You're right, I misunderstood it

Definitely ddrescue. Unlike traditional dd, it can deal with failing drives, it's operation is resumable, and has some other features that's helpful. I would recommend using it even if your drive is fine.
What it produces is a byte for byte copy just like dd.

I've been a social media hermit for the past 3 years but recently

I doubt that they have uploaded any kind of photos

If you want to invent and maintain your wheel then go ahead.. but I think we have better things to do than maintaining half the code of an operating system.

Udisksctl has a variety of relevant features, and it works good, kind of.

Is this a joke?

Obviously, 8 wide tabs are too much. That's like defining Pi as 5.

The benefit of the higher resolution shouldn't be about the colors, but that with bigger screens the movie does not start to get blurry.

For desktop use on a desktop display, I don't see the benefit either. Even less on a phone, that is totally unnecessary.

If you’re at that point of not trusting a company, the best practice would be to avoid using their devices or connecting them to your network.

Yes, that would be the best practice. However there are a lot of best practices that cannot be followed for one reason or another.

visiting only known websites is not a scaleable option

On the regular day to day use, that's right. But on a protest you really should be careful, more than usual.

but every other important one

Is that universally true for all phones?

if you need smth anonymous Proton is not for you.

Oh it is for you, but you have to be careful. Proton won't try to find out info you didn't give them, but they can't pretend that they don't have info that they actually have. They run an onion service, and account recovery is made possible without a recovery contact.

I don't see what that has to do with the drive dying. Every drive dies at some point, even if left in it's place

Or if you don't trust Microsoft to begin with, just use Veracrypt, it won't upload your recovery key anywhere, but will help to make a recovery usb stick.

Additionally, the problem above was not some kind of "unhealthy paranoia", but disliking Microsoft and then still creating an account for some reason, one that they deemed to be a throwaway account. Question is why did they do that (oh, because Microsoft made it hard* to skip registering an account? That can't be! Microsoft is trustworthy and anyone thinking else is just unhealthily paranoid, right?), but also how should have the user known that this was a dangerous thing to do? Don't tell me they should have read the dozens of pages of dry legal text.

*Yes, it's hard if it's not an option in the installer. How the fuck you look it up when you don't have your computer?

And you slowly figure out that every photo, every document, everything critical to you is now protected from you and you can’t get it back.

How fortunate that onedrive auto uploads those to Microsoft. That is, until you run out of your quota..

There's an extension that can unlock LUKS drives using the TPM, but by default it does not do that, and probably that extension isn't installed either

Hopefully it's not news to them that they have some kind of Microsoft account, let alone know the credentials to it.

Haven't seen it published in his channel either

Secret chats only. With their own, in-house encryption, that, if I remember correctly, the apps don't use according to the specifications.

Maybe I'm mixing up mtproto 1 and 2 with that second part, though.

But what if you get it back? Or if you just keep it?

There is a chance that you have Pegasus on there, and I wouldnt want a phone without the detection of this.

You attempt to flash your full backup to it. And maybe then read it back if you can for verification that it was actually written to memory, but that probably won't be possible when using fastboot. That's all you can do that's reliable, to some extent.

Not sure if VPN eliminates all risks with 2G and 3G, maybe it does.

It doesn't, but probably even on modern phones it only does if you explicitly set it to only use 4G but nothing below that.

Mull has no process isolation at all, but support for UBO and Noscript. Bad situation

If you only visit known reputable websites it's probably not really a problem, but also, I think there are chromium browsers that have addons. Not sure though if there's one that besides that also has the security patches.

These cannot be written without TPM verification or stuff

I doubt that it couldn't be written, I believe TPM can only verify its contents and make the phone refuse to boot if it doesn't agree on the authenticity of the partition contents.
However it's also a question which partitions are checked that way: only the system partition? Or more? Probably not all, because they can't verify e.g. the main user data partition, because it's ever changing contents were never signed by the manufacturer. There's a few dozens of partitions usually so this is not trivial to answer.

the verification will not be done inside the OS, that would be totally flawed.

Yes, verification is done by one of the bootloaders. At least partly, the OS and maybe other layers must be doing it too, just remember why Magisk had a feature to hide it's processes and the controlling app itself from select system services and other apps.

Reading data has nothing to do with that. They likely can, but that doesnt matter.

Didn't mean that. I meant writing data that is later being read by other important system software that is vulnerable to specially crafted quirks in that data.

Water does not think, it flows where it can.
People while driving cannot know which route isn't clogged, because cars are not flowing like water. If that would be the case all the small streets around main roads would be full too. If a street is clogged, and the driver sees it, they can decide to go on a different route, but in waze if they are using it to plan a route, it'll try actively to avoid roads that are too busy.

in order to be able to modify the stream in real-time and send it back out...

It doesn't need to modify. What it needs is detection, and then either blacking it out, or replacing with a simple progesssbar-like screen on a black background.