5 ms·

Seems like a strong case for encryption. Why is it even possible for these devices to read your info?

afshin 7y ago
Encryption does not fix this completely even if you assume all texts and voice calls are encrypted. The metadata is equally important: - your location in time and space - the numbers you contacted - the duration of contact
- ikeboy 7y ago
  Metadata is useful but it's a stretch to call it equally important as actual call content. If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls?
  - michaelt 7y ago
    If I had a choice between a full recording of all their phone calls, or a trace of their movement with 50 meter precision? Good chance I'd go for the second one to be honest - unless I knew for sure they made a lot of voice calls.
  - desertrider12 7y ago
    Metadata from one person isn't worth anything, but the graph of who's contacting who is very useful. Plus, it's computationally feasible to do that graph analysis on everyone, while listening to every call wouldn't be.
  - ceejayoz 7y ago
    > If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls? That depends entirely on the purpose of the spying. If you're spying with a goal of assassination, the location data from their morning commute might be far more valuable.
mirimir 7y ago
Because phones are totally insecure. The only secure option is using an external WiFi or cellular data router for Internet connectivity. The router can of course be geolocated. And adversaries may gain some access. But it should be possible to prevent access through it to the phone. That is, it's a firewall. Then do end-to-end encrypted Internet stuff, messaging and VoIP. And by using some mix of VPNs and Tor, adversaries won't even see most metadata. Except for communication timing, of course. See https://blog.torproject.org/mission-improbable-hardening-android-security-and-privacy https://blog.torproject.org/mission-improbable-hardening-and... Edit: But this still doesn't protect from some third party with root rights on the phone. For Android, the Copperhead OS might be enough. But I don't know enough to know. And for iOS, I suspect that you're stuck trusting Apple.
- judge2020 7y ago
  iOS's only security issue is users not updating and being vulnerable to well known vulnerabilities. Neither iOS nor Android will survive a truly targeted nation state attack, but for most people 0-days aren't worth protecting against. The only exception to this is the checkm8 vulnerability, which can be performed on an A11 and older chips (so iPhone XR/XS/XS+ and 11/11 pro/11 pro max aren't vulnerable) from DFU mode, which doesn't need the device passcode.
  - mirimir 7y ago
    Right. I guess that phones can't update without direct cellular or WiFi connectivity. But I don't know. Is that true? Could one somehow enable updates through pure TCP/IP?
    - Retric 7y ago
      You can update iOS devices through iTunes via USB, or buy an ethernet adapter.
      - mirimir 7y ago
        Cool. So you could take the phone/tablet totally offline, except for external router via USB. Maybe same for Android? Except that you'd arguably want to update it locally with the Copperhead OS.
Kalium 7y ago
One of the key functions of a cell tower is to know what devices are connecting to it. This is important information for things like routing calls, delivering messages, etc. As you say, all of that can and should be encrypted. With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable part of how cellular devices work. Inbound / outbound numbers are something that has to be available for similar reasons. There's also clear legal precedent making those accessible to law enforcement and not requiring a warrant. There's little to be gained by trying to encrypt them, even if it was possible. Call and text comments are the things here that can be encrypted. It's not something the phone companies are in a rush to do.
- schoen 7y ago
  > With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable part of how cellular devices work. The comment from mirimir elsewhere in this thread reminds me that this is kind of an overstatement, or at least that the details are complicated. You could gain a lot of privacy in this regard by separating mobile data services from telephony and identity. For example, you could imagine paying for mobile data anonymously, either using existing prepaid mobile data services or using a hypothetical future service with blinded payment tokens and only extremely-ephemeral device identifiers. Then you could imagine getting all of your identity and communications services from someone totally independent of your mobile data provider. If the mobile data provider cooperated with your application-layer communications service provider more than you wanted, you could try to create your own service instead, or try to route at least the messaging setup part of the process via Tor or other proxies, so that the mobile data operator and application-layer intermediaries didn't even know about the connection. I'm not sure anyone other than privacy advocates would consider this progress relative to the current situation; certainly carriers and governments would like it a lot less (it might already be illegal in some jurisdictions in various ways), and most users would probably find that it increased cost while decreasing reliability and usability of some services. It could also make it harder to use the network to investigate or deter device theft, as well as harder to investigate application-layer fraud and account hijacking. To be clear about what could change, it's true that towers will always know which devices are connecting to them at a particular moment, but this could in principle be separated from billing, identity, and any kind of persistent identifier. So they don't have to know that a particular device is being used by you, or that a particular device is being used by the same person who uses a particular application-layer identity. The other problem in trying to get there right now without carriers' and governments' cooperation is that, since you can't rotate hardware identifiers on GSM interfaces, a carrier can see your movement patterns for the lifetime of your use of a particular device, and can probably determine that those movement patterns are similar enough to another device's movements that they're probably used by the same person. Sometime I hope to write a long article on possible non-metadata-collecting mobile communications futures. It's a really interesting topic.
softwaredoug 7y ago
It’s actually more a case for authentication. Why don’t our phones authenticate cell towers when connecting to them? Why are providers so lax at enforcing that?
- dahfizz 7y ago
  Because then stingrays wouldn't work. Cellular carriers are much more beholden to the government than to the very small subset of users who knows what "authenticate with the cell tower" even means.
- jellicle 7y ago
  Even if your phone insisted that each cell tower authenticate itself as an authentic Verizon Tower(TM), then Verizon would just provide 500 extra authentic tower keys to various police agencies for their use. shrug emoji You can't trust cell companies to help you against the government.
  - gruez 7y ago
    >then Verizon would just provide 500 extra authentic tower keys to various police agencies for their use. shrug emoji I don't buy this reasoning. It suggests that cell companies will roll over to any law enforcement demands. If that's the case, why don't law enforcement ask cell companies for their cell tower logs directly? Why spend thousands of dollars on equipment when the same information is an email away?
jniedrauer 7y ago
As I understand it, cellphone infrastructure is intentionally simplistic so that it works the same everywhere. If the US implemented some kind of end to end encryption or authentication, Canada might not, and then everyone who crosses the border would have a brick.
- Spooky23 7y ago
  It’s designed to minimize billing issues. User privacy or in transit security aren’t significant business requirements.
capitalsigma 7y ago
Seems like a strong case for making all of your phone calls over an encrypted VoIP channel.

Encryption does not fix this completely even if you assume all texts and voice calls are encrypted. The metadata is equally important: - your location in time and space - the numbers you contacted - the duration of contact

ikeboy 7y ago
Metadata is useful but it's a stretch to call it equally important as actual call content. If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls?
- michaelt 7y ago
  If I had a choice between a full recording of all their phone calls, or a trace of their movement with 50 meter precision? Good chance I'd go for the second one to be honest - unless I knew for sure they made a lot of voice calls.
- desertrider12 7y ago
  Metadata from one person isn't worth anything, but the graph of who's contacting who is very useful. Plus, it's computationally feasible to do that graph analysis on everyone, while listening to every call wouldn't be.
- ceejayoz 7y ago
  > If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls? That depends entirely on the purpose of the spying. If you're spying with a goal of assassination, the location data from their morning commute might be far more valuable.

mirimir 7y ago

Because phones are totally insecure. The only secure option is using an external WiFi or cellular data router for Internet connectivity. The router can of course be geolocated. And adversaries may gain some access. But it should be possible to prevent access through it to the phone. That is, it's a firewall. Then do end-to-end encrypted Internet stuff, messaging and VoIP. And by using some mix of VPNs and Tor, adversaries won't even see most metadata. Except for communication timing, of course. See https://blog.torproject.org/mission-improbable-hardening-android-security-and-privacy https://blog.torproject.org/mission-improbable-hardening-and... Edit: But this still doesn't protect from some third party with root rights on the phone. For Android, the Copperhead OS might be enough. But I don't know enough to know. And for iOS, I suspect that you're stuck trusting Apple.

judge2020 7y ago
iOS's only security issue is users not updating and being vulnerable to well known vulnerabilities. Neither iOS nor Android will survive a truly targeted nation state attack, but for most people 0-days aren't worth protecting against. The only exception to this is the checkm8 vulnerability, which can be performed on an A11 and older chips (so iPhone XR/XS/XS+ and 11/11 pro/11 pro max aren't vulnerable) from DFU mode, which doesn't need the device passcode.
- mirimir 7y ago
  Right. I guess that phones can't update without direct cellular or WiFi connectivity. But I don't know. Is that true? Could one somehow enable updates through pure TCP/IP?
  - Retric 7y ago
    You can update iOS devices through iTunes via USB, or buy an ethernet adapter.
    - mirimir 7y ago
      Cool. So you could take the phone/tablet totally offline, except for external router via USB. Maybe same for Android? Except that you'd arguably want to update it locally with the Copperhead OS.

Kalium 7y ago

One of the key functions of a cell tower is to know what devices are connecting to it. This is important information for things like routing calls, delivering messages, etc. As you say, all of that can and should be encrypted. With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable part of how cellular devices work. Inbound / outbound numbers are something that has to be available for similar reasons. There's also clear legal precedent making those accessible to law enforcement and not requiring a warrant. There's little to be gained by trying to encrypt them, even if it was possible. Call and text comments are the things here that can be encrypted. It's not something the phone companies are in a rush to do.

schoen 7y ago
> With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable part of how cellular devices work. The comment from mirimir elsewhere in this thread reminds me that this is kind of an overstatement, or at least that the details are complicated. You could gain a lot of privacy in this regard by separating mobile data services from telephony and identity. For example, you could imagine paying for mobile data anonymously, either using existing prepaid mobile data services or using a hypothetical future service with blinded payment tokens and only extremely-ephemeral device identifiers. Then you could imagine getting all of your identity and communications services from someone totally independent of your mobile data provider. If the mobile data provider cooperated with your application-layer communications service provider more than you wanted, you could try to create your own service instead, or try to route at least the messaging setup part of the process via Tor or other proxies, so that the mobile data operator and application-layer intermediaries didn't even know about the connection. I'm not sure anyone other than privacy advocates would consider this progress relative to the current situation; certainly carriers and governments would like it a lot less (it might already be illegal in some jurisdictions in various ways), and most users would probably find that it increased cost while decreasing reliability and usability of some services. It could also make it harder to use the network to investigate or deter device theft, as well as harder to investigate application-layer fraud and account hijacking. To be clear about what could change, it's true that towers will always know which devices are connecting to them at a particular moment, but this could in principle be separated from billing, identity, and any kind of persistent identifier. So they don't have to know that a particular device is being used by you, or that a particular device is being used by the same person who uses a particular application-layer identity. The other problem in trying to get there right now without carriers' and governments' cooperation is that, since you can't rotate hardware identifiers on GSM interfaces, a carrier can see your movement patterns for the lifetime of your use of a particular device, and can probably determine that those movement patterns are similar enough to another device's movements that they're probably used by the same person. Sometime I hope to write a long article on possible non-metadata-collecting mobile communications futures. It's a really interesting topic.

softwaredoug 7y ago

It’s actually more a case for authentication. Why don’t our phones authenticate cell towers when connecting to them? Why are providers so lax at enforcing that?

dahfizz 7y ago
Because then stingrays wouldn't work. Cellular carriers are much more beholden to the government than to the very small subset of users who knows what "authenticate with the cell tower" even means.
jellicle 7y ago
Even if your phone insisted that each cell tower authenticate itself as an authentic Verizon Tower(TM), then Verizon would just provide 500 extra authentic tower keys to various police agencies for their use. shrug emoji You can't trust cell companies to help you against the government.
- gruez 7y ago
  >then Verizon would just provide 500 extra authentic tower keys to various police agencies for their use. shrug emoji I don't buy this reasoning. It suggests that cell companies will roll over to any law enforcement demands. If that's the case, why don't law enforcement ask cell companies for their cell tower logs directly? Why spend thousands of dollars on equipment when the same information is an email away?

jniedrauer 7y ago

As I understand it, cellphone infrastructure is intentionally simplistic so that it works the same everywhere. If the US implemented some kind of end to end encryption or authentication, Canada might not, and then everyone who crosses the border would have a brick.

Spooky23 7y ago
It’s designed to minimize billing issues. User privacy or in transit security aren’t significant business requirements.

capitalsigma 7y ago

Seems like a strong case for making all of your phone calls over an encrypted VoIP channel.