3 ms·

Agreed, but it can be done at higher layers. Just use some secure app instead of SMS and phone calls. The carrier should not be able to know much about you, ex

Agreed, but it can be done at higher layers. Just use some secure app instead of SMS and phone calls. The carrier should not be able to know much about you, except some vague metadata (an histogram of the amount of data you exchanged with some IPs.)

bdamm 8y ago
This is a common and incorrect misconception. The network needs security, as does the applications running on it. These are different security layers, and cannot be provided together. With an insecure network, even if your applications are secure, then bad actors (government, company, whoever) have a much easier time attacking your phone directly. Perfectly secure applications and an insecure network leaves your phone open to attack from nearby radios. If we assume your applications are all perfectly secure, and your phone software and hardware are also all perfectly secure, then that leaves abuse of the network as a tool to affect denial of service, spying on presence meta-data, and not limited to the carrier. But of course there are no perfectly secure applications, nor any perfectly secure phones. So keep in mind that the weak network greatly expands the attack surface from which bad actors can mess with your phone. This isn't a problem solved with layer-7 security.
- kstenerud 8y ago
  Since the infrastructure is beholden to governments, one must assume that the data link layer is compromised.
shittyadmin 8y ago
> The carrier should not be able to know much about you, except some vague metadata (an histogram of the amount of data you exchanged with some IPs.) And your approximate location at all times due to their triangulation capabilities. Not much you can do about that one though.
gruez 8y ago
>Agreed, but it can be done at higher layers. Just use some secure app instead of SMS and phone calls. But then you lose the whole network of SMS/phone numbers. You can probably get all your friends & family to contact you using whatsapp/fb messenger (or if you try really hard, signal), but good luck convincing your bank. Your phone calls with your bank/broker probably contains more sensitive information than your phone call with your friends/family.
est31 8y ago
I know we live in the app age now but apps don't have many of the properties that SMS and phone calls have, including that they aren't federated and typically disallow alternative clients. Due to this, you can't just use some secure app, but you have to use the app that the people you want to stay in touch with use. For SMSs you have a very wide choice of frontends. I'm already using non-SMS apps but I'd love them to become more like SMSs: federated and with free client choice. Edited to add: Also, as long as phone calls and SMS are around and used we should strive to work to make them more secure.

bdamm 8y ago

This is a common and incorrect misconception. The network needs security, as does the applications running on it. These are different security layers, and cannot be provided together. With an insecure network, even if your applications are secure, then bad actors (government, company, whoever) have a much easier time attacking your phone directly. Perfectly secure applications and an insecure network leaves your phone open to attack from nearby radios. If we assume your applications are all perfectly secure, and your phone software and hardware are also all perfectly secure, then that leaves abuse of the network as a tool to affect denial of service, spying on presence meta-data, and not limited to the carrier. But of course there are no perfectly secure applications, nor any perfectly secure phones. So keep in mind that the weak network greatly expands the attack surface from which bad actors can mess with your phone. This isn't a problem solved with layer-7 security.

kstenerud 8y ago
Since the infrastructure is beholden to governments, one must assume that the data link layer is compromised.

shittyadmin 8y ago

> The carrier should not be able to know much about you, except some vague metadata (an histogram of the amount of data you exchanged with some IPs.) And your approximate location at all times due to their triangulation capabilities. Not much you can do about that one though.

gruez 8y ago

>Agreed, but it can be done at higher layers. Just use some secure app instead of SMS and phone calls. But then you lose the whole network of SMS/phone numbers. You can probably get all your friends & family to contact you using whatsapp/fb messenger (or if you try really hard, signal), but good luck convincing your bank. Your phone calls with your bank/broker probably contains more sensitive information than your phone call with your friends/family.

est31 8y ago

I know we live in the app age now but apps don't have many of the properties that SMS and phone calls have, including that they aren't federated and typically disallow alternative clients. Due to this, you can't just use some secure app, but you have to use the app that the people you want to stay in touch with use. For SMSs you have a very wide choice of frontends. I'm already using non-SMS apps but I'd love them to become more like SMSs: federated and with free client choice. Edited to add: Also, as long as phone calls and SMS are around and used we should strive to work to make them more secure.