11 ms·
NSA's Tips to Keep Your Phone from Tracking You
- sawaruna 6y ago>Also important to remember is that GPS is not the same as location services. Even if GPS and cellular data are unavailable, a mobile device calculates location using Wi-Fi and/or BT. Apps and websites can also use other sensor data (that does not require user permission) and web browser information to obtain or infer location information. Wondering what kind of sensory data they meant here, I had a look at the citation[0]. If anyone else is curious: >We describe PinMe, a novel user-location mechanism that exploits non-sensory/sensory data stored on the smartphone, e.g., the environment’s air pressure and device’s timezone, along with publicly-available auxiliary information, e.g., elevation maps, to estimate the user’s location when all location services, e.g., GPS, are turned off. Unlike previously- proposed attacks, PinMe neither requires any prior knowledge about the user nor a training dataset on specific routes. We demonstrate that PinMe can accurately estimate the user’s location during four activities (walking, traveling on a train, driving, and traveling on a plane). [0] https://arxiv.org/abs/1802.01468 https://arxiv.org/abs/1802.01468
- ourmandave 6y agoWe demonstrate that PinMe can accurately estimate the user’s location during four activities (walking, traveling on a train, driving, and traveling on a plane). Wonder if they can track someone who is "lost in remote area without hope of being rescued." Maybe if the phone is set on Survival Mode?
- Nasrudith 6y agoEven traveling on a plane has a transponder to piggy back on IIRC. Remote area implies a spotty network at best. The best that could be done is noting when and where contact with a network of some sort is lost or regained.
- thdrdt 6y agoWhen you have a location you can also use the gyroscope to track where the device is going after the starting point. Almost like a video stream. Once in a while a keyframe and a stream of changes in between.
- pbhjpbhj 6y agoMaybe also compass and step counting (accelerometer) data?
- maeln 6y agoThats the purpose of an IMU[0]. But even the best IMU have a limited amount of precision, and, has time goes by, these imprecision can accumulate to a very big margin of error in your location. With the cheap IMU in phones, you very quickly reach the 100+ meter margin. That is why you usually combine it with other sources of localization to keep the margin down. If no other sources are available, the localization provided by the IMU become next to useless. [0] https://en.wikipedia.org/wiki/Inertial_measurement_unit https://en.wikipedia.org/wiki/Inertial_measurement_unit
- imglorp 6y agoMicrophones too. Signage and TVs etc can emit ultrasonic beacons your devices can hear, with applications like tracking your viewing habits and your location. Ditto the proximity sensor: it's just a photocell and a simple room light could comprise a beacon. Flashing over, say 30hz would be invisible to us.
- guessbest 6y agoA lot of the cheap wifi security cameras already use sound to transmit data such as for pairing. https://setup.smartlink.pitneybowes.com/advancedTroubleshooting https://setup.smartlink.pitneybowes.com/advancedTroubleshoot...
- 082349872349872 6y agoYou all probably already knew this, but I recently discovered "airplane mode" does wonders for battery life. Then again, I'm from a generation old enough to feel no qualms about wandering about with no device whatsoever, so YMMV.
- Santosh83 6y agoDo recent phones actually honour the Airplane mode absolutely or do they still allow WiFi/BT to bypass it, or override the user and activate the mobile radio under exceptional conditions?
- touristtam 6y agoYou might as well ask if the device honor the command to switch off or it says on a standby state.
- deleted 6y ago[deleted]
- somehnguy 6y agoI'm interested in this too. Recently I downloaded a podcast locally and turned off cellular on my phone before going for a walk. About halfway through my walk I looked at my phone screen and noticed that my phone was still showing cellular bars. It wouldn't communicate and the LTE symbol was gone, but the signal bars remained. Made me wonder what turning cellular off actually meant, was it still connected but data was off? Are the bars just a client side thing and no comms were going out? No idea.
- gruez 6y agoI'm pretty sure the "cellular" button you were talking about was labeled and was for "cellular data".
- somehnguy 6y agoThe one I'm talking about is the green one here: https://www.howtogeek.com/wp-content/uploads/2020/02/control_center_basic2.png https://www.howtogeek.com/wp-content/uploads/2020/02/control... There is no label, it just looks like a cellular icon. When you press it it turns grey, indicating off like this: https://i.redd.it/76b0j4im36f41.jpg https://i.redd.it/76b0j4im36f41.jpg
- jonplackett 6y agoIsn’t it a bit ironic that the organisation most likely to be tracking you is giving tips on how not to be tracked?
- checkyoursudo 6y agoI suspect that the organization most likely to be tracking me, in particular, is a for-profit one rather than a governmental one.
- chupasaurus 6y agoIt's completely logical because they try to keep alarm levels lower.
- staticassertion 6y agoThe NSA invests heavily in its defensive role, providing guidance and awareness training both to the US privately and globally through open recommendations. It doesn't matter. We've invested so heavily in offense that we can tell people how to defend themselves and we'll still own them. Here's one of my favorite talks, NSA TAO Chief on Disrupting Nation State Hackers https://www.youtube.com/watch?v=bDJb8WOJYdA https://www.youtube.com/watch?v=bDJb8WOJYdA This is the NSA Chief of Tailored Access Operations telling people how to defend themselves against the NSA (and other similar capabilities organizations), and it's all really valuable. None of it is fancy ML 0day detection or whatever, it's just about understanding your network better than an attacker can.
- deleted 6y ago[deleted]
- akerro 6y agoIt's like in Rick and Morty episode where Scissorshand says "you can run but you can't hide" and the run ends with "since when we take advice from this guy" https://www.youtube.com/watch?v=y5g7Z1qC7-k https://www.youtube.com/watch?v=y5g7Z1qC7-k
- 6y ago
- pella 6y ago3y ago: "Does disabling Wi-Fi prevent my Android phone from sending Wi-Fi frames?" https://news.ycombinator.com/item?id=15141077 https://news.ycombinator.com/item?id=15141077
- chupasaurus 6y agoThe only measure there is for the most of phones is to put them in a Faraday cage.
- tmaly 6y agoI always put my phone on airplane mode before going to bed. I just don't want the extra radiation while I sleep.
- tombert 6y agoCorrect me if I’m wrong, but isn’t the radiation from the WiFi and Cell towers in your bedroom regardless of whether your phone is on?
- RealStickman_ 6y agoHis phone doesn't answer, so I'd think there would at least be less radiation.
- Aachen 6y agoIndeed, the thing trying to reach a 2km distant tower 50cm from your head is a bit more powerful than the signal coming from 2km away trying to reach your phone.
- tanatocenose 6y agoYour comment seems intuitively entirely backwards. You think the tiny battery powered device in your bedroom is producing more EMF than the hundred foot tower hardwired to the grid actively sending the same exact type of data to thousands of devices in every direction beyond every wall that surrounds you?
- Aachen 6y agoAbsolutely. If you're asking about ability then yes: a grid-connected tower will both be able to produce stronger radio waves and last much longer (indefinitely versus some battery), but that's not legal, not what they do in practice, and wouldn't make sense: if the tower is so much stronger, then only your phone would be able to receive the tower. The tower wouldn't hear your phone's reply if the phone were significantly weaker. Since both generally want the maximum possible range, they'll transmit as much as regulations allow. A tower might have bigger and more sensitive antennae, but not so much that the transmissions are significantly different in power output. Both are safe to be nearby, but in case of long phone calls with the cell phone at your literal ear, your brain does heat up a measurable amount (if you have the right equipment), or so I've heard. To confirm this "both sides need to be roughly equally strong to hear each other" story, do a 30 seconds search online, or for a practical example you could look at the dBm (decibel-milliwatt) values your WiFi devices' output (the access point versus the stations; it's not the same as cellular but in the case of WiFi both are under your control so you might be able to observe both values).
- slowhand09 6y agoYour phone? Ha!! Count the connected wireless devices in your home. Cellphones, Amazon Echo, garage door opener, fitness watch, Ring doorbell, cable tv boxes, tv's, computers, printers, tablets, digital pencils, modems, wifi APs, earpods, wireless speakers, cordless phones, ovens, fridges, door locks, light bulbs, automobiles, VR goggles, quadcopters... Are we there yet?
- RandomBacon 6y ago> Count the connected wireless devices in your home. Done. Result: 0 Your comment is a Whataboutism Fallacy. --- EDIT: Seriously, I've had friends over and none of them noticed/mentioned any lack of "smart" devices. I would venture to guess that most U.S. households do not have any "smart" wireless devices besides a laptop and a smartphone. Attempting to discredit the desire to secure a smartphone by saying you have all these other potential attack vectors and being snarky about it is not cool.
- flanbiscuit 6y ago> Turn off Bluetooth and Wifi > Turn on Airplane Mode > Decline location-sharing or at the very least restrict it to only when the app is open These seem obvious but I guess need repeating. The last one is only an option for Android 10+ users which apparently only account for ~25% of Android devices out there. So 75% of Android users can't even do this yet. Not sure about iOS but I know they've had it longer at least. > Reset you phone’s Advertising ID This one I personally was not aware of > Don't use iOS and Android's FindMy or FindMyDevice features What happens if I lose my phone though? I wonder what the numbers are on people who have successfully retrieved their phone using these compared to people who can see where their phones are but never got it back. > consider using a trusted VPN provider. I clicked on their link and just skipped straight to their "Advanced User" recommendation, because this is HN, and they recommend Mullvad. Curious to see what HN users think of that one. https://gs.statcounter.com/os-version-market-share/android https://gs.statcounter.com/os-version-market-share/android https://source.android.com/devices/tech/config/tristate-perms https://source.android.com/devices/tech/config/tristate-perm... https://mullvad.net/en/ https://mullvad.net/en/
- Izkata 6y ago> and they recommend Mullvad. Curious to see what HN users think of that one. There is no signup information when creating an account, and one of the payment options is "cash in an envelope". Even if they're lying and do keep logs, it's as disconnected from your identity as I think is possible (assuming you do use that payment option instead of the others). It's also what Mozilla VPN runs on.
- reaperducer 6y agoone of the payment options is "cash in an envelope" I was intrigued by this line in your post, and it turns out it's true. I'm not all that paranoid, but I kinda like that idea. Also, right now there's a caveat about it: "Cash payments are delayed due to corona 6 May 2020 NEWS If sending cash is your preferred method for topping up your Mullvad VPN account, please plan ahead. The coronavirus is causing delays in postal delivery. To avoid being stuck with no time on your account, send your payment well in advance. Mail coming from the US is taking four weeks longer than usual, and even post from countries in southern Europe and England are delayed."
- zxcvbn4038 6y agoVPN usage is problematic - my phone provider blocks the major VPN providers so I have to switch it off whenever I'm outside wifi range. About half the financial sites I visit consider VPN usage a threat and the response ranges from CapitalOne's extra authentication to Synchrony's lock out the account for 72 hours to Goldman Sach's refuse to load and ask you to call a toll free number (where the confused rep just says they block some vpns and has no real advice to offer). There have been a number of cases where someone was a suspect in a crime because their phone was in the area. I'm thinking it might be better to keep the data service shut off all the time and just use wi-fi calling when I get to where I'm going. Phones don't work on the subway and are a distraction when driving, so maybe solve multiple problems that way.
- pcast 6y agoI had the same problem some time ago (VPN providers blocked). I solved it using DNS over HTTPs
- james_pm 6y agoThe actual guide instead of a summary in a Wired article. https://media.defense.gov/2020/Aug/04/2002469874/-1/-1/0/CSI_LIMITING_LOCATION_DATA_EXPOSURE_FINAL.PDF https://media.defense.gov/2020/Aug/04/2002469874/-1/-1/0/CSI...
- onetimemanytime 6y agoUnless you're a spook, isn't it pointless? We're bound to make mistakes. Or just make it a bit more anon?
- pinocio 6y agoCool, cool. I take all my security tips from thieves and spies. Next up, henhouse security tips from a coyote. None of these 'tips' are effective if you're connected to your cell carrier. The cells can still locate you. Also your phone can turn its wifi/bluetooth back on, and even log which WiFi networks you've been near when it's 'off'. All seem like good ways to find you. If you really don't want to be tracked, you need a phone with a removable battery. Full stop. Have you noticed that you can't get a flagship phone with one of those anymore?
- SergeAx 6y agoSo, the world's most powerful surveillance agency gives me advice how to avoid surveillance? Thank you, I'll pass.
- IRegretNothing 6y agoMonth ago I built my own android app that automatically switches on airplane mode whenever the display switches off (and vice versa). Made in 10 minutes with Tasker, it's even in the play store. Since then I really enjoy life again without any notifications, it's just wonderful.
- reeboo 6y agoWhich API did you use to do this? I looked into this a while ago but it looked like Android wasn't allowing programmatic access to airplane mode.
- plouc 6y agoThat sounds great! What's the app called, I'd like to install it.
- nikonyrh 6y agoI just use the moderate power saving mode which disables network traffic of the background apps. Now my 2017 Samsung A3's battery lasts about 3.5 - 4.5 days / charge. If I need to be "urgently" contacted people can still call or SMS me but I don't want any realtime notifications from apps.
- ReptileMan 6y agoRoot and firewall?
- curation 6y agoDid onion.com change their name?