https://www.aliexpress.com/w/wholesale-universal-washing-machine-board.html

Old phone which is supported by (even an old version of) LineageOS, kept permanently in airplane mode.

Can be extra cheap in countries which have switched off 2G+3G networks, and old phones are more likely to have a headphone jack. You might even have one kicking around in a drawer.

Audio output quality and headphone driving capability varies – research on audio forums for what might be good. LG v-series were very good.

If you’re feeling adventurous you could crack it open and remove/short antennas & microphones and cameras.

If it’s usb-only or the audio section is poor quality, apple sell a cheap usb-c dac that’s pretty good. (get it from a reputable source – most are counterfeit).

Usually they’re normal x86 PCs with nothing unusual about them so just your Linux/BSD distro of choice. You can look up the processor model to see what crypto acceleration it can do, or see if there’s any wireguard benchmarks available.

Some have interesting processors like PowerPC, or other strange hardware, but avoid them unless interesting is what you’re after.

You have the pi, give it a go.

If it’s inadequate then i’d recommend a used fanless thin-client type PC, such as a Wyse 5070, just make sure it comes with PSU and a few GB of RAM and SSD. And check reports of how much power it uses at idle.

• IMAP mailboxes can be shared between users: https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/shared_mailboxes/
• A contact email address could feed into an issue tracker / ticket type system.

Ok, it’s beginning to look like bad UI design on accounts.firefox.com:

If I click sign in at monitor.mozilla.org, it redirects me to an oauth process hosted on accounts.firefox.com which prompts me for my password then sends me back to monitor.mozilla.org.
The settings page at accounts.firefox.com then lists Mozilla Monitor under “Connected Services - Everything you are using and signed into” along with all my browser/device instances. But it doesn’t disappear when signed out from monitor.mozilla.org in the same way that a browser instance disappears when signed out from sync browser-side.

I’m supposing that list does not indicate what has access to sync data, which as far as I understood uses its own strong private keys browser-side which are never shared with the servers.

I’ve seen no documentation that Mozilla Monitor works by accessing one’s sync data.

The interface suggests that it only monitors email addresses manually added on monitor.mozilla.org’s UI.

Yes, I was aware of that at the time, and I probably assumed that my browser would be hashing each piece of data (e.g. each email address or username) before sending it to Mozilla Monitor or haveibeenpwned.

What concerns me is Mozilla Monitor appearing in the list of devices/browsers synced, each of which is implied to have cleartext access to all the data I decide to sync (bookmarks/history/tabs in my case, logins+passwords and more for many other people).

Most mass-marketed VPN services (the type marketed for accessing the internet) allow you to VPN into their private subnet where the thing you can access is their gateway router (which you use in place of your home gateway router/modem for connecting to the internet). You don’t need a VPN service to use VPN software between two points you control.

Plus, is he an abolitionist?

Slavery, abortion, prison, or guns?

ublock origin does not have this disclaimer. It works well and is widely trusted.

If you’re using Mozilla’s level of endorsement as a metric, note this prominent disclaimer on the addon’s page:

⚠️ This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.

Yep. It works and it’s awesome. I use conversations on android devices and dino and gajim on desktops, various family members use siskin on iOS.

With zero app or server-software or provider lock-in, and an actual in-practice diversity of apps and providers, the whole thing seems pretty immune to enshittification.

Well within the budget of a private investigator or burglar or peeping-tom or abusive ex-partner.

No need to scale; plenty of privacy/security incursions don’t require mass-surveillance.

That said, I’d suggest that the attack does scale economically . Think war-driving but with one of these setups – cruising around in a van through a dense neighbourhood collecting short clips of cctv footage looking for something of interest.

[…] the attack is an extremely expensive nation state level operation that doesn’t scale.

About $250 at most. Quoting the linked page:

Below is a list of equipment we used for the experiments.

• (1) Software Defined Ratio (SDR): Ettus USRP B210 USRP, ~$2100.
• (2) Low Noise Amplifier (LNA): Foresight Intelligence FSTRFAMP06 LNA, ~$200.
• (3) Directional Antenna: A common outdoor Log-periodic directional antenna (LPDA), ~$15.
• (4) A laptop, of course.

Note that the equipment can be replaced with cheaper counterparts. For example, USRP B210 can be replaced with RTL-SDR that costs ~$30.

To reproduce the attack: our GitHub repository provides the codes and instructions for reproducing and understanding the attack. We have prepared a ready-to-use software tool that can produce real-time reconstructions of the eavesdropped videos with EM signal input from the USRP device.

I wonder when (if?) orbital radio receiver arrays (a la starlink) are sensitive and discriminating enough to be used for this type of attack.

No, the “distributor” is the part which runs on your portable device, receives the push notifications, and wakes up the target apps as necessary.

https://unifiedpush.org/developers/spec/definitions/

Conversations can be a unified push distibutor: https://unifiedpush.org/users/distributors/conversations/

…and I’d trust it (battery-wise) with that. I have an old tablet with conversations running without battery restrictions on it, and if I’m not actually picking it up and using it it regularly goes 1-2 weeks on an 80% battery charge before it dies, the whole time giving audible notifications for XMPP messages/calls (which I attend to on other devices).