You could add keepassxc as an option for those who don't want a hosted service at all. You can still exchange the storage file with other computers if you have to (via USB stick, mail, nextcloud etc)
You Should Know
YSK - for all the things that can make your life easier!
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must begin with YSK.
All posts must begin with YSK. If you're a Mastodon user, then include YSK after @youshouldknow. This is a community to share tips and tricks that will help you improve your life.
Rule 2- Your post body text must include the reason "Why" YSK:
**In your post's text body, you must include the reason "Why" YSK: It’s helpful for readability, and informs readers about the importance of the content. **
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding non-YSK posts.
Provided it is about the community itself, you may post non-YSK posts using the [META] tag on your post title.
Rule 7- You can't harass or disturb other members.
If you harass or discriminate against any individual member, you will be removed.
If you are a member, sympathizer or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people and you were provably vocal about your hate, then you will be banned on sight.
For further explanation, clarification and feedback about this rule, you may follow this link.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- The majority of bots aren't allowed to participate here.
Unless included in our Whitelist for Bots, your bot will not be allowed to participate in this community. To have your bot whitelisted, please contact the moderators for a short review.
Partnered Communities:
You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.
Community Moderation
For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.
Credits
Our icon(masterpiece) was made by @clen15!
Also, do not post personal information here ever. Once you posted a comment, there are no guarantee you can fully delete them later. If you post a personal information, there is a chance that it might still up in some instance somewhere even if you attempt to delete it. Some instance might not receive the activitypub push about the deletion due to federation issue/lags, getting blocked from the original instance, bugs or random internet connection issues. Use other channel if you need to share personal info to fellow lemmings so you can be sure to purge them if needed later (e.g a link to pastebin, discord, etc)
I wouldn't say don't post personal information at all. But rather don't post information that you're not comfortable with everyone knowing, while being identified and never being able to delete it.
IMO it's best to assume that if you post enough online, someone dedicated enough will be able to identify you, especially people who already know you in real life. It's difficult to post without revealing small details about yourself that can be combined to piece together who you are. Eg, you might never say where you work, but your city, field, an offhand comment about a coworker, a mention of a conference, and such might let someone narrow it down. Similarly, you might never mention what city you're in, but it might be narrowed down from mentions of things like traffic, weather, events near you, remarks of things being close by, etc. And that's not even getting into devious things like trying to trick someone into clicking a link to a domain you control so that you can get their IP.
I'm of the opinion you should generally act as if you're talking to people face to face with a name tag saying your full name and address. I think that approach also just plain makes the internet a better place. Anonymity seems to make a lot of people more comfortable being aggressive assholes.
I say "generally" because there's plenty of valid reasons to want to post things you would want to post things that you'd never say if identified. But in that case, you should strongly consider using an absolutely minimal throwaway account, while being extremely careful with details. And even then, you should at least consider that you might still get identified. In particular, I think a lot of users of throwaways only consider strangers not being able to identify them. Sometimes that's all you care about, but your family, friends, and coworkers are going to have a lot easier time identifying you.
You could also use an instance that doesn't require email for signups. Like fmhy or lemmynsfw.
It’s not very open-sourcey, but Apple include a email forwarding service called Hide My Email in their iCloud+ plans. So, you may already have access to that service.
I like and use anonaddy.com. Unlimited free aliases.
Nice, I didn’t know of them, thanks for sharing!
I totally agree with using strong unique password manager generated passwords for every server (as everyone should do for every service they use regardless) but my email has been leaked so many times by so many breaches I’m not sure I really care about that part at this point…
Speaking of which, stuff that frequently comes up in privacy related forums:
Differentiate between your professional accounts (it has your real name attached) and your non-professional ones (you use it to discuss pooping methods for example). Don't mix them up. I know many will say "so what if people in the fediverse know where I live and how I poop, I got nothing to hide" a lot, but that's how people got doxxed or swatted.
Even if you don't feel the need to, it's good to sit down and identify the potential threats given certain problems. Do you recycle passwords for email and social media accounts? What about banking? If a malicious coworker or an immature family member got access to your social media profile and posted reputation-damaging content, how bad can things get? Identify the outcomes you can mitigate or must prevent, and plan accordingly.
There is no "100%" when it comes to privacy. It's a process, not an "all-or-nothing" switch. Beginners often ask if "program X and Y will protect me 100%", and the answer usually boils down to "there isn't a single magic pill".
Privacy ≠ Security ≠ Anonymity. A VPN subscription can secure your connection (content secret in transit), but does not make you anonymous (sender known to middle node). You could leave an anonymous message (sender unknown) on a public forum, but the message itself isn't private (content not secret). And so on.
Encryption is a useful tool, but don't fall for the "military grade encryption" speech. They often mean "we just slapped whatever shit it came up with", nothing extraordinary.
There are many more but I will stop for now. No, I am not in Guantanamo.
Great points all around!
The throwaway email providers I personally use are:
- If I want to receive ongoing messages and have the ability to reset passwords etc: DuckDuckGo
- If I don't care what happens after the first email: Yopmail
DDG is great, I've been using it for a while now, but I recently learned that I can also send mails from my main account as a @duck.com address and now I'm in love.
Caution: The following requires that you have "Keychain" and "iCloud Mail" activated for your Apple ID, and are running iOS 15+, iPadOS 15+, and macOS Monterey+ on the applicable devices.
For macOS / iOS / iPadOS users you can use "Hide My Email" (aka "Sign in with Apple") to have a randomly generated e-mail address used for sign-ups. Then you can have Keychain generate a random, strong, passcode for you to use on that particular website.
Note: If you see just an "e-mail" field on the sign-up page, and when you click in it you see a drop-down menu of your current Apple e-mail addresses, just scroll to the bottom of that list to get to "Hide My E-mail".
After you've completed a sign-up on a website (not just federated, but any website) Apple will e-mail you the new e-mail address you generated and for which website is was used on. Store that in a safe place to easily keep track of what's being used where. (You can also find them here: System > Apple ID > Hide My E-mail > Options…)
All of the above, the randomly generated e-mail addresses and passcodes for the websites, are automatically synced through iCloud to all of your devices signed into the account used to create them.
Note: The "Sign in with Apple" button is a bit weird. When you've used it on a website, then later go back and are asked to sign-in to your account, you'll see the same "Sign in with Apple" button you saw originally. There's no visual indicator on the page that you've used this feature before. It's not until you select the button that the next screen will show you the e-mail address that was generated.
This is a good explanation of the feature for use with Lemmy.
I’m gonna be an annoying pedant for a second though and say that “hide my email” and “sign in with apple” are two different and unique features, though they both act as an email relay.
The former just creates a semi-random email address for you that forwards to your email. This address will end in “@icloud.com,” making it indistinguishable from any other iCloud email address (other than the ridiculous address you get).
The latter is an authentication system that allows you to sign up for services that support it with your apple account. The service doesn’t get your password directly of course, when you click the “sign in with apple” button it will redirect you to an apple sign in, typically faceID or touchID, and when you sign in successfully (or are already signed in to Apple) it will redirect back to the service with a token that says “this person is cool.”
Importantly for this conversation though, you can optionally send the service your real email or a generated email address as a relay, but the generated email is not the same as the email generated by “Hide my email,” instead it’s a clearly random series of characters and ends in “@privaterelay.appleid.com”.
In the end they have roughly the same purpose for your email, but the important bit here is that on Lemmy, only “hide my email” will be useful. There are no Lemmy instances that support “sign in with Apple” (yet).
Okay, I’ll stop being a pedant now. Sorry for being annoying there.
Thank you for the excellent clarification.