I did pick the DBrand Kill Switch case (including. skin and screen protector) for both me and my partner. It was on the pricer side, but I’m pretty happy with it. Feels quite good to hold and certainly rugged enough to protect it. The skins also stop us from getting each others decks mixed up.

As for a dock, I picked up the Anker one and it’s alright. Would have preferred the official one, but everywhere was charging a hefty price for importing it.

I already had a hefty battery pack for travelling. Haven’t needed it much myself, but my partner recently made good use of it for an international flight.

I bought some gray imports a couple of months ago. Cost me about $100 more than Valve’s official AU prices, for the 1TB OLED.

My partner and I have been playing them both pretty much constantly since then. Very happy with them.

The UnifiedPush server is intended to be a single source your phone can keep a persistent connection open to, rather than needing a connection per service/app (this is how Google’s Firebase notifications work too).

As Signal doesn’t support UnifiedPush, MollySocket keeps a permanent connection open to Signal’s servers to listen for new activity and forward them to your UnifiedPush server. This saves your phone keeping a permanent connection open to Signal’s servers and draining your mobile battery more.

I’m self hosting both too. MollySocket’s docs are pretty clear that it never gets an encryption key for your account, so it can’t read your messages. It only gets/forwards alerts that something happened on your account AFAIK. So I’m not sure what data it has that’s worth encrypting.

For Signal/Molly, it’s less that the notification is encrypted as I understand it. It’s more the notification content is just “Hey! Stuff happened” for Signal. The app then reaches out directly to the Signal servers to see what’s new. So the message content is never sent via the push notification service (UnifiedPush or Google’s service).

I’ve got a few old PCI cards around somewhere. I should pull one of them out and give them a try at this.

That would require a lot of data privacy concerns to be addressed. Even if it’s an explicit opt-in. The current method uses sample text which can’t include PII. Using user supplied text would almost guarantee they’d get names and other PII in their data set.

I also imagine it’s harder to train the model when you don’t know exactly what the user was trying to type. I.e. Was the swipe detection wrong, or did the user delete the word because they changed their mind on what to write?

The issue isn’t a big deal for the average user. The vulnerability required them to first get your username and password, physically steal your Yubikey, spend half a day using $10-15k worth of electronics equipment to repeatedly authenticate over and over, they then could potentially make a clone of the key.