this post was submitted on 07 Jan 2025
1 points (100.0% liked)

Privacy

6 readers
1 users here now

Everything about privacy (the confidentiality pillar of security) -- but not restricted to infosec. Offline privacy is also relevant here.

founded 1 year ago
MODERATORS
ciferecaNinjo@fedia.io
1
I'm checking out various "personal knowledge management" tools in a sandbox to see if it be an upgrade my ragtag collection of text file-based notes. (fedia.io)
submitted 2 months ago by loadhigh@bitbang.social to c/privacy@fedia.io
32 comments fedilink hide all child comments
 

I'm checking out various "personal knowledge management" tools in a sandbox to see if it be an upgrade my ragtag collection of text file-based notes.

First candidate is #Logseq, supposedly "privacy-first".

How #privacy friendly is something based on Electron (aka Chrome)? Debatable, but then they also do this:

  1. Have "Send usage data" on by default
  2. Start with an example page that embeds a YouTube video, and accepts all cookies

tcpdump and mitmproxy go wild when starting the program.

Shows that the "Send usage data and diagnostics to Logseq" setting is enabled by default.
Shows the services being contacted by Logseq over HTTPS right after starting it for the first time. Hosts that are being contact: www.youtube.com, googleads.g.doubleclick.net, jnn-pa-googleapis.com, play.google.com, app.posthog.com, o416451.ingest.sentry.io

you are viewing a single comment's thread
view the rest of the comments
[–] loadhigh@bitbang.social 1 points 1 month ago (1 children)

Ok then, number 5: the desktop version of #TiddlyWiki, #TiddlyDesktop.

The Chromium wrapper isn't as old as the wiki web software itself but still goes back to 2014.

Standard Chrome traffic and... a lot of calls to googleapis.com. Why? Because it calls the Google spell check API with everything you enter.

All your text is being sent to Google.

I couldn't turn it off and on top of that a dummy API key is used so the API returns an error, meaning the functionality is completely useless.

A screenshot of the page editor of TiddlyWiki in TiddlyDesktop. The contents of the page read: "Secrets" "So I've disabled ""network activity"", surely it won't pass my biggest secrets on to Google, right? ... Right?" It also shows that the "network activity" option has been disabled (I've also tested it with the option enabled, restarting the program, etc. Google's API was still being contacted)
Shows the contents of one of the calls to the Google spell check API. The payload of the call contains the following JSON: { "text": "So I've disabled \"network activity\", surely it won't pass my biggest secrets on to Google, right?\n\n...\n\nRight?", "language": "en", "originCountry": "USA" }

[–] CrossEye@mstdn.plus 1 points 1 month ago (1 children)

@loadhigh@bitbang.social I use the Node.js version of Tiddlywiki and see no such traffic. I don't use TiddlyDesktop, though, so can't comment on that.

[–] loadhigh@bitbang.social 1 points 1 month ago

@CrossEye@mstdn.plus This is definitely TiddlyDesktop only. It was added because people were missing the spell checking that their browser normally does ()