Para_lyzed

Interesting to note, though another user pointed out that this does not work the same way in the United States (political organizations still have to provide a means to opt out).

Yes, I believe all of that is in line with what I have stated. Just to clarify, my interpretation of the previous comment was that political parties were exempt from the requirement to provide an opt out in Australia for political parties (by my interpretation, just the official parties and not unrelated political organizations), and they implied they believed it to be the case in many other countries. I have not recently reviewed the relevant laws, so I was not 100% certain if that implication would prove true in the United States (though was pretty confident that was not the case by my previous experiences with messages from officially endorsed organizations), but I went on to explain how these are not officially endorsed by political parties anyway, so if such an exemption did exist, it should not apply to this particular message.

Thank you for the clarification!

Political organizations and non-profits are exempt from this list.

In that case, you’re best off opting out and seeing if it works. If you get a text from the same group at a later date, then you can report them to the FTC. Please do not do this unless they do not honor your opt out request, as politically affiliated groups are legally allowed to market in this way so long as they provide a means to opt out of communication. Falsely reporting puts strain on the already incredibly underfunded system and prevents real scams from being caught and dealt with due to a lack of resources. I recommend you keep a list of groups you have opted out from that is easily searchable to track this. 4 years ago I got multiple of these texts per day. I have been opting out every time I receive one, and now I have not gotten one in over 2 years. Eventually you will run out of groups to opt out of, and will only be messaged by newly created groups, which will happen much more slowly than all of the groups constantly texting/calling.

Beyond that, there isn’t really much you can do. Your number is on a list, and people are buying that list. Although you could see if putting your number on the national do not call list would help (EDIT: though apparently political organizations are exempt from that on further reading). I have not done this personally, but I came across it while looking up how to report scam texts. Perhaps it could be beneficial to you (who knows?)

Mine reset when I switched phones a couple months ago, and I had to manually add them to my new phone. If I hadn’t noticed, then my blocked numbers list would be empty. Not saying that is a common issue, but it doesn’t hurt to opt out before blocking; just don’t click any links or say anything other than the opt out keyword.

While I would have to find the US law and examine it more closely to tell if that is true here, these groups are not actually representatives of political parties. They are groups of self-proclaimed political advocates that try to raise money to host events that raise awareness of their causes for local voters. But they would not qualify for an exemption due to association with a political party, as they are not officially connected to or endorsed by a party.

True, but if you get a new phone and your blocked numbers list is reset, or they send messages from a different number, then you could get them again in the future. I see this often because there are multiple people in that campaign that will all reach out to people with their own phone numbers. Opting out prevents that for legitimate donor campaigns (you are removed from the list for all of the solicitors associated with that campaign), but obviously not for scams. There is no harm in doing both, and I would recommend that (it’s what I do).

Your number is on a list of real numbers with real identities associated with them that was sold to them. Data brokers sell this information daily. They already know your number is real, but in order to comply with the law, they have to provide you with a legitimate option to opt out, so you will actually stop receiving correspondence from them if you ask them to stop (it is legally required). If not, they could be subject to a fine, but you’d obviously have to file a complaint with the relevant regulatory body for that.

If you do not attempt to opt out, they cannot be fined for spam if this is part of a legitimate donation campaign. If you don’t reply, they will continue sending messages to you in the future. It costs them almost nothing to do, so even if they didn’t know your number was real, they would do it anyway. Most of the people who donate from these messages don’t reply through text message anyway. And if this were an actual scam, then there is nothing they gain from receiving a text back so long as you do not open their link. But again, in order for legal action to be taken (since these political reach outs are legal and not spam so long as there is an option to opt out), you must first try to opt out.

EDIT: Feel free to block the number after opting out. If they are legitimate (though the name is really fishy), then opting out will remove your number from all of their solicitors’ lists, so you won’t get texts or calls from different numbers working for the same campaign. Again, replying doesn’t give them anything even if it is a scam, as your number was obtained from a real list sold to them by a data broker; they already know the number is in service. Just don’t click the link in the text, and don’t reply with anything other than stop.

Facebook has been selling your data to ad companies since the day you created your account. This only changes what you visually see on the website. It makes absolutely zero difference from a data collection standpoint. Just consent so you can delete your accounts with less hassle. Filing GDPR complaints through email is a pain, takes a long time, and has no guarantee that they’ll actually accept it. Plus, some sites (likely including Facebook) will ask for a government ID to verify you live in an area where the GDPR applies. It isn’t worth the trouble when there are easier methods. Once you’re able to log in, you should be able to access a GDPR portal somewhere in case you still want to file a report before deleting your account, but it’s up to you if you want to go through the trouble. At the very least that saves you from having to write a letter and either email or mail it to them. With Facebook’s consistent history of violating GDPR, I honestly don’t even feel like it’s worth it to try. Chances are that your data will still be sold regardless. Just look at all the lawsuits against Facebook for GDPR violations in the past years.

I’d argue SimpleX does it better, they’re even modifying the Signal protocol to support post-quantum encryption. No phone number, uses the Signal protocol, and has no user identifiers at all (no usernames, no account numbers, no account at all; everything is stored locally on your device).

Oh also, before the reply that Signal is post-quantum already, here’s an excerpt from the blog post I linked detailing why SimpleX’s implementation is better:

unlike Signal design that only added quantum resistance to the initial key exchange by replacing X3DH key agreement scheme with post-quantum PQXDH, but did not improve Signal algorithm itself, our design added quantum-resistant key agreements inside double algorithm, making its break-in recovery property also quantum resistant.

There is much more detail in the blog post if you’re interested. SimpleX also has an incredible whitepaper

The best options for you are going to be SimpleX Chat or Jami, depending on your use case. If you only need to make video calls, probably Jami is the easier option, but if you’d like to have a chat app with video call support, SimpleX is the right choice. SimpleX is also just a really good messaging app, because it has no user identifiers or accounts. They have a wonderful explanation of their method for two-way communication in their whitepaper if you’re interested.

Also, video calling in a “secure environment”, as you’ve stated, is not difficult in the slightest, and absolutely not impossible. There are plenty of options available. Others beyond the ones I gave are Jitsi (but it’s gone way downhill; don’t use it), Signal, Element (you do NOT have to self-host for it, you can use the main instance or any other instance), and the options open up to basically everything if you make a new user profile and install sandboxed Google Play Services in the new user profile (from the “Apps” app). With sandboxed Google Play, you can use apps like Zoom if you really wanted, but I’d strongly encourage you not to for the sake of privacy. You can download apps without signing into a Google account via the Aurora Store.

Yes, of course GrapheneOS can run SimpleX! SimpleX has no dependence on the Google Services Framework, and even for apps that do have GSF dependence, they can be run with sandboxed GSF. The only apps that don’t work on GrapheneOS are apps that try to use the SafetyNet, which is mostly banking apps, or those that require GSF to have deep root privilege to operate.

Yes, that is exactly where perfect forward secrecy fails in Element. It allows all of the message keys to be downloaded by attacking a single point of failure. Perfect forward secrecy would necessitate that all messages and their encryption keys be completely independent, and each message would need to be broken one-by-one, as each key is completely different. What Element does with their cloud backup solution is it adds a single point of failure that results in every single message being compromised, without physical access to any device. Real perfect forward secrecy would make that impossible, as you have to break the encryption of every message independently (again, ignoring physical access to the device, because the device will always have access to all the messages anyway). It essentially invalidates many of the benefits of using a double-rachet key exchange protocol to begin with, as you can attack a single point of failure that would compromise all messages instead.

Granted, whether or not that matters to you is entirely up to you. I’m just clarifying that Element lacks perfect forward secrecy, so I have an ideological objection to my own personal use of it for anything sensitive, since there are more secure messengers out there (like SimpleX) that do have perfect forward secrecy, and many more security and privacy features (like the whole no user identifiers thing and no server side storage with SimpleX). That does of course come with the tradeoff that you can only use it on one device at a time, but everything is a list of pros and cons. Is anyone going to target you and attack you by attempting to gain access to your cloud backup keys? No, most certainly not. But the fact that it exists as an attack vector to begin with is troubling from a security perspective (again, that’s where SimpleX shines with all data being stored locally, so there is no way to access those messages on demand without physical access to the device). I personally think that the metadata issues are much worse with Matrix from an immediate privacy perspective, as that is an avenue that can be actively exploited in a much easier capacity.

If I understand correctly though, I believe we’re both on the same page. Element is still a much better option than something like Discord, but it is not without its own flaws.

The idea with perfect forward secrecy is that by breaking one key, you aren’t able to read all the other messages. The way Element works (allowing users to share encryption keys for messages stored server-side across devices, using a shared storage system), allows for a single key to allow access to all messages. All you need is your backup phrase (or a valid login session), and suddenly not just one message is visible, but all messages are. That is fundamentally in complete opposition to perfect forward secrecy.

The way to work around this is by storing all messages locally so they cannot be decrypted simply with server access, but Element stores messages on their servers, not locally (like SimpleX does, for instance). That would allow robust backup and syncing without breaking PFS.

Do you have any sources for that, preferably their own documentation

https://github.com/element-hq/element-meta/issues/1296

I got that from the privacyguides.org website, at:

https://www.privacyguides.org/en/real-time-communication/#element

If you look carefully on the Element website, there are never any claims that it provides perfect forward secrecy. This is intentional, and unless they change their backup keys, it will continue to stay that way. As the issue is still currently open, I can only assume it is still currently an issue.

I’d like to add SimpleX to this list, as Matrix based messengers hemorrhage metadata, and Session doesn’t have perfect forward secrecy. Also, while the Matrix protocol technically supports perfect forward secrecy, Element does not currently use it.

https://simplex.chat/

Yet Another Call Blocker. Also available on F-Droid

1984.hosting is great, I’ve been using their service for a couple of years now. They’re based in Iceland (really strong privacy laws) and have options for crypto payment if you don’t want to reveal yourself through your payment method. As with all registrars, they’ll need an email address (or alias) to reach you at in case there’s a domain dispute, and while they also ask for address and phone number, they’ve never had me actually verify anything beyond the email. If you give a fake address and phone number, then you’ll just need to understand that if someone challenges your domain, it will be very difficult for you to prove ownership with fake details (not as if that’s likely to happen unless you’re allowing the site to be crawled by a search engine though). I only have a domain through them, not a hosted webserver, but they seem to have good options for hosting. I know that they handle Let’s Encrypt certs automatically for hosted sites, and they run off green energy (geothermal) if that matters to you.

Talking on the YouTube front, a trivially small donation will support them far more than watching ads ever could. Even something as small as $1/year is often far more than they would ever make from you in a year. As far as donations to developers go, it depends entirely on what you feel comfortable with. Most people who work on open source projects are unpaid volunteers, so it isn’t expected that you donate, but if you choose to do so it can be quite helpful to sustaining the project. If many people in the userbase were to make small donations, that would go a long way.

In reality, ads almost entirely benefit exploitative multi-billion dollar companies such as Google and Facebook, so my personal philosophy stands against them. I much prefer donating to people directly to cut out the exploitative middle-man.