TPMs protect the data on the drive if the drive is separated from the computer. If the drive is still in the computer, then it doesn’t protect the data. It doesn’t provide protection from physical attacks.

They would need to kidnap you to type multiple different passwords. The point is that they can’t quickly unlock the device. Mobile phones are literally designed to be easy to unlock.

The key to encryption is to have your key encrypted with a strong passphrase.

Phones are literally designed to be convenient. Convenient is the antithesis of security.

You want a 20-100+ character passphrase to symmetrically encrypt your private keys, and you want to never type that in public.

Most people have 4 digit pins on their phones, and they constantly type them in public, in plain view of others. And its super easy to snatch out of their hands and run.

Phones are, by design, not secure devices. Marketing teams trying to sell you something say otherwise. Don’t be gullible.

So you’re saying that, in order for me to steal everything on your phone, all I have to do is stand behind you in a supermarket and film you unlock your screen once. Then, on the way to your car, I quickly pull a knife on you and force you to tap your finger on your phone, then I hop on a motorbike and ride away.

Hope you didn’t have any banking apps or crypto on your phone, because now that’s gone.

QubesOS on a laptop is much much safer.

Thanks for sharing ACCA. Very neat

Common misconception

That’s extremely insecure compared to a computer

I don’t think this is inherently a problem, if the data is anonymized.

How long is your password? Do you ever type it in public?

Well, it usually is a good sign when an org actively breaks laws…choosing morality over law

To be clear: they’re tracking the mouse on the website, not the real time movements of a dildo going in and out of an orifice

We don’t talk about Hannah Montana Android.

Phones are insecure devices, by design. Should be OK.

Just don’t do anything on a phone that falls under “sensitive” on your threat model. Use a proper computer with a proper password for that.

I love the battery. I got a well used phone and I rarely have less than 70% at the end of the day.

But I leave my phone in airplane mode 24/7 (just use WiFi, no SIM)

Its comments like this that lead Google to make newer phones have stupid big batteries. I hate those big, heavy phones :(

I have a Pixel 3a, and I love it. I also have a Pixel 4a and love that one too

I bought a Pixel 5a, and hated it. I think the 4a is the best phone on the market right now. Great price, great support in Lineage, and its not too big and heavy.

Go to a local free cryptocurrency meetup group. Bring $5 and buy some bitcoin from someone there. Then go home and use a website to convert the bitcoin to monero. Do this with just $5 at first.

Once you understand that process, repeat with some larger amount and you can use it to buy things.

They have a onion service. If the climate activist used that, then proton wouldn’t have any details to give LE.

Use the privacy tools they tell you to use. they literally tell you how to prevent this from happening.

Use TAILS for activism

I wouldn’t trust client side encryption with something as porous as a web browser, though. Better to use a tool that doesn’t download and execute code from the internet constantly (like rclone)

No

Many developers sign their AppImages, but its up to you to verify it