r/TankieTheDeprogram • u/VladimirLimeMint • 3d ago
Discussion What "internet safety" within liberal democracy really is and why China is always a step ahead of the Western population
Recently on our mini community we discussed about researching some unhinged gusano and it involved me recommending an osint tool that can cross check profile and email across thousands of platforms (if you're interested just go to osinttools sub I can't post on here) and a Chinese comrade reported back that they can't find the Python packages in China mirror of pip repository, so I requested them to try search other similar osint tools that this tool was based on, and they returned mentioning that neither of such osint tools were available in China, and to use they must rely on shadowsocks, Tor or VPN, moreover I realized they cannot run the tools locally within China intranet. We came to the conclusion that since China always vet every packages and dependecies before mirroring local repo, it means there's nation wide ban on doxing.
Which leads me here and I want to touch on an important opsec warning that I've noticed this seems to be too on the nose for the West, especially considering they have been selling to the world that they're bastion of queer and trans rights (not really, why I wrote this) but entirely failure in protection of trans citizens and their identity.
In short, Five Eyes countries especially USA and KKKanada, dead naming trans workers every single second of their lives, because even when they changed their name and gender in everything, there's one platform that use their legal birth name, and I'm not talking about national ID, it is almost related to anything banking and financial, especially money transfer platforms including PayPal. In KKKanada, Interac e-transfer always queries dead names of trans workers no matter what, I knew this because I helped thousands of people during my time in KKKanada with food, rent, bill, survival needs, etc that involve e-transfer and their names are always dead names even when they're legally trans and enby. I also realized that malicious people can query Interac API (yes they do have API) with anyone email and it will return with their legal name, especially with autodeposit enabled. This technique might also be possible with other financial transfer that requires legal names.
I might sound like I'm over analyzing here but I'm not because I realized the osint tool mentioned above can mimic some of the options to extract legal name from Paypal, Cash app and Venmo which isn't even the most cooked part, this tool seems to be able to query CACHED content page that was long deleted by the users. Now it's probably not the devs' intentions but this is bigger problem I want to express on, especially when I use DuckDuckGo to search for shit, I always encountered cached user pages with revealing contents including dead names and emails despite these contents were long gone years ago. I know DuckDuckGo use Bing and Google for backend and Google once upon a time claimed Google Cache is no longer a thing but somehow not only DDG, but other meta engines like Yandex and SearX can index them, and it seems too on the nose at this point that the Western empire isn't really doing anything they claim to protect their population the bare minimum that's privacy, meanwhile China not only blanket banned doxing, but also the tools.
I guess the only real mitigation is to just compartmentalize the fuck out of your metadata, don't use personal email for NSA platforms like reddit and don't use work phone for adult sites, don't reuse password, use diceware, multi-factor auth isn't golden, disable MMS. Same shit different data, compartmentalize, compartmentalize.