And E2EE is only available on phones, circa a couple of years ago anyways

Telegram’s servers are located in US, Singapore, Netherlands (and maybe some other countries) from what I’ve gathered. And all chats that are not E2EE’ed are stored there, encrypted at rest at best with keys in the same database, or somewhere else that can still be accessed in automated way. Maybe it is not even encrypted at rest.

The point is, all those countries are either in 5 eyes or have information sharing agreements with 5 eyes countries. So as far as I’m concerned, TLAs can still have their fingers in those pies, in addition to Telegram’s overall shadiness and Russian ties. So maybe you get KGB strongman keeping a watch over your chats too.

This is not something I’d have much confidence in to be honest.

Switch to Telegram

You know it’s not even E2EE by default, and when it is it uses a homegrown algo that is not exactly well spoken of? (at least V1)

It is reasonable yet subpar under a threat model where you do not trust any single provider, which is a model I find appropriate most of the time.

You should not assume your password manager is unhackable.

That’s my main point. Perfect is an enemy of good indeed, but I feel that doing things properly the first time is a good idea in general, especially when it as easy as using a different app for your TOTP tokens. It’s a low hanging fruit really.

Please don’t use your password manager for TOTP tokens. It is called two factor authentication for a reason.

Until next time they try to push through something similarly stupid. Now it’s EU’s turn to make their mind too.

As a rule of thumb, do not put all your eggs into one basket. No software is infallible and vulnerabilities can be uncovered and exploited in both open and closed sourced applications.

That’s being said, as long as you don’t store all information necessary for a successful login in your password manager, you should be fine.

So storing credentials for your bank account is fine, as long as it is also protected by MFA and you do not use the same password manager for handling that.

You can store PIN codes from your debit cards in the password manager as long as you do not store card number / expiration / CVV2 there too.

Personally, I keep passwords in a password manager, MFA tokens in a separate authenticator, MFA recovery codes go to FIPS 140-2 certified encrypted USB sticks (3 separate copies). I do store debit card PIN codes in my password manager, but only alongside the last 4 digits of the card number.

I’ve had this setup for quite a while, it is very good, I’ve used the vertical monitor for my browser.

Dual ultra wide. Not even kidding. PPI might not be as swanky as it can be, but you can’t beat that amount of screen real estate.

Mullvad is trusted. They are pretty open with their policies, exist for a long time already, not involved in any privacy scandals (to my best knowledge), charge flat and fair fee without 60% sales and other dubious marketing practices. It is one of the better VPN providers, not in 5/9 eyes (they are in 14 eyes though), you can buy a subscription with crypto, which (assuming crypto was acquired anonymously too) is a good start for some privacy guarantees.

Pretty much every cyber security professional I know uses Mullvad in one way or another, usually as part of a more complex solution.

But all in all, please bear in mind that VPN is not some magic silver bullet to preserve your privacy and anonymity. With VPNs you basically shift your trust from your ISP to the VPN provider. That trust you put into the provider, it is still a requirement. Not to mention that a good chunk of tracking is happening on a lower level nowadays, so if you use Mullvad on Windows / any Apple device etc. do not expect to become untraceable :)

Use Firefox or Safari, the more people use Chromium-based browsers the faster we get to the situation where Google completely owns the Internet (and they almost do now).

• Settings -> General -> Language & Region -> Region
• Settings -> YOUR NAME -> Media & Purchases -> Account Settings -> Country/Region

Both must be changed to a different region to fully switch. Requires a valid payment method from that region (e.g. a debit card from that region). There are consequences to changing regions too, so be careful.

From my experience, sometimes you also need to contact Apple support to finish the change process. Otherwise it may just revert back.

Overall, Amazon surely knows where you are now and it will be set in your Amazon account, I suspect there is nothing you can do.

The best way to achieve what you want is to boot something like TailsOS and create a new account while under the VPN in that region. With a payment method from that region.

VPNs are not magic. Most big companies nowadays have means of detecting actual user locations, which is pretty trivial if you use an app or an operating system that leaks data when under the VPN.

Fiercely agree. I have Samsung “smart” TV that I use as a dumb screen for my Apple TV and PS5.

Samsung’s software manages to bug out even without using it. The TV remote would randomly disconnect, screen would respring, randomly adjust contrast etc. It’s like “the printer of TVs”.

I take digital notes in Apple Notes for knowledge and facts that should be quickly searchable and there is no need for me to remember it.

I maintain multiple digital knowledge graphs (vaults) in Obsidian.md for more complicated and interconnected information, like my work, software development, hobbies etc.

The rest is kept on paper.

Quick notes that I need to take during phone calls or conversations go into one of my Traveller’s Notebook inserts.

I’ve also started using a “concepts” notebook (another TN insert) where I note down new concepts (one per line, without explanation or elaboration, e.g. “acropalypse”, “goodhart’s law”). This helps me with remembering them better, as long as I go through my previous notes regularly and look up things that I no longer can recall.

Indeed

Books, online courses. Education in depth, ideally.

Yeah but… Brilliant has… a trial period. Seven days is plenty to realise that there’s next to zero educational value in that platform no matter how hard it is shilled online.

They are pretty poor courses anyway, why would you want them?

“Buttfuckers & Sons” 😅