcement

Smartphones have become an indispensable part of our lives. Apple, a company known for its tight integration of hardware and software, has created a monopoly on the software that runs on its devices. This limits consumer choice and control, and Apple claims the DMA (Digital Markets Act) puts users at risk. They are further entrenching their control by limiting consumer choice. A fair and long summary of this issue can be found in The Home Screen Advantage.

…

We live in a rapidly evolving world. Technology and science intersect with every aspect of our lives, leading to extremely personalized AI assistants to become interwoven in most of what we do (as the internet has). Shifting balances between returns to violence, the ability to tax individuals, and the rise of decentralized cryptocurrencies are about to change the geopolitical scene.

Bitcoin, the first thermodynamic currency, is both a battery for energy as well as the best intersubjective clock we currently have. Energy and time, though, are not the sole commodities our society requires to prosper. Knowledge is important as well. Science serves as a unifying element, revealing a ‘winner takes all’ dynamic prevalent in macro theories. Maxwell’s equations, for instance, are validated in every microscopic interaction with our electronic devices, underscoring the universality of scientific principles. However, the application of science to highly specific cases, is much more complicated. One example of this is Larry Page’s throat condition (an extremely rare disease with not enough cases to be studied efficiently) or the COVID-19 vaccines, whose efficiency varies greatly from individual to individual, illustrating the challenges of dealing with limited data points and the need for reproducibility on a local scale. The future of medicine is personalized, based on individual genetic profiles and locally-harvested databases for privacy-respecting research.

…

In the age of hyper-personalized software, code becomes ubiquitous and everyone gets to create interfaces tailored to their preferences. This personalization extends beyond interfaces, encompassing AI-assisted automation for tasks such as organizing files, handling incoming messages, scheduling meetings, processing information, consuming news, and coordinating gatherings.

As the future unfolds, software will become responsible for much of this automation, eliminating the need for humans to manually sort files into folders or transfer data between spreadsheets. Users will still need to maintain their systems, communicating with them to ensure they remain up-to-date and aligned with user preferences.

…

1. The privacy of end users and the amount of data their phones leak to unknown numbers of third parties is at its highest point. Accepting or rejecting cookies really doesn’t matter: the headers browsers send on every request to any website, and the AS from which you are communicating are likely to be enough to uniquely identify who you are. With Javascript available, there is no chance: the mere combination of width and height your screen display has, your language preferences, and which fonts are installed on your phone are more than likely to provide the 33 bits of entropy required to uniquely identify you as a human being. We are very new to this concept, it’s really unprecedented that we are able to collect and analyze so much data about our global village. For example, just a few seconds of using a VR headset are enough to uniquely identify you, but smarter techniques can be much more efficient at knowing who you are.

   • Android Stock phones send about 2MB of data every day
   • Indian ISPs: We Already Give Governments Full Access to Web Traffic
   • Am I Unique.org
   • Unique Identification of 50,000+ Virtual Reality Users from Head & Hand Motion Data
   • Exploring the Privacy Risks of Adversarial VR Game Design

2. States have unprecedented power to control its citizens and shut down dissenting citizens by force. This even happened in Canada, one of the most free countries in the world, which terrified me when it happened. This is not Iran (which also does it), but a western democracy. This is why we need separation of money and state: to prevent ramping authoritarianism.

   • Canadian Authorities Freeze Financial Assets for Those Involved in Ongoing Protests in Ottawa
   • Canada Ends Its Freeze on Hundreds of Accounts Tied to Protests
   • How Iran Can Track And Control Protester’s Phones
   • Eric Vorhees: The Separation of Money and State

3. Big tech companies control not only the services and the data centers required to provide you with the services for which you would pay, but they also have massive control over how your device accesses those services. For example, clicking on a link on Instagram opens it on a “web view” that allows Facebook to collect information about your browsing activities that they wouldn’t necessarily get if you used your own browser. The devil is in the details: even such a small change as redirecting “maps.google.com” to “google.com/maps”, which can be 100% honest for performance and efficiency reasons, results in the inability to prevent Google from tracking what you do in other websites. Where is the opt-out option to pay for a service, without the advertising? Microsoft transmits the contents of the offline version of PowerPoint, without any clue as why Microsoft needs this data, or what is it going to use it for. Their terms and conditions changed very recently, and as usual, the changes are non-negotiable.

   • iOS Privacy: Instagram and Facebook can track anything you do on any website in their in-app browser
   • Smart Move, Google: maps.google.com redirects to google.com/maps
   • “You might also like”, on the inability to opt-out of ads
   • Microsoft is phoning home the content of your PowerPoint slides
   • Microsoft Changes Terms and Conditions to Add Restrictions for AI Offerings
   • In case there was any doubt, Google’s privacy policy now explicitly states that it’s going to suck up all your data to train its AI

4. We live in a far safer world. Mission accomplished: serial killers are almost a thing of the past thanks to surveillance capitalism. The use of these applications and the actually heroic work of thousands of content reviewers at Facebook, Google, and others allow us to catch really gruesome offenders. Can we get some of our privacy back now? The false positives of these practices, extreme power of the platforms, and lack of due process can lead to really bad outcomes and abuses of power.

   • Serial Killers Have Rapidly Declined Since The 1980s
   • San Diego Man Sentenced to 25 years in Federal prison over Child Pornography Offences
   • Facebook Gave Nebraska Cops A Teen’s DMs. They Used Them To Prosecute Her For Having An Abortion
   • A Dad Took Photos of His Naked Toddler for the Doctor. Google Flagged Him as a Criminal
   • FBI abused spy law but only like 280,000 times in a year
   • Using Signal, Whatsapp, VPNs, or protecting against the exploitation of your personal data as collected by Google/Appple/Facebook/Amazon/Microsoft is “Conspiratif” and makes you a potential criminal, according to the French Government
   • We kill people based on metadata

5. We need to amplify more the voices of those people that try to re-vindicate privacy, for the good of our democracies. Even if you think you’ve got nothing to hide, there might be unintended consequences of this massive advertising revenue-driven virtual economy. I simply would like to opt out of Google knowing everything about myself, but looks like this is a very expensive option in today’s world.

   • Privacy is OK
   • The chat control proposal does not belong in democratic societies
   • How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did
   • “I’ve got Nothing to Hide” and other Misunderstandings of Privacy
   • Google’s Surveillance: The Shocking Truth
   • Google Has Most of My Email Because it Has All of Yours
   • Extreme Privacy: What it takes to Disappear

…

Hidden in plain sight, the importance of full text search is extremely relevant to our day-to-day lives in the information age. We rely on search engines, both web and in-app, to navigate through haystacks of information, and we don’t necessarily have first-hand access to that data.

The Search Prompt

The web search engine that we use everyday is super critical and relevant for our information consumption. Giants like Google and Amazon understand this really well. The search box is one of the most important elements of any user interface, and in some cases, it’s a product out of itself. Operating systems also generally provide an interface to search through your local files, but this is generally not really well crafted nor optimized – it’s generally slow or incorrectly indexed.

…

“Make social networks more humane”

I’m motivated by this goal of making social networks more humane. I usually try to explain it from three angles:

• Rebalance power to the humans, not towards platforms

Platforms should never have the power to de-platform users, and users should be able to modify and personalize the software they use to access the platform. This will only be achievable through malleable systems, a modern reincarnation of the Free Software movement: software should be easy to use, easy to change, and easy to share with others.

…

What information do we need on our phones to enable the communication systems and social exchange of data and resources viable?

• Most of the world runs on SAP and Excel.
• SMS and Whatsapp are also critical in business
• Emails!
• Catalogs of information
• Video calls and in-real meetings
• Calendars and rolodexes embedded on our phones
• Trellos and boards for multimedia management
• Papers, science publications

What kinds of mechanisms have been lost from the early days of BBS?

…

It’s been well known for a while that fingerprinting is an extremely useful mechanism for personally identifying users using javascript techniques. The most recent variations of “cookies” from Google have been “privacy sandbox” and “Federated learning of cohorts”. But little has been discussed about the use of server-side fingerprinting.

I browse the web without javascript. I use uBlock Origin’s advanced feature to turn off not just ads, but also images or media larger that 50kb, and fonts. Font usage has been known to easily identify unique users, but also it leaks network information such as your IP by linking to an external site.

…

In computer trust, there are a few “roots of all evils” or “seed of the poisonous tree”. For some, that’s Djikstra’s “early optimization”, but for most (defensive) security researchers it’s that annoying reminder in your head that, unless you’re the daughter or son of Magnetto and an AI, you won’t know what code is the CPU running. Because your TODO list to be certain of the code that’s running is exhausting:

…

There is a lot of cruft and unnecessary abstraction in the code and programs that we use every day.

Most of the data that is shown to a user is irrelevant; a fraction of the information stored in RAM is actually “readable as usable” for the person in front of the screen. That’s probably OK; to take an example from real life, we don’t need to understand how DNA works in order to grow or live our daily lives. But when it comes to computers, we are responsible for representing and managing data efficiently.

…