On 2024-01-30 01:01, Andrew wrote:
> But you and Frank think they're exactly the same, which is why you called
> me a troll. You don't understand anything - so when I tell you something
> that you don't understand - you immediately call me a troll for that.

Arlen, you are a troll because anybody that nymshifts is a troll. It is
a definition and you fit it. It is not an insult.

https://en.wiktionary.org/wiki/nymshift

https://www.urbandictionary.com/define.php?term=nymshift

And you do so in order to avoid our filters. As we learn your new name,
we update our filters, and when become too well known you change it
again, trying to evade the filters.

You claim it is for privacy, but that is false. A person changes his/her
name here once, using a pseudonym, for privacy. We do not know his name
or home, and we respect that. If you do it more than once, you become a
nymshifter and thus a troll.

Sorry about that.

https://en.wiktionary.org/wiki/nymshifter

nymshifter (plural nymshifters)

(Internet) One who deceptively posts messages under several
different pseudonyms.

--
Cheers, Carlos.

On 2024-01-30 02:22, VanguardLH wrote:
> "Carlos E.R." <robin_listas@es.invalid> wrote:
>
>> VanguardLH wrote:
>>
>>> I'm still looking into how to keep everything encrypted on the server,
>>> including the headers.
>>
>> I don't think you can.
>
> There is no further transport when the message reaches the target server
> (unless an option to forward from there is enabled). Once in my
> ProtonMail account, the entire message can be encrypted, including
> headers. Using their web app will decrypt to view.

So they have the decryption key.

> For an IMAP client
> retrieving messages, their proxy (bridge) is needed to decrypt before
> delivering to the mail client (something akin to how sTunnel handles
> encrypted login between inept client to server).
>
>>> ProtonMail is too expensive for my very low
>>> e-mail volume. I prefer to use a local e-mail client, not their web
>>> app, and that requires using their bridge (local proxy) that locally
>>> decrypts the e-mail traffic to then handed to the local e-mail client,
>>> but their bridge requires a paid service tier with them. They do
>>> encrypt all content (body and headers) in-situ on their server, so a
>>> breach won't get at my contacts or e-mails (and their headers with
>>> contact info). Their free service tier has me using their web site
>>> instead of a local e-mail account; however, there is an option to send
>>> notifications of new mails in a Proton account to another account, so I
>>> do can get notification by my local e-mail account of new mails at
>>> ProtonMail, but I would still have to use a web browser to see the new
>>> mail. I've found other ProtonMail wannabees, but they don't have the
>>> e-mails themselves fully encrypted, including headers, so a breach could
>>> expose contacts via e-mail headers.
>>>
>>> PGP or x.509/SMIME certificates with public/private key pairs encrypt
>>> only the bodies of e-mails, but not the other headers in an e-mail
>>> containing the contact info needed to route and track transfer of
>>> e-mails.
>>
>> That can not be done, it breaks transport.
>
> No further transport. Communication at the target server is to client.
> The client is polling their account, not a server receiving a message to
> further transport to another server. However, their local proxy is
> needed to decrypt before delivering to the local client.
>
> Also, encrypting an encrypted document and decrypting the first time
> leaves the previously encrypted document. If you encrypt 7 times, you
> need to decrypt 7 times to get the original document which might've
> already been encrypted with PGP or SMIME.
>
> Their local proxy is not to handle PGP or SMIME encrypted messages.
> Those pass through their bridge to get decrypted from the in-situ copy
> on their server to deliver to your local client with the original
> PGP/SMIME encrypted message.
>
> Without their bridge, you would end up getting gobblety gook in the
> messages retrieved from their server.
>
> https://proton.me/mail/bridge
>
> You can't just connect your local mail client to their server to get
> your messages. The key for the bridge is different than in your
> account, and only you know that key (similar to you having the private
> key in a PGP/SMIME key pair). If you don't use their bridge, I'm not
> sure how a local mail client is going to handle messages with no
> discernable Subject, From, or other headers.
>
>>> Plus, you cannot force your senders to always encrypt their
>>> e-mails to you (after you've given them your public key). The headers
>>> aren't encrypted, because they're needed for routing the message until
>>> deposited into your account, but once in your account the headers could
>>> be encrypted, too.
>>
>> Maybe. I have my doubts. If they have webmail and you can read email
>> there, they have the key too.
>
> Not if the encryption is using your login password. Similarly, you can
> encrypt a document to send and the recipient uses a passphrase to
> decrypt. Yep, they probably have that (password or key), but their
> claim is they cannot or will not look into your e-mails on their server.
> They are not in a 5-Eyes country, so not subject to an NSL (National
> Security Letter) forcing them to divulge e-mails, logging, or any info
> about their accounts. I'm sure they are still subject to Swiss laws.

Hum. I remember a case at least in which Protonmail handled email from
one client to the authorities demanding it.

>
> I'm sure they still do have the key (password) for my account for their
> web app to decrypt the messages when viewing them there. However, my
> concern is not with my e-mail provider looking at my e-mails. It is
> with hacking and breaches. If you don't trust an e-mail with your
> messages, you shouldn't be using them. However, as you noted for
> transport, e-mail was built on a trust model. Making it secure, even
> from the e-mail provider, is difficult, but necessarily from hackers and
> breaches. Hopefully they have processes in place regarding trust in
> using keys/passwords against disgruntled employees stealing data (ever
> heard of a gruntled employee?). They claim they cannot recover or read
> your e-mails, because they don't have the key/password. If the password
> you enter for login is encrypted, and compared against an encrypted
> password database, then it's harder for them to peek, but not
> impossible.
>
> One of the options in a ProtonMail account is the user can change the
> account key (RSA 2048). So, for the super paranoid, the user can keep
> changing the key. That still doesn't make it necessarily impossible for
> them to get.

--
Cheers, Carlos.

On 2024-01-30 11:57, Frank Slootweg wrote:
> VanguardLH <V@nguard.lh> wrote:
>> Frank Slootweg <this@ddress.is.invalid> wrote:
>>
>>> VanguardLH <V@nguard.lh> wrote:
>>> [...]
>>>
>>>> Why does this guy remind me of Alan Connor?
>>>
>>> You asked yourself that in December 2021 as well about 'Joel' in the
>>> Windows 10/11 groups.
>>>
>>> This was my response:
>>>
>>> Message-ID: <sqn87q.qgg.1@ID-201911.user.individual.net>
>>>
>>> Can't be bothered to back-track that to see if 'Joel' was 'Arlen'.
>>
>> I need to retract that. With Alan Connor, if you agreed with him you
>> were God's right hand, but if you disagreed or even asked for more
>> information you became Satan. Andrew seems familiar due to his style,
>> but I can't place him yet.
>
> It's blatantly obvious that he's 'Arlen Holder'. Carlos and I have
> been calling him "Arlen" and he has not objected, so ...

And today he mentioned using wasap to talk with German relatives or
friends, something he said before under another name.

I have doubts about Frankie, who appeared 2023-11-02.

>
>> Perhaps your NNTP client's (tin) retention
>> is longer than mine. How long has Andrew been here? More than 3
>> months? Maybe he nymshifted. I previously purged messages older than 2
>> months since the older the thread then the less interesting it is. I
>> upped retention to a year, but that change was in the last month.
>
> I could find out since when this nym popped up, but it doesn't matter.
> It's just one of many, probably getting close to a hundred. Just
> recently he seems to be recycling yet another old nym.
>
>> Claims an app can connect to an undefined account. I've experienced the
>> opposite. I suspect eventually he would suggest I reset my phone, and
>> load the bundled Gmail app which will divine my Google account. Says
>> there have thousands of posts here about hiding contacts. "It's so
>> simple that it's obvious. Elegant. Efficient. Private. Secure." as that
>> must be so detailed as to help others ... not. Needs prodding to give
>> details (similar to micky). Thinks his setup on a LAN is of any
>> importance regarding a solution across devices over the Internet. Makes
>> statements about WhatsApp that refutes info by WhatsApp and elsewhere.
>> Belittles others, but he wants apologies from those who contend his
>> statements ... in Usenet, no less. Claims Internet access to a NAS
>> device on his intranet is easy, yet doesn't describe how he manages that
>> so easily compared to how I describe a possible setup. Focuses on
>> contact lists, but never addresses why unprotected e-mails on the server
>> with all those contact headers doesn't obviate his solution on
>> protecting contact lists.
>
> Good summary and that's only of this thread! :-)
>
>> Not everything Andrew says is bogus. There's enough content to keep
>> interest in reading him, whether I agree with him or not, but it can
>> take some prodding to get specifics rather than his sweeping claims.
>
> For me, there's way too much noise and hardly any signal, so I filter
> most of his nyms. This one not yet, mainly because of his
> misrepresentations about me, what I did (not) say, etc.. But it has -
> again - gone way beyond ridiculous, so I'm limiting my responses to the
> minimum.

I only tag his posts, not delete them, so that I am aware of whom I'm
talking to. It is a nuisance keeping track (and in several computers).

>> Yes, for some users, keeping their contacts private is very important,
>> and some methods have been mentioned here, but it's only been about
>> protecting contact lists, not about the e-mails that contain the
>> contacts. If a breach can get at your contacts, it can also get at your
>> e-mails with contact headers.
>
> Indeed. That aspect, which you raised repeatedly, seems to escape :-)
> him completely. He's very careful about keeping *other* people's contact
> information in his safe, locks all the windows and doors in his house to
> keep the thieves out, but while doing all that, he sends his *own*
> contact information out the front door, ready to be (ab)used by others!
>
> The mind boggles!
>
> [...]

--
Cheers, Carlos.

On 2024-01-30 02:57, VanguardLH wrote:
> *IF* I decide to pay for their next service tier that includes their
> bridge, I'll do a test to ensure what they say is what happens. I'll
> have my IMAP client connect directly to their e-mail server, and also
> through their bridge. I can then see if the headers were encrypted in
> the direct connection to their servers.
>
> Oh wait, they don't allow direct connections to their mail servers. You
> must use their bridge. Their bridge (proxy) is currently available for
> Windows, Linux, and MacOS. For Android and iOS, you need to use their
> mobile apps where they could incorporate their bridge to encrypt all
> traffic.
>
> When I needed my sister's social security number to complete a title
> transfer of my mother's house after she died, I sent you a message via
> ProtonMail with a passphrase. She didn't have any clients that support
> PGP or SMIME for encrypting messages between clients. When she got my
> PM message, she clicks a link to go to PM's web app, and enters the
> passphrase. Then she could reply securely regardless of her inept mail
> client.

Interesting.

Me, I do not need to encrypt headers; content is enough. Maybe the
subject: Thunderbird can encrypt it.

This method you mention, is interesting.

--
Cheers, Carlos.

Carlos E.R. <robin_listas@es.invalid> wrote:
> On 2024-01-30 11:57, Frank Slootweg wrote:
[...]
> > It's blatantly obvious that he's 'Arlen Holder'. Carlos and I have
> > been calling him "Arlen" and he has not objected, so ...
>
> And today he mentioned using wasap to talk with German relatives or
> friends, something he said before under another name.
>
> I have doubts about Frankie, who appeared 2023-11-02.

I'm quite sure 'Frankie' (Frankie <frankie@nospam.usa>) is 'Arlen'. He
appeared on/before 01OCT2023 in the Windows 10 group, knows that
'Newyana2' is the old 'Mayayana' and he used (uses?) yet another troll/
rogue server, Neodome.

Just FYI, should not be a problem in or by itself, 'Arlen' is (as he
mentioned himself [1]) in his late 80s.

[1] <Message-ID: <ukj1od$mlgf$1@paganini.bofh.team>

Carlos E.R. <robin_listas@es.invalid> wrote:
[...]

> And please remember that I do know how to sync files, and did so, since
> the computers came with RS232 ports several decades ago.

I can beat that! I synced files via papertape in the late 60s!

[Well, there's hardly anything serious in these subthreads, so why
should I spoil things!? :-)]

Carlos E.R. wrote on Tue, 30 Jan 2024 14:13:56 +0100 :

> anybody that nymshifts is a troll.

You're racist, Carlos.
All you clearly racist people can see, is the color of someone's skin.

You've said that before that everyone who is Black is a criminal even if
they've never committed a crime and you also said that everyone who wears a
facemask is planning to rob a bank also - even though they've never robbed
a bank. You've said that anyone who is tall & blond is a Nazi too.

You own the limited-input wrong-output perfect mind of a racist, Carlos.

And because you're a racist, you never will understand why I said the best
place to store your contacts (for privacy) is NOT in the default database.

HINT: It doesn't matter the color of someone's skin, Carlos, when they try
to explain to you something that you're incapable of understanding.

Frank Slootweg wrote on 30 Jan 2024 11:15:26 GMT :

> credentials of his Google Account into the Gmail app on his so, so the
> (reference to) his Google Account got re-created on his phone.

Frank - you missed the important part. The important part is NOT that the
account is automatically created by the GMail app (and other apps) when you
log into the account - that's not what's important, silly.

What's important is the account is simultaneously created with the default
settings which at that same time will upload your contacts - without you
having any say in the matter.

As I said to the racist Carlos, Google can't upload your contacts is you do
not put them in the default Android contacts database.

I don't know why you can't understand a concept _that_ simple, Frank.

Frank Slootweg wrote on 30 Jan 2024 10:05:50 GMT :

> Guess what the double quotes mean? It was an exact
> verbatim quote of what you *did* say.

Idiot. Carlos is a racist and you're an idiot.
*I was explaining how to _test_ it you idiot.*

For you to claim a simple test procedure is something everyone should do is
an example of why I said your IQ doesn't even approach that of normal yet.

Who on earth would run a test procedure every single day of their lives?
You Frank.

But nobody else who isn't an idiot.

I wasn't recommending it in general use.
Even I don't do that, you idiot.

The last time I wiped out the Google account not in testing was way back in
Android 4.4 when I first learned about the Google Account, Frank.

Earth to Frank-the-idiot. Learn to read for comprehension, Frank.

Carlos E.R. wrote on Tue, 30 Jan 2024 13:59:38 +0100 :

> You can, if you wish, explain some other method, for curiosity shake,
> but you must know I will not use it. This is a conscious and meditated
> decision.

Carlos,

You're not the only one on this newsgroup.
You have no education. No comprehension. No understanding.

Hell, you repeatedly ridiculed the use of Microsoft Office on a PC.
Who does that?

Anyway, the astute sage comment I made that started this is still valid.

The best place (for privacy) to store contacts is NOT in the default db.
The reason is you have no idea which programs are uploading them en masse.

On 2024-01-30 09:37, Andrew wrote:
> Carlos E.R. wrote on Tue, 30 Jan 2024 14:13:56 +0100 :
>
>> anybody that nymshifts is a troll.
>
> You're racist, Carlos.
> All you clearly racist people can see, is the color of someone's skin.

How can he see the colour of anyone's skin here, Arlen?

>
> You've said that before that everyone who is Black is a criminal even if
> they've never committed a crime and you also said that everyone who wears a
> facemask is planning to rob a bank also - even though they've never robbed
> a bank. You've said that anyone who is tall & blond is a Nazi too.
>
> You own the limited-input wrong-output perfect mind of a racist, Carlos.
>
> And because you're a racist, you never will understand why I said the best
> place to store your contacts (for privacy) is NOT in the default database.
>
> HINT: It doesn't matter the color of someone's skin, Carlos, when they try
> to explain to you something that you're incapable of understanding.

What is the point of all your blather?

Andrew <andrew@spam.net> wrote:
> Frank Slootweg wrote on 30 Jan 2024 11:15:26 GMT :
>
> > credentials of his Google Account into the Gmail app on his so, so the
> > (reference to) his Google Account got re-created on his phone.
>
> Frank - you missed the important part. The important part is NOT that the
> account is automatically created by the GMail app (and other apps) when you
> log into the account - that's not what's important, silly.

Backpedal duly noted.

> What's important is the account is simultaneously created with the default
> settings which at that same time will upload your contacts - without you
> having any say in the matter.

Thatt's what you get for removing the (reference to the) account for
no good reason. You did something silly, you live with the consequences
(which, mind you, can easily be fixed, so molehole->mountain).

> As I said to the racist Carlos, Google can't upload your contacts is you do
> not put them in the default Android contacts database.

Calling someone a racist for absolutely no reason, is an extreme low,
even for you. Don't want to be called a troll and a nymshifter, then
don't troll and don't nymshift. Rather simple really.

As you've have been told a zillion times, your 'privacy' excuse for
your nymshifting it utter BS. Nymshifting is abuse on the net and even
abuse of the net. No amount of your foot-stamping will change that.

Don't like it, bring it up in the abuse and admin groups, if you dare,
but I advise you to exchange your tinfoil hat for some sturdier armour,
you'll need it.

> I don't know why you can't understand a concept _that_ simple, Frank.

Yet another misrepresentation/straw-man, not only about my position,
but also about what "Google" 'does'.

But indeed, if you don't put your contacts in the default Android
contacts database, *Backup by Google One* - i.e. not "Google", but
*software* on *your* *phone* - can not *sync* - i.e. not "upload" - your
contacts to the contacts area in *your* Google *Account*.

Now that your urban legends, FUD and innuendo have been translated to
factual English, there's nothing left other than a gigantic "DUH!".
Bummer that, hey!?

Andrew <andrew@spam.net> wrote:
> Frank Slootweg wrote on 30 Jan 2024 10:05:50 GMT :
>
> > Guess what the double quotes mean? It was an exact
> > verbatim quote of what you *did* say.
>
> Idiot. Carlos is a racist and you're an idiot.
> *I was explaining how to _test_ it you idiot.*
>
> For you to claim a simple test procedure is something everyone should do is
> an example of why I said your IQ doesn't even approach that of normal yet.

Then it's a good thing that I did *NOT* claim any such thing, isn't it!?

What I wrote, was of course in the context of your test procedure.
What else could it *possibly* have been!? Hence I said - and you
dishonestly silently snipped (I wonder why that is) - "His flaw". See
"His"!? That "His" is *you* and the "flaw" is indeed in *your* test, not
"everyone"s test. Duh!

Again, as you have such severe problems following the discussion(s)
and with reading for comprehension, you shouldn't snip so much context.
But you do snip too much (for you) and every time fall into your own
trap.

So once more, we've again established that there is indeed an idiot
with a sub-normal IQ and once more it's not me.

[More foaming at the mouth deleted.]

Frank Slootweg wrote on 30 Jan 2024 18:25:40 GMT :

> Backpedal duly noted.

Idiot. You confuse a test sequence with the real world, Frank.
And I said it was optional, so you're a double idiot.

I had to simplify the test case because Vanguard is stupid.
But I don't consider you stupid, Frank.

Your IQ is probably only about 10 or 20% below normal.
That's not great. But it's not stupid.

Get this fact into your head, Frank.
*Never once did I advocate it EXCEPT in the context of a testcase.*

Just like Carlos is a racist because he says that I'm a criminal because
I'm Black (no other reason than that) - you claim that an illustrative test
case is the real world.

All because I had explained why the safest place (for privacy) to keep yuor
Android contacts database is NOT in the default Android contacts location.

>> As I said to the racist Carlos, Google can't upload your contacts is you do
>> not put them in the default Android contacts database.
>
> Calling someone a racist for absolutely no reason, is an extreme low,
> even for you.

No. You're wrong Frank. Carlos uses one attribute of a person to label them
another. That's racist. It's racist to the core.

> Don't want to be called a troll and a nymshifter, then
> don't troll and don't nymshift. Rather simple really.

First off, you're an idiot if you can't figure out my posts in five
seconds. Seriously. Who is _that_ stupid? Carlos is. Vanguard is.

But I didn't think _you_ were, Frank.

Secondly, if you can't figure out the difference between the header and the
body of a message, then you are even less intelligent than I think you are.

The gift of the knowledge in a Usenet post is NOT in the header Frank.
I know m ore than all of you combined (at least the three of you).

Sure, Andy Burns and a couple of others know more than I do. A lot more.
But the three of you don't know one tenth of what I know about Android.

Carlos has an IQ of about 60. Vanguard about 70. You about 80 Frank.
It's easy to tell because none of you can understand simple concepts.

Part of the reason is you only see the wrapping paper in the gift.
Not the gift of the knowledge that was given to you freely.
> As you've have been told a zillion times, your 'privacy' excuse for
> your nymshifting it utter BS.

I posted my classic screenshots for God's sake, Frank.
How _stupid_ are you that you can't comprehend that?

You calling me a troll when I do not troll, is a classic racist attitude.
I didn't say you were racist - but you are if that's how you think.

HINT: You have to rob a bank to be a bank robber, Frank.
You can't just be wearing a ski mask.

I think the simplest way to solve this problem is to put you and Carlos and
Vanguard in my killfiles (which is a PITA actually, given my setup).

Then you learn nothing from me.
Which, I have to admit with a smile, you'd be perfectly happy doing.

As you have no intention of understanding why I said the safest place (for
privacy) for your contacts is NOT in the default Android contacts database.

>> I don't know why you can't understand a concept _that_ simple, Frank.
>
> Yet another misrepresentation/straw-man, not only about my position,
> but also about what "Google" 'does'.

I told you how to reproduce what Google does, Frank.
And then you went to the ludicrous levels of confusing a simple test case
with what I recommend people do.

If I would recommend you reboot your router, Frank, to test something out,
would you likewise make the ludicrous claim that I'm advocating rebooting
the router every moment of your life? Idiot.

You're an idiot, Frank - because you confuse a simple testcase with
reality. That you can't separate the two is how I know your IQ is below
normal, but I assess it as not too far below normal. Just 10 or 20 points.

Seriously. Learn to comprehend the difference between a test case and
reality and then I will assess your innate IQ at closer to what is normal.

Frank Slootweg wrote on 30 Jan 2024 18:40:31 GMT :

> Then it's a good thing that I did *NOT* claim any such thing, isn't it!?

If I suggest a test case of adding fake contacts and then testing those
fake contacts, you'd claim I am promoting everyone use fake contacts.

You can't separate the concept of testing a situation.
And the normal setup.

You're an idiot because you can't separate a test-case sequence with the
real world - and you _still_ don't understand it was a test case, Frank.

Even I said I haven't done it in years, Frank.
I realize you can't read for comprehension, but I said that many times.

It was a test case.
Nothing more.
Nothing less.

A test case.

Anyway, it's clear you do not understand why I helpfully suggested the
safest place (for privacy) to store contacts is NOT in the default
location.

I had never expected Carlos or Vanguard to understand that simple concept.
But it's disappointing you have no idea whatsoever why I had suggested it.

You don't know how Android works.
Because you never ran that test case which proved how it works.

"Carlos E.R." <robin_listas@es.invalid> wrote:

> On 2024-01-30 02:57, VanguardLH wrote:
>> *IF* I decide to pay for their next service tier that includes their
>> bridge, I'll do a test to ensure what they say is what happens. I'll
>> have my IMAP client connect directly to their e-mail server, and also
>> through their bridge. I can then see if the headers were encrypted in
>> the direct connection to their servers.
>>
>> Oh wait, they don't allow direct connections to their mail servers. You
>> must use their bridge. Their bridge (proxy) is currently available for
>> Windows, Linux, and MacOS. For Android and iOS, you need to use their
>> mobile apps where they could incorporate their bridge to encrypt all
>> traffic.
>>
>> When I needed my sister's social security number to complete a title
>> transfer of my mother's house after she died, I sent you a message via
>> ProtonMail with a passphrase. She didn't have any clients that support
>> PGP or SMIME for encrypting messages between clients. When she got my
>> PM message, she clicks a link to go to PM's web app, and enters the
>> passphrase. Then she could reply securely regardless of her inept mail
>> client.
>
> Interesting.
>
> Me, I do not need to encrypt headers; content is enough. Maybe the
> subject: Thunderbird can encrypt it.
>
> This method you mention, is interesting.

Andrew's objective was to protect your contacts by not uploading them.
Well, your contacts are also in the headers of your e-mails. I'm not
concerned my e-mail provider will steal my contacts. At worst, Google
creates profiles, not sell individual account data. Well, I go to the
airport, and they profile all the time without knowing who they chose to
pass through the fluoroscope (or whatever that think is called). My
counter to Andrew was that protecting contact lists was insufficient as
contacts can also be culled from e-mails, and anyone that hacked or
breached the e-mail provider would have access to BOTH.

Because ProtonMail uses its own local proxy to interface between IMAP
client and their servers, their proxy doesn't have to use any of the
e-mail protocols (that would include non-encrypted headers) to get
messages from their server. Their proxy only needs to support e-mail
protocols on the client-side after decrypting the message retrieved from
the server.

For myself, using PGP/SMIME encryption (when usable with someone else
whose client supports those), or sending passphrase encrypted e-mails is
sufficient protection. I'm not paranoid about an e-mail provider
stealing my contacts from a contacts list or culled from my e-mails.
Even if my contacts were stolen or culled, it's not my responsibility to
protect others from spam. Each does their own spam filtering. That's
why the Challenge-Response anti-spam scheme is so stupid: it has others
filtering out your spam. Not their responsibility. It's your
responsibility. If at a party and I call out to John, it's not my fault
when the whole room of party-goers starts chanting "John John John".

Problem nowadays is getting a free e-mail certificate for SMIME. Comodo
stopped in 2022. Others died before that. Acatalis still has them, but
asks unknown data during registration that prevents getting an account
to get the free certs (almost as though they expect companies to get
them, not end users). So, I use ProtonMail to send passphrase encrypted
e-mails (and any replies have senders go through their web app).
ProtonMail also support PGP. My local client also supports PGP, but
that whole web of trust stupidity and key ring lookups (assuming you
know which to use to lookup the public key) is junk, and doesn't satisfy
privacy requirements of many gov't agencies or institutions where a CA
(Certificat Authority) is required for validating a cert. Also, even
when there were free e-mail certs from CAs, all they did was verify the
sender's e-mail address versus the one they used to send their message.
There was no other identifying info in the e-mail cert unless you paid
to add more info into their cert they issued to you.

Frank Slootweg wrote on 30 Jan 2024 15:12:34 GMT :

> Well, there's hardly anything serious in these subthread

And yet, there is.

You just can't comprehend the concept as it's foreign to you to think.

To wit:

The best place (for privacy) to store contacts is NOT in the default db.
The reason is you have no idea which programs are uploading them en masse.

That's a valuable hint.
You're welcome.

"Carlos E.R." <robin_listas@es.invalid> wrote:

> Hum. I remember a case at least in which Protonmail handled email from
> one client to the authorities demanding it.

https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/

Not sure where any e-mail provider could be headquarterd that would
obviate it from responsibility of the laws in that region.

Google gets tons of FBI requests to hold logs. These are not
court-ordered. They are requests where Google must keep the logs, but
doesn't hand them over until there is a court order.

https://www.statista.com/statistics/273501/global-data-requests-from-google-by-federal-agencies-and-governments/

This is a nuisance to Google, because the vast majority of those data
hold requests are never followed up with a court order. These are
different than NSLs (National Security Letters) that can force user data
disclosure, and the victim is, by law, not allowed to disclose they ever
got an NSL until a court dismisses it (which takes about 5 years).

https://www.zdnet.com/article/google-lifts-lid-on-fbi-data-requests-now-you-can-read-actual-letters-online/
https://blog.google/outreach-initiatives/public-policy/new-government-removals-and-national-security-letter-data/
https://blog.google/outreach-initiatives/public-policy/sharing-national-security-letters-public/

Most are old since getting an NSL cannot be disclosed until resolution
via "litigation or legislation", so figure you won't hear about any NSLs
until about 5 years later. The courts are slow, and NSLs presume guilt
putting the onus of innocence on the victim.

I don't know the Swiss have access to the hand grenades of NSLs. So,
ProtonMail, after the above user data disclosure court case, reinforced
the need to use Tor web browsers to visit their web app.

https://proton.me/tor

I do nothing that would make me a POI (Person Of Internet) to any
government to get my e-mail provider targeted to get at my e-mails, or
my IP address. An investigative branch (e.g., FBI) can issue requests
which requires holding the user data (so the data cannot be erased in
the interim awaiting court decision), but still requires a court order
to decide to force disclosure.

Or use ProtonMail's VPN (or some other VPN) to connect to their web app.
"ProtonMail also operates a VPN service called ProtonVPN and points out
that Swiss law prohibits the country's courts from compelling a VPN
service to log IP addresses." Even their free service tier includes
their medium-speed VPN service. No max bandwidth measure is mentioned
for "medium", but I can't see getting and sending e-mails as bandwidth
expensive.

https://protonvpn.com/
https://protonvpn.com/pricing?ref=pricing_mail
(free tier: no ads, no logs, unlimited, free forever)

I suppose if I became an activist or in any way might trigger some gov't
agency to consider me a POI then I might bother with Tor to ProtonMail.
However, remember that Tor was invented by the FBI, and the FBI operates
many entry and exit nodes, and those have been mapped, so it's still
possible to track you through the Tor network.

If I were more paranoid, I'd probably start using free ProtonVPN to
access my free ProtonMail account using their web app via HTTPS. You
can layer more security atop security, but you need to decide at what
point you are comfortable. Security and ease-of-use are the anti-thesis
of each other.

On 2024-01-30 18:48, Andrew wrote:
> Carlos E.R. wrote on Tue, 30 Jan 2024 13:59:38 +0100 :
>
>> You can, if you wish, explain some other method, for curiosity shake,
>> but you must know I will not use it. This is a conscious and meditated
>> decision.
>
> Carlos,
>
> You're not the only one on this newsgroup.
> You have no education. No comprehension. No understanding.

You resorting to insults, as usual when contradicted.

Not reading.

Get a doctor. Seriously.

--
Cheers, Carlos.

On 2024-01-30 16:12, Frank Slootweg wrote:
> Carlos E.R. <robin_listas@es.invalid> wrote:
> [...]
>
>> And please remember that I do know how to sync files, and did so, since
>> the computers came with RS232 ports several decades ago.
>
> I can beat that! I synced files via papertape in the late 60s!

:-D

>
> [Well, there's hardly anything serious in these subthreads, so why
> should I spoil things!? :-)]

:-)

--
Cheers, Carlos.

On 2024-01-30 18:37, Andrew wrote:
> Carlos E.R. wrote on Tue, 30 Jan 2024 14:13:56 +0100 :
>
>> anybody that nymshifts is a troll.
>
> You're racist, Carlos.
> All you clearly racist people can see, is the color of someone's skin.
>
> You've said that before that everyone who is Black is a criminal even if
> they've never committed a crime and you also said that everyone who wears a
> facemask is planning to rob a bank also - even though they've never robbed
> a bank. You've said that anyone who is tall & blond is a Nazi too.

Cite?

--
Cheers, Carlos.

On 2024-01-30 18:37, Andrew wrote:
> Carlos E.R. wrote on Tue, 30 Jan 2024 14:13:56 +0100 :
>
>> anybody that nymshifts is a troll.
>
> You're racist, Carlos.
> All you clearly racist people can see, is the color of someone's skin.

Wow.

Get a doctor, Arlen.

--
Cheers, Carlos.

On 2024-01-30 20:23, Andrew wrote:
> Frank Slootweg wrote on 30 Jan 2024 18:25:40 GMT :
>
>> Backpedal duly noted.
>
> Idiot. You confuse a test sequence with the real world, Frank.
> And I said it was optional, so you're a double idiot.
>
> I had to simplify the test case because Vanguard is stupid.
> But I don't consider you stupid, Frank.
>
> Your IQ is probably only about 10 or 20% below normal.
> That's not great. But it's not stupid.
>
> Get this fact into your head, Frank.
> *Never once did I advocate it EXCEPT in the context of a testcase.*
>
> Just like Carlos is a racist because he says that I'm a criminal because
> I'm Black (no other reason than that) - you claim that an illustrative test
> case is the real world.

Cite?

Message-ID?

I could sue for this...

--
Cheers, Carlos.

On 2024-01-30 20:30, VanguardLH wrote:
> "Carlos E.R." <robin_listas@es.invalid> wrote:
>
>> On 2024-01-30 02:57, VanguardLH wrote:
>>> *IF* I decide to pay for their next service tier that includes their
>>> bridge, I'll do a test to ensure what they say is what happens. I'll
>>> have my IMAP client connect directly to their e-mail server, and also
>>> through their bridge. I can then see if the headers were encrypted in
>>> the direct connection to their servers.
>>>
>>> Oh wait, they don't allow direct connections to their mail servers. You
>>> must use their bridge. Their bridge (proxy) is currently available for
>>> Windows, Linux, and MacOS. For Android and iOS, you need to use their
>>> mobile apps where they could incorporate their bridge to encrypt all
>>> traffic.
>>>
>>> When I needed my sister's social security number to complete a title
>>> transfer of my mother's house after she died, I sent you a message via
>>> ProtonMail with a passphrase. She didn't have any clients that support
>>> PGP or SMIME for encrypting messages between clients. When she got my
>>> PM message, she clicks a link to go to PM's web app, and enters the
>>> passphrase. Then she could reply securely regardless of her inept mail
>>> client.
>>
>> Interesting.
>>
>> Me, I do not need to encrypt headers; content is enough. Maybe the
>> subject: Thunderbird can encrypt it.
>>
>> This method you mention, is interesting.
>
> Andrew's objective was to protect your contacts by not uploading them.
> Well, your contacts are also in the headers of your e-mails. I'm not
> concerned my e-mail provider will steal my contacts. At worst, Google
> creates profiles, not sell individual account data. Well, I go to the
> airport, and they profile all the time without knowing who they chose to
> pass through the fluoroscope (or whatever that think is called). My
> counter to Andrew was that protecting contact lists was insufficient as
> contacts can also be culled from e-mails, and anyone that hacked or
> breached the e-mail provider would have access to BOTH.

I know for certain that the spammers that bother me have not got my name
and data from the Google Address Book from me or others. It is obvious.
So I am not worried about having my address book backed up in the Google
cloud.

They are getting them from other sources who sell them. It is visible in
the spelling errors or the amount of data they have, which is not in the
Google Contact List.

>
> Because ProtonMail uses its own local proxy to interface between IMAP
> client and their servers, their proxy doesn't have to use any of the
> e-mail protocols (that would include non-encrypted headers) to get
> messages from their server. Their proxy only needs to support e-mail
> protocols on the client-side after decrypting the message retrieved from
> the server.
>
> For myself, using PGP/SMIME encryption (when usable with someone else
> whose client supports those), or sending passphrase encrypted e-mails is
> sufficient protection. I'm not paranoid about an e-mail provider
> stealing my contacts from a contacts list or culled from my e-mails.
> Even if my contacts were stolen or culled, it's not my responsibility to
> protect others from spam. Each does their own spam filtering. That's
> why the Challenge-Response anti-spam scheme is so stupid: it has others
> filtering out your spam. Not their responsibility. It's your
> responsibility. If at a party and I call out to John, it's not my fault
> when the whole room of party-goers starts chanting "John John John".
>
> Problem nowadays is getting a free e-mail certificate for SMIME. Comodo
> stopped in 2022. Others died before that. Acatalis still has them, but
> asks unknown data during registration that prevents getting an account
> to get the free certs (almost as though they expect companies to get
> them, not end users). So, I use ProtonMail to send passphrase encrypted
> e-mails (and any replies have senders go through their web app).
> ProtonMail also support PGP. My local client also supports PGP, but
> that whole web of trust stupidity and key ring lookups (assuming you
> know which to use to lookup the public key) is junk, and doesn't satisfy
> privacy requirements of many gov't agencies or institutions where a CA
> (Certificat Authority) is required for validating a cert. Also, even
> when there were free e-mail certs from CAs, all they did was verify the
> sender's e-mail address versus the one they used to send their message.
> There was no other identifying info in the e-mail cert unless you paid
> to add more info into their cert they issued to you.

Yep, that's so.

--
Cheers, Carlos.

Carlos E.R. <robin_listas@es.invalid> wrote:
[...]

> I know for certain that the spammers that bother me have not got my name
> and data from the Google Address Book from me or others. It is obvious.
> So I am not worried about having my address book backed up in the Google
> cloud.

Indeed. My contact details (including e-mail) are in my (Google)
Contacts (<https://contacts.google.com>, but I do get no [1] spam on
that - or any other - address. So one's Google Contacts are indeed *not*
a source for spam.

[1] Well, maybe one message per month, if that much.

> They are getting them from other sources who sell them. It is visible in
> the spelling errors or the amount of data they have, which is not in the
> Google Contact List.

Yes, and sometimes some of one's - somewhat - legit suppliers seem to
share your e-mail address with their partners without asking/telling you
and backtracking to the source is often not possible, so you don't know
who to blame. But even those are included in my about one message per
month, so nothing to get worked up about.

[...]