newscracker

Authenticate where? How does the authentication prove that the intended recipient is the one who has clicked on the link and should be able to view? What happens if the email is forwarded with the link? What should one do to forward the email to someone without this encryption?

Organizations may need ways to store, archive and manage received email content from others.

I don’t understand what problem this solves for organizations and how.

Microsoft Outlook 365 has a somewhat similar feature where the email is just a link to hosted content on its servers (this kind of functionality isn’t new or recent on other platforms). It doesn’t require any authentication by the recipient. IIRC, the sender can also decide on the expiry of the content.

Last I checked, Proton Mail does not support standard email client protocols. So you’re stuck with its apps and a browser interface or with buying a paid subscription and using a bridge software on desktop to use a client like Thunderbird. Getting mails out of Proton Mail is also not as easy as setting up a client with IMAP or using other tools like imapsync.

The one thing I don’t like about both Proton and Tuta is that they don’t support IMAP. Users of these platforms would find it a bit more difficult to move their emails out of the system if they wish to.

For mail hosting, take a look at Posteo.de (no custom domains though), mailbox.org, runbox.com, mailfence, migadu, and cranemail. All these are cheaper and a lot more affordable than something like Fastmail. All of them support IMAP, using which you can move your email elsewhere (or easily backup/have local copies).

Chat messages with some people can hold a lot of value. Nostalgia, recalling past incidents/events, missing someone, etc. Sometimes even the most trivial of messages can be looked at with fondness and longing.

I’m personally very glad that Signal finally implemented this. It’s been such a short sighted strategy to promote itself like a mass market messaging platform while not allowing people to keep, move and restore memories.

Since it’s opt-in, those who don’t want it don’t have to use it. They’re well served by the self-destructing message timers in chats.

I feel there’s very little hope for privacy and freedom if people like the author — who claim to be for privacy and understand the implications of digital payments — choose cards all the time “because it’s convenient”. Convenience and coercion (by the businesses not accepting cash or governments forcing more “cashless”) are what the common person succumbs to.

I’m not saying that everyone should switch to cash for everything all the time. But the more that privileged people switch to digital payments and eschew cash, the more difficult it becomes for those who rely on or want to use cash to do so.

Choosing privacy could mean a little more (or a lot more, depending on one’s views) inconvenience. Hopefully there are still enough people who use cash and keep cash payments alive for longer (which helps many other people who may not be as privileged or as educated as a different crowd).

AFAIK, only Fastmail (which was the creator of JMAP).

Here’s the link for anyone wanting to join the waitlist for Thundermail (the service):

https://www.thundermail.com/

I really hope this takes off well and provides some funding for the Thunderbird project too. Currently the only way to monetarily support Thunderbird is through donations (https://www.thunderbird.net/en-US/donate/ ).

The support is only for the EWS protocol (MS Graph will probably come next year). You can enable it in beta by going to Config Editor (this is primarily for advanced users), searching for the preference "experimental.mail.ews.enabled" and setting it to true.

You would have to manually add the account. Currently only mail is supported. No calendar support.

See https://blog.thunderbird.net/2025/07/thunderbird-monthly-dev...

Two suggestions, if you have the time to look at the effort and difficulty to implement them:

> P.S. I plan publish it on Homebrew soon.

1. Please consider publishing on MacPorts too.

2. Please consider supporting m4b audiobooks (it’s a different file extension from the common m4a, but also supports chapters).

I haven’t done a detailed comparison, but there’s been a free app called Decoupled [1] on iOS that supports various formats and loading music into it. The app hasn’t been updated in about four years though.

[1]: https://decoupled.app/

> The private key remains bound to the user device, where it can’t be extracted.

So what exactly is being transferred with this new cross platform mechanism? Isn’t it the same private key, except that it’s a direct device-to-device transfer?

This export and import of passkeys also seems to blur the lines between passwords and passkeys a little more. If every device supported a built in password manager that generates a random password on signup with a service, stores it securely and then the platforms implement a secure password export and import mechanism where the CSV/JSON/whatever file is encrypted and kept only in memory during a direct device-to-device transfer, that would be close to this, right?

Other than passkeys being randomly generated for each site (and linked to it) and tied to some kind of biometric authentication, it looks like passwords and passkeys are converging (except for some implementation details).

The biggest advantage (which could also be considered a disadvantage from a different angle) with passwords is that one can use it from any device without having their primary device close by. With passkeys, the primary device must be close by if one wants to authenticate with a service on another device.

The biggest disadvantage with passkeys is that if one’s primary device is lost, they wouldn’t be able to login to services. The recovery process would also have to be the same old personal information check or (ugh) secret questions or a link sent to an email address or (ouch) an OTP by SMS to a new replacement device.

If there’s something that’s to be sherlocked [1] in 2025, this would be it! There is a very high motive and incentive for Apple to make something like this part of the OS annd it’s probably working on something similar. Apple can also do it (though probably not as quickly) with minimal privacy concerns.

In some ways, this app reminds me of Windows Recall, which has been heavily panned by privacy and security critics. Do we want a third party app to be looking at everything we do? It would have to meet a high bar on privacy.

[1]: referring to the computing term at https://en.m.wiktionary.org/wiki/Sherlock#English

Below I’m listing some of the projects I donate to:

DownThemAll, a browser extension that makes multiple simultaneous downloads from a page easy: https://www.downthemall.org/howto/donate/

Free Software Foundation (FSF): https://www.fsf.org/about/ways-to-donate

LibreOffice: https://www.libreoffice.org/donate/

Mozilla Thunderbird: https://give.thunderbird.net/

Soundswitch (Windows application to switch default playback devices and/or recording devices using simple hotkeys): https://soundswitch.aaflalo.me/

Tab Session Manager browser extension: https://tab-session-manager.sienori.com/

Tor Project: https://donate.torproject.org/

VLC media player: https://www.videolan.org/contribute.html

> 2. Able to hide development of mobilecoin (somehow) from us for nearly a year. To be clear: There were updates to the Signal app on iOS and Play, otherwise there would have been security bugs, but those patches did not make their way into the repositories. Signal operates on a "trust us bro" mentality, and no matter how trustable they seem to be- something about that doesn't sit right with me and never has.

The MobileCoin work and the source code not being published on the public repository for nearly a year was an extremely ill thought move. It soured my view of Signal as well.

Dupe: https://news.ycombinator.com/item?id=42970412

Archive link: https://archive.is/3Pp0U

I was wondering whether this is about Advanced Data Protection, which encrypts almost all data end-to-end on iCloud. It’s only later in this report that it gets into this key detail:

> At issue is cloud storage that only the user, not Apple, can unlock. Apple started rolling out the option, which it calls Advanced Data Protection, in 2022.

Before stating this, the article says:

> Rather than break the security promises it made to its users everywhere, Apple is likely to stop offering encrypted storage in the U.K., the people said.

This means Apple would be prevented from providing Advanced Data Protection to users in the U.K.

Not making Advanced Data Protection available is made worse by this requirement:

> One of the people briefed on the situation, a consultant advising the United States on encryption matters, said Apple would be barred from warning its users that its most advanced encryption no longer provided full security.

Apple can appeal, but is forced to comply meanwhile (until the appeal is heard) anyway:

> Apple can appeal the U.K. capability notice to a secret technical panel, which would consider arguments about the expense of the requirement, and to a judge who would weigh whether the request was in proportion to the government’s needs. But the law does not permit Apple to delay complying during an appeal.

This page says it was last updated a few weeks ago, but the recommendation against iCloud backups seems to have glaring errors and omissions.

> Keys to unlock the phone’s full-disk encryption are also stored in the iCloud backup. This arrangement allows law enforcement to request the backup data from Apple and use the key to unlock the entire phone. It also offers a convenience, where if the user forgets their unlock code, Apple can still recover the device.

This is not true. Even if it were, the advice to activists should in all cases be to enable Advanced Data Protection so that almost everything (except iCloud mail, contacts and calendar) are end-to-end encrypted (including iCloud phone backups). Apple cannot access the data or help in any kind of recovery when Advanced Data Protection is enabled. It is up to the user to set up recovery contacts and recovery key (and keep this safe).

You have two different points in your comment. Firstly, iOS has not been behind on having apps work if they don’t get access to a specific sensor or data. It’s on Android that apps refuse to work if they’re not given contacts access or location access and so on. Comparing the same apps on iOS and Android, I have found that Apple’s requirements for apps not to break when a permission is not granted is well respected and implemented on iOS apps. The same apps on Android apps just refuse to work until all the permissions they ask for are granted. YMMV.

I do agree that iOS is behind by not providing profiles and multiple isolated installations of apps, and it would be great if it did.

I’ve used Wire for quite sometime before (when Signal didn’t have desktop message sync). I’ve even recommended it here.

It was after a year or so of usage that I realized that Wire does not provide any way to export or save chats outside of its application (it has a backup option to backup from and restore back to Wire). Wire also seems to store images on its servers and those images won’t be available if you save a backup and restore from it. The backup formats are platform/OS specific. Losing images but having just text alone was a big loss for me.

For all practical purposes from a basic end user’s point of view, Wire can be considered as proprietary and closed as Instagram or FB Messenger.

> For me personally privacy and security is less of a concern vs Ads and manipulation.

Those two don’t add up. You expose yourself to manipulation and control when you don’t have adequate privacy. If privacy is less of a concern to you, then manipulation equally so too.

It’s possible for users to donate money directly for Thunderbird development (since it’s a separate for-profit subsidiary under Mozilla Foundation). All donated money goes into developing and supporting Thunderbird.

But it’s not possible to donate money to support Firefox development because that’s under Mozilla Corporation (another for-profit entity under Mozilla Foundation). This, I believe, has resulted in multiple monetization strategies and offerings, such as Mozilla VPN (which is actually reselling Mullvad), MDN Plus (not sure about how this money is used), etc.

With Google’s antitrust lawsuit going on and the real possibility of Google not being allowed to pay for being the preferred search engine (this was the main source of income for Mozilla Corporation), Firefox is at a bigger risk of not having enough money. Unless Mozilla restructures the organization and finds ways to get money for Mozilla Corporation, Firefox as it exists now will probably have to find a new home with a new name.

The number of permissions that Laspass may request also looks very invasive.

With all the security issues that Lastpass had been dealing with time and again for years, I wonder who’s even using it in 2025. Is it just non-tech people who are not aware of its poor track record? Or is Lastpass very good at hiding its past from potential customers?

Does anyone here recommend Lastpass to others? If yes, I’m curious to know why (when there are, IMO, much better options).

The main issues here are the default opt-in and not announcing this feature way back in September. If someone wants this, they can always enable it if it’s opted out by default. I’d expect Apple to fix this soon.

The link below is from the original author of this revelation, and is better suited for discussion, IMO. The author, Jeff Johnson, is a long time developer of applications on macOS and iOS/iPadOS.

Apple Photos phones home on iOS 18 and macOS 15

Discussed five days ago at https://news.ycombinator.com/item?id=42533685

December 28 2024

https://lapcatsoftware.com/articles/2024/12/3.html

The follow up is also interesting and relevant:

The internet is full of experts

December 31 2024

https://lapcatsoftware.com/articles/2024/12/4.html

> New Tab Page

> We will be running an experiment in December featuring a Fakespot feed in the vertical list on newtab. This list will show products that have been identified as high-quality, and with reliable product reviews. They will link to more detailed Fakespot product pages that will give a breakdown of the product analysis.

Will the products be generic (not targeted at the user based on some profile building) or is there some tracking and profile building going on to “suggest useful products” for that person? Is there going to be a different “Topics” implementation to serve this purpose?

Whatever you end up using, make sure that there is an easy way to turn it off and on from each client device. A network wide blocker could cause issues with some sites (like banking, as an example).

Tangential topic: I see some suggestions for NextDNS here as an additional layer. I can’t speak for Android, but if you’re looking for iOS/iPadOS/macOS/tvOS, note that NextDNS does not work well on these. The app hasn’t been updated for several years and toggling on the app does nothing (I like the app because I can quickly switch it off and on when needed, which cannot be done with a profile). Most of the time the test page at test.nextdns.io shows as “unconfigured”. Even the profile installation approach does not work on Apple TV (I’ve tried this a few times). Overall, the NextDNS servers around the world exist, but there is zero support and maintenance on the client side for the platforms I mentioned. The community forum has posts about issues that the founders don’t respond to.

At least on macOS, I have Little Snitch that acts as a system wide blocker (one can subscribe to blocking lists just like in uBlock Origin).

NextDNS does not work many a times. I prefer the iOS app so that it’s easy to disable when needed, but the app has not been updated for a few years. Many a times the test page at test.nextdns.io will show as unconfigured and sometimes it will show as passing the test.

On Apple TV, I have the NextDNS profile installed, but it still doesn’t work.

Most of the community forum posts on NextDNS don’t get any answers. I’m sure the DNS servers exist, but the clients and the configuration options have not been supported by the creators.

I wouldn’t recommend NextDNS to anyone because of this apathy by its creators.

> I do not know how it is financed

You can donate to Thunderbird in general. Right on the homepage of Thunderbird mobile [1], is a donation link. [2] Unlike donations on mozilla.org, where the funds go to Mozilla Foundation (and not to Mozilla Corporation, which is the one developing Firefox), the donations on thunderbird.net go to funding Thunderbird on all the platforms that the Thunderbird team works on.

[1]: https://www.thunderbird.net/en-US/mobile/

[2]: https://www.thunderbird.net/en-US/mobile/?form=tfa

I came here to ask a similar question, looking for alternatives to Lockdown Privacy on iOS/iPadOS. [1] I've been using Lockdown for some years as a local and system firewall to block trackers across all apps, but this company got sold a few years ago and has since been annoyingly and frequently pushing for its paid subscription. It also moved some free blocking lists to the paid subscription.

Any alternatives to Lockdown on iOS/iPadOS would be nice to know about.

[1]: https://lockdownprivacy.com/

> Google may be a privacy issue... So I would love to have the possibility to prevent anyone putting my info in their contacts in Google.

This can be quite difficult to achieve. The moment your contact information is given to someone using Android, it will be synced up with Google (and known by most Google properties).

> I personally use a paid E-Mail service (mailbox.org)

May I know how long you’ve been using it and how the experience has been? Are you using it with a custom domain?