Cider9986

Original Title: *That Time Japan Suddenly...

While consumer related payouts are way lower.

https://www.enzuzo.com/blog/data-privacy-lawsuits

https://openclassactions.com/news/apple-siri-settlement-paym...

I hope we get tap to pay on GrapheneOS in the US soon. You can already use it in the EU with Curve and PayPal. It's a blocker for a lot of people.

Hacker News seems generally not interested in private payments or how terrible the banking system is, which is disappointing.

https://eylenburg.github.io/payments.htm

With accrescent.app you will be able to sell apps or distribute closed source apps in a privscy-focused way.

If you want music I've found Metrolist to be the nicest frontend.

https://github.com/MetrolistGroup/Metrolist/releases

They assembled the avengers.

But seriously, privacy must not become a sided issue. Attacks on privacy are bipartisan, the defense of it would be weakened if it was not bipartisan. Civil liberties protected by the constitution should not be controversial.

> Cambridge Analytica, the organization, of course, loves to claim that they're the dark evil viziers behind the Trump campaign and they've advertised themselves as such to dictators all over the world.

Aren't they defunct [1]?

[1] https://en.wikipedia.org/wiki/Cambridge_Analytica#:~:text=De...

There was a senate hearing a few days ago where this woman testified. Also Benn Jordan and Chad Marlow from the EFF were htere. I was happy hearing them put into words the problems on the national stage.

https://www.youtube.com/watch?v=klE498xFjOY

FHE would be nice, but there's a lot of products that could be E2EE today. Plenty of breaches are just server-side files and dumps, there's no excuse for not using E2EE cloud storage.

Databases are much more tricky, but if we're talking a significant shift, it is as good a plan as any. Clearly server trust is not working.

AI is accelerating both sides for defenders and attackers, but mobile clients are already way ahead of typical desktop. Android's desktop mode exists in the OS now but needs a lot of work and more powerful chips before it can replace desktops.

For security against remote attacks, I'd rank clients roughly: GrapheneOS, iOS/iPadOS, stock Android on Pixels, ChromeOS, macOS, Windows, desktop Linux. Prefer more secure clients, always, but now the client is all that's left to trust for content.

Native clients avoid the web E2EE problem and are easier than ever to build. With AI, you can audit the source as often as you want and reproducible builds mean you know that's what you're running.

Why would that be better than my GrapheneOS phone?

I really like the UI especially the about page. I don't think you are supposed to be able to see the about page on the playing page (it took a bit to start and then started when I was in about) but it looks good there with the blur.

Here's a list of other sound/relaxation websites: https://fmhy.net/audio#ambient-relaxation.

This one is pretty funny but not relaxing to me. It may be a covid remnant: https://imisstheoffice.eu/

It's crazy SimpleX is fine being based there. I mean, everything is open, the clients have reproducible builds, but it seems like it may end up being a hassle.

Has the UK started attacking any open source E2EE projects yet?

Apple's control over iOS is the main reason I prefer GrapheneOS so much over it. You get amazing privacy and security without sacrificing control. GrapheneOS has said they won't introduce age verification and a backdoor they obviously won't implement.

Mr. Chad Marlow is certainly a Chad.

We did not see. Unfortunately.

I don't think it's actually fabric. It's a "fabric-like polymer coating".

I think it means their extortion victims. So we actually know who some of their "clients" are. Like instructure/canvas. We certainly know the ones who "don't become clients" because they are all posted.

They mention hindering trust because for an extortion gang, they want companies to trust that they won't leak the data in order to make it seem worthwhile to pay.

> It doesn't route through Cloudflare. It doesn't even connect to T-Mobile, Verizon, or Stingray automatically.

I fail to see how that's significant at the banking level. What does Stingray mean in this context??? Signal??? It's just a messaging app. You can use a VPN or Tor.

Your purchases still go through all these routes on the payment processors side. And you can use Apple pay offline–it's just NFC.

You realize ever card purchase (when where what how much) is logged and stored for like 5+ years (probably forever). Yeah I'd probably prefer not to add Google to the mix but your carrier only sees DNS logs not the encrypted content.

If you want any privacy whatsoever in payments use Monero and Cash: https://eylenburg.github.io/payments.htm

Deceptive marketing about privacy but it can't be worse than the other options.

It wouldn't be worse than those but with AI, AOSP is patching way more vulnerabilities than before and people without technical skill can abuse vulnerabilities, and those with skill can abuse them even more. It simply is not wise to run out-of-date GrapheneOS.

I'm curious how many months/years before out-of-date GrapheneOS becomes the worse option security wise compared to various brands' stock Androids. Obviously it is nuanced and there's no clean answer but it would be interesting on average.

We could think of metrics in public patches, but GrapheneOS has exploit protections that prevent against 0-days which would be hard to factor in.

Full text of Shinyhunters' box on their site about the FBI labeled, "PSA - READ THIS NOW":

https://rentry.co/shtext

>That defacement says, “this site has been seized by ShinyHunters,”

No archive but at least a screenshot: https://cyberinsider.com/wp-content/uploads/2026/09/fbi-site...

>https://news.ycombinator.com/item?id=49807388

The photo they put is a Pokemon so yeah probably their name is from it.

Yep. Not sure all of them are attesting GrapheneOS, but there's at least 5 banks officially supporting it.

https://github.com/PrivSec-dev/banking-apps-compat-report/is...

I don't know if that's really significant. But yeah technically you give up less information by using the card directly instead. But it's like going from 98% privacy loss to 99%.

Cash and Monero are private so they're in a different space and are what should be prioritized.

I'm only buying it if it comes with a secure raccoon feeder.

Do you know if that's the process for the 2026 Signature? I don't remember exactly but GrapheneOS may have mentioned that for the current Motorola flagship devices the unlocking isn't as onerous.

Considering Motorola is doing a lot of the porting, I would guess it will be improved or will be easy.

You can also factory reset, check boot key hash, and use Auditor to verify integrity on devices sold with GrapheneOS preinstalled. That's what they currently recommend to do for Pixels sold with GrapheneOS preinstalled.

Unfortunately the privacy/security features GrapheneOS requires as well as just the ability to replace the OS are only put on premium phones. You can buy an a series Pixel a few years behind to get it in the price point you want. But this won't save money long term because the price per year of support is worse than newer models like the 10a or 9a.

So, 7a at your pricepoint:

https://www.ebay.com/itm/820099695470

But, it's only supported for 1.6 more years.

So that puts it at $143 per year of support. While the 10a [1] will be supported for 6.4 more years, which puts it at $55 per year of support.

[1] https://www.ebay.com/itm/137767347717

Yes. https://news.ycombinator.com/item?id=47241551

> Graphene OS devs themselves recommend that you install apps on Graphene OS via Google Play Store for security reasons.

Can you provide a source that they've said this recently? This seems to be a bit of a misrepresentation.

They say:

>The Play Store app is also the most secure way to install and update apps from the Play Store.

on /usage, but this does not indicate it's the most private way or that it's the recommended way to install apps. It seems to me to indicate that this is their assessment of the security of the ways to install apps that are distributed on the Play Store, not a recommendation or privacy assessment that applies to other apps or to their users in general.

They don't recommend against Aurora Store [1], but it is not user friendly as the Play Store because app installs frequently fail and automatic updates do not work as well. Installing apps from Aurora has the advantage of no google account, but Google is still handed a list of all the apps you have installed, IP address, app details, device details, and GSF ID. It will likely stop working or become even more broken. It is useful when apps block installs from the Play Store because of play integrity.

I use it myself for the few Google apps I install like Camera because I don't want to install play services.

I would consider their actual recommendation to be their own App Store and Accrescent (alpha).

Obtainium is great but not user friendly.

The claims about problems with F-Droid are true. It's not like they oppose FOSS, their whole operating system is FOSS and they've never said anything bad about IzzyOnDroid, which fixes the problems with F-Droid and even adds a bit of security.

[1] https://nitter.freedit.eu/GrapheneOS/search?f=tweets&q=auror...

It's cool how the GPL has allowed for-profit companies to release open source software. But maybe it's just VPNs are suc h a competitive space.

Mullvad, Proton, IVPN, Windscribe, Nym all use the GPL.

> Separate from this is wallet and payment apps which still have not had much traction on GrapheneOS.

Curve works in Europe and Paypal has a trial thing in Germany for tap to pay IIRC. There's nothing in the US unfortunately, yet.