First of all, BGP routing problems don’t just affect Tor. They affect all kinds of network architecture like VPNs and certificate authorities. While I don’t have a complete understanding, the attacks presented by Princeton University’s team against Tor are not unique. A similar attack was documented by Certik against the crypto exchange KLAYswap. By that point, this seems out of scope of Tor when all of us could be hit.

Second, I’m not familiar with the specifics of what NoScript is doing, but the team has expressed that they need more data for building more up-to-date NoScript profiles. Seeing as I’m one of the only people on the planet who uses uBlock Origin advanced mode, I don’t know what the expectation is here nor what should be blocked in each mode except Default. The Tor security settings made sense back when NoScript was the only game in town, but there are plans integrating uBlock Origin into Tor and it’s going to take some time.

Third, on the Tor Browser no longer changing the user agent to Windows, user agents have long been broken. I constantly get questions on old videos and I’ll say it here, stop using user agent switchers. As long as you know what user agent you want (e.g. Chrome on Mac), you can use the responsive design mode in Firefox or “Inspect Element” in Chromium to change it. This feature exists for people who are web designers or app makers to test compatibility and responsiveness of their sites or apps.

Changing your user agent can fool certain scripts, but other scripts easily bypass it using fonts/CSS detection and find some way to detect your true operating system. Since Apple created Apple Silicon, the Tor Browser has reported the accurate “Firefox ESR on Mac” user agent because they mostly still are the only ARM users of the Tor Browser. When you think about it this way, it makes changing your user agent detrimental to your privacy because only weirdos and web devs change their user agent.

Fourth and finally, maybe consider not trusting sources that only show their sources in screenshots and make me go down rabbit holes online and yank things out of my brain. He clearly doesn’t know anything about Fair Use when he watched Reddit videos in a livestream with no meaningful commentary, previously claimed Proton is a honeypot without provided substantial proof, stole thumbnails from other YouTubers to use in videos, or complained about politics/open source rather than helping people or fixing problems. I hope one day the feds would pay me the money some people will likely accuse me of making. Maybe consider not getting your news from YouTubers, including me, especially when they use awful sources like Linuxiac, the Register, Tech Radar, Reddit, and X (formerly Twitter). This kind of critical thinking is taught in school to fifth graders or students in primary school.

Oh and happy Saturday to you all. I realized Meta Connect is this Wednesday, so I’ve had to slow down video production until it’s over. Shorts will be out for the last 4 tech events I’ve watched over the last 2 months, commentaries are out for Patrons/YouTube members, and the groundwork for 2 videos have been laid out, including one about the mythical Windows 12.

I love two factor authentication (2FA) and it’s essential to operating accounts in the digital world. But have you ever been forced to use it? Last year, I had to help my dad use the Symantec VIP Access app for his Fidelity account and apparently it’s deployed in many other businesses as well.

First, a bit of background. Fidelity is a popular investment broker here in the US and in particular, my dad got so annoyed by the text messages every time he had to login to his retirement account. By default, Fidelity does everything through your phone number so I was tasked to find a way around it.

For years, Fidelity only supported one other form of 2FA, that was Symantec VIP Access, a lame proprietary app that was basically a gated wrapper for standard 2FA, like in Google Authenticator. In August 2024, Fidelity made an announcement on their Reddit page (Onion link) that they now welcome any kind of 2FA app.

The thing that was irks me about apps like Symantec VIP Access is it’s a proprietary solution and not an open one. Deep down in the app, it is running the normal Google Authenticator stuff good websites run. They also make it so you can’t export your codes and include unnecessary data collection in the app, which is just unacceptable for an app to guard your accounts.

• Official Symantec VIP Access page
• Symantec VIP Access on εxodus
• Symantec’s App Privacy Label on Apple’s App Store

Like most financial institutions, Fidelity has terrible practices and I had to go through the trouble of setting all of this up, but I’m making this video to celebrate Fidelity amends and prepare all of you the next time you are forced to use Symantec VIP Access.

python-vipaccess

Some people on GitHub, cyrozap and Dan Lenski, have reverse-engineered the desktop and mobile apps and Symantec’s protocol, so you don’t need to use Symantec’s app and continue using an open-source authenticator app like Aegis or Ente for desktop/iPhone users.

Read cyrozap’s blog post about reverse engineering server calls for Symantec VIP Access

python-vipaccess GitHub

Installation

You will need Python and pipx installed in order to use the script. You can use scoop for Windows, pipx from Homebrew, or your Linux package manager. I use a Distrobox/Docker container to run it to keep my system clean.

Next, we need to install python-vipaccess from pip using pipx.

pipx install python-vipaccess

Now you can launch python-vipaccess from your terminal.

Symantec’s Provisioning:

python-vipaccess will generate your Symantec token by negotiating with their server the same way their app does. Symantec uses a proprietary, server-side protocol to issue you a token to obtain Google’s open-source TOTP standard to generate a code. This is yet another reason Symantec sucks, because Google Authenticator or other open source authenticators only require one device–yours.

vipaccess provision -p -i Fidelity -t VSMT

• -p prints the output without saving it to a file.
• -i is the 2FA issuer. Default is VIP Access, but this could changed to Fidelity for example.
• -t is the token format requested from Symantec’s servers. The token in this case is VSMT.

There are alternative tokens marked for either for mobile or desktop, but all equally functional. Keep this in mind if when you interact with IT or customer support.

• SYMC/VSMT (Mobile)
• SYDC/VSST (Desktop)
• More classification codes from Broadcom (parent company of Symantec)

Running the command should get an output that looks like this:

Generating request...
Fetching provisioning response from Symantec server...
Getting token from response...
Decrypting token...
Checking token against Symantec server...
Credential created successfully:
    otpauth://totp/Fidelity:VSMT95687533?secret=HHW3IFLSHQJBTZQRTULZQN5Q7DV4ZOQR&digits=6&algorithm=SHA1&image=https%3A%2F%2Fraw.githubusercontent.com%2Fdlenski%2Fpython-vipaccess%2Fmaster%2Fvipaccess.png&period=30
This credential expires on this date: 2027-02-19T16:44:55.044Z

You will need the ID to register this credential: VSMT95687533

You can use oathtool to generate the same OTP codes
as would be produced by the official VIP Access apps:

    oathtool    -b --totp HHW3IFLSHQJBTZQRTULZQN5Q7DV4ZOQR  # output one code
    oathtool -v -b --totp HHW3IFLSHQJBTZQRTULZQN5Q7DV4ZOQR  # ... with extra information

Let’s translate this output:

• Under Credential created successfully, this is the information we need to set up the service.
• IT/customer support will ask you for an account ID. With the example output above, this is VSMT95687533, but you will need to supply your own.
• If support asks you for a different token (e.g. “it’s the code that starts with ‘SY’”), regenerate your code with the matching token. You can also politely tell them your app is showing you something different and read your code aloud.
• Afterwards, manually enter the text after ?secret= into your authenticator app. In this example, the Google Authenticator seed is HHW3IFLSHQJBTZQRTULZQN5Q7DV4ZOQR
• Make a reminder in your calendar app of choice, password manager, or physical planner to setup Symantec prior to the expiration date.

Track Listing

• Minobe Yutaka (蓑部雄崇) - Satellite (サテライト) from Yu-Gi-Oh! 5Ds (遊☆戯☆王5D’s（ファイブディーズ）)
• Neötrön (ネオトロン) - City Girl Walks Down a Country Road (シティーガールは田舎道を歩く)
• Nyalpaca BGM - City Girl (シティガール)
• Outro: Khaim - Neon Lamp

Verifying downloads is something that should be ingrained into every computer user. Unfortunately, the process is very complicated and very few services make this easy for people. It’s intimidating to be told to use the terminal, especially if you are on Windows or Mac.

Paid Signatures

What’s more, why bother when a lot of the programs you use are probably verified already? Windows and macOS have a built-in mechanism to identify whether or not a program was created by the manufacturer that claimed to make it. If you use Snaps or Flatpaks on Linux, both implement a checkmark system to show the developer was verified by the Snapcraft and Flathub developers.

Signed applications are necessary to ensure the file wasn’t tampered with on the way from the developer to your computer. If you use a package manager like Winget, Homebrew, or the one in your Linux distribution, this process is also automatic. What’s more on Linux, the vast majority of packages on Linux are not verified. Even within the average distribution repository, most packages are not officially sanctioned by the original developers. This doesn’t mean a application is malware, but it can often introduce more problems.

The problem is signing systems like Apple’s notarization process or Microsoft certificates are costly for developers, requiring at least a couple hundred dollars up front just so the program you made won’t get blocked by the default antivirus.

• Apple’s crazy developer fees
• Microsoft’s explainer about certificates
• Microsoft’s list of code signing certificate providers

Unsigned applications don’t suggest they are malware, but it’s important to pay attention to where you got the program to begin with.

Bypassing Signature Checks on macOS

Like Microsoft, Apple has a robust verification system. Unlike Microsoft, Apple is more proactive at blocking unverified downloads. When you open an application for the first time, Apple will prompt you if you want to open the application.

If you need to open an unsigned application (e.g. LibreOffice, Alacritty, etc): navigate to /Applications and Ctrl + Click the application you want to open. Then select “Open.”

If you are on macOS Sequoia or higher, you will need to go to the Settings, “Privacy & Security” and manually allow an unsigned app.

Manual Verification

Naturally, people aren’t accustomed to verifying their downloads.

A couple years ago, Linux Mint was hacked and the ISO was modified to mine cryptocurrency off the unlucky souls who downloaded it. Thankfully, Mint’s team shut down the attack very quickly, but it goes to show how important it is to verify your downloads.

The attack was easily prevented if users verified their downloads. Unfortunately, verifying downloads is something that doesn’t get enough attention. The hacker of the Linux Mint, Peace, made the bold, but accurate claim:

Who the f**k checks those anyway?

Peace, to ZDNET’s Zack Whittaker February 21, 2016

We’re going to have to go and prove him wrong. It’s not going to be easy and maybe this is something that we need to start developing.

GPG Signatures

One of the most popular ways files are verified is PGP keys. Pretty Good Privacy (PGP) keys are often necessary for verifying other files using a central server for trust. Some projects also require verifying additional files.

PGP was originally only available to the government in the 1970s and PGP was developed to make file and text encryption more accessible to average people. Almost 40 years later, PGP is very unfriendly and is far too complicated to use. Encrypted messaging apps automate this message verifiability and security process, so they fill this void better. Despite its shortcomings, many open source projects and packaging utilities rely on PGP, because nobody has been able to break it.

PGP is typically handled with a command line application called GNU Privacy Guard (gnupg). There are various graphical front-ends:

• Windows: Gpg4win
• macOS: GPG Suite (Mail encryption is paid)
• Linux: Kleopatra

Of course, like most GNU applications, using gnupg or any of its frontends is not particularly straightforward.

Verifying GPG Signatures

I will be using the instructions for Kleopatra and Gpg4win. The instructions are similar for GPG Suite.

First, download the files you wish to verify. This will be your desired file and a signature file with the extension .sig or .asc.

Typically, these files are named something similar. If you download openSUSE Tumbleweed’s ISO and verify the checksums, the files we need here are the signature file openSUSE-Tumbleweed-DVD-x86_64-Current.iso.sha256.asc and file we want to verify openSUSE-Tumbleweed-DVD-x86_64-Current.iso.sha256.

Make note the folder where the files you downloaded are (e.g. Downloads).

1. In your GPG program, navigate to “Decrypt/Verify.”
2. Select the signature file first and the file that needs to be verified.
3. If you are told the certificate is unavailable, select “Search” to download the key from a known key server. Otherwise, skip to #6.
4. Once the key server has found the certificate, click on it and select “Import.”
5. Accept the next dialogue once the certificate was imported.
6. Repeat the process of “Decrypt/Verify” and select the files again.
7. Select “Show Audit Log.” If you see “Good signature from…,” the file has been verified as the authentic file.

Ignore any warnings that tell you the signature cannot be verified. This often confuses people who are trying to verify files when they aren’t trying to encrypt files themselves.

Since PGP keys aren’t designed for humans, you need to move them electronically. But of course humans still need to verify the authenticity of received keys, as accepting an attacker-provided public key can be catastrophic.

PGP addresses this with a hodgepodge of key servers and public key fingerprints. These components respectively provide (untrustworthy) data transfer and a short token that human beings can manually verify. While in theory this is sound, in practice it adds complexity, which is always the enemy of security.

Now you may think this is purely academic. It’s not. It can bite you in the ass.

What’s the matter with PGP? - Matthew D. Green, Johns Hopkins University

Command-Line

gnupg can also be used from a terminal to verify keys. As a GNU utility, it’s best utilized on Linux, macOS through Homebrew, or Windows Subsystem for Linux. It’s also preinstalled in many Linux distributions.

First, verify your file using the signature file first, then the downloaded file.

gpg --verify openSUSE-Tumbleweed-DVD-x86_64-Current.iso.sha256.asc openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso.sha256

If the certificate is not yet added, we need import it into our GPG keyring. You will get presented with a dialogue similar to this:

gpg: Signature made Tue 06 Aug 2024 09:04:47 AM EDT
gpg:                using RSA key 35A2F86E29B700A4
gpg: Can't check signature: No public key

Next, import the certificate from a remote server. This is the blob of letters and numbers after the key type. In this example, openSUSE uses an RSA key and the key is 35A2F86E29B700A4.

gpg --recv-keys 35A2F86E29B700A4

You should get an output informing you if the signature was imported to your keyring. Rerun the gpg --verify command from earlier. If you see “Good signature from…,” the file has been verified as the authentic file.

Check Out Those Checksums!

Often times, software makers will provide checksums, which are verified using GPG keys. This ensures the files you downloaded aren’t tampered with or corrupt in some way.

Checksums are alphanumeric representations of files or data—every file has one. There are many different algorithms to check files and it’s different for every operating system. For example on Linux, there’s a nice GUI called Collision. There are also command-line options.

An alternative is uploading the file to VirusTotal, but this may be privacy invasive as VirusTotal will receive a copy of your file.

At any point if you need to navigate to a folder or type a file name, you can drag the folder or file into your terminal instead of typing it out.

Popular Algorithms

• SHA1
• SHA256
• SHA512
• MD5

GNU coreutils (Linux)

Linux has the most comprehensive and commonly used hash verification tools by the GNU Project. The commands also have a built-in checker to formatted checksums from a file.

sha256sum openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso

Running the command will give an output that looks like this:

3b55f6f88c0a64f0e4e2abe19e106c40578ef60a9d97b5be149736e83154b0ce  /var/home/user/bin/mullvad-browser/Browser/Downloads/openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso

If you have a .sha* file, you can verify the file with the -c command.

sha256sum -c openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso.sha256

If you were not provided a .sha* file, you can manually verify by opening the file in a text editor or word processor, then manually comparing the hashes.

macOS/BSD: shasum and md5

On Mac, the process is slightly different than Linux, because macOS still maintains BSD tooling. The GNU version from above can be downloaded from Homebrew if you prefer the Linux commands.

Apple briefly discusses SHA checksums in their developer documentation. MD5 is deprecated due to its insecurities.

Open Terminal (or an alternative like iTerm2) and enter the desired commands.

shasum

For SHA checksums, use the shasum command. Below is an example for SHA256 sums.

shasum -a 256 subscribe.pkg

The output will look like this:

baaeeedffc7ef4a4f65ec8015699a5c95db91d131d253f1eb2ebc469557344c2 subscribe.pkg

md5

For MD5 checksums, use the md5 command.

md5 likethevideo.dmg

The output is very different from the Linux version, but it’s functionally the same.

MD5(likethevideo.dmg)= 20665acd5f59a8e22275c78e1490dcc7

Windows

Windows has a PowerShell utility called Get-Filehash, which is a catch-all command for all signatures and algorithms.

Get-Filehash is always following by your file, then the algorithm you wish to use.

Get-FileHash C:\Users\user1\Downloads\Contoso8_1_ENT.iso -Algorithm SHA256

All common algorithms are supported by Windows like SHA and MD5.

Did It Work?

Regardless of operating system, if the file is verified, you should just get an “OK.” Now your file is ready to use!

Now that you know, verify your downloads every time. You’ll keep yourself safe from the nasty things out there. All we need to do is pray for better tooling.

Resources

• Riseup’s tutorial on GPG key management. The guide is outdated, but the format of commands and best practices are still true.
• The Code Book: The Secret History of Codes and Code-breaking by Simon Singh. If you want to read specifically about key exchange, PGP, and quantum computing, it’s chapter 6 and onward.
• Damon Garn’s blog post for Red Hat “An introduction to hashing and checksums in Linux”

Track Listing

• Takashi Waraya (稿屋 隆) - With watching the donkey (ロバでも眺めながら)
• Yu-Gi-Oh! Power of Chaos: Kaiba the Revenge - Card List
• えだまめ88 - chocomint (チョコミント)
• Outro: Khaim - Neon Lamp

Do you have external storage like USB drives or portable hard drives? Unfortunately with external storage like USB drives or portable hard drives, your data is totally unprotected and can be accessed by anybody.

What would you do if you lost that device? Some devices come with software you could use, but most of these demand too much trust or might not work on Mac or Linux. Many of these programs are also upsold to you on top of the device you bought.

If you want assurance that you can password protect a device, VeraCrypt is the way to go. VeraCrypt is one of the most reliable ways to guarantee the ability not only encrypt devices, but seamlessly transfer that device’s data to other operating systems.

VeraCrypt’s Website

History

VeraCrypt is a rewritten version of a program called TrueCrypt. Initially for Windows, TrueCrypt was exclusively for Windows users and provided a substitution for Microsoft’s Bitlocker full-disk encryption.

The TrueCrypt developers were anonymous, but seemed genuine in their goals and gave the source code to anyone (we’ll get back to that one later).

But one day, during the height of the Snowden leaks and NSA paranoia, the TrueCrypt website was replaced with big red text demanding their users immediately stop using and uninstall TrueCrypt from their computers.

Enter VeraCrypt, a full rewrite of TrueCrypt. The process was a large undertaking and it was because the source code’s license was very problematic to develop with and to root out the alleged issues.

• The TrueCrypt license does not legally absolve the developers or distributors.
• An audit from Johns Hopkins University in 2015 revealed TrueCrypt is vulnerable to key extraction from live memory. This means if someone gains access to a computer with TrueCrypt turned on, data from volumes could be extracted.
• Another audit by QuarksLabs was completed in October 2016.
• TrueCrypt was for Windows only, although a Linux version was in the works. VeraCrypt is cross platform rewrite for Windows, Mac, and Linux.

The restrictions and lack of legal protection are the reasons most Linux distributions do not package VeraCrypt.

Why Not VeraCrypt?

The first thing you will need to consider is whether VeraCrypt is the right decision for you or not. VeraCrypt is best geared for cross platform file encryption on physical hardware.

Lack of Platform Diversity

If you need to access a file across different devices, for example, Windows and Linux or Linux and Mac, VeraCrypt is good for you.

If you share an encrypted device with somebody who doesn’t use the operating system you use, VeraCrypt will help maintain the encryption of your data while being available across operating systems.

VeraCrypt isn’t good if you only use one operating system or if only you use it. Windows, Mac, and Linux all offer much better integrated solutions (Bitlocker To Go, encrypted APFS, and LUKS respectively) at the cost of platform lock in.

No Official Mobile Clients

VeraCrypt has no official mobile apps. Despite having a page on their website, it is horribly out of date and none of the programs listed are officially by the VeraCrypt team.

A better alternative is Cryptomator. Unlike VeraCrypt, Cryptomator has an official, paid mobile app.

Do not use any mobile app for VeraCrypt. You risk the compromise or loss of data if you do so.

Not Cloud Friendly

Since mobile isn’t supported, this is where end-to-end encrypted cloud storage serves a better purpose. Cloud servers can easily sync to mobile devices more easily while still retaining full encryption at rest. I use Proton Drive personally.

VeraCrypt isn’t a good fit if you use cloud storage. You have to upload a large file with all of your encrypted belongings every time you sync. If that file is 16 GB, you need upload 16 GB each time.

Not to sound like a shill, Cryptomator stores your data is many different encrypted blobs. This way, it’s easier to sync only what gets changed will be synced properly to cloud storage.

I made a video on Cryptomator 2 years ago (Odysee Link).

Installing VeraCrypt

Because of TrueCrypt’s legacy, VeraCrypt is first and foremost a Windows program. You download the installer, verify it, and run it. On Mac and Linux, things get a bit more complicated.

Mac

On Mac, in addition to downloading the installer, you must download macFUSE so macOS can mount external volumes properly.

Linux

On Linux, VeraCrypt comes officially in 3 packages, a Debian/Ubuntu .deb, a Fedora/CentOS/openSUSE .rpm, and a generic tarball installer.

There’s also a third party package in the Arch Linux extra repository, but it’s not officially maintained by the VeraCrypt developers. The reason Arch allows packaging VeraCrypt is because their philosophy doesn’t discriminate against the TrueCrypt license, unlike the vast majority of Linux distributions.

Generic Archive

Unpack the generic archive and run the GUI x64 installer in the terminal.

Fedora Atomic Desktops

If you use Fedora atomic desktops or Universal Blue, you can layer the .rpm with rpm-ostree. Since VeraCrypt is mounting drives, it requires access to your host system and cannot be installed with Distrobox.

Usage

After VeraCrypt is installed, you can choose to use either the GUI or the command line. I’ll focus more on the Windows GUI, since there is more options, but will include the relevant terminal commands to do the same things on Mac and Linux.

Much of this tutorial comes from the VeraCrypt Beginner’s Guide, including the screenshots.

Unfortunately, VeraCrypt’s website looks like it was made at least 10 years ago and could be rewritten to make this information more accessible. There is also little documentation on the command-line options.

Creating a Volume:

sudo veracrypt -t -c

After installing VeraCrypt, click on “Create Volume” to get started. Then you will be presented with 3 options:

• Create an encrypted file container: This creates a digital file that will encrypt your data. This is the default option.
• Encrypt a non-system partition/drive: If you need to encrypt portable storage, select this option.
• Encrypt a non-system partition/drive: (Windows only) VeraCrypt is capable of operating as a substitute to Bitlocker. However, with the system requirements of Windows 11, this is not recommended.

Encrypting your Windows installation is not recommended. It is easier and less hassle to use Bitlocker or follow a guide to enable it for free on Windows Home

• Using VeraCrypt has a major downside of going through various hoops to enable Secure Boot and signing the VeraCrypt bootloader.
• Sometimes Windows Update will delete the VeraCrypt bootloader and you will need to use the VeraCrypt Rescue Disk to unlock your system and reinstall the bootloader.

Hidden Volumes:

Volume type:
 1) Normal
 2) Hidden
Select [1]: 1

A standard or normal VeraCrypt container is a file that houses all of your data. A hidden file creates another section within that file that can be opened with a second passphrase.

Despite what the command-line menu says, it’s much more intuitive to use the GUI to create a hidden volume. Using the command line requires you to create a normal VeraCrypt volume with no filesystem, then modify it after the fact.

Hidden volumes can also store decoy files. In the event you are forced to reveal the contents of the VeraCrypt container, these files can be used to placate or mislead people.

Hidden volumes require a lot of maintanance. Your operating system has the potential to reveal the presence of a hidden volume through things like file caching and “recent files” menus.

If you chose to use a hidden volume, especially if you regularly store files inside it, you need to have the discipline to update the files inside the outer volume regularly as well.

Your decoy files should be regularly updated to keep up the illusion they are valuable. Examples include financial information, journals, or photos.

If you aren’t prepared for this kind of maintenance, it is for extreme threat models. Most people shouldn’t have to resort to this and it reduces your overall storage for valuable files.

Using a hidden volume by default could result in data loss unless specific mounting options are checked. By default, your hidden volume files will be deleted to free up space for the outer volume, so give the illusion it is a normal container. Better safe than sorry!

Volume Location

Enter the location where you want to store the file. If you use the command-line, this must be an absolute path.

Enter volume path: /home/user/Documents/test.hc

Encryption Algorithms

VeraCrypt comes with various standard encryption algorithms. Most people should just stick with the default settings.

Encryption Algorithm:
 1) AES
 2) Serpent
 3) Twofish
 4) Camellia
 5) Kuznyechik
 6) AES(Twofish)
 7) AES(Twofish(Serpent))
 8) Camellia(Kuznyechik)
 9) Camellia(Serpent)
 10) Kuznyechik(AES)
 11) Kuznyechik(Serpent(Camellia))
 12) Kuznyechik(Twofish)
 13) Serpent(AES)
 14) Serpent(Twofish(AES))
 15) Twofish(Serpent)
Select [1]: 1

Hash algorithm:
 1) SHA-512
 2) Whirlpool
 3) BLAKE2s-256
 4) SHA-256
 5) Streebog
Select [1]: 1

A warning for the command-line, the order is the swapped between the encryption algorithms and the volume size. Consistency!

Volume Size

Specify how big you want your volume to be. If you are using a hidden volume, you will need to allocate space for the decoy files in addition to your hidden files.

Enter volume size (sizeK/size[M]/sizeG.sizeT/max): 1M

As another knock on inconsistency, you will be prompted to pick your volume format here.

Volume Password

Enter a strong passphrase to protect your volume.

PIM

Personal Iterations Multiplier (PIM) is a value that will run an algorithm for multiple iterations. For extreme threat models, volumes will mount slower, but the more the algorithm is run, the more secure your data is.

Normal users can leave this at its default setting.

Keyfiles

In addition to a password, keyfiles can be added as another file required to unlock your volume in addition to a password.

You can add file paths to any file you want or have VeraCrypt generate a keyfile for you.

Enter keyfile path [none]: /var/home/user/like.txt
Enter keyfile path [none]: /var/home/user/subscribe.txt
Enter keyfile path [finish]:

It’s imperative you backup and store your keyfiles in a safe place. If you cannot access them, you will lose access to the data within a VeraCrypt volume.

By default, no keyfiles are used.

Volume Format

Filesystem:
 1) None
 2) FAT
 3) Linux Ext2
 4) Linux Ext3
 5) Linux Ext4
 6) NTFS
 7) exFAT
Select [2]:

Formatting your container dictates where your container can be shared or what kind of files can be stored inside. In general, using these filesystems outside of VeraCrypt is the same.

• Ext: One of the oldest file formats on Linux. Do not pick the other options, just pick Ext4. Can only be opened on Linux.
• FAT: A filesystem universally supported across Windows, Mac, and Linux. Maximum of 4 GB per file.
• Mac OS Extended (APFS): The macOS filesystem. It can store files larger than 4 GB, but is only supported on macOS. Some Linux distributions like Kali Linux come with a driver called apfs-fuse to read it, but Windows cannot open it.
• NTFS: The Windows filesystem. It can store files larger than 4 GB and decent support on Linux as well. However, macOS doesn’t behave well and often will not let you write files to it.
• exFAT: Yet another Windows filesystem. It can store files larger than 4 GB, but plays better with macOS. Works across Windows, Mac, and Linux.
• BTRFS: A newer Linux only file format with special repair functions.
• None: This option is only available in the command-line and used if you use hidden volumes. This will prompt you to create a hidden volume. The rest of the space will become the outer, decoy volume.

Finalizing Your Volume

Entropy

Once you have made it here, it’s time to collect some random noise. This further protects your VeraCrypt volume.

• In the GUI, you will be prompted to shake the mouse as randomly as possible within the window.
• In the command-line, you will be prompted to type 320 random characters on your keyboard, then hit Enter when you are done. If you still have characters remaining, you will be prompted to continue typing.

Click “Format” and then your volume will be created to specification.

Access Your VeraCrypt Volumes

Now that you have created your first volume, let’s open it.

Unlocking

GUI

Select a drive letter (Windows) or a number (macOS/Linux), then click “Mount.” Then a password prompt will appear. Enter all information relevant to your container.

If you stuck with the default settings, they are the defaults here too. VeraCrypt will auto-detect which format your container is.

Command Line

To unlock a VeraCrypt volume, here are some sample commands:

# File
sudo veracrypt -t --mount /home/user/hitthebell.hc

# External Device (Linux, match letters)
sudo veracrypt -t --mount /dev/sda

After either option, you will be prompted to use your administrative password on macOS and Linux. On Windows, VeraCrypt is able to bypass UAC for admin users.

Once your volume has been unlocked, it can be accessed the same way you access a USB drive. Files can be interacted with in real time.

Dismounting

Similar to thumb drives, VeraCrypt has a procedure that needs to be followed to remove disks.

To dismount a VeraCrypt volume, select the volume you want to remove, click “Dismount” in the menu and enter an admin password.

sudo veracrypt -t -d /dev/sda

If you need to dismount multiple volumes, click “Dismount all”

sudo veracrypt -t -d

Updating VeraCrypt

VeraCrypt doesn’t have a mechanism to auto-update. Newer versions of VeraCrypt often fix issues or serious security vulnerabilities.

The only way to see if there is an update is to subscribe to the VeraCrypt GitHub releases. You can track VeraCrypt releases using an RSS feed, where you will repeat the installation process again once you are notified of a new release.

To follow VeraCrypt’s updates, add the following to your RSS feed reader:

https://github.com/veracrypt/veracrypt/releases.atom

Referenced:

• YouTube to insert server-side ads to break skipping sponsors and adblocking.
• The footage from the Snowden leaks is from Citizenfour (2014).
• “Come with me if you want to live” is from Terminator 2: Judgment Day (1991).
• xkcd 538: Security
• The clip shown at 29:18 is from Keijo!!!!!!!! Episode 2

Track Listing

• Kei Morimoto - Utopia
• The music for the sponsor segment is “Blizzard in DC” from the game Arctic Thunder. Heavily edited to remove the interposed America bits.
• yuhei komatsu - Bump!
• crepe (くれっぷ) - Fairy Lullaby (妖精の子守歌)
• crepe (くれっぷ) - Fairy Gift (妖精の贈り歌)
• yuhei komatsu - Scattered Sakura (桜が散る時)
• Outro: Khaim - Neon Lamp

Did you know Microsoft Build happened? It’s one of the biggest days for Microsoft every year, including announcing the new features of Windows like the new Windows Recall. Unfortunately for Microsoft, their PR team was quite up to snuff and has been greeted with hostility about Recall since the moment of its inception.

People who know me know I’m far from the biggest fan of Microsoft. As a company, Microsoft is rotten to its core and has few redeeming qualities. When I was reading the news and listening to opinions last week, I was very disappointed in new outlets and online influencers at spreading the narrative Recall is a privacy disaster (which to be fair, it probably will be in the future).

From the Microsoft Build keynotes, Microsoft showcasing a rigged Minecraft game and a gamer AI chatbot.

In addition to making a video and hopping on the bandwagon of recent news, I waited and did some reading about Microsoft documentation. Recall does a lot of things that will negatively impact your Windows computer, but let’s also be realistic about what those things are, so we don’t spread any panic, moral or otherwise.

What is Windows Recall?

At Microsoft Build this year, Microsoft announced Recall, a system powered by the artificial intelligence processors in the Qualcomm Snapdragon X computers, dubbed Copilot+ PCs. Recall is powered by a new API system in Windows called Windows Copilot Runtime, which empowers other non-Windows applications to take advantage of the newfound power and features of the Snapdragon X chips.

Inside the Snapdragon chips are what’s called language models, which give the Windows Copilot Runtime to caption dialogue, translate it, or run other types of local, onboard processing. Recall is also not as intelligent of a system as Microsoft’s engineers would have you believe. In order to make use of the on-board AI of a Snapdragon X chip and Windows Copilot Runtime, Recall needs to take screenshots of your screen every 5 seconds.

Ensuing/Ensured Outrage

Over the last month, many people decried the feature, but we encounter the first problem with the presentation with Recall and the Windows Copilot Runtime in general—it’s Microsoft’s inability to communicate. Not just any woman, Joanna Stern from The Wall Street Journal got to interview the CEO of Microsoft and the answer only instilled panic in people because it was poorly worded.

After watching the paywalled interview, The Wall Street Journal should have interviewed a lower level engineer or a different PR rep for Microsoft, because Satya did an awful job at giving Stern a straight answer to any of the questions she asked. The free interview also warps the conversation in 2 cuts and hides some of the information Satya said.

STERN: There could be this reaction from some people that this is pretty creepy. Microsoft is taking screenshots of everything I do.

NADELLA: Yeah, I mean, that’s why that it can only do it on the edge, right? …So this is, you have to put two things together. This is my computer, this is my Recall, and it’s all being done locally, right? …So that’s the promise. So, that’s one of the reasons why Recall works as a magical thing, because I can trust it that it is on my computer.

Joanna Stern & Satya Nadella, Microsoft vs. Apple: Satya Nadella Says AI-Focused Copilot+ PCs Beat Macs | WSJ (the free version) 4:16

How does Windows Recall work?

What’s interesting here in this interview is the distinction between offline language models versus large, cloud-based language models, like Windows Copilot or ChatGPT. While machine vision AI models are not something new, the dedication of neural processing units (NPUs) like what we see in the Snapdragon are going to become commonplace because of Microsoft’s insistence to their hardware makers.

Since Windows Recall is a very simplistic system. But it does prompt the question—does it violate user privacy? First, we need to put what Microsoft tells us about Recall under a microscope. As there is requirements and compliance for businesses, in light of potential privacy concerns, Microsoft documents the process.

Unfortunately, the most useful is scattered across 5 pages: Microsoft Support, the Microsoft Learn page about Copilot, the Microsoft Learn page about Windows Copilot Runtime, and the landing page for Copilot+ PCs. This is all the information for app developers and IT admins, but it’s arranged in multiple places.

About Windows Recall:

Microsoft fails to communicate anything clearly if there’s no place to consolidate this information.

• Recall Overview | Microsoft Learn
• Consumer Information (i.e. the Windows support site)
• Copilot FAQ
• Manage Recall for Windows clients - Windows Client Management | Microsoft Learn
• Microsoft Copilot Runtime Overview | Microsoft Learn

The App/Browser Bottleneck

The first thing to return to is the Windows Copilot Runtime. In order for the search to be the AI enhanced search like Microsoft shows in their demos, app makers need to write their applications with these features in mind. If an application is not supported, Windows Copilot will capture this data and it cannot be automatically filtered out.

As of time of writing, it’s not clear what non-Microsoft applications that don’t support Windows Copilot Runtime. It appears they will be indiscriminately captured and collected because of the section in Microsoft Learn about browser support, so let’s try to read between the lines here.

The mainstream browsers for Windows: Edge, Chrome, Firefox, and Opera all support the Windows Copilot Runtime and already filter out private browsing, DRM-protected content, or user-specified websites. The only time that private browsing will be collected is when the user explicitly presses Win + j to manually take a Recall snapshot or if a browser is not supported.

Opting Out

Since we know how browsers work and what makes Recall’s search to be effective, what can we, as users or businesses, do about Recall? How can we turn it off?

To configure Recall, in the Settings app, navigate to Privacy & security → Recall & snapshots → uncheck Save snapshots.

To configure Recall’s storage of screenshots, in the Settings app, navigate to Privacy & security → Recall & snapshots → Storage → Maximum storage for snapshots limit. There is a table of the storage minimum requirement for Recall on Microsoft Learn.

To delete Recall snapshots, in the Settings app, navigate to Privacy & security → Recall & snapshots → Delete snapshots from a specific timeframe or Delete all snapshots.

The most comprehensive way is to use Windows Pro or higher, where you get access to Group Policy Editor. There is likely an undocumented registry key for Windows Home users.

In Group Policy, navigate to User Configuration > Administrative Templates > Windows Components > WindowsAI > Turn off saving snapshots for Windows

“Justified” Outrage

An important thing I want to touch on is what I call “justified” outrage. It’s fine to be angry about something our oppressive corporate overlords do, but if you’re going to pick something, it better be something with demonstrable, substantial evidence and based in reality and technical feat.

The point being—Windows Recall cannot be tested right now and we should reserve judgement until it can be. There’s a common myth that proprietary software cannot be analyzed, but that’s far from true. It’s harder, but it’s not impossible.

Most importantly, let’s critically analyze why you should reserve your judgement about Recall, but also what can you be angry about now. To be clear and given Microsoft’s track record, there is a high likelihood that Recall will be used by invade your privacy, but this will need to be subject to experimentation.

The NPU Requirement

Recall requires a Snapdragon X processor. Additionally, hardware makers AMD and Intel have promised to release Copilot+ PCs in the future. The key thing here is none of these devices are in the hands of journalists or consumers (as of time of writing). Since nobody has any of these computers handy, you can’t do any of the testing.

The annoyance introduced by Recall is Microsoft’s requirements for it that screws over people who have computers capable of AI operations. I have a Nvidia 4060 in a gaming laptop. I can already run AI that runs speech inference or large language models like Google’s Gemma or Facebook’s Llama 3.

According to Microsoft’s arbitrary system requirements, my computer, fully capable of AI programs, cannot run Recall. I can only guess that it’s because they want to sell me more computers…

• a NPU (Qualcomm Snapdragon X, Intel, AMD)
• a minimum of 256 GB of storage
• 16 GB of RAM
• 8 processor cores

Recall’s “Allocated Storage”

While Recall allows you to turn it off, Recall will perpetually eat up at least 10% of drive. There’s a full table in Microsoft’s documentation about how much storage is taken up by Recall.

• If you have storage higher than 1 TB, 150 GB will eaten up out of the box.
• This is in addition to the 27-28 GB part of the base Windows 11 installation.
• The amount cannot be customized beyond the set amounts Microsoft prescribes.
• All future snapshots will stop when Recall is disabled or if the C:/ has 25 GB or less space.
• Snapshots will only commence if 50 GB is available.
• Since snapshots are stored in the temporary files, all data is deleted upon resetting Windows or installing an alternate operating system.

Peering Deeper In the Crystal Ball

Recall is a PR nightmare. Microsoft is vague about actual information people are looking for and distrust for Microsoft is at an all time high as a result. Privacy will be a concern for some, but Windows itself and Microsoft have greater problems that will eventually ruin the good parts of Recall.

On the Build Day 2 Keynote, Microsoft showed an ad for Lumen. For a brief moment within the ad, a Windows desktop is shown, but Google Chrome is blurred out in the taskbar. Microsoft traditionally has tried to make switching to alternative browsers like Google Chrome more difficult.

• Windows has a nasty habit of resetting your settings to default settings after updates. Such a feature could be enabled again after an update.
• Recall is enabled by default, according to The Verge’s Tom Warren. Microsoft claims it is opt-in. We need to wait and see which one.
• While Windows may process and store your Recall data offline, there’s nothing to stop Microsoft from running not-so-private telemetry on it after the fact. This will need to be subject to experimentation.
• Microsoft has a problem with enshittifying Windows by adding advertisements or promoting their own products. Recall has the potential to be next.
• Storing this data brings up the possibility that law enforcement will start requesting it, hackers will steal it, or people will sabotage it.
• The snapshots are not synced to the cloud. Yet.
• What is the power draw of the NPU accelerated tasks like Recall? It’s probably terrible.

As someone who has a deep distrust of Microsoft, I don’t recommend anybody use Recall. The greater problem is how the “choice” of using Recall or not is handled by Windows. This outrage over the last month is distraction from real questions people should be asking and where Microsoft has been light on answers.

We need to wait until Recall becomes generally available so it can be tested and prove/dispel rumor. The next time you read the news, hold off on sounding the alarm. Think before you act and as always, just buy a Mac or install Linux already.

Referenced:

• Microsoft Build 2024 Monday Keynote: Introducing Copilot+ PCs (Journalists only)
• Microsoft Build 2024 Tuesday Keynote
• (Disinformation Warning) The origin of Roko’s Basilisk
• What is Windows 11 ‘AI Explorer’? Everything you need to know about Microsoft’s upcoming defining AI PC feature - Zac Bowdin It’s important to note this information came out before the announcement and Bowdin says the leakers were insistent the data was stored locally.
• Scott Hanselman’s (VP at Microsoft) TikTok about the local processing of Recall
• Windows 10: CNIL publicly serves formal notice to Microsoft Corporation to comply with the French Data Protection Act within three months (Archive)
• Microsoft Windows 10 Home and Pro investigation by the Autoriteit Persoonsgegevens (Dutch DPA), August 2017
• Windows Weekly 884 and Paul Thurrott’s angry rant about Recall sensationalism at 33:57
• The Neuralink livestream featuring the first patient Noland Arbaugh
• Neuralink’s silent blog post about the setbacks of Arbaugh’s surgery

Bonus Content

Track Listing

• KK - ordinary landscape (いつもの風景)
• Kurippu (くれっぷ) - Skip of the Beginning (始まりのスキップ)
• Moppy Sound (もっぴーさうんど) - Escort
• Sharou (しゃろう) - Weekend Kyoto Reality Escape (週末京都現実逃避)
• yuhei komatsu - Holiday
• Outro: Khaim - Neon Lamp

Did you hear about that really bad Linux vulnerability? It’s the compression software liblzma or by the better shorthand xz and the code was backdoored. Now when most people hear backdoor, most of the time it’s just bozos on the internet abusing the term; this time, it’s not a drill. Also, remember how I said it was a Linux vulnerability? It’s actually much worse than that. If you are a BSD or use other Unix-like tools on macOS or Windows, this matters for you too. I’ll do a quick recap of the situation, but I’m not interested in telling you the news. Instead, let’s the discuss the impact this has on you, the end user, and what the open source community can learn from this situation and respond effectively.

What Happened?

Everybody compresses their files. It could be a .zip file or it could be done by your operating system or a website you visit so you don’t use as much bandwidth. Even watching videos on YouTube or Peertube are compressed videos. To compress things, programmers rely on compression algorithms, which bulk analyze files and remove information to save on space. If you extract a file, that space becomes filled up again. File compression plays an important role in saving you data and memory.

In the case of xz, a developer at Microsoft, Andres Freund, found that liblzma, the core compression library in many popular programs, was manipulated by the xz maintainer Jia Tan to steal security keys to login to servers. The vulnerability was only found after ssh, the protocol commonly used to login to remote computers, was taking merely milliseconds longer to connect. This attack is not normal for open source and speaks of a sophisticated actor with in-depth knowledge of the inner workings of xz and its potential weaknesses.

There’s more to this story, but I will be returning to pull details as they become relevant.

• Official response from lead maintainer Lasse Collin
• What we know about the xz Utils backdoor that almost infected the world
• An infographic created by Thomas Roccia

Am I Affected?

Now most journalists panicked and ran with this story, but let’s not downplay how bad this is. Unless you maintain a server that is connected to the public internet and even if you do, this is largely irrelevant to you. Most of the open source vendors responded promptly on Friday and stopped the backdoored library from getting very far. If you are a “normal” end user or you just run a home lab, you are probably safe from the xz disaster. If you do have a server, most servers run older libraries than the ultra newest libraries that had the backdoor. Even if your system had the most updated backdoored xz, you’d still need to have a distro that downloaded the releases page of the GitHub. That’s a lot of ifs and if you are a normal user, keep calm and download the latest update from your package manager.

• Alpine Linux: Backdoor found in xz package source
• Arch Linux
• Debian CVE-2024-3094 concerning a backdoor exploit in XZ Utils
• Fedora 40 and Rawhide: CVE-2024-3094: Urgent alert for Fedora Linux 40 and Rawhide users
• Gentoo discussion
• Homebrew for macOS
• Kali Linux: All about the xz-utils backdoor
• openSUSE addresses supply chain attack against xz compression library
• Red Hat: CVE-2024-3094
• systemd changes libsystemd to block liblzma
• Ubuntu 24.04 Delay LTS Xz/liblzma security update

Technological, Social, and Cultural Issues

But even after you download your updates, we still have arguably a complicated and bigger problem remaining—what do we do if something like this happens again? What’s worse, what other vulnerabilities have been using the same tactics as the xz backdoor? What are developers doing to detect them? The unfortunate reality is this will not be the last time this happens. You bet after the attention over the last couple days that everyone has been watching this. There’s no clean solutions, but let’s take look at what’s been done and what’s being done.

The Technological Solution: Reproducible Builds

A technological solution we can turn to is reforming the build process. Extensive testing with the infected library showed that fake white spaces Unicode lookalikes were used to falsify commit history and making various obfuscated files to deliver the final blow. White spaces will require some extra code in testing tools and we’ve also seen programs like Google’s extension store adopt policies against using obfuscated code.

Something that many Linux distros have been striving for is reproducible builds. The backdoor relied on someone downloading the archives from the releases page, not the source code, so when developers like Freund comes along to troubleshoot, contributors can verify the source code matches the final product of libraries or binaries. For years, distros like Debian and NixOS have championed reproducible builds because it builds a great degree of trust between all parts of software delivery.

If you are willing to pitch in, Linux vendors could always use help in making sure their software is reproducible.

• Who is involved? — reproducible-builds.org
• Stretching out for trustworthy reproducible builds - creating bit by bit identical binaries - DebConf 2015

Intelligence agencies…

Mike Perry, “Reproducible Builds Moving Beyond Single Points of Failure for Software Distribution” 5:07

The Social Solution: Combating Project Leeching and Burnout

So we’ve addressed real name policies and things developers can do prevent these kind of vulnerabilities, but we need to talk about cultural reform. Open source has a big problem and it’s a human one. The lead maintainer of xz, Lasse Collin, has been doing so tirelessly for years. Unfortunately, it was only him working on xz for a long time. There were other contributors, but none of them did as much work by Collins, who was very open about his own mental health issues. Except if you see what prompted this response, which was two of the puppet accounts run by the perpetrators and almost like a heist movie, 3 days later, Jia Tan joins as a developer. There’s multiple layers to this, so let’s break this down.

Related: Evan Boeh’s breakdown of the exchanges of the puppet accounts

I think the most important thing here is some basic operational security. It’s tough to be a big target on the internet and being a developer falls into that camp. Everybody will get on your case and blame you for every tiny issue about and stuff that’s not even related to your software. But mention of Colin’s mental health issues was taken advantage of by people who intended to do ill. As a warning, do not tell the internet about your mental health, especially with the risk somebody will try to use it to exploit your overworked state of mind.

Related: Mr. Robot S1, E5

The Cultural Solution: Leadership and Vision

But on mental health, we also need to talk about the state of open source development and the consumerist culture in FOSS. Maintainers are accustomed to people visiting their repos to have people ask about new features or fix a bug or two. Unfortunately, some people are… not very nice to put it mildly. And it’s not just xz, but tons of other projects like the Android app store F-Droid deal with this as well as an attempted SQL backdoor.

In fact, this whole xz backdoor only started because of the sock puppet accounts started with really aggressive language to make Collin feel like he wasn’t doing enough.

The issue here is a communication one and there’s no easy fix, so let me provide two of my internet armchair opinions. Projects need to curb toxic behavior like this. Notice nobody stepped in to quash this kind of behavior against Collin. Open source projects aren’t the only things on the internet with these issues, but it’s high time to start addressing this. I’ll let you be the judge of how. People are the biggest weaknesses of hacking, not just the code.

No matter how big or small, your project should have a clear vision in mind from the get-go. For xz, these “complaints” could be easily quashed by simply declaring the project feature complete. There also needs to be a defined pipeline for users to give back to a project, either financially or through maintenance like fixing bugs or packaging. Getting there requires a vision that leads successful communities that can tackle complex problems: technological, social, or cultural. It needs to be a vision that inspires people to say “I want to be a part of that” and building relationships that make everyone better.

Relevant: Zack Weinberg’s Mastodon post on reform in FOSS

Closing

At risk of going too long, I think it’s better to close out with an ask: there’s three solutions for communities to consider, the matter here is picking the right one. This whole situation isn’t so much about the security as much as it is a wake up call for proper community development and solid technological policy to prevent incidents like the xz backdoor. You can read all the news you want about liblzma, but if we don’t evaluate our own practices, we’ll be doomed to repeat the same mistakes again.

Track Listing

• KK - Ordinary Landscape (いつもの風景)
• gooset - Bittersweet
• gooset - SUNNY
• Fukagawa - Green Harmony
• Song that plays over the Mr. Robot clip is 1.4_3-billharper.mp3
• Lukrembo - Store
• Outro: Khaim - Neon Lamp

Today, I’m here to talk about my mother. My mom has also been looking to downsize the amount of technology in her life. My mom daily drives an iPhone and has for a long time, but has no concern for the Apple ecosystem. My dad still handles most of the tax collecting duties and my mom has also completely dropped using a computer altogether and only uses her iPhone. After all, most things are done in a web browser just fine.

But as my parents starting to get up there in the years and their senses are start to get weaker. My mom in particular has wanted a device with a screen larger than her iPhone and initially suggested an iPad. Not wanting her to fall deeper into the Apple ecosystem, I pushed her to get Google’s first generation Pixel Tablet. You have the ability to use a tablet fully free of the Google ecosystem through GrapheneOS and a mobile device with more software longevity than an iPad. Google has had a rough reputation with Android tablet support, but have leapt into action to try to catch up to iPads. So going in, I’m going to be focusing on the Android Tablet experience for a “normal” user–my mom.

I do a lot of paranoid things with my own devices, but the priority is for my mom to what she needs done done; open source and respect for her privacy are secondary priorities. Don’t get too excited about a hardware review because there isn’t a whole lot to say.

As a reminder, I receive nothing from Google except your ad revenue (if you watch the video on YouTube). The tablet was bought at a Best Buy with my parents’ retirement fund.

Hardware

The Pixel Tablet comes in a large box with the “charging speaker dock,” some manuals, and the tablet itself. In terms of hardware, the Pixel Tablet uses and shares similarities to Samsung’s Galaxy Tab. A difference is the Pixel Tablet uses the Exynos chip, which Samsung appears to be returning to with their phones.

If wasn’t clear by the video footage, the Pixel Tablet isn’t very visible in bright lighting conditions. The display is quite capable, but not ideal. It works great in dark environments like during the evening, but leaves a bit to be desired during the day.

On the charging speaker dock, it’s an interesting idea, but the speakers are kind of middling. There is also no charging cable included, so you will need to provide your own. When charging the tablet, the tablet comes with dots which allows you to magnetically attach it to the dock. The magnets are pretty sensitive, so you have to make sure the dots are properly aligned or you risk the tablet falling. She also purchased a synthetic leather Fintie case from Amazon.

In terms of hardware, the Pixel Tablet is pretty unremarkable, but not overtly cheap. The price comes in at $500, frequently discounted 1 year in. In some ways, the Pixel Tablet provides a worse app experience than an iPad, but outperforms an iPad in offering more freedom and features Apple refuses to give users.

GrapheneOS

The very first thing that I did was install GrapheneOS. On this tablet. However, one thing I want to make obvious is my mom is not a technical user–far from it actually. I chose to use GrapheneOS because of the security features, but also the “extended” support cycle. Since moving away from Qualcomm, Google has extended their hardware to 3 years of feature updates (or Pixel Feature Drops) and 5 years of security updates. After June 2028, the Pixel OS will be out of support and ROMs like GrapheneOS and CalyxOS will be the top picks. GrapheneOS is the winner for me because of their frequent updates and the constant innovation of features to making Android better, including assisting Google and the Android community in detecting serious vulnerabilities and bugs.

There are some post installation steps you can do, which I never touched on in my original GrapheneOS video. I want to cover some of GrapheneOS’s extra apps and features.

Following the esoteric guide on GrapheneOS’s website (seriously, this thing is way too technical for normal people) and used my Pixel 7 Pro as the installation device. I jacked in with a USB-C cable and pressed all the buttons the installer told me to.

If you don’t have another Android device, you will need to use one of the supported operating systems, download the Android debugging bridge from Google’s website or from a supported Linux distro’s repos, and the Chromium browser from their list. Then you enter what is basically a cheat code to unlock the bootloader and click 3 buttons.

The installation took about 20 minutes, but at the end, the Google was ripped out and GrapheneOS was in. Afterwards, you follow more post-installation steps.

The GrapheneOS App Store

GrapheneOS comes with an app store for independently updating their secure Camera, PDF Viewer, the default Vanadium browser, and the Auditor.

Separate from the stock apps, GrapheneOS includes downloads for various Google products compatible with GrapheneOS: Android Auto, Markup, and the Play Store. Typically, Google’s apps get much more visibility into your device and could potentially use this to collect more information about you.

GrapheneOS levels the playing field by forcing these apps to be installed and treated as normal apps you might download from another app store. They don’t get the special access, but are still able to do what most people expect them to do.

Google Play Store

Unlike other Android ROMs, GrapheneOS provides a fully functional copy of the Google Play Store. This is the standard of way of getting apps on Android, but also necessary for specific services. For example, when you use apps that receive notifications, most apps call for the Google services because it’s more battery efficient.

• To download the Play Store, you need to download all of the pre-requisite libraries. At the end, you should only get the Play Store available. The Play Store and the Google services are required if you wish to use Android Auto.
• Some apps require Google services in order to function properly. Others will have features missing, like passkey support or specific banking apps. Great resources for seeing app performance are Techlore’s Plexus, which documents various apps with(out) Google services and PrivSec’s list of working banking apps.
• There are some apps like Tuta or Signal, which do not use Google’s services and provide a redundant service instead for privacy reasons.

Usage

Using an Android tablet like the Pixel Tablet is pretty similar to running an Android phone, but there are some differences. My mom also has very different uses than most of the target audience of something like GrapheneOS–she needs to use all of the spyware apps in her life.

User Profiles

A feature Android possesses is user profiles. User profiles allow Android users to have a separate profile where they can store data or install things separate from their main profiles. User profiles are similar to users on computers.

On most Android ROMs, you are limited to 4, but GrapheneOS bumps this limit up to 32 and makes various enhancements to these profiles, including a secure “end session” feature, which shuts down all running apps.

While not typically seen as a business device, using a profile is much more valuable when a tablet is a family device. Suppose my dad wants to use the Pixel Tablet. He can create a user profile for himself to install apps just for him, completely separate from my mom. My mom is also given the “owner” account, which allows her to retain full control of the Pixel Tablet. What if you have a child who want to hop in on the latest mobile game? You can install the game in a separate profile so the game doesn’t get access to all my personal app data.

To Google or Not?

My mom has very specific needs and uses her tablet only for using streaming services and social media apps. This already encompasses a wide variety of apps like YouTube, Netflix, and Amazon Prime.

As a result, I linked her Google account to the Tablet and we got the Play Store up and running. YouTube requires Google services to function, plus my mom was just going to sign in anyway.

I said earlier that GrapheneOS locks these apps down more, but they are still very much functional. This includes spying on you, so with higher threat models, Google Services will still capture your notifications. Google account information is also kept if you choose to login, so it would be prudent to disable your advertising ID.

Disable your advertising ID (GrapheneOS)

hidden=""

In the Settings app, navigate to Apps > Sandboxed Google Play > Google Settings > Ads > Delete advertising ID

Android Tablet Support Exists…

When I set up the Pixel Tablet last year, my mom and I came across our biggest hurdle–incompatible apps. The long and short is despite the budding interest in Android tablets, not every app will work with Android tablets properly, if even at all.

Fixing the Aspect Ratio

Similar to iPads, some apps like Reddit are limited to a phone-like window to preserve the app’s intended aspect ratio. If you are bothered by this, Android 14+ allows you to stretch these apps to match your tablet’s screen ratio. It’s pretty seamless.

Early Woes with Signal

Thankfully, I have convinced a good portion of my family to adopt the secure messaging app Signal. However, when we first got the Pixel Tablet, there was a major issue: Signal would not work on Android tablets at all. Today, Signal works flawlessly on Android tablets, but this was not always the case.

With Signal in particular, there was a workaround I found that worked. I installed Molly using their F-Droid mirror. Molly is a fork of Signal Android client that implements some anti-forensic features not present in Signal. For a long time, Molly was the only way to use Signal’s service on an Android tablet.

Molly is generally a day behind Signal with updates (which is pretty reasonable) and I personally prefer the main Signal app as using Molly requires you trust their developers in addition to Signal’s. Molly is also great if you need to access more than one Signal account on a single Android profile.

While Signal works today, I feel it is too much friction to get my mom to switch away from Molly.

AirPods on Android

As an Apple refugee, my mom has 2nd generation AirPods as her headphones of choice. However, as Apple products, controlling them without an Apple device is difficult. I discovered a project by Frederico Dossena (the creator of LibreSpeed) called OpenPods. It lets you control your AirPods, gives connection notifications, and monitor their battery life of both ears.

OpenPods must be downloaded from F-Droid as they were mysteriously banned from the Play Store.

Viki & Vanadium

In the United States, there’s been a surge in people seeking to stream Korean dramas and my mom is no exception. The most popular app to watch K-dramas is an app called Viki. However, Viki is incompatible with Android tablets and they still refuse to make a compatible app.

The solution was actually fairly simple–using a web browser. Using a web browser is not only possible, but we can also create a home screen shortcut so it can be used similar to an app. However using a web browser opens up the can of worms that is browser choice.

GrapheneOS’s default browser, Vanadium, supports Google’s Widevine DRM. GrapheneOS also takes your connection to Google’s DRM and puts it through a proxy to limit what Google can collect about you.

The one disappointment with Vanadium doesn’t support blocking static or cosmetic ads and I really do not want my mom clicking on malicious ads. Instead, my mom uses Brave. I know there are some who swear by Vanadium, but Vanadium has weaker fingerprinting protection and content blocking. Brave is the only other browser endorsed by GrapheneOS and my second choice anyway.

I’d be open to exploring NextDNS in the future, but have not had adequate time to test whether the free plan would work with my mom or not. If it doesn’t, I would have to pay and have her piggyback off my plan.

Gboard

I installed Gboard, the stock Google keyboard and the keyboard for the Pixel Tablet’s stock ROM. I disabled the internet connection for the app to limit Google’s data collection. As much as I like GrapheneOS, the AOSP keyboard is borderline unusable. Since my mom uses Google services anyway, I figured it would be a better experience.

Misc

• There’s a phone app in GrapheneOS’s Tablet ROM. The Pixel Tablet can’t use eSIMs or a SIM card, so I don’t know why this is here.
• I enabled button navigation opposed to gesture navigation. My mom has a strong preference for buttons.
• I disabled all touch/tap sounds. My mom is so angry whenever my dad types on his phone.
• Adaptive brightness can sometimes be very aggressive.

Should you buy?

After 5 months with the Pixel Tablet, my mom has been very satisfied with its performance and rarely commented on the differences of GrapheneOS. It very much is the stripped down Android experience for the vast majority of people, but they will need help setting it up, whether it’s a custom ROM like GrapheneOS or because of lack of app support.

Setting up a custom Android ROM is not overly difficult, but if you don’t have that knowledge, it can difficult. While GrapheneOS has made lots of great changes to make the installation experience pretty painless, it could stand to hold the less technical user’s hand a little bit. Most people will see the wall of text on that installation page and lose their minds. In my mind, unless you set up GrapheneOS or CalyxOS, the Pixel Tablet isn’t worth your time.

There’s also the issue of identifying problematic apps because Android tablets have been treated like third-class citizens for years. The Android tablet app experience leaves a bit to be desired, complicated more by the “fragmentation” of the Android ecosystem. If you won’t install a custom ROM or you have apps you know will not work, you’d probably be better off with the tried and true iPad.

I think that if you are willing to learn and follow that ultra-technical guide on GrapheneOS’s website, the Pixel Tablet is the best choice for you for a tablet device that respects your privacy, freedom, and ownership of the device. This, combined with user profiles, proper split-screen, and freedom to use alternate app stores are all amazing reasons to consider a Pixel Tablet. It would also be cool to see if Google keeps making tablets and what the next generation has in store.

Summary

🚫 Not recommended, due to poor Android tablet compatibility and Google discontinuing future prospects for this form factor (but will continue device security updates until 2028). Installing GrapheneOS is necessary to last beyond end of life, but not encouraged.

Pros

• Allows installation of a custom OS (GrapheneOS)
• Best choice for Android tablets in terms of updates (5 years of support), legacy support on custom ROMs
• Tablet experience offers things Apple will not: calculator, split screen, user profiles, third party app stores
• Good performance
• Great as media or emulation device

Cons

• Comes with privacy invasive stock OS
• Android tablet experience (while functional for most) leaves a bit to be desired
• Screen does not perform well in bright conditions
• No headphone jack
• Forces you to buy a gimmick speaker dock with a proprietary cable and does not include a USB-C charger

Track Listing

• kinono - Peaceful Days (平穏な日々)
• Sharou (しゃろう) - 10°C
• KK - Oya oya (おやおや)
• Takashi Waraya (稿屋 隆) - Cats (カッツェ)
• Outro: Khaim - Neon Lamp

Windows is notorious for having the worst update system in the world. It’s unstable, breaks all the time, and it’s slow as hell. You made it through the awful install/setup process and dodged creating a Microsoft account. If you want to use Windows effectively, you need to know what it takes to survive Windows Update. Let’s dive into the Windows Update schedule, how to download your updates, and how you can avoid any problems along the way.

Patch Tuesday

Windows Update is how you update your computer and firmware. For something simple for most Linux and Mac users, Microsoft makes their update process incredibly confusing and painful for their users. It’s already a meme that Windows Update forcefully turns off people’s computers to install updates.

Windows Update is notorious for being slow and causing lots of problems: ranging from broken partitions, fundamentally flawed protocols, and worst of all, dereferenced files that looked like data loss in addition to these great anti-features.

Microsoft has a schedule of releasing the security update, split into a 4-5 letter cycle for each week of the month (A, B, C, D, and sometimes E). This naming scheme how Microsoft organizes their updates and we can use this lettered cycle to plan around a game plan to deal with Patch Tuesday.

Microsoft describes their process in their Microsoft Learn documentation and on the Tech Community blog.

One of the core tenets of maintaining Windows is Patch Tuesday, although Microsoft would prefer you refer to this as “Update Tuesday,” but that isn’t a marketing term–it’s a derogatory term given to it by the IT community. The 2nd Tuesday of every month (Week B) is a nightmare day for IT admins, as Microsoft, Adobe, and Intel all orchestrate their updates on this day, hence Patch Tuesday. In years past, Microsoft would deliver updates erratically and through “service packs,” which often led to extreme distrust and breakage or people not downloading their updates at all.

Of course, Microsoft isn’t transparent about this at all, plus they might watch my video and change their mind because it’s too predictable right now! The communication for this is scattered across blogs, X (formerly Twitter), forums, and documentation and there’s no good way to get a real answer about this.

After First Install

Before we formulate a game plan with how Windows Update works, let’s start with a fresh Windows 11 install. You’ll want to go into Windows Update and just download as many updates as you possibly can. Often times, when you first purchase your computer, the computer haven’t turned it on and is likely running an older version of Windows. If you recently reinstalled Windows, there’s a number of updates since that version of Windows was released.

As an obligatory warning, when you do this, Microsoft will instantly make you a guinea pig to test their updates and enroll you in beta-testing updates for the rest of Windows. In fact, Week D, the 4th Tuesday of the month is when Microsoft delivers feature updates to Microsoft’s other products like Office 365 and .NET.

To configure non-Windows Microsoft product updates, in the Settings app, navigate to Windows Update → Advanced Options → Receive updates for other Microsoft Products

While that happens, go to the Microsoft Store and update all of the Store apps. All of the stock applications in Windows are installed through the Microsoft Store and the easiest way to update them is to visit the Microsoft Store and verify that all of them are fully updated. Windows’s stock apps are updated independently of Windows Update, so it’s important you come back and check for updates often. This really tedious and takes at least an hour, but it’s worth it to get the security updates you need and making sure all of your Store apps are up to date.

To update your apps from the Microsoft Store or Winget, in the Microsoft Store, navigate to Library → Get Updates

When you’re done with both your Windows Updates and Microsoft Store updates, hit restart and pray your computer turns on again.

Update Frequency

Despite its problems, Windows Update does impact the reliability and bottom line of Microsoft and the Windows team has made some minor, but respectable improvements to the process by making the updates smaller in size and preventing common forms of installation corruption.

Microsoft self-reports issues and describes Windows feature updates on the Windows Release Health page.

This is the tough decision: Windows is the only way for you to download security updates, sometimes for actively exploited attacks in the wild, but is constantly plagued with buggy, broken updates, beta-tested breakages, and Microsoft anti-features. What’s the most optimal way to update Windows while keeping up effectively with Patch Tuesday and keeping our devices updated?

The Vicious Cycle

Automatic updates are crucial to keeping your device updated. Utilize the fact that the Windows team rolls out updates in stages and you’re not going to be immediately hit with an update at once. We also can’t sit idly by and let Microsoft wreak havoc on our devices. Therefore, let’s take appropriate measures to handle Windows Updates and the schedule I use when I deal with Patch Tuesday, starting from Patch Tuesday itself.

Week A

Hunker down and block Windows Update. It’s always prudent to block Windows Update and if an update is really bad, Microsoft will block it from getting to your computer. Delaying updating is a more reasonable approach to disabling Windows Updates altogether. Be prepared to back up any data to offline or cloud-based storage. If an update goes wrong, you can always restore from a backup.

To delay Windows Update, in the Settings app, navigate to Windows Update → Pause Updates

Week B

Microsoft issues the newest Windows Update. Be on the lookout for news websites that talk about Microsoft and report immediate problems related to Patch Tuesday. I typically view Brian Krebs and Susan Bradley’s comments from Ask Woody. While both Krebs and Bradley reiterate information directly from Microsoft, they save you the work of wading through the mess that is Microsoft’s Update Catalog. They both offer different perspectives too.

• Krebs focuses on the security-related issues and often links the original work submitted to Microsoft. If you see any vulnerabilities, especially for popular programs that you use, his monthly warning is your nudge to update.
• Bradley takes the slow and steady approach and is very vocal about the instability of Windows. If she’s still squawking, that’s your cue to wait on Windows Updates. She usually separates recommendations for both home and business users. In my personal opinion, she’s a little too cautious, but generally she helps strike a healthy balance for home users.
• Microsoft will often block problematic updates from being installed and will not let you get them, even if you smash that update button. However, if their engineers (or AI) decide that the update is “safe,” they will forcefully install it unless you have delayed Windows Update. You will get a prompt in the system tray or the Start menu.

No matter where you get your update information from, it’s important to use your own judgment. Krebs, Bradley, nor I can answer if updating is right. Microsoft will help a little bit if they block an update, but more often than not will force it upon you. It’s important to develop an awareness and the discernment to accept a Windows Update or delay it longer.

Week C

If you see people complaining online about how Windows Update broke something, there’s a big button to delay Windows Update for a week and sit Week B out. If you get through Week C with no complaining, it’s probably safe to accept that Update button.

Week D (and E)

Microsoft releases non-security updates for their other software, like Microsoft Office or .NET. Pick these up while can, unless you’re a crank like me. Otherwise, use this time to catch up on updates if you’re behind on Patch Tuesday.

Week A (Again)

Patch Tuesday is next week and another month has come and gone. Even if people are still complaining, download your updates now for security reasons, else you might be forced to update during the next Patch Tuesday, then you have 2 Patch Tuesdays worth of trouble.

The Cycle Goes On

Remember, by the next Patch Tuesday, you have downloaded all security/cumulative updates, then the vicious cycle will repeat, you’ll be doing this forever. Or you could just ditch Windows altogether…

The Annual Windows Update

Every year, Microsoft issues a new version of Windows and has obligations to their commercial customers to alert them of changes. Thankfully, this has gone down from twice a year, but it’s not exactly an improvement with how long these updates take and useless features introduced. What’s more, these version numbers are largely invisible to end users, especially when disparate versions of Windows 11 all look the same.

To find your Windows release, non-Windows Microsoft product updates, in the Settings app, navigate to System → About → Windows specifications → Version

Microsoft provides information about Windows 11’s support cycle in their Learn documentation. Upgrading works seamlessly between versions as long as your version of Windows is currently supported and between major Windows releases (e.g. 10, 11, etc).

If you rarely use Windows or you haven’t updated in a while, you could get into a situation where you are using an unsupported version of Windows. In this scenario, Windows Update will not give you security updates and we need to upgrade to the most recent stable build of Windows. For example, if you are running 21H2, consulting Microsoft’s documentation shows 21H2 lost support in October 2023.

If you get stuck on an unsupported version of Windows, you can attempt to upgrade using the Windows Installation Assistant. This will get you hooked up with the latest version of Windows 11 (provided you meet the hardware requirements). Using the Windows Installation will allow you to keep all of your data and install the latest version of Windows on your device.

Alternatively, you can download a Windows ISO and burn it to a USB stick using Rufus or creating a new Windows Installation Media. Once you boot into the Windows USB, you can upgrade in-place and preserve your data.

Uninstalling an Update

Let’s say you install the latest Windows update, but it’s a little sluggish. People are complaining online that their system got slower, but you installed the bad update! You can uninstall the offending update from Windows.

To uninstall a Windows update, identify the current name of the update. Microsoft uses the Knowledge Base (KB) to document individual changes to Windows. After your brain turns to mush scrolling down their massive list, look for the KB number that might be the offending update.

Let’s return to our fictional scenario. I’ve read a news article and found out that the offending update is KB1234567.

In the Settings app, navigate to System → Windows Update → Update history → Uninstall updates

The legacy Control Panel will open and list all of the updates you can uninstall. From here, select the offending update, right-click, and Uninstall. Windows will prompt you to reboot afterwards similar to normal Windows Updates. Afterwards, delay updates so the offending update is not installed.

If you still encounter problems, well that’s Windows for you. Good luck next month!

Track Listing

• yuhei komatsu - Cry Baby
• gooset - SUNNY
• h - Saturday morning
• yuhei komatsu - Pop out
• yuhei komatsu - Twilight Sunset (黄昏Sunset)
• Outro: Khaim - Neon Lamp

Don’t use Okta. Wait, you want to know more? How about the utter mishandling of user information and complete disregard for transparency?

Even funnier, it was revealed that the September/October breach was actually much more serious than was originally believed and leaked everyone’s information. All while I was editing this video.

How to Protect Yourself from Okta:

Okta requires a phone number, the email your IT admin associated with your account, or in certain configurations, downloading the app as the only option. So you don’t want to give them a phone number or download the app because of their awful practices and your value for privacy, what can you do?

• Using a work VOIP number: If your employer provides a voice over IP (VOIP) phone number, you can use that as a second factor. This is my current strategy.
• Using a “burner” phone number: If you own more than one phone number, you can dedicate another phone number to protect your personal phone number.
• Using a separate Android profile: If you use Android, you can create a separate profile for your work apps and download the Okta app. It’s not totally anonymous, but using the QR code for their 6 digits, it doesn’t require internet access.
• Using Android-x86 in a virtual machine or spare device: You can sideload the Okta Verify app and sign in to your email in the virtual machine to receive a magic link. When the app is installed, you can click the link and bind the virtual machine’s app to Okta’s push notification system.
• The old phone: If you have a spare old smart phone, you can download the app there.
• Using a third party emulator: There are many commercial Android emulators, like GenyMotion or Bluestacks.

Side notes:

• The Okta app works without Google Play Services, but you will not receive notifications.
• Okta’s push verification requires internet access, but their proprietary 6 digit codes works without internet access. It is not Google’s standard, so you can’t use a conventional TOTP app.
• I tried Waydroid, but the orientation and functionality of the Okta app within it is questionable at best.
• It would be worth looking into Google’s Android Studio and trying to run it there.

Alternatives to Okta

• Aegis
• Bitwarden
• Ente
• Passkeys, a universal standard by the FIDO alliance (ironically funded by Okta)

Referenced

• Lapsus$ found a spreadsheet of accounts as they breached Okta, documents show | TechCrunch, Zack Whittaker
• New Lapsus$ Hack Documents Make Okta’s Response Look More Bizarre | WIRED
• Teen Suspected by Cyber Researchers of Being Lapsus$ Mastermind - Bloomberg
• Frequently Asked Questions Regarding the January 2022 Compromise | Okta
• Okta’s disgusting pricing page
• Okta Support System incident and 1Password
• How Cloudflare mitigated yet another Okta compromise
• Okta’s Latest Security Breach Is Haunted by the Ghost of Incidents Past | WIRED
• ArsTechnica’s Dan Goodin’s woes with Okta’s PR team
• Various compiled critiques by WIRED’s Lily Hay Newman
• Hackers Stole Access Tokens from Okta’s Support Unit – Krebs on Security
• Okta: Breach Affected All Customer Support Users – Krebs on Security

Firefox is one of the longest living browsers still with us today (good riddance Internet Explorer) and is arguably the most customizable browser when comes to protecting your privacy. I have made lots of videos about Firefox, but lots has changed to Firefox since then and I want to take my time to take a step back to review the basics, update some of the configuration files I have, and why I still use Firefox as my daily browser.

Browser Battles

The undisputed point is Firefox is Mozilla has always been at odds with the current browser at the time (Netscape in the old days and now Chromium). Firefox has also become the heart of many important open source projects: Thunderbird, the Tor Browser, Web Assembly, and nss.

Mozilla has diverged from many other browser makers because of their nonprofit status and has been more proactively for the end user than many other web browsers.

• It’s easier to switch your default search engine in Firefox and access multiple search engines in the address bar.
• It’s easier to change it to the default browser on Windows 11.
• Firefox has one of, if not the most, robust screenshooting utilities in a web browser, full stop.
• Also has a built-in color picker and my favorite developer mode.
• Firefox has also been faster to accept hardware acceleration on Linux and macOS than Chromium has. For example, Firefox’s initial Apple Silicon support was much better than Chromium’s, as they got the secret sauce directly from Apple. Similarly, Wayland support on Linux is much stronger than Chromium.
• Firefox also offers Total Cookie Protection, blocking websites from viewing your other websites by further isolating the cookie jar.

Mozilla has also been much more forgiving in regards to the dreaded C-word, and you know, the C-word that blocks things on websites. That’s right, I’m talking about cont—Containers to compartmentalize multiple logins and data. Want to stay logged into work and personal accounts at the same time? Firefox Containers have you covered!

Unlike Chromium, Mozilla has been much more of ManifestV2, soon to be replaced by ManifestV3. To be fair, ManifestV3 is absolutely a security win: browser extensions will be much more limited in what they can do. This comes at the drawback of traditional content blockers not being as good as they used to be die to rule limits of 500,000, far too low for most common content blockers.

Mozilla’s response to this has been to continue support for ManifestV3, especially because of the number 1 most downloaded extension on Firefox that starts with the letter U. The bottom line is this: Chromium is largely maintained by companies that rely on surveillance capitalism and have incentive to neuter content blockers. Firefox doesn’t and is able to users this choice.

Unfortunately, most people fall victim to the tyranny of the default. The decline of Firefox has been obvious for multiple reasons.

• Firefox has little mobile market share. By default, phone users are presented Google Chrome on Android and Safari on iPhone. Even if you do install it, it’s a crippled browser. It’s also more insecure, but that’s a topic for another day.
• Most browsers are based on Chromium, which is for the most part largely controlled by Google. Lack of browser competition among giants is harmful for users in the long run.

That also doesn’t even account for Firefox has some cheap imitators. I would advise you stay away from most of them. A lot of them struggle to receive updates in a timely manner.

Installing Firefox

Installing Firefox is about what you’d expect: visit your software store or Mozilla’s FTP server to get it and avoid the unique identifier planted in the installer. If you are on Mac, consider using homebrew.

Special Note for Windows Users

An important thing to note is Windows users are going to need to take some extra steps:

1. While you can download Firefox from the Microsoft Store (not winget), this version doesn’t include various hacks to automatically set Firefox as your default browser when you ask it to. This is because Microsoft hates your freedom, plain and simple. The primary benefit of using the Microsoft Store is to get UWA apps, which Mozilla isn’t anyway.
2. Firefox installs a scheduled task to constantly check if Firefox is your default web browser. Mozilla, it’s none of your beeswax what I use as my default browser. Go into Task Scheduler and delete it.

Profile Manager

Now you have Firefox and we’re going to configure it, right? Hold your horses there sport! We’re going configure profiles. While not as easy to use or as forward facing as Chromium, Firefox supports profiles to separate different identities and configurations of Firefox. I’m going to cover some in a future video, but it’s all about ensuring we only use one browser that we know works in various different ways.

First, you have to run a Firefox command, then we can append an argument to open the profile selector by default. This varies based on operating system. In the video, I cover Linux and Windows, but the principal is the same on macOS as it is on Linux.

Windows

C:\Program Files\Mozilla Firefox\firefox.exe -p

macOS

Make sure you open Firefox normally first to bypass Gatekeeper prompts. Then you can create an alias with the following:

/Applications/Firefox.app/Contents/MacOS/firefox -p

Linux

If you are on Linux, consider using the snap package on Ubuntu or the Flatpak if you don’t use Ubuntu.

• Snap/Flatpak: Both the snap and Flatpak are maintained by Mozilla’s developers. The snap and Flatpak are also sandboxed, so you can configure permissions using Snap Store or Flatseal.
• Your distro’s native package: While behind on updates, native packages can offer stronger sandboxing than what Flatpak provides.

You’ll need to make a decision:

Native

Pros

• Stronger security
• Can include special fixes for your distro

Cons

• Slower to deliver security updates and bug fixes
• Might not even be available at all due to licensing conflicts

Snap/Flatpak

Pros

• Universal package
• Officially maintained by Mozilla, no middlemen
• Fast updates and bugfixes

Cons

• (Flatpak only, snap untested) Weaker sandboxing and isolation
• (Snap only) Requires AppArmor for proper isolation

# Native/snap
firefox -p
# Flatpak
flatpak run org.mozilla.firefox -p

Uncheck the box Use the selected profile without asking at startup, now every time you launch Firefox as such, you will be presented with a menu to choose which profile you want. The first profile you create is called default-release, but you can rename it or create a different one.

Stock Firefox

Out of the box, Firefox isn’t all that great. The search engine is a bit invasive and has sponsored links. Pocket is lurking around at the top. Mozilla collects telemetry which they never cite as helpful. Rather than fix this right now, I might get some hate for this, but there’s an argument to not configure Firefox at all. Configuring Firefox in extreme ways can cause websites to be much more suspicious of you. You must be doing something wrong if you used the about:config, obviously!

Keeping a stock Firefox with no configuration is great for a browser where your anonymity isn’t as important. Services like banks and critical work or business functions are great examples of this. You could get on your high horse and say that you are doing your duty by configuring it, but I would argue it’s not worth the hassle when these services probably know you by your real name anyway, so it’s not a big deal.

Configuring Firefox the Easy Way

Firefox has a lot of configurability, especially when configuring Firefox offers a lot benefits protecting your privacy, security, and the occasional weird Mozilla feature. If you’re looking to configure Firefox, but don’t want to have to deal with the fuss of a user.js file, this is the place for you!

Why bother?

Firefox has a lot of settings and these are the only ones that most people have access to! If you haven’t already, I strongly recommend setting up custom profiles if you haven’t already. I maintain at least 4 Firefox profiles at once, each of them serving a different purpose. I typically name this profile “PrivacyFox,” because we’re going to configure Firefox to a minimal degree. Scripts like Arkenfox turn off a lot of features and while features that break websites are marked, many others indirectly cause websites to break.

And even if you’re an advanced user and use privacy-hardened Firefox with a custom user.js and fancy userChrome.css, you still need to be aware of the GUI settings because scripts like Arkenfox won’t configure these for you most of the time. They often leave the GUI settings open for users to configure it themselves.

The benefit is you can customize Firefox to resemble the behavior you want and you can choose how you want Firefox to look. Unlike most other browsers, Firefox truly lets you claim it as your own, and no, it won’t break upon updates unlike Vivaldi!

We’re going roll through all of the default Firefox settings and give a quick rundown of each one.

Home

You can toggle your homepage by changing it something else. And for the last time Josiah, I’m not making your homepage Google if you can just type in the search bar to use Google!

Popular options include:

• DuckDuckGo
• Startpage
• Brave Search
• Google
• Bing
• Yandex
• Baidu

Search

The search settings are where you can configure Firefox’s search engine. I would be remiss not to tell you that Firefox gets paid millions of dollars by Google to be the default search engine. There have even been rumored talks of a bidding war with whether or not Bing would replace Google as the default. If you have preference for a different search engine here, you can change it here.

Alternatively, if your search engine is not listed, you can visit your favorite search engine and right-click on the Address Bar, then click to add it to these options.

• Disable “Provide search suggestions”

Firefox will also proactively search with autocomplete enabled by default. This means that anything you type into your Address Bar will be sent to your search engine provider. I recommend turning this off.

Privacy & Security

• Select “Strict” Enhanced Tracking Protection

Firefox offers Enhanced Tracking Protection (ETP) against common threats on the web. It will not protect you from everything, but it’s designed not to negatively impact your browsing at all, even on Strict.

Navigate to “Address Bar,”

• Disable “Suggestions from the web”
• Disable “Suggestions from sponsors”

In America, us Firefox users are pestered with sponsored links in the autocomplete. Just turn them off.

• Navigate to “Cookies and Site Data” and select “Delete cookies and site data when Firefox is closed”

Cookies are used to track things across the web like login sessions and cached information. However, most websites abuse this and use this as a mechanism to track you.

[Advertisers] capture the “cookies” that your computer automatically deposits into your Web browser, creating an indelible of every site you visit and every page you view, then use that information to send you personalized advertisements… “Cookies are used by virtually all commercial websites for various purposes, including advertising, keeping users signed in and customizing content… Bad as it was to be stalked by shoes…”

Martin Lindstrom, Brandwashed

But naturally this leads to a question: how do you stay logged into accounts you always use and you want the convenience of staying signed in?

• Under “Manage exceptions,” you can add an exception by typing in the site, and selecting “Allow”
• Visit the site you want to save your credentials for, then press Ctrl+i (⌘+i on Mac) Navigate to “Permissions” -> “Set cookies” -> “Allow”

HTTPS-Only Mode

Back in the old days, websites thought it was a good idea to use unencrypted websites, which allow your ISP to snoop on what you do. Most of these things have been eradicated from the Internet today, but for those who couldn’t figure out how to do it, you want to be presented with a full-screen warning to protect your privacy.

• Enable “HTTPS-Only Mode in all windows”
• You can also “Manage Exceptions”

DNS over HTTPS

DNS over HTTPS (DoH) is one of the newest web standards for secure DNS connections, which translate your URLs like “trafotin.com” into the corresponding servers on the internet and IP addresses.

DoH changes the DNS paradigm by using HTTPS packets to call the websites you want to visit. By using DoH, in junction with encrypted DNS, your internet service provider can still see sites you visit, but they aren’t allowed to tamper with any of the content, because yes, they have done this before.

I previously enabled the US default of Cloudflare’s DoH server as the default, but I’m taking a step back and letting you guys decide what you want. I think Cloudflare is a great default and the other, NextDNS, is also very handy. Other providers like Quad9 offer their own servers.

Enable Secure DNS using:

Lastly, Firefox now has the ability to force all traffic through DoH, which is really cool. In Chromium and previously in Firefox, DoH would be the default, but if websites rejected it, it would just fall back to normal DNS.

• Select “Increased Protection” or “Max Protection” for DoH.

If you select “Max Protection,” if you can’t connect to your DoH provider or if the connection is routed back, you will get a full screen warning.

If you are interested in learning more about DNS, I recommend a talk from Jim Nitterauer about compliance and protecting your privacy with DNS.

Telemetry

• Disable “Allow Firefox to send technical and interaction data to Mozilla”
• Disable “Allow Firefox to install and run studies”
• Disable “Allow Firefox to send backlogged crash reports on your behalf”

While Firefox is fairly respectful of your rights, one of the things I am the most suspicious of is their telemetry collection. The telemetry being opt-in isn’t a crime, but they don’t make it clear whether this information is useful or not, nor is it published anywhere publicly. It also doesn’t help that Mozilla places ads everywhere.

Even if you believe Mozilla is in the right, I’m a paranoid weirdo who would turn it off anyway. If you use an account, Mozilla collects more information about you and ties it to your Firefox account, so you might have more reason to turn it off given Firefox accounts demand an email.

Customizing Firefox

Firefox allows users to customize the UI to their liking. For example, if don’t like the “wide” address bar, you can remove the spaces. If you’re a front-end dev, you can add the developer tools to the toolbar. If you want to add back the extension icons to your taskbar, you can pin them near the puzzle piece icon. Be creative and make Firefox your own. You can make it look like Chrome, old school Firefox/Opera, or Safari.

• Right-click on the top bar or window decorations and select “Customize Toolbar”

New Tab

Firefox also allows users to customize the New Tab page, including using a custom website as one. Still, with the vanilla New Tab page, there are things to be done.

• Right-click and unpin all preinstalled shortcuts. These are all sponsored links for companies who paid to be here.
• Gear -> # rows here
• Gear -> Sponsored Shortcuts -> Disabled
• Gear -> Pocket

Mullvad Browser

You could configure Firefox by going through the settings, but the easy way to get a privacy-hardened Firefox is using the Mullvad Browser. Since my very first video with Arkenfox, this has been what I consider the most radical change to Firefox forks. Ordinarily, I never recommend Firefox forks because most of them have trouble updating in a timely manner or don’t have a good enough reason to exist.

The Problem With Firefox Forks

The problem with most Firefox forks is you need to not only trust Mozilla, you need to trust the other people who are touching the fork, and trust that they will keep it up to date. With something as important and unfortunately resource heavy like a web browser, you need to ensure you get updates promptly and most smaller browser forks aren’t able to do this well.

Why the Mullvad Browser?

The exception has been the Mullvad Browser. Mullvad Browser doesn’t use the normal Firefox, but the Extended Support Release or ESR of Firefox. It’s much slower to adopt features, but the core security and engine of Mullvad Browser is the same.

In fact, Mullvad Browser was developed in conjunction with the foremost popular fork of Firefox, the Tor Browser. The Tor Browser has worked with Mozilla for years to fine tune Firefox against the invasive practice of surveillance capitalism and protecting your anonymity on the internet. Mullvad Browser inherits all of the Tor Browser’s work and it basically the Tor Browser, just no dark web functionality.

Well if you can’t connect to the dark web, what’s the point? Because Mullvad Browser is perfectly privacy-hardened by default and has all the extensions you might need in it, you don’t even need to pay for a Mullvad subscription to use it; you can use it as is. Everyone who uses Mullvad Browser is now lumped into the same pool of people and if you use a VPN (commercial, self-hosted, etc), you are now part of the same army of people using this browser.

Limitations to the Mullvad Browser

There are some caveats where you might want to avoid Mullvad Browser:

• You can’t use some newer features of Firefox. Previously this included screenshots, but also things like AI integration and vertical tabs. This is because Mullvad is based on Firefox’s extended support release (ESR).
• You can’t save logins. All data is deleted upon closing Mullvad Browser. You run this in Private Browsing/Incognito mode all the time.
• You are stuck with the extensions they give you and you shouldn’t configure them beyond their default values. In order to blend in, everyone needs to have the same uBlock Origin settings and the same NoScript settings.
• There are what some would consider bloat features like the Mullvad extension or the Mullvad Leta search engine, especially if you don’t use/like Mullvad.
• Some websites might not work correctly, because of the Tor Browser configurations. You can’t watch DRM-protected content for example or some website elements might not work.
• There’s also the pain point of the Mullvad Browser is pretty young and not as many people use it.

The Easy Way Out

And that’s why I’m recommending it. I’m selfishly recommending it because it is the easiest way to get privacy-hardened Firefox and you can join me in the sea of people using it. It’s the newest kid on the block, so we need to make this pool of people bigger and more normies use it.

Remember the last time I made a video on Android? It was over a year ago (and on Airguard)! Now that changes. I have right here a Google Pixel 7 Pro, which I pawned off a relative. I mean, if it were me, I would have waited for the Pixel 8! But this is something I’ve been excited for: an Android operating system that truly puts your rights first and foremost. This has now become my daily driver phone and I have never been more exicted for a Phone since my LG VX-5400! Buckle up guys, Android ROM flashing time!

What is GrapheneOS?

GrapheneOS is a custom Android ROM, but what does that actually mean? Android ROMs are the same as when you choose to run operating systems on your computer. Few Android phones grant you the ability to install custom operating systems and many manufacturers refuse to provide you such a freedom or will hamper your efforts to run custom Android ROMs.

But why would someone choose to do this? It really comes down to control or functionality. Since many manufacturers maker it difficult, they are effectively taking away your freedom to do or run exactly what you want on your device. It’s important because compared to Apple for example, at least you are given the choice (on certain phones) to do what you want.

That being said, there are risks and I can’t go without mentioning them. In the past, installing a custom Android ROM could result in bricking your phone, but times have changed. As long as you choose to run a reputable Android ROM, the chances of you bricking your phone are telegraphed to you. As long as you play it safe and stick to big name ROMs, it’s hard to mess up.

Custom ROM Insecurity

While I am all about encouraging software freedom and running what you want on you device, I want to warn you against rooting your device. Rooting usually gives you as the end user the same ability to run dangerous command that could your damage your system. “But Trafotin, I made it this far and I haven’t gotten in trouble yet!” Rooting your phone has dangerous consequences especially if you are downloading files outside of the Google Play Store. Sure you can do you get your whiz-bang battery enhancing apps, but newer innovations prove using an unrooted device is great. You can install an Android ROM and not be constantly using your phone with administrative privileges. It’s a bad practice for computers and it’s just as much a bad practice for phones.

The GrapheneOS Solution

This is why I am firm proponent of GrapheneOS. GrapheneOS is a custom Android ROM, designed to not compromise on user security while still respecting your rights. It’s the most robust custom Android ROM, but that polish comes at a cost. GrapheneOS can only be installed on Google devices. Google makes the best smart phones when it comes to keeping your phone up to date and not flooding your phone with crapware that other Android manufacturers throw in. Inevitably, people will fear Google kills off their phone line, but I am doubtful that this will happen. The state of manufacturers providing timely security updates on Android is so bad Google is willing to go into debt and force their OEMs to do the same. Sure Google is one of the Big Tech companies, but they recognize they are responsible for the biggest phone operating system in the world.

And I know the irony of using a Google phone to get more privacy, but Google’s phones are legitimately the easiest phones to install custom Android ROMs on and they have been for years. The entry level devices, like the Pixel 7a and the Pixel Tablet are less than $500 and pretty affordable.

Installing GrapheneOS

So you’re sold on using a custom Android ROM and you have a nice fresh Google phone. I’m doing this with a Pixel 7 Pro, but all of Google’s newest product line is compatible with GrapheneOS. I normally recommend buying a phone on sale, but I got a $200 discount for 4 years of updates and I wanted a model with an actually decent camera because anyone who has seen videos filmed with my iPad are atrocious. But how do we install GrapheneOS?

The following entails a guide on how to install GrapheneOS. The project has been in some drama because their former head developer didn’t like publishing guides, even if you supply the same or more depth instructions than on their website.

Prerequisites

I’m not going to get into detail, but the first step is to

• a Google device that is carrier unlocked
• use a computer from one of their supported operating systems to reduce as much error as possible. This can be a computer or even another Android phone.
• use a Chromium-based browser from the list
• connect your Google device with a USB cable and trust the device you plug it into

If you do the computer method, you need to make sure to have the Android SDK tools. I used a spare computer with Ubuntu and Brave and the instructions are pretty reliable with Linux and Windows, but pretty vague overall. If I had criticize the installation process, there could be a little pulldown menu with some extras instructions.

OEM Unlocking

But that’s the hard part, let’s do something more fun–OEM unlocking. This is one of the coveted features of Android phones that allow custom ROMs. But how do we configure this?

• Go to Settings→About→Build number then smash that button until you become a developer.
• Go to Settings→System→Developer options→OEM unlocking enabled.

You might also need to connect to Wi-Fi at least once.

Rebooting

After you enabled OEM unlocking, you need to turn off the Google device. In my case, it’s the sleep button and the volume up button at the same time. This took me more attempts than I would like to admit.

When you turn on the device, then hold the volume down button while the phone turns on and you get a spooky tiny text menu. This means we are in business for the hardest step of all…

Doing the Deed

• Go to your nice Chrome browser and click the button to identify your Google device and unlock the bootloader.
• Click the button to download the corresponding release for your device.
• Click the button to wipe Google off your device. Do not touch your device or unplug it while it is working. It will reboot multiple times and you know when you succeed when the Google logo shows up, only for the GrapheneOS logo to jumpcut in front of it just like having in movies.

You still see a hash appear as your phone boots up and compare this with the hash on GrapheneOS’s website. This ensures you’re running an official GrapheneOS image.

Have you enabled Secure Boot on your computer? I sure have, but what is it and why it’s so important to the fabric of computing today? Why is Windows 11 pushing Secure Boot so hard? Is it a way for Microsoft to block off third party operating systems? Did someone on a forum or Discord tell you to turn it off? All of this and more as we learn together why UEFI Secure Boot should be required for everyone!

What is UEFI?

Desktop computing is exposed to constant threats in the wild and one of the worst things that could be compromised is your boot process. For something like your phone or your laptop with critical information, we want that stuff locked down tight to prevent bad guys from getting in.

In a brief (ultra-simplified) explainer, any computerized has 3 major layers:

1. Your hardware, like the device you use.
2. Your BIOS, which operates as a single point of trust to handle things like peripherals.
3. Your operating system, like Windows, macOS, or Linux, where you make changes to your computer.

While booting up a computer started off simple in the early days, it has become more complex. Previous older iterations were things like the Extensible Firmware Interfaces (EFI), which is a miniature operating system that vastly increased this capability. EFI adds that ugly interface you have hidden away that controls things like your power management, virtualization, and what not.

UEFI “unifies” the complexity of EFI, but also makes UEFI the “trusted” version of EFI. You rely on your firmware to know if your computer is properly booting and not doing something sketchy in the process. UEFI is another chip attached to your motherboard that adds cryptographic authentication your devices are running and initialized properly. We need UEFI because many corporations view UEFI as the continuation and future of EFI.

What is Secure Boot?

The added cryptographic verification presented a new frontier for device makers. Personal computing devices like your computer or your phone contain lucrative information for attackers, so the big operating system vendors invest into protecting the sanctity of your system.

This started with the Platform Initialization standard. This generates a key, typically from your motherboard’s manufacturer, which attests the firmware on your motherboard is indeed valid and has not been tampered with (there’s protections for timestamping changes, so modifications, to prevent rollbacks, and replay attacks).

Secure Boot uses UEFI’s keys and ties it to pre-baked keys from your manufacturer to add an extra layer of security against malware exploiting this boot process (it’s similar to the prebuilt keys in your browser). This validates that the operating system you boot up is precisely the intended target and there’s no malicious code burrowed in as your device boots up. There’s also a keystore with forbidden keys, where if a key can no longer be used to verify boot images, it’s added to a blacklist so they won’t ever work again.

Exploitable Firmware Interfaces

This isn’t hypothetical, because state-sponsored attacks and limited attacks in the wild take advantage of people who haven’t caught up yet despite the years that have gone on. The Chinese research company Qihoo 360 reported on (in Chinese) UEFI rootkits using the backwards compatibility modules for EFI in ASUS’s computers.

Most recently, the Russian firm Kaspersky found a rootkit yet another vulnerability targeting this backwards compatbility, once again in ASUS and Gigabyte motherboards. If you thought ASUS shorting their BIOS or Gigabyte getting their firmware backdoored, that isn’t even the worst of it!

Microsoft Vs Corporate Linux

These sophisticated attacks are nothing compared to the history tied into the way Secure Boot was presented to the public. The dreaded operating system Windows 8, under the iron fist of Steven Sinofsky, began to require “Microsoft-compliant” UEFI Secure Boot. In the classic, poorly worded style of Microsft communication from the madman, Sinofsky added just a little clause to these requirements:

In the screenshot below you will notice that we designed the firmware to allow the customer to disable secure boot. However, doing so comes at your own risk. OEMs are free to choose how to enable this support and can further customize the parameters as described above in an effort to deliver unique value propositions to their customers.

This last line got major Linux manufacturers seriously concerned because history has shown OEMs often cut corners to ship firmware and what if the ability to boot something other than Windows was taken away?

Papers from Red Hat and Canonical describe how the ability to write and add keys needed to be included into the Microsoft requirements so OEM keys. In the original Build blog post, Sinofsky does mention this at the beginning, contradicting the quote that got everyone so worried:

Secure boot doesn’t “lock out” operating system loaders, but is a policy that allows firmware to validate authenticity of components… Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows

This quote provides probably the “intended” (whatever that means to you) meaning to users, “you can turn off Secure Boot, but you do so at your risk.” If you examine these carefully, you’ll see Red Hat and Canonical’s engineers don’t reject the UEFI or Secure Boot standard, but it needed to be done in an inclusive way to allow Linux users, on the server or desktop, to get Secure Boot.

Secure Your Boots Now!

To this day in comments, in places like Reddit, Discord, or 4chan, I continue to hear is using Secure Boot doesn’t work if you don’t use Windows. And while that might have been true at one point, it hasn’t been true for over a decade. I can guarantee that the vast majority of Linux users disabled Secure Boot because a guide online told them to. For example, I caught this “guide” from some guys on the Garuda Linux team telling their users to disable Secure Boot, which just borders on irresponsible because it can be done!

Not just this behavior, but also the fact Garuda automatically trusts and rebuilds some goofy fork of the AUR is reason alone you should just stay away from them.

It’s even more ironic the 2 most popular desktop Linux distributions, Fedora and Ubuntu (and their derivatives like Mint and ublue for example), have never been subject to this. Red Hat and Canonical have to cough up a one-time $99 fee to access the 3rd party Microsoft key, which ensures their users get full access to Secure Boot. This third party shim key Fedora pays for is used by the USB tool Ventoy to ensure Windows 11 and other compatible Linux distros can use Secure Boot out of the box (with a nifty guide!).

But Secure Boot on Linux breaks if you use the proprietary drivers like NVIDIA proprietary driver. In Fedora, Fedora includes Akmods, a startup script that rebuilds your packages on boot. Akmods allows you to generate your own key using openssl and sign the Linux kernel, thus allowing NVIDIA’s driver through Secure Boot correctly.

I wrote 2 little scripts based on a guide from the folks at Fedora’s RPMFusion that allows you to sign the kernel, so you too can get Secure Boot with the NVIDIA driver on Fedora. Once you enroll your keys, you reboot and can toggle some settings using mokutil to configure Secure Boot properly, by continuing with your keys. There are other methods for openSUSE’s installer and Arch Linux, but I’m not familiar enough with them.

I’m going to leave it there because instead of making strawman arguments claiming Secure Boot will lock people out, we need to accept the new standards because UEFI and Secure Boot are realities you need to wake up to. I didn’t even get into the part where Windows and Linux are just broken compared to Macs or mobile devices! So leave a like on this video. Leave a like on this video if you hated the Windows 8 era!

Verified Boot and TPM-verified boot

Desktop computing security is fundamentally broken compared to the strength of verified boot on Android and Apple devices. The advent of technologies like Intel Bootguard and Microsoft’s Pluton prove that the silver-lining of Windows 11 is PC verified boot has gotten easier than ever. However, there’s the issue of certificate verification. There’s are bypasses that require enabling third party UEFI certificates, like the ones Fedora and Ubuntu use, on Lenovo computers, but Linux now supports Secured Core computers without the need for such measures. If you use a distribution that isn’t a rolling release with an updated Linux 6.3 kernel or higher, you won’t get access to stuff like Pluton.

It’s time to learn about Flatpak and why you need to use it. Flatpak is the way to go and is going to revolutionize Linux, whether you want to or not, especially since it’s the easiest way to get things that you want. I’m going to be going over what Flatpaks even are, how to use it, and how to control what your Flatpaks do.

What are Flatpaks?

Flatpaks are sandboxed apps using bubblewrap, designed to universally work across many Linux operating systems, but specifically on desktop. Flatpak acts as a front-end for bubblewrap, which has really complex command-line arguments, and as an easy way to install packages independent of the operating system you use (a Debian user and an Arch user install the same packages together in harmony).

Since apps are sandboxed, Flatpak downloads dependencies and libraries independently, so your programs work the everywhere. Gaming on Linux is one desktop activity that greatly suffers from this, whether you’re running SteamOS, Ubuntu, Arch, you and developers will experience the agony of inconsistent results, when they could be universal. Flatpak also simulates architecture, so you can still run all your 32 bit libraries, ARM programs, or x86 games and graphics using Flatpak.

Linux Can’t Sandbox

On desktop Linux, applications are given access to daemons or allowed to access all files on your system. Ideally, your operating system shouldn’t be allow this to happen, but this is a very real problem Flatpak wants to solve, especially as Apple and Google have figured out how to do this already (with Android, ChromeOS, and iOS, MacOS has sandboxing too, but it’s opt-in for developers, so tyranny of the default).

The technology Flatpak is built to provide an answer to both of these problems. Flatpak is also integrated in major Linux app stores like GNOME Software, Discover, and pamac. Flatpak also provides a container folder which separates your data from your raw home folder, keeping your system and all the data inside organized.

Wayland Only

To take full advantage of Flatpak, you need to be using the Wayland display server. While you can use Flatpak on X11, it can’t properly sandbox applications using X11 only because X11 does not provide any GUI isolation whatsoever and will work against your security. After all, in order to future-proof our stuff, we need to use Wayland to get that sweet fractional scaling and HDR support (coming soon™).

Why Not Snaps or AppImages?

Since Linux has no sandboxing at all, you NEED to be using something that provides sandboxing. Almost every Linux distro will not do this for you.

AppImages

AppImages, another universal format that while nifty, still won’t do for you, especially since you are just trusting random packages on the internet, rather than a centralized store. This also results in the same user behavior that happens on Windows (and MacOS to a good degree) and we shouldn’t go back to.

AppImages also pack duplicate versions of programs. If you install Electron apps like the private messenger Session and the note-taking app Standard Notes, you now have duplicate copies of Electron, which eats up more space.

There are people who argue Flatpaks also duplicate on multiple different versions of libraries, but this is greatly mitigated by compression, which AppImages don’t allow for. That way, you aren’t downloading the full package.

It has also come out the main dev of AppImages is a dunce who refuses to use Wayland and to update the FUSE module to work with modern systems.

Snaps

Canonical’s snap packages also seek to solve the same issues Flatpak does, but it’s mired with problems.

• Many people don’t like Ubuntu pushing snaps or packaging Chromium/Firefox as a snap (even though Debian’s maintainers are way too taxed to properly maintain Chromium fast enough).
• Many people don’t like the concept of snap’s backend being proprietary (in my opinion this is silly because even if it was open-source, there would be no way to verify if Canonical were actually using the open-source code or not).
• Snaps auto-update and don’t allow users to disable it except through experimental settings.
• Snaps’ sandboxing doesn’t apply to legacy apps (“classic snaps”) and requires AppArmor. The sandboxing is worthless if you use SELinux or systems without mandatory access controls.
• Many people, including me, also hate that Canonical logs everything you install, which assigns a unique ID to on installation and for Canonical to do who knows what with. Anonymized statistics will always eventually be deanonymized, so it’s only a matter of time, even if it’s something like the flavor of Linux you use, the branches you enable, or the timezone you reside in. There’s no way to opt out either.

No doubt people will pick something to hate, but for me, inescapable telemetry and lack of SELinux is reason enough to give snaps a wide berth, unless you are locked into an application that absolutely needs it.

Flatpaks Are Better

Flatpak doesn’t collect any telemetry, lets you add/host your own repositories, also doesn’t require root, so it’s more secure for you to use and more convenient for desktop users who want to download their favorite applications. Flatpaks also provide a powerful permissions access system, which controls exactly what programs are allowed to access.

Flatpak may be imperfect, but some sandboxing is better than none at all.

The Cons

• Many people cite flatkill.org, which at the time, presented valid points. Unfortunately, that site hasn’t been updated in years and some of what was said then is no longer true now. However, Flatpak is still irrevocably broken because of the fact it’s built more to be a container than an application sandbox. As a result, this makes it really easy to bypass, but the devs are working on a solution.
• Flatpak’s poor security realistically could be fixed in the future through apps makers their sandboxes based on a standard (say, XDG portals) by coding their apps to distrust certain permissions by default. In fact, Whonix’s devs are working on a sandboxed app launcher and Chromium has stronger native sandboxing than Flatpak.
• Flatpak relies on every application operating off of the same libraries. This can result in dependencies not updating while some programs play catch up. Flatpak’s developers appear to be aware of this and developed an internal tool for making sure their package manifests are up to date.
• Wine and 32-bit dependent gaming needs a lot of work. While some programs like Heroic work flawlessly, I’ve seen problems with Lutris where some games will not install where they installed on the native package.
• Flatpak strongarms people into Pipewire. While there are still some edgecase holdouts, we need to be moving towards more secure defaults rather clinging futilely to PulseAudio. In fact, when I was testing Pipewire when it first came out years ago, I had far less issues in its beta state than PulseAudio.
• Some developers do not support Flatpak altogether. I had mentioned Session in the last video, but the Flatpak is not official. Many other programs fall into this category, so it’s vital you analyze the build manifest. As of the time of recording, the beta Flatpak site gives direct link to the manifest and with a teeny bit of know-how, it’s pretty easy to figure out what’s going on. Flatpak now has a pretty simple and robust verification system to mitigate this, but anything without a checkmark should be suspect.

Using Flatpaks

Forget about all this technical jargon! I’ve talked about why you need Flatpaks, some “drawbacks,” but let’s put this practice.

How to Setup & Use

First, add the Flathub remote. This gives you access to the main Flathub store.

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

Using flatpaks is also easy! Flatpak uses the same syntax as apt and dnf:

• update to update the repositories
• upgrade to run software upgrades
• install to install
• remove to uninstall
• search to search applications in your Flatpak remotes
• uninstall --unused to remove unused dependencies.

What/where should I download?

Now that we have access to Flathub, this pretty much is the whole kitchen sink to download anything we want. Of course, I do want to address a common thing I’ve read from other people online or seen in other content creators is people is something like this (first to last):

1. Distro package
2. Flatpak
3. AppImage
4. Third party repo (AUR, PPA, etc)
5. Snap
6. Tarball/provided by developer
7. Compile from source

This has been the way most people have seen packaging on Linux for a long time, but instead, I want to encourage all of us to look at this differently:

1. Flatpak
2. Snap (if you use Ubuntu)
3. Distro package
4. Tarball/provided by developer
5. Third party repo
6. Snap (non-Ubuntu)
7. AppImage
8. Compile from source

Flatpak, especially for graphical applications, needs to be your top priority as to where you download a package. Flatpak is far more flexible than many of its distro counterparts and is much robust at providing a secure window to a program without much tradeoff.

The other reason the vast majority of sandbox systems on Linux are unsufficient compared to Flatpak. Only Snap comes close, but Snaps come close and are definitely more suited for command-line programs, but if you don’t use AppArmor, the protections that Snap provides are useless. The sandboxing of Snaps is also very flawed in that the experience is only really geared for Ubuntu as you need a completely separate patch from Canonical for AppArmor to achieve acceptable sandboxing.

The Time to Say No

The other issue people need to look at is the landscape of apps in Flatpak, but consider whether or not you should use them. Here’s some of what find valid reasons to use a Flatpak:

• The application is old and never received an update to match upstream. For example, one of the packages I could never recommend to anyone in Flathub is a really old copy of Adobe Reader for 32-bit Ubuntu 12.04. While this application is an amazing achievement at demonstrating the fact Flatpak can run multiple architectures, I could never recommend running it because of Adobe abandoning the project and many unfixed security holes remain.
• Unverified applications. On the topic of unofficial applications, Flathub implements a pretty simple and reliable verification system. Basically, this means you can trust any application with a blue verified checkmark. But what happens with apps that aren’t verified? In these scenarios, you should view the “build manifest,” so you can verify what’s happening. Chances are because of new vetting processes odds of these being malicious are highly unlikely, but be cautious and read the code. If you can’t read the code, how many other people submit issues and star the manifest on GitHub? Do your best here, but odds are you will be fine.

Manage Your Permissions With Flatseal

However, if you use Flatpak, I would strongly recommend double-checking your permissions using Flatseal. Flatpak is way too permissive by default, especially it allows most programs access to whatever they ask for on install silently.

There are plenty of easy ways to use graphical programs to tweak your Flatpak permissions like Flatseal. Flatseal is a program that generates “override” files that change what programs are allowed to do on your system, stored in ~/.local/share/flatpak/overrides. If you use KDE, KDE has a built-in frontend identitical to Flatseal.

These permissions might be confusing and overwhelming, but I’m going to try my best simplify how they work:

• Network: Does GNOME Calculator or LibreOffice really need the internet, especially when Flatpak manages their updates? Audacity and Musescore adding telemetry? Let’s kill the internet for the apps that don’t need it. Most applications typically only enable it because they need it for their internal updating.
• Interprocess Communications (IPC): Allows program to read other processes and resources on your host machine. “Is not necessarily required” unless you use X11, but you shouldn’t be using X11.
• socket=pulseaudio: PulseAudio is a common vector for attack on desktops, since it grants access to your microphones if it’s being used by another application. Applications that don’t need to play audio (e.g. LibreOffice and ONLYOFFICE for example), should have this revoked.
• filesystem=: make sure you want your program to choose what folders it can access. Look out for global accesses and selectively pick folders to add using “Other files” in Flatseal.
• device=all: Don’t want an app accessing PCI and USB devices, like your webcam? Limit this, but it is needed if you use security keys, webcams, microphones, etc.
• Fallback to X11: As X11 is a legacy technology, we should avoid it like the plague. Older applications like Chromium/Electron-based applications, Krita, and Minetest still need it, but applications like OBS, LibreOffice, KeePassXC don’t because they support Wayland natively; just experiment with what works.
• talk-name=org.freedesktop.secrets: D‑Bus access to secrets stored on your keychain, like say, your GNOME Keyring or KDE Wallet data. This is needed for Chromium/Electron-based apps.

Takeaway

But what’s the point of this discussion? Why are you even covering this? Because you need to use Flatpak because secure solutions need to be easy otherwise people aren’t going to use them. Flatpak truly makes it easy and brings the Linux desktop one step forward to being that much greater.

I’m going to go out on a limb here and strongly recommend you install as many of your applications as Flatpaks. In fact, go uninstall your applications that have Flatpak versions, move your config folders to the Flatpak sandbox, and embrace the future as we wait for the next best thing.

More Resources:

• Setting up Flathub on various distros
• Flatkill (2019-2020) discusses how the default permissions set by Flatpak need to be more strict.
• Response to flatkill.org, TheEvilSkeleton’s rebuttal for Flathub not addressing security advisories.
• Flatpak gives complete access to /proc and /sys by madaidan
• Flatpak Command-Line Overrides, by the official documentation
• rusty-snake’s Flatpak overrides
• tommytran732’s flatpak overrides
• How does Flatpak handle security?