7 ms·

Monthly (daily?) reminder that you should use an app that encrypt your messages.

by Raphmedia 10y ago

Desustorm 10y ago
Would you count WhatsApp amongst that list of apps?
- Taek 10y ago
  I believe that WhatsApp would protect against this attack in particular, so it's at least an upgrade over the status quo. But you really want something like like Signal.
- milcron 10y ago
  Before they were bought by Facebook, maybe.
sschueller 10y ago
There are also apps that can tell you when you are connected to a new unknown tower.
- initram 10y ago
  Can you post some names and links? I'd like to check them out.
  - sschueller 10y ago
    SnoopSnitch is such an app: https://play.google.com/store/apps/details?id=de.srlabs.snoopsnitch&hl=en https://play.google.com/store/apps/details?id=de.srlabs.snoo...
- loeg 10y ago
  Any for iOS?
  - joecool1029 10y ago
    No, iOS has no way to expose the cellid information to the apps on phone. Well at least for non-jailbroken. Best you can do is \3001#12345#\ and memorize your regular cell information for areas you frequent. (NFC how to get asterisks to show on here, help is useless put them in where the backslashes are)
    - jrowley 10y ago
      That didn't work on my iphone on att. :(
      - joecool1029 10y ago
        It'll work, I just have no idea how to escape special characters here, see my parent.
        Pyxl101 10y ago
        Works on my phone. Reminds me of phreaking. What other secret codes are there like this? How did you come to learn about this one?
        shavingspiders 10y ago
        It's called USSD, there's a short list on Wikipedia. A lot of them are carrier dependant, and some carrier models of certain handsets will block some codes. https://en.wikipedia.org/wiki/Unstructured_Supplementary_Service_Data https://en.wikipedia.org/wiki/Unstructured_Supplementary_Ser...
        jamestnz 10y ago
        Not the OP, but I remember these codes from my first phone, a Nokia 5110. In addition to the already mentioned code of [STAR]3001#12345# there is also [STAR]#06# which will show your IMEI. There were plenty of others (including spelling out 'WARRANTY' to get the manufacture date of the phone) but I forgot most of them. Interestingly, on the iPhone, dialling anything of the format [STAR]# ...anything... # will cause the screen to go grey as if a separate app, then after a short delay tell you that your code was invalid.
- Tharkun 10y ago
  There aren't any that don't require rooted phones or specific hardware. So not at all practical.
strictnein 10y ago
Use Tor. Use Signal.
- striking 10y ago
  That won't protect your location and identity from constantly being leaked.
  - joecool1029 10y ago
    Don't use a phone then. Identifying information is being collected and stored by the carrier for at least a month, which can then be handed to regular law enforcement upon subpoena. Federal level likely doesn't even need due process. Moxie himself spoke about this in the past.
    - striking 10y ago
      I'm not talking about carriers identifying you, I'm talking about people intercepting your IMEI and phone number and being able to uniquely identify you wherever you go. People have been drone strike'd based on the location of their phones. Carriers being awful is a separate problem. My annoyance rests with the 2G protocol being awful.
      - dom0 10y ago
        At least in the past anyone with SS7 access could already do that based on either of those identifiers. Phones, especially smartphones, are pocket spies. If you need privacy, don't take them with you!* There is no such thing as a privacy smartphone. * Honestly if you want a private conversation don't have any kind of phone or laptop in the same room.
        striking 10y ago
        I get that, and carriers are definitely stupid. But preventing people from gaining SS7 access is much easier than fixing a broken protocol in use by many devices. Blocking SS7 access is something carriers can do. Fixing 2G is just not possible, and anyone can break it, right at this very moment, with a tiny bit of hardware.
stanleydrew 10y ago
This is good advice, but I'd like to point out that you could avoid the surveillance revealed in this project by simply using anything other than default SMS.
- digi_owl 10y ago
  Would be interesting to deploy an app that can send encrypted/signed SMS. It would likely spike your messaging bill thought, as fitting all that in 140 would be hard, resulting in multiple SMSs going out pr message sent.
  - joecool1029 10y ago
    It was done before. See Signal's predecessor, Textsecure (before they added Signal protocol, pre-2.7.0). If I recall it limited encrypted messages to 60 characters before splitting. It was also annoying in that you needed to initiate an OTR handshake to start messaging.
    - digi_owl 10y ago
      That handshake, or the initial exchange of public keys, is the one thing that seems to stymie general adoption of encryption for personal communication.
      - joecool1029 10y ago
        Current Signal fortunately doesn't make this apparent to the end user, it's install and go message whomever advertises support. I'm ditching Pidgin-OTR today actually because of the OTR usability issues needing to handshake on every laptop restart. Will be going over to bitlbee terminating OTR on a server and then accessing my ZNC supporting push through TLS. Much less jarring. OMEMO would be better than OTR for this, but not much supports it yet.
sliverstorm 10y ago
If only there was some robust, open, mature protocol supported by every device on the planet that supported encrypted sessions using an open, mature form of encryption.

Monthly (daily?) reminder that you should use an app that encrypt your messages.

Desustorm 10y ago

Would you count WhatsApp amongst that list of apps?

Taek 10y ago
I believe that WhatsApp would protect against this attack in particular, so it's at least an upgrade over the status quo. But you really want something like like Signal.
milcron 10y ago
Before they were bought by Facebook, maybe.

sschueller 10y ago

There are also apps that can tell you when you are connected to a new unknown tower.

initram 10y ago
Can you post some names and links? I'd like to check them out.
- sschueller 10y ago
  SnoopSnitch is such an app: https://play.google.com/store/apps/details?id=de.srlabs.snoopsnitch&hl=en https://play.google.com/store/apps/details?id=de.srlabs.snoo...
loeg 10y ago
Any for iOS?
- joecool1029 10y ago
  No, iOS has no way to expose the cellid information to the apps on phone. Well at least for non-jailbroken. Best you can do is \3001#12345#\ and memorize your regular cell information for areas you frequent. (NFC how to get asterisks to show on here, help is useless put them in where the backslashes are)
  - jrowley 10y ago
    That didn't work on my iphone on att. :(
    - joecool1029 10y ago
      It'll work, I just have no idea how to escape special characters here, see my parent.
      - Pyxl101 10y ago
        Works on my phone. Reminds me of phreaking. What other secret codes are there like this? How did you come to learn about this one?
        shavingspiders 10y ago
        It's called USSD, there's a short list on Wikipedia. A lot of them are carrier dependant, and some carrier models of certain handsets will block some codes. https://en.wikipedia.org/wiki/Unstructured_Supplementary_Service_Data https://en.wikipedia.org/wiki/Unstructured_Supplementary_Ser...
        jamestnz 10y ago
        Not the OP, but I remember these codes from my first phone, a Nokia 5110. In addition to the already mentioned code of [STAR]3001#12345# there is also [STAR]#06# which will show your IMEI. There were plenty of others (including spelling out 'WARRANTY' to get the manufacture date of the phone) but I forgot most of them. Interestingly, on the iPhone, dialling anything of the format [STAR]# ...anything... # will cause the screen to go grey as if a separate app, then after a short delay tell you that your code was invalid.
Tharkun 10y ago
There aren't any that don't require rooted phones or specific hardware. So not at all practical.

strictnein 10y ago

Use Tor. Use Signal.

striking 10y ago
That won't protect your location and identity from constantly being leaked.
- joecool1029 10y ago
  Don't use a phone then. Identifying information is being collected and stored by the carrier for at least a month, which can then be handed to regular law enforcement upon subpoena. Federal level likely doesn't even need due process. Moxie himself spoke about this in the past.
  - striking 10y ago
    I'm not talking about carriers identifying you, I'm talking about people intercepting your IMEI and phone number and being able to uniquely identify you wherever you go. People have been drone strike'd based on the location of their phones. Carriers being awful is a separate problem. My annoyance rests with the 2G protocol being awful.
    - dom0 10y ago
      At least in the past anyone with SS7 access could already do that based on either of those identifiers. Phones, especially smartphones, are pocket spies. If you need privacy, don't take them with you!* There is no such thing as a privacy smartphone. * Honestly if you want a private conversation don't have any kind of phone or laptop in the same room.
      - striking 10y ago
        I get that, and carriers are definitely stupid. But preventing people from gaining SS7 access is much easier than fixing a broken protocol in use by many devices. Blocking SS7 access is something carriers can do. Fixing 2G is just not possible, and anyone can break it, right at this very moment, with a tiny bit of hardware.

stanleydrew 10y ago

This is good advice, but I'd like to point out that you could avoid the surveillance revealed in this project by simply using anything other than default SMS.

digi_owl 10y ago
Would be interesting to deploy an app that can send encrypted/signed SMS. It would likely spike your messaging bill thought, as fitting all that in 140 would be hard, resulting in multiple SMSs going out pr message sent.
- joecool1029 10y ago
  It was done before. See Signal's predecessor, Textsecure (before they added Signal protocol, pre-2.7.0). If I recall it limited encrypted messages to 60 characters before splitting. It was also annoying in that you needed to initiate an OTR handshake to start messaging.
  - digi_owl 10y ago
    That handshake, or the initial exchange of public keys, is the one thing that seems to stymie general adoption of encryption for personal communication.
    - joecool1029 10y ago
      Current Signal fortunately doesn't make this apparent to the end user, it's install and go message whomever advertises support. I'm ditching Pidgin-OTR today actually because of the OTR usability issues needing to handshake on every laptop restart. Will be going over to bitlbee terminating OTR on a server and then accessing my ZNC supporting push through TLS. Much less jarring. OMEMO would be better than OTR for this, but not much supports it yet.

sliverstorm 10y ago

If only there was some robust, open, mature protocol supported by every device on the planet that supported encrypted sessions using an open, mature form of encryption.