Did you muck with Logseq at all? That’s my preferred note taking app and it checks a lot of your boxes, the biggest miss probably being the Electron app part. That said, I’ve never noticed any slow downs.

But this is great to have options and a larger ecosystem. I’ll have to check it out.

100% it’s always a question of your resources vs theirs, but you’re dead on to make it harder.

I’ll just add to also turn it off, pull the SIM, and show in a Faraday bag on your way back too. If the recent reporting about ICE buying location data from ad networks shows anything, it’s that they are interested in a capability of following people to and from protests. Graphene should obviate this by disabling Google Play services by default anyway.

You should leave your regular phone at home, go to another place, power on your other device, speak your part in public, then travel another location and power off. This provides no consistent start or end location to work with for a particular device.

Alright, I already “umm, ackshually’d” someone in this thread but this post in particular hit a nerve with me. The Tor security model is based on 3 hops but does not guarantee 3 different jurisdictions. Their circuit building only takes into account “jurisdiction” in the way we’re using it here if you use guard nodes or specific cases when you cannot access the network directly or look like you’re exiting from a Tor node.

That said, it’s still a very strong project and security model. And everything you said about spreading out your providers without a single point of failure (or pressure) applies.

I know this was in jest but seems on topic with the post - please switch from pattern to PIN (or better still, password). Pattern is orders of magnitude easier to crack than PIN.

Sorry, I wasn’t as clear in my original post.

At the bottom of the settings page you can generate a “bookmarklet” that includes the config options in your URL. So https://duckduckgo.com/ becomes https://duckduckgo.com/?kae=t if I want the Terminal color scheme. And this works without cookies. And this applies for all possible settings.

Interestingly I set my home page to a string that should disable all the AI features and I still got summaries sometimes so not sure if that’s a bug, user error, or hostile UI. In either case, something like you suggest with https://noai.duckduckgo.com/?kae=t&etc=… should give you the best of both worlds.

For you and whomever else needs to hear it, you can solve the second part by going to https://duckduckgo.com/settings and saving the bookmark with all the options included. Then you can clear all the cookies you want and it’ll always load the same settings.

Could tie it to something like a biometric. That and storing it on a write-only device would keep it from being shared too wide. The trickiss to tie it to a true multi-factor and not just something you have (if unencrypted) or something you know (if ASCII armored).

I’ll address the second objection first regarding the phone or browser. You’re always going to rely on some technology for the solutions that use cryptography, you just can’t do those calculations long-hand realistically. That said, look up frameworks like CTAP that allow a potentially untrusted user terminal, like a browser, to interact with a trusted hardware token. Those hardware tokens can be made fairly tamper-proof, see FIPS authorized Yubikeys, such that the phone is pretty much removed from the attestation process. Yes these can still be stolen, but they make hardware keys that are fingerprint authenticated and the biometric stays on the device. Doesn’t get much more self-sovereign than that.

The existence of a trusted credential provider is a challenge. Fully self-sovereign credentials need to either be trust on first use or validated against a larger system everyone participates in. Even if we had some system of birth certificates tied to a distributed ledger, we would have to trust the third party recording that certificate in the first place, be it a hospital, doctor, or state entity. These trust and proof systems don’t create the trust, they just allow us to extend that trust from one claimant to a verifier. Whether you place that trust in the state, an individual, or an independent third party is up to you.