10 ms·

I've been trying to think of a practical, effective way for smartphone end users to protect their confidentiality. This is the simplest solution I've come up wi

I've been trying to think of a practical, effective way for smartphone end users to protect their confidentiality. This is the simplest solution I've come up with, but I'd appreciate any feedback: Hardware: * Tablet, or smartphone with baseband disabled. * Cellular-wifi router (i.e., wifi hotspot), prepaid so the provider doesn't need your personal info. . Software: * Android with per-app permissions controlled by user (e.g., user can enable/disable access to location data for particular apps). This could be a fork of Android or maybe there is security software that could be installed, such as on a rooted phone. * VOIP app on phone * VPN . By decoupling the baseband from the handheld computer (i.e., by keeping the tablet and cellular connection on different devices), using the cellular service without providing identifying info, and sending only encrypted data over the cellular connection (via VPN), you would protect your confidentiality from the cellular provider. Because your phone number is decoupled from your cellular service (because you use VOIP over a VPN), nobody can tie your phone number to your location. Of course someone who is determined could track you down. Your identity needs to be tied to your phone number or nobody will know how to call you; and your VOIP vendor could point someone to your VPN provider, who could point them to your cellular provider, who could figure out which hotspot you use. But I think it does protect you from everyday mass surveillance. Any thoughts on how practical or effective this would be?

dublinben 11y ago
There is a very thorough guide for achieving pretty much this from the Tor Project blog.[0] The most significant part in this process is completely separating the baseband from your user device. [0] https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy https://blog.torproject.org/blog/mission-impossible-hardenin...
superuser2 11y ago
VoIP calls over VPN over cellular data are likely to have extreme reliability, latency, and jitter problems.
- hackuser 11y ago
  I was wondering about that. * Regarding the VPN: Inevitably it adds an extra hop but with a VPN that provides sufficient bandwidth, low latency, and sufficient processing resources to decrypt/encrypt at wire speed -- I assume that either it will cost extra or will be something the user has to setup at a good hosting provider -- couldn't performance be sufficient for voice? IIRC, from long ago, voice needs ~80 Kbps. * Regarding cellular data: Cellular connections are very widely used for voice, of course. Cellular data connections are used now (e.g., VoLTE). On one hand I'd have the same doubts you do; on the other it seems to work. Aren't there already VOIP apps?
  - e12e 11y ago
    "Uncompressed" voice "needs" 64kbps (hence ISDN was 2 voice channels etc). If you use a modern codec, you could probably get away with less, for high-quality mono voice. Note that you might not want to use VBR, for other reasons (I thought this was already submitted to hn - couldn't find it - so here's a fresh submission): "Attacks on packet length may be surprisingly good: Hookt on fon-iks": https://news.ycombinator.com/item?id=10462363 https://news.ycombinator.com/item?id=10462363 That said, I suspect that eg: Ogg Vorbis at 64kbs CBR would be fine for voice, assuming you could keep the latency down. Latency and drops would probably be the biggest issue. And you can of course prove, that latency sets a limit to the number of hops -- say if you'd want to hop through a European jurisdiction from the West Coast. I'm actually planning to (try to) move to a pure data-oriented (not sure if there will remain a cellular part, or if I'll just use wlan) (probably) SIP for all my phone needs. That'll probably involve a SIP server on dedicated (rented) hw in Germany, and VPN from the phone/laptop. Not quite sure yet if it'll work out, or if it'll be good enough.
joering2 11y ago
> prepaid so the provider doesn't need your personal info. I don't think this is possible in the USA anymore. I tried with ATT Verizon and Tmobile but I'm sure they are smaller players. All required somewhat my personal info altho for prepaid Tmobile did not ask for SSN. All told me this is due to the fact you're getting equipment "practically free". When offered to actually pay for it, I was always told "we don't have option like that". Europe is much simpler. I walked into Play store [1], put $60 on table, and got USB dongle with prepaid scratch card of 6GB on a 3G network. No IDs, no documentation, nothing. Refills are very simple - you purchase a scratch offs for 3/6/9 GB or more, over the counter, no ID required. [1] http://www.play.pl http://www.play.pl
- ltnately 11y ago
  I think you can still get around that with some effort. In 2010, I purchased a dumb phone/sim card for use on a prepaid plan. At the time it was the only way to get onto a super cheap prepaid plan since they wouldn't sell you a sim/the plan directly. I then put the sim into my own purchased smart phones(multiple nexus devices and a one plus one). For convenience reasons, I refill my account online with a cc but I technically could simply buy the t-mobile refill cards for cash then activate the time on them. As far as I know, there's nothing stopping me from doing this fresh again with a new prepaid phone and then never associating my real identity in any way.
  - exelius 11y ago
    They don't even need to; your telco can know your home address based on a week's worth of location data, and could likely determine more about you based on where you go to work, shop, etc. Humans are creatures of habit, so it's relatively easy to draw inferences from simple patterns (i.e. if you spend 6-8 hours in the same location every night, that's probably where you live.) All it takes is one time checking your e-mail from an IP address to forever link that IP address to you. Know enough IP addresses someone has connected from and you can come up with a pretty good picture of their friend circle, their movements, how old they probably are, etc. I work in the telecom industry, and this behavior exists because it's not explicitly illegal. This type of data mining is just scratching the surface of their capability -- turns out that a combination of about 30 seconds worth of data scraped off http traffic (not https, though even https can tell you something) and a location are enough to identify most individuals and link them to a profile in a DMP -- which can tell you all sorts of information like which products you've purchased recently (both online and in brick and mortar stores with a credit card), any relevant demographic information, and even what kind of porn you like. The real restraint on this has been in the use of this information. Marketers have been remarkably conservative in using this information; likely for fear of scaring off customers with "creepy" data. But rest assured they know more about you than you do yourself.
petra 11y ago
I think we should differentiate two things: First there's state level surveillance.It's a hard technical challenge and I'm not even sure those steps would help. Second , there's what this article talks about. Probably using VPN(and maybe some software that turns down 3G/4G connection unless it's strictly necessary) would neutralize most of this issue - because planting baseband malware and maybe risking exposure doesn't seems to be worth it just for ads.
- hackuser 11y ago
  > First there's state level surveillance.It's a hard technical challenge and I'm not even sure those steps would help. If the state is determined to track or identify the user, I agree this doesn't help. It might delay them a little. But I don't mind the state investigating people for legitimate reasons (e.g., under a warrant); I'm not trying to protect criminals. Also this won't protect people persecuted by repressive states - that's a very valuable goal, but outside the scope of this idea. For dragnet surveillance I suspect this would work, simply by adding enough complexity to the task that it's not worth it for one more data point among billions. Of course anyone could make a social graph based on my phone calls and learn a lot that way, but I don't think anonymous phone calls are possible. If I want to receive incoming calls then I have to give out my phone number; my name and number inevitably become associated. (I can think of a few weak solutions, such as having many phone numbers, but that's imperfect and impractical.)
  - petra 11y ago
    The thing is: just by doing those thing - you mark yourself as a target(maybe worthy of deeper probing). And if everybody do so(hard to believe), the state, since it seem to really value dragnets - would play another move in this probably infinite cat and mouse game.
exelius 11y ago
The problem with all of this is that you would need to swap SIM cards on the cellular-wifi router almost every time you change locations -- and that's if you can even find a data vendor willing to sell you a prepaid data plan without a credit card on file. Practically, this solution you've come up with is too fragile to be relied upon. It's only secure if you can maintain this level of care with every operation you perform on the phone. This is why the NSA's data collection is so insidious -- it only takes one slip-up to connect everything you ever did anonymously to your "profile". With the type of data collection that is done today, it's nearly impossible to avoid unless you use the Internet in a very different way than the average person. Avoiding data collection through technical means is a futile exercise at this point -- if you object to the data collection, public policy is the best avenue to prevent it at this point.
- hackuser 11y ago
  > you would need to swap SIM cards on the cellular-wifi router almost every time you change locations Assuming the user can get an anonymous pre-paid service (which I agree isn't certain), why would they need to change SIMs? The cellular provider only sees an unknown person sending encrypted data to a VPN hosting service.
  - Retric 11y ago
    Assuming there selling your home address to stores you visited. If you carry the same phone to the same house every day for a month they can guess your home address.(1) boom targeted direct mail. Let's take this a step further, they link your phone's location to when you leave the checkout line, now they know where you live and what your buying. (1) They may or may not be doing this, but at a technical level it would be easy.
    - seabee 11y ago
      Identifying home or work location is something Google Maps does for your convenience. It would be trivial for cell operators.
    - 11y ago
smpetrey 11y ago
Sounds great so far. There would have to be a temporary switch for 911 emergency calls from the user-endpoint. I have heard that VOIP services are not compatible with the phone/location trace programming necessary for emergency dispatch centers.
- deckard1 11y ago
  VoIP uses E911. Usually you pre-register your address with the VoIP service. But services with dedicated apps may pass along your GPS location today, I'm not too sure there.
  - MichaelGG 11y ago
    There are ways to pass the coordinates in a VoIP 911 call. Unfortunately, these standards are designed by astronaut architects and are rather cumbersome. For instance, one uses MIME multipart bodies inside a SIP message. Which few systems handle properly (because it's such a bad idea and has no practical use cases). Instead of being engineers and saying "ok, well just throw in a header X-911Location" or something simple, they gotta make shit complicated. It's ridiculous. They also use this IETF designed address format. Which is rather ... comprehensive. All sorts of designation for streets and branches and so on. Except... none of the 911 systems actually use that. So they design this protocol with no care to how actual systems work. Or how actual street addresses in the US work. They basically made up their own idea of how address topographies could work. But I'm guessing some of the larger companies doing VoIP probably have it sorted (like when you do a VoIP call on T-Mobile and there's no GSM just WiFi).
dice 11y ago
>Android with per-app permissions controlled by user (e.g., user can enable/disable access to location data for particular apps). This could be a fork of Android or maybe there is security software that could be installed, such as on a rooted phone. This is a built-in feature in Marshmallow [0]. [0]: http://www.greenbot.com/article/2990078/android/how-to-toggle-app-permissions-in-android-marshmallow.html http://www.greenbot.com/article/2990078/android/how-to-toggl...
- josh2600 11y ago
  Doesn't solve the problem of the network reporting your location (disabling the baseband does, but operating system level permissions don't impact the network). I know that's outside the scope of your comment, but I wanted to point out that the baseband is not a thing the operating system really controls in any meaningful fashion.
- nicholasjarnold 11y ago
  Yes, one can limit some permissions, but there are others that vanilla Android will not allow one to block. For instance: Device ID. I don't have a complete list of the un-blockable permissions, but simply using Android's built-in functionality is not sufficient to block all identifiable data that your phone's apps leak.
  - hackuser 11y ago
    > simply using Android's built-in functionality is not sufficient to block all identifiable data that your phone's apps leak Do you know happen to know a solution? I know there are many confidentiality utilities and Android forks which emphasize it, but I don't know enough to evaluate them.
    - nicholasjarnold 11y ago
      Not exactly. Years ago I used an app called LBE Privacy Guard with success, but it's closed-source and cannot be trusted with such a privileged level of access to my phone. Now I use a combination of blocking with the built-in app, running a custom ROM with root (which allows you to use many of the known privacy apps at their full potential), regularly changing my DeviceID with the help of yet another app and routing some of my device traffic through Tor via Orbot. It's definitely not perfect, but I feel like I'm at least partially thwarting the rampant collection/trade of my personal and private data. So, sorry I can't be of more help, but you really have to just dig in and read the fine print with this sort of thing. Many of the apps only work with specific versions of Android, require root, might require ROM patching, ect. YMMV, unfortunately. Good luck.
TeMPOraL 11y ago
The biggest problem with this I think is that it files in the face of the goals and incentives of all service providers. They want your personal data for marketing (not to mention engineering reasons like infrastructure optimizations), and they need your personal data because government. Some commenters mentioned that you can still get burner SIMs in Europe, but last time I checked it was incredibly hard anywhere in the world (maybe I don't know where to look) - even in China they want your official documents to sell you a prepaid card. The reason I always been told, that sounds plausible to me, is that easy access to burner phones leads to too much mess with criminals using them for their criminal things, and with random pranksters calling in fake bomb alerts.
- jessedhillon 11y ago
  When I was in Europe and Latin America both, I could buy SIMs by writing down whatever number I concocted for my DNI. Now, I actually wrote my passport number down but nobody really looked. One time I used my CA drivers licence, which could have been a Boy Scout troop membership card for all anyone cared.
  - e12e 11y ago
    Note that document forgery is a "real crime" most everywhere - so if you were caught (perhaps due to some unrelated investigation) - it might not be the best idea. I'm not saying you shouldn't break the law to preserver your anonymity (at your own discretion) -- I'm just saying it's something to take into consideration. If you for example fear that you might get dropped in a black site, fed polonium or pushed down some stairs over your on-line activities -- a little document forgery might be just the ticket.
- rizwank 11y ago
  Astonishingly simple in the states to get a SIM without an ID; a random exception.
- aianus 11y ago
  > it was incredibly hard anywhere in the world (maybe I don't know where to look) I was never asked for any sort of ID to get a SIM in Mexico or Vietnam. In any case, retail mobile store workers don't care enough / can't tell a real document from a fake one.
mindslight 11y ago
Computer + wifi hotspot is a strong local optimum. I started down this road, and ended up with a Samsung i9500 because I wanted something small enough to fit in my pocket (everything without a baseband was too big, or wicked old). Hotspot is from Freedompop - $4/mo is great for experimenting. I didn't have a clear direction after that, so I proceeded with the works-right-now solution of Google Hangouts (with all of its associated proctology). I haven't done much else with it besides backslide a bit by getting a cheap SIM so that it would ring reliably (Hangouts is a flaky POS). Location tracking is my biggest concern (Getting on the PSTN anonymously seems like a completely different problem, and I'm less interested in tackling it), but I don't see much way around it when you're using the cell network for backhaul. Unless you religiously shut off your wifi point, pay for a new wifi point + plan in cash every few weeks, and get enough people doing this that you can blend in. IMHO all of these guides that talk about prepaid sims and burner phones really only work for exceptional situations where someone is willing to jump through many opsec hoops. They aren't congruent with people's standard expectations of cell phones. Any solution has to roughly work with people's expectations to be adopted, since most people only casually want to defend their privacy. The proper privacy-preserving cell solution would use bearer tokens to pay for network access, and have no device identifier tokens. This is obviously a pipe dream. The only advance I see on the horizon is as more wifi points open up, ideally coupled with software control of your identifiable cell radio that would selectively allow tracking for checking in if it had been too long since seeing a wifi spot. Most people are probably only out of the range of wifi for an hour at most times, so if it was acceptable to delay reception of messages that long, a lot of every day privacy could be practically achieved. If you had $100M perhaps it would be possible to start a privacy-preserving MVNO with devices that shuffled identifying information every day.
- hackuser 11y ago
  > Location tracking is my biggest concern ... but I don't see much way around it when you're using the cell network for backhaul If the cellular provider doesn't know who you are, why does it matter if they track your location? Under my proposed plan, they won't know who you are because the prepaid cellular service is anonymous and all your data on the wire is encrypted and going to the same VPN host. > Getting on the PSTN anonymously seems like a completely different problem, and I'm less interested in solving it Is there a VOIP service that will take bitcoin or some other anonymous currency? The problem is that you have to give people your name and phone number (unless you do only outgoing calls); inevitably they will become associated in many databases.
galtwho 11y ago
To add, IMO there is a gap in the market for a dumb phone that can also act as a 4G router. I can then pair it with my tablet/iPod touch when I need to go online. But most times, I want to use the phone just to make/receive calls/text & have good battery. No need for a big display or other stuff.
simcop2387 11y ago
Android tablet with no baseband, e.g. a Nexus 9 for example. Freedom pop sells such a device permissions: Android Marshmallow has this bog standard, no root needed, so might have to watch to make sure it's available on whatever device you choose. voip: google voice/hangouts can make this possible, also skype, hangouts, and a number of others. VPN: basically anything android compatible. It's not a terribly convenient thing to initially setup but it's not difficult either anymore, I actually did this for a few months when I broke my phone and just decided to go all IP instead of buying a new phone (had the tablet, and the hotspot device, previous phone didn't have data). It worked well enough in the Los Angeles area, but outside a city it was basically non-functional. The other points about 911 and such are bigger issues than this.

dublinben 11y ago

There is a very thorough guide for achieving pretty much this from the Tor Project blog.[0] The most significant part in this process is completely separating the baseband from your user device. [0] https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy https://blog.torproject.org/blog/mission-impossible-hardenin...

superuser2 11y ago

VoIP calls over VPN over cellular data are likely to have extreme reliability, latency, and jitter problems.

hackuser 11y ago
I was wondering about that. * Regarding the VPN: Inevitably it adds an extra hop but with a VPN that provides sufficient bandwidth, low latency, and sufficient processing resources to decrypt/encrypt at wire speed -- I assume that either it will cost extra or will be something the user has to setup at a good hosting provider -- couldn't performance be sufficient for voice? IIRC, from long ago, voice needs ~80 Kbps. * Regarding cellular data: Cellular connections are very widely used for voice, of course. Cellular data connections are used now (e.g., VoLTE). On one hand I'd have the same doubts you do; on the other it seems to work. Aren't there already VOIP apps?
- e12e 11y ago
  "Uncompressed" voice "needs" 64kbps (hence ISDN was 2 voice channels etc). If you use a modern codec, you could probably get away with less, for high-quality mono voice. Note that you might not want to use VBR, for other reasons (I thought this was already submitted to hn - couldn't find it - so here's a fresh submission): "Attacks on packet length may be surprisingly good: Hookt on fon-iks": https://news.ycombinator.com/item?id=10462363 https://news.ycombinator.com/item?id=10462363 That said, I suspect that eg: Ogg Vorbis at 64kbs CBR would be fine for voice, assuming you could keep the latency down. Latency and drops would probably be the biggest issue. And you can of course prove, that latency sets a limit to the number of hops -- say if you'd want to hop through a European jurisdiction from the West Coast. I'm actually planning to (try to) move to a pure data-oriented (not sure if there will remain a cellular part, or if I'll just use wlan) (probably) SIP for all my phone needs. That'll probably involve a SIP server on dedicated (rented) hw in Germany, and VPN from the phone/laptop. Not quite sure yet if it'll work out, or if it'll be good enough.

joering2 11y ago

> prepaid so the provider doesn't need your personal info. I don't think this is possible in the USA anymore. I tried with ATT Verizon and Tmobile but I'm sure they are smaller players. All required somewhat my personal info altho for prepaid Tmobile did not ask for SSN. All told me this is due to the fact you're getting equipment "practically free". When offered to actually pay for it, I was always told "we don't have option like that". Europe is much simpler. I walked into Play store [1], put $60 on table, and got USB dongle with prepaid scratch card of 6GB on a 3G network. No IDs, no documentation, nothing. Refills are very simple - you purchase a scratch offs for 3/6/9 GB or more, over the counter, no ID required. [1] http://www.play.pl http://www.play.pl

ltnately 11y ago
I think you can still get around that with some effort. In 2010, I purchased a dumb phone/sim card for use on a prepaid plan. At the time it was the only way to get onto a super cheap prepaid plan since they wouldn't sell you a sim/the plan directly. I then put the sim into my own purchased smart phones(multiple nexus devices and a one plus one). For convenience reasons, I refill my account online with a cc but I technically could simply buy the t-mobile refill cards for cash then activate the time on them. As far as I know, there's nothing stopping me from doing this fresh again with a new prepaid phone and then never associating my real identity in any way.
- exelius 11y ago
  They don't even need to; your telco can know your home address based on a week's worth of location data, and could likely determine more about you based on where you go to work, shop, etc. Humans are creatures of habit, so it's relatively easy to draw inferences from simple patterns (i.e. if you spend 6-8 hours in the same location every night, that's probably where you live.) All it takes is one time checking your e-mail from an IP address to forever link that IP address to you. Know enough IP addresses someone has connected from and you can come up with a pretty good picture of their friend circle, their movements, how old they probably are, etc. I work in the telecom industry, and this behavior exists because it's not explicitly illegal. This type of data mining is just scratching the surface of their capability -- turns out that a combination of about 30 seconds worth of data scraped off http traffic (not https, though even https can tell you something) and a location are enough to identify most individuals and link them to a profile in a DMP -- which can tell you all sorts of information like which products you've purchased recently (both online and in brick and mortar stores with a credit card), any relevant demographic information, and even what kind of porn you like. The real restraint on this has been in the use of this information. Marketers have been remarkably conservative in using this information; likely for fear of scaring off customers with "creepy" data. But rest assured they know more about you than you do yourself.

petra 11y ago

I think we should differentiate two things: First there's state level surveillance.It's a hard technical challenge and I'm not even sure those steps would help. Second , there's what this article talks about. Probably using VPN(and maybe some software that turns down 3G/4G connection unless it's strictly necessary) would neutralize most of this issue - because planting baseband malware and maybe risking exposure doesn't seems to be worth it just for ads.

hackuser 11y ago
> First there's state level surveillance.It's a hard technical challenge and I'm not even sure those steps would help. If the state is determined to track or identify the user, I agree this doesn't help. It might delay them a little. But I don't mind the state investigating people for legitimate reasons (e.g., under a warrant); I'm not trying to protect criminals. Also this won't protect people persecuted by repressive states - that's a very valuable goal, but outside the scope of this idea. For dragnet surveillance I suspect this would work, simply by adding enough complexity to the task that it's not worth it for one more data point among billions. Of course anyone could make a social graph based on my phone calls and learn a lot that way, but I don't think anonymous phone calls are possible. If I want to receive incoming calls then I have to give out my phone number; my name and number inevitably become associated. (I can think of a few weak solutions, such as having many phone numbers, but that's imperfect and impractical.)
- petra 11y ago
  The thing is: just by doing those thing - you mark yourself as a target(maybe worthy of deeper probing). And if everybody do so(hard to believe), the state, since it seem to really value dragnets - would play another move in this probably infinite cat and mouse game.

exelius 11y ago

The problem with all of this is that you would need to swap SIM cards on the cellular-wifi router almost every time you change locations -- and that's if you can even find a data vendor willing to sell you a prepaid data plan without a credit card on file. Practically, this solution you've come up with is too fragile to be relied upon. It's only secure if you can maintain this level of care with every operation you perform on the phone. This is why the NSA's data collection is so insidious -- it only takes one slip-up to connect everything you ever did anonymously to your "profile". With the type of data collection that is done today, it's nearly impossible to avoid unless you use the Internet in a very different way than the average person. Avoiding data collection through technical means is a futile exercise at this point -- if you object to the data collection, public policy is the best avenue to prevent it at this point.

hackuser 11y ago
> you would need to swap SIM cards on the cellular-wifi router almost every time you change locations Assuming the user can get an anonymous pre-paid service (which I agree isn't certain), why would they need to change SIMs? The cellular provider only sees an unknown person sending encrypted data to a VPN hosting service.
- Retric 11y ago
  Assuming there selling your home address to stores you visited. If you carry the same phone to the same house every day for a month they can guess your home address.(1) boom targeted direct mail. Let's take this a step further, they link your phone's location to when you leave the checkout line, now they know where you live and what your buying. (1) They may or may not be doing this, but at a technical level it would be easy.
  - seabee 11y ago
    Identifying home or work location is something Google Maps does for your convenience. It would be trivial for cell operators.
  - 11y ago

smpetrey 11y ago

Sounds great so far. There would have to be a temporary switch for 911 emergency calls from the user-endpoint. I have heard that VOIP services are not compatible with the phone/location trace programming necessary for emergency dispatch centers.

deckard1 11y ago
VoIP uses E911. Usually you pre-register your address with the VoIP service. But services with dedicated apps may pass along your GPS location today, I'm not too sure there.
- MichaelGG 11y ago
  There are ways to pass the coordinates in a VoIP 911 call. Unfortunately, these standards are designed by astronaut architects and are rather cumbersome. For instance, one uses MIME multipart bodies inside a SIP message. Which few systems handle properly (because it's such a bad idea and has no practical use cases). Instead of being engineers and saying "ok, well just throw in a header X-911Location" or something simple, they gotta make shit complicated. It's ridiculous. They also use this IETF designed address format. Which is rather ... comprehensive. All sorts of designation for streets and branches and so on. Except... none of the 911 systems actually use that. So they design this protocol with no care to how actual systems work. Or how actual street addresses in the US work. They basically made up their own idea of how address topographies could work. But I'm guessing some of the larger companies doing VoIP probably have it sorted (like when you do a VoIP call on T-Mobile and there's no GSM just WiFi).

dice 11y ago

>Android with per-app permissions controlled by user (e.g., user can enable/disable access to location data for particular apps). This could be a fork of Android or maybe there is security software that could be installed, such as on a rooted phone. This is a built-in feature in Marshmallow [0]. [0]: http://www.greenbot.com/article/2990078/android/how-to-toggle-app-permissions-in-android-marshmallow.html http://www.greenbot.com/article/2990078/android/how-to-toggl...

josh2600 11y ago
Doesn't solve the problem of the network reporting your location (disabling the baseband does, but operating system level permissions don't impact the network). I know that's outside the scope of your comment, but I wanted to point out that the baseband is not a thing the operating system really controls in any meaningful fashion.
nicholasjarnold 11y ago
Yes, one can limit some permissions, but there are others that vanilla Android will not allow one to block. For instance: Device ID. I don't have a complete list of the un-blockable permissions, but simply using Android's built-in functionality is not sufficient to block all identifiable data that your phone's apps leak.
- hackuser 11y ago
  > simply using Android's built-in functionality is not sufficient to block all identifiable data that your phone's apps leak Do you know happen to know a solution? I know there are many confidentiality utilities and Android forks which emphasize it, but I don't know enough to evaluate them.
  - nicholasjarnold 11y ago
    Not exactly. Years ago I used an app called LBE Privacy Guard with success, but it's closed-source and cannot be trusted with such a privileged level of access to my phone. Now I use a combination of blocking with the built-in app, running a custom ROM with root (which allows you to use many of the known privacy apps at their full potential), regularly changing my DeviceID with the help of yet another app and routing some of my device traffic through Tor via Orbot. It's definitely not perfect, but I feel like I'm at least partially thwarting the rampant collection/trade of my personal and private data. So, sorry I can't be of more help, but you really have to just dig in and read the fine print with this sort of thing. Many of the apps only work with specific versions of Android, require root, might require ROM patching, ect. YMMV, unfortunately. Good luck.

TeMPOraL 11y ago

The biggest problem with this I think is that it files in the face of the goals and incentives of all service providers. They want your personal data for marketing (not to mention engineering reasons like infrastructure optimizations), and they need your personal data because government. Some commenters mentioned that you can still get burner SIMs in Europe, but last time I checked it was incredibly hard anywhere in the world (maybe I don't know where to look) - even in China they want your official documents to sell you a prepaid card. The reason I always been told, that sounds plausible to me, is that easy access to burner phones leads to too much mess with criminals using them for their criminal things, and with random pranksters calling in fake bomb alerts.

jessedhillon 11y ago
When I was in Europe and Latin America both, I could buy SIMs by writing down whatever number I concocted for my DNI. Now, I actually wrote my passport number down but nobody really looked. One time I used my CA drivers licence, which could have been a Boy Scout troop membership card for all anyone cared.
- e12e 11y ago
  Note that document forgery is a "real crime" most everywhere - so if you were caught (perhaps due to some unrelated investigation) - it might not be the best idea. I'm not saying you shouldn't break the law to preserver your anonymity (at your own discretion) -- I'm just saying it's something to take into consideration. If you for example fear that you might get dropped in a black site, fed polonium or pushed down some stairs over your on-line activities -- a little document forgery might be just the ticket.
rizwank 11y ago
Astonishingly simple in the states to get a SIM without an ID; a random exception.
aianus 11y ago
> it was incredibly hard anywhere in the world (maybe I don't know where to look) I was never asked for any sort of ID to get a SIM in Mexico or Vietnam. In any case, retail mobile store workers don't care enough / can't tell a real document from a fake one.

mindslight 11y ago

Computer + wifi hotspot is a strong local optimum. I started down this road, and ended up with a Samsung i9500 because I wanted something small enough to fit in my pocket (everything without a baseband was too big, or wicked old). Hotspot is from Freedompop - $4/mo is great for experimenting. I didn't have a clear direction after that, so I proceeded with the works-right-now solution of Google Hangouts (with all of its associated proctology). I haven't done much else with it besides backslide a bit by getting a cheap SIM so that it would ring reliably (Hangouts is a flaky POS). Location tracking is my biggest concern (Getting on the PSTN anonymously seems like a completely different problem, and I'm less interested in tackling it), but I don't see much way around it when you're using the cell network for backhaul. Unless you religiously shut off your wifi point, pay for a new wifi point + plan in cash every few weeks, and get enough people doing this that you can blend in. IMHO all of these guides that talk about prepaid sims and burner phones really only work for exceptional situations where someone is willing to jump through many opsec hoops. They aren't congruent with people's standard expectations of cell phones. Any solution has to roughly work with people's expectations to be adopted, since most people only casually want to defend their privacy. The proper privacy-preserving cell solution would use bearer tokens to pay for network access, and have no device identifier tokens. This is obviously a pipe dream. The only advance I see on the horizon is as more wifi points open up, ideally coupled with software control of your identifiable cell radio that would selectively allow tracking for checking in if it had been too long since seeing a wifi spot. Most people are probably only out of the range of wifi for an hour at most times, so if it was acceptable to delay reception of messages that long, a lot of every day privacy could be practically achieved. If you had $100M perhaps it would be possible to start a privacy-preserving MVNO with devices that shuffled identifying information every day.

hackuser 11y ago
> Location tracking is my biggest concern ... but I don't see much way around it when you're using the cell network for backhaul If the cellular provider doesn't know who you are, why does it matter if they track your location? Under my proposed plan, they won't know who you are because the prepaid cellular service is anonymous and all your data on the wire is encrypted and going to the same VPN host. > Getting on the PSTN anonymously seems like a completely different problem, and I'm less interested in solving it Is there a VOIP service that will take bitcoin or some other anonymous currency? The problem is that you have to give people your name and phone number (unless you do only outgoing calls); inevitably they will become associated in many databases.

galtwho 11y ago

To add, IMO there is a gap in the market for a dumb phone that can also act as a 4G router. I can then pair it with my tablet/iPod touch when I need to go online. But most times, I want to use the phone just to make/receive calls/text & have good battery. No need for a big display or other stuff.

simcop2387 11y ago

Android tablet with no baseband, e.g. a Nexus 9 for example. Freedom pop sells such a device permissions: Android Marshmallow has this bog standard, no root needed, so might have to watch to make sure it's available on whatever device you choose. voip: google voice/hangouts can make this possible, also skype, hangouts, and a number of others. VPN: basically anything android compatible. It's not a terribly convenient thing to initially setup but it's not difficult either anymore, I actually did this for a few months when I broke my phone and just decided to go all IP instead of buying a new phone (had the tablet, and the hotspot device, previous phone didn't have data). It worked well enough in the Los Angeles area, but outside a city it was basically non-functional. The other points about 911 and such are bigger issues than this.