7 ms·

This is a problem with the GSM/UMTS standards themselves. Carriers always know where you are, but one could create a standard where they wouldn't have to know u

by Darthy 8y ago

This is a problem with the GSM/UMTS standards themselves. Carriers always know where you are, but one could create a standard where they wouldn't have to know unless you make a call. With enough encryption and effort, I'm pretty sure one could even create a standard where carriers would never know where you are, even while you are using services.

sp332 8y ago
They have to know your location if you want to receive a call.
- jakeogh 8y ago
  With the current setup, sure, but that's by design. The cellular modem could stay off until you decided to take the call if there was a nationwide page circuit listening, the user would get the ring, see the number the page sent, and if desired, answer, which powers on the modem, hits a tower and connects to a backend system that sent the page which took the incoming call. Page messages are in-the clear, but that's fixable by (gasp) OTP.
  - sp332 8y ago
    You want every single cell phone call in the world to send out a signal over every single cell tower?
    - mdhardeman 8y ago
      No. But at a certain point, with the high speed modulations we have today, it is totally feasible to broadcast these passively to a multi-state region encompassing a radius of hundreds of miles. There's not a legitimate engineering reason that the network needs to maintain constant fine-grained location data for each registered device at this point. The scope of the registration can be far more widely cast. This would even have upsides for the devices and users. As check-ins to the network in which the device must transmit to the network would be far reduced, battery life improvements can be had. Yes, this increases the amount of "broadcast" traffic, but honestly, even for some of the busiest telco switches in New York or LA, those data streams don't even approach the throughput requirements of a single HD Youtube stream...
    - jakeogh 8y ago
      /napkin overestimate using US 6B/calls/day with a nationwide 256B packet each, that's roughly a 100Mbps broadcast channel, which is ~5 digital TV channels, or one geostationary satellite's half-duplex bandwidth if it could see the entire US. As mdhardeman points out, it's easier than that, and there is plenty of room for re-transmission. What is the passive bitrate of a tower->cell connection? LTE/GSM whatever.
      - sp332 8y ago
        With everyone's phones receiving and parsing that, batteries would die very quickly.
        jakeogh 8y ago
        Pagers parse every single page. They only alert you when it's to your address. /napkin is just that, if you designed the protocol this would be very doable. The receiver can passively listen quite cheaply energy wise. This is nothing like decoding a video stream.
        facetube 8y ago
        And ethernet and 802.11 receive every frame, whether it's addressed to the equipment or not.
droopybuns 8y ago
How does one determine which tower to route an incoming call through, in your model? How could roaming work? Spoiler: I don’t think doing what you are describing is feasible.
- awelkie 8y ago
  Calls could be done over IP, and as long as you could anonymously authenticate to the tower then you could be granted a new IP address at each tower via something like DHCP. I imagine roaming and handovers would have to be done on the end-device though; the end-device would need to proactively associate to new towers and both ends of the voice call would need to agree to switch to the new IP address. But if the tower operators collude then they can still track you across towers by localizing the physical source of the end-device's signal.
  - ethbro 8y ago
    If you really wanted to do this, a more secure approach is onion routing. It's essentially the same problem -- attempting to preserve anonymity in the face of adversarial network hardware, while being limited by a requirement to enter / exit through certain nodes. So you'd want a mesh network, formed adhoc out of currently in range cellular device neighbors, with packets re-encapsulated and encrypted at each hop, eventually hitting the tower from a random device. Authorization would be impossible (the intent of the scheme) without a side channel (as you can't simultaneously have individual authorization and individual anonymization). Which makes it a non-starter for commercial use.
    - awelkie 8y ago
      Oh yeah, that's an interesting solution. I'm not sure simultaneous authorization and anonymization is impossible. Couldn't you use something like Chaum's e-cash to obtain tokens that guarantee the holder the right to use the network for some amount of data, but these tokens are tradeable and therefore the spender doesn't have to be the same as the buyer. Then you could spend this token in the network to get access and the network could authenticate the token without identifying the spender. I'm guessing something like zcash could be used as well...
codedokode 8y ago
Would not it be easier to ban anyone from using this location data for anything except explicitly permitted by law? The problem is not with standards, the problem is with people.
- Daycrawler 8y ago
  Banning things works relatively well for people because they fear having trouble with law and justice. Doesn't work that well for corporations whose law department is just like any other department. In this case you must assume that if it's technically possible then it's done.
  - codedokode 8y ago
    This argument can be used against any law, like antitrust law. Having a law department doesn't give you a free pass to break laws.
    - monetus 8y ago
      Maybe not, but when the cost of breaking the law is less than the gain, it seems logical. A law department is probably better equipped to make that calculation. edit: Reading into the context of 'too big to fail' and 'collateral consequences' reveals exactly that kind of behavior.
    - brewdad 8y ago
      Unless we start throwing the legal department and higher ups into prison then it basically becomes a free pass to break laws. Currently, we assess fines to corporations that violate these laws. It then becomes a cost/benefit analysis weighing the likelihood of getting caught * cost of potential fine vs business value of ignoring the law. Ignoring the law is frequently the correct decision.
      - pteredactyl 8y ago
        Agreed. There needs to be criminal liability for folks like Stumpf and other big bankers/corporate overlords. But do you think our government will ever stand up? Doubtful
Gaelan 8y ago
> where they wouldn't have to know unless you make a call Presumably this is actually "unless you make a call or use data"?

by Darthy 8y ago

sp332 8y ago

They have to know your location if you want to receive a call.

jakeogh 8y ago
With the current setup, sure, but that's by design. The cellular modem could stay off until you decided to take the call if there was a nationwide page circuit listening, the user would get the ring, see the number the page sent, and if desired, answer, which powers on the modem, hits a tower and connects to a backend system that sent the page which took the incoming call. Page messages are in-the clear, but that's fixable by (gasp) OTP.
- sp332 8y ago
  You want every single cell phone call in the world to send out a signal over every single cell tower?
  - mdhardeman 8y ago
    No. But at a certain point, with the high speed modulations we have today, it is totally feasible to broadcast these passively to a multi-state region encompassing a radius of hundreds of miles. There's not a legitimate engineering reason that the network needs to maintain constant fine-grained location data for each registered device at this point. The scope of the registration can be far more widely cast. This would even have upsides for the devices and users. As check-ins to the network in which the device must transmit to the network would be far reduced, battery life improvements can be had. Yes, this increases the amount of "broadcast" traffic, but honestly, even for some of the busiest telco switches in New York or LA, those data streams don't even approach the throughput requirements of a single HD Youtube stream...
  - jakeogh 8y ago
    /napkin overestimate using US 6B/calls/day with a nationwide 256B packet each, that's roughly a 100Mbps broadcast channel, which is ~5 digital TV channels, or one geostationary satellite's half-duplex bandwidth if it could see the entire US. As mdhardeman points out, it's easier than that, and there is plenty of room for re-transmission. What is the passive bitrate of a tower->cell connection? LTE/GSM whatever.
    - sp332 8y ago
      With everyone's phones receiving and parsing that, batteries would die very quickly.
      - jakeogh 8y ago
        Pagers parse every single page. They only alert you when it's to your address. /napkin is just that, if you designed the protocol this would be very doable. The receiver can passively listen quite cheaply energy wise. This is nothing like decoding a video stream.
        facetube 8y ago
        And ethernet and 802.11 receive every frame, whether it's addressed to the equipment or not.

droopybuns 8y ago

How does one determine which tower to route an incoming call through, in your model? How could roaming work? Spoiler: I don’t think doing what you are describing is feasible.

awelkie 8y ago
Calls could be done over IP, and as long as you could anonymously authenticate to the tower then you could be granted a new IP address at each tower via something like DHCP. I imagine roaming and handovers would have to be done on the end-device though; the end-device would need to proactively associate to new towers and both ends of the voice call would need to agree to switch to the new IP address. But if the tower operators collude then they can still track you across towers by localizing the physical source of the end-device's signal.
- ethbro 8y ago
  If you really wanted to do this, a more secure approach is onion routing. It's essentially the same problem -- attempting to preserve anonymity in the face of adversarial network hardware, while being limited by a requirement to enter / exit through certain nodes. So you'd want a mesh network, formed adhoc out of currently in range cellular device neighbors, with packets re-encapsulated and encrypted at each hop, eventually hitting the tower from a random device. Authorization would be impossible (the intent of the scheme) without a side channel (as you can't simultaneously have individual authorization and individual anonymization). Which makes it a non-starter for commercial use.
  - awelkie 8y ago
    Oh yeah, that's an interesting solution. I'm not sure simultaneous authorization and anonymization is impossible. Couldn't you use something like Chaum's e-cash to obtain tokens that guarantee the holder the right to use the network for some amount of data, but these tokens are tradeable and therefore the spender doesn't have to be the same as the buyer. Then you could spend this token in the network to get access and the network could authenticate the token without identifying the spender. I'm guessing something like zcash could be used as well...

codedokode 8y ago

Would not it be easier to ban anyone from using this location data for anything except explicitly permitted by law? The problem is not with standards, the problem is with people.

Daycrawler 8y ago
Banning things works relatively well for people because they fear having trouble with law and justice. Doesn't work that well for corporations whose law department is just like any other department. In this case you must assume that if it's technically possible then it's done.
- codedokode 8y ago
  This argument can be used against any law, like antitrust law. Having a law department doesn't give you a free pass to break laws.
  - monetus 8y ago
    Maybe not, but when the cost of breaking the law is less than the gain, it seems logical. A law department is probably better equipped to make that calculation. edit: Reading into the context of 'too big to fail' and 'collateral consequences' reveals exactly that kind of behavior.
  - brewdad 8y ago
    Unless we start throwing the legal department and higher ups into prison then it basically becomes a free pass to break laws. Currently, we assess fines to corporations that violate these laws. It then becomes a cost/benefit analysis weighing the likelihood of getting caught * cost of potential fine vs business value of ignoring the law. Ignoring the law is frequently the correct decision.
    - pteredactyl 8y ago
      Agreed. There needs to be criminal liability for folks like Stumpf and other big bankers/corporate overlords. But do you think our government will ever stand up? Doubtful

Gaelan 8y ago

> where they wouldn't have to know unless you make a call Presumably this is actually "unless you make a call or use data"?