Live Q&A: Privacy, Security & Your Digital Life - Techlore Office Hours Live

Summary

Techlore host Henry answered live-chat questions about privacy tools, software security, browsers, devices, and digital-rights issues. The stream was informal and included no major announcements, but it offered several practical recommendations and product assessments.

Privacy and security tools

• Tuta: Henry praised Tuta’s team and approach, while noting that it is more focused and slower-moving than Proton. It also lacks some features he would want before using it personally.
• Proton controversy: Henry separated the discussion into three issues: an AI manifesto from Proton’s CTO, employee concerns about releasing code too quickly and securely, and an attempt to re-interview employees about their willingness to embrace AI. He did not consider the manifesto inherently problematic, but said the employee accounts raised questions about the company’s security culture. He also noted that paying customers can raise concerns directly and may have more influence than free users.
• New encrypted services: AI tools may make it easier to launch software, but they do not replace the need for security updates, an identifiable and active team, audits or established trust, usability, and long-term maintenance. Henry suggested testing new services with low-risk data and building trust gradually rather than moving sensitive information immediately.
• Open source and server code: Client-side open source can be especially valuable when users can verify the software running on their own devices. Publishing server code does not, by itself, prove that a service runs that code. Henry used Signal as an example: its encryption and client-side code are central to its security model, while server code has different verification limits.
• Push notifications: Apple and Google’s push-notification systems can expose notification content if an app does not encrypt it before sending. Henry said privacy-conscious services such as Signal, Proton Mail, and Tuta take steps to protect notification contents. Users with particularly high security needs can hide message previews or disable notifications. UnifiedPush is an open-source alternative, but relatively few apps support it.
• Intel ME and AMD PSP: Henry may create a guide explaining what users should know about these technologies, separating evidence-based concerns and practical steps from exaggerated claims.

Browsers, tracking, and online accounts

• Brave Speedreader and the New York Times lawsuit: Henry thought the case against Brave could be legally challenging for the browser because Speedreader can bypass paywalls through a built-in feature. He was sympathetic to the open-internet argument but said the lawsuit’s premise seemed to have some merit, while stressing that he is not a lawyer.
• Fingerprinting: Brave’s fingerprint protections prioritize usability rather than maximum anonymity. Henry considered that a reasonable balance for ordinary use; for high-anonymity needs, he recommended Tor Browser. He described using Brave for most browsing, Mullvad Browser for stronger separation, and Tor when he wants activity kept especially distinct from everyday browsing.
• Server-side tracking: Browser protections and DNS filtering cannot prevent a company’s server from sharing data with an advertising platform. Henry said the exact tracking path can be difficult to establish; account logins, IP addresses, and other shared signals may contribute to linking activity. The incident is a reminder that users still have to trust websites’ servers.
• Brave Origin, Dia, Zen, and Firefox: Henry uses Brave Origin as a clean browser for recording and streaming, not as his general browser. He was skeptical that AI features alone would persuade users to switch browsers, and felt that extensions or features within an existing browser may be more practical. He criticized the Browser Company’s shift from Arc to Dia, while praising Zen as an open-source Firefox-based option. He also said he likes Firefox’s redesign and uses Firefox with uBlock Origin and a password manager.
• Firefox Sync: Henry highlighted that Firefox Sync can work across Firefox installations without each browser fork creating its own separate sync ecosystem. He contrasted this with Chromium-based browsers, which generally cannot share sync accounts with one another.
• Email aliases: Giving a site your real name does not eliminate the benefits of an email alias. Aliases can limit cross-service linkage, help identify where spam or a leak originated, and be disabled. Henry recommended using aliases even for services that already know your name.
• Google OAuth: Henry said OAuth can reduce the need for a website to store passwords, but can also increase dependency on Google. He recommended offering it as one choice among several, including email-based registration. Depending on the service and email address, users may be able to set a password and continue accessing an account even if they lose access to Google OAuth.
• Mac software signing: Henry had no definitive solution for distributing unsigned open-source Mac apps. He said Apple’s signing process is part of macOS’s security model and that, as a user, he is wary of unsigned software. Homebrew may be an option for distribution, but he also expressed concerns about the quality and maintenance of community packages.

Devices, operating systems, and AI

• GrapheneOS hardware: Henry welcomed possible GrapheneOS support for newer Pixel devices, if confirmed, and hoped the project would support a broader range of hardware, especially more repairable devices such as Fairphone. He was interested in Motorola’s potential support but said the initial device discussed was an expensive flagship and plans for cheaper devices were still unclear.
• Buying devices to signal demand: Henry said buying a product can signal demand for particular values, but the meaning of that purchase is not always clear to a company. His practical advice was to buy a device if it is right for you and tell the company directly why you chose it.
• Apple Intelligence and macOS: Henry liked the idea of a maintenance-focused future macOS release and reported improved battery life on an iPad after updating. However, he was strongly critical of how Apple Intelligence is handled: he said it had consumed about 30 GB on his laptop, objected to the lack of a clear way to disable or remove it, and was frustrated that deleting its models could lead to them returning during updates. He advised viewers to verify the setup behavior on their own devices rather than relying on his experience.
• Linux alternatives: Henry said Linux is becoming more viable for creative and professional work, pointing to DaVinci Resolve support, Affinity’s stated plans for a Linux desktop version, and more capable hardware options such as Framework laptops. He suggested that these developments make the choice between macOS and Linux less clear-cut.
• Local language models: Henry described using a local model on a Mac mini and found it useful for tasks such as summarizing public privacy policies. He encouraged using local models where convenient, while noting that public documents are relatively low-risk to process. He also cautioned that AI summaries can hallucinate and recommended asking models to quote the relevant text.

Digital rights and service decisions

• Fighting age-verification laws such as KOSA: Henry recommended contacting representatives, explaining specific technical concerns rather than only expressing anger, and educating others. He cited an interview with Carl from System76, who had advocated for an open-source exemption in age-attestation laws in Colorado and California.
• Choosing privacy tools: Henry argued that, for many people, the practical difference between reputable tools is smaller than the difference between using a privacy-respecting option and a major default service. He encouraged choosing tools that fit one’s routine instead of getting stuck comparing options, while emphasizing that higher-risk users may need different choices based on their threat model.
• Starlink: Henry supported the value of better internet access, particularly in rural areas, but said he distrusted Elon Musk and had not used Starlink himself. He speculated that users should treat it like other internet providers and consider measures such as a VPN or changing DNS, without claiming detailed knowledge of Starlink’s privacy practices.
• Cape mobile service: Henry said Cape aims to provide privacy protections beyond those of typical prepaid carriers, but acknowledged that he still needed to publish a review addressing both its strengths and his own experience.

Guides, reviews, and project updates

• Ghost website customization: Henry explained that Techlore’s site, newsletter, and other functions were consolidated on the hosted Ghost platform. The site began with a purchased theme, Vincent; Henry then customized the theme files, added a custom landing page, and maintained the work in a private GitHub repository. He used Ghost’s documentation and LLMs to help understand the platform.
• Techlore SPA quiz: The quiz now gives more specific explanations of what affects a user’s score and allows answers to be changed directly from the results page. Henry invited users to submit feedback, including their results, through an end-to-end encrypted form.
• Go Incognito: Henry said the updated version is being developed and that a free version is planned. He considered much of the original course’s material still relevant, though some sections, such as Firefox hardening, are outdated. The premium version also includes access to the original course.
• Upcoming coverage: Henry said a new Surveillance Report episode had been recorded and was being edited. He also mentioned plans to return to regular interviews and content.

Main speakers and sources

• Henry, Techlore host: The primary speaker and source of the analysis and recommendations.
• Live-chat participants: Asked questions and shared experiences that prompted much of the discussion.
• External sources mentioned: Carl from System76, interviewer Simon Hill, and John from Cryptee.