5 ms·

A very important note: Pages are plaintext, they are not encrypted. Anyone with a radio can receive and decode all pages sent within reception range of that rad

A very important note: Pages are plaintext, they are not encrypted. Anyone with a radio can receive and decode all pages sent within reception range of that radio. (which is evident when you read the article, but not called out explicitly) This is a big deal for any use which involves private/sensitive/confidential data, as it can inform eavesdroppers about current issues, internal tools/architecture, personnel status, etc. For example, do you want to know when a major cloud company is having an internal outage? Listen for pages which follow their internal notification format. Or maybe you want to know if a critical patient at a hospital is having troubles - listen for pages to their doctor. Does the military command center use pagers (I hope not) - that could be interesting too... If your employer is using pagers, raise this issue to their security team (and share this great page showing how easy it is to eavesdrop). At the least, the pager messages should be as vague/simple as possible while still being useful. At the best...don't use pagers. Pagers are already a poor choice - messages are delivered "with best effort" but there's no guaranteed sending, no receipt, no retries. If you're out of range (or signal blocked), the message is lost, and it's up to the sender to implement their own ack & retry system. (I carried a pager for work for almost 15yrs)

tyingq 5y ago
>Pagers are already a poor choice - messages are delivered "with best effort" but there's no guaranteed sending, no receipt, no retries. They were pretty good towards the end of their reign when 2-way pagers came out. We were able to easily implement something where the system would keep paging you until you responded with an "I've got it" ack or a "Hand it off to the secondary" response, both of them an easy pick-list item.
mattowen_uk 5y ago
When did we all become so paranoid? Pagers used to be used by millions of people, in thousands of companies. 99.999% of the messages sent would have been utterly mundane. Stuff like 'call the office' or 'go to place x'. Just like our chat platforms of today, the data just isn't that interesting. Pagers were good for the era they were invented for, and at scale ended up being almost free to operate for the companies that used them. Encrypting stuff requires CPU grunt that pagers simply did not have, especially when the driver was to have as long battery life as possible. If anything, I miss that simpler era when we didn't have to assume that everybody in the chain was a bad actor trying steal our information.
- minitoar 5y ago
  Even Caesar encrypted his pages.
- Spooky23 5y ago
  We didn’t assume because of ignorance. Innocence lost. Plenty of people were listening - there’s an archive from 9/11/01 that was released with many of the pages in lower Manhattan that day. Police routinely monitored this stuff, and it’s reputed that PIs, ambulance chasing attorneys, etc did the same. Was it relevant/meaningful to when my mom was going to pick me up from work at the mall was a page? Probably not.
- klyrs 5y ago
  > When did we all become so paranoid? One industry that makes extensive use of pagers is health care. Frequently, personal and identifying information (PII) is transmitted over pages. By all rights, this is a violation of privacy laws (e.g. HIPAA). Why does a desire for privacy constitute paranoia? Pagers aren't only a technology of yesteryear -- they're still in use by millions of hospital staff. Despite the availability of cheap & easy strong crypto today, the technology is still stuck in the past. I'd wonder why, but upgrading infrastructure is expensive and it will probably take a class-action suit to make continued privacy violations more expensive than upgrades.
  - deleted 5y ago
    [deleted]
  - mikecsh 5y ago
    >> I'd wonder why I'm a doctor, and whilst I despise carrying a pager it does have some benefits over more modern alternatives in some scenarios. Mobile (cell) reception in hospitals is generally very poor and wifi connectivity is also generally poor. Trying to rely on either of those to deliver critical communication (e.g. bleeps to the crash team to respond to a cardiac arrest) is more unreliable than the hospital blasting a simple radio signal that any pagers within a few mile radius will always receive and decode appropriately. For less critical communications (e.g. where you might bleep someone to contact them to a refer a patient to their specialty) there is a (slow) move towards messaging apps or email. These solutions do not yet have the immediacy and reliability of a simple pager for critical applications.
dmd 5y ago
My employer (a large healthcare company) has been shown over and over that they're broadcasting PHI in the clear over pagers, and that this is bad, and their response every time has been "the paging company assures us it is secure". Evidence doesn't matter, only the word 'secure' in their contract with the paging company does, so it's "not their fault".
- 77pt77 5y ago
  Worse. If you show that it's trivially insecure, you are now the suspect/perpetrator. Never break these illusions. Keep your mouth shut.
  - WrtCdEvrydy 5y ago
    Even as the dedicated security contact whose job is it to test this shit, you will be looked at as a dickhead for pointing that we just spent 30k on something we can't use.
- somedangedname 5y ago
  I once asked a med student why pagers continued to see use in a medical setting over mobile phones. The response: doctors could use a phone to receive urgent notifications but the lower delivery guarantee for messages meant that they wouldn't be covered by their hospital's malpractice insurance for cases arising from late or non receipt of messages. Not sure if true but could be a strong incentive to ignore security complaints.
nixgeek 5y ago
It has been possible to get encrypted pagers in the U.S. for some time now. This clearly doesn't mean everyone adopts it.

tyingq 5y ago

>Pagers are already a poor choice - messages are delivered "with best effort" but there's no guaranteed sending, no receipt, no retries. They were pretty good towards the end of their reign when 2-way pagers came out. We were able to easily implement something where the system would keep paging you until you responded with an "I've got it" ack or a "Hand it off to the secondary" response, both of them an easy pick-list item.

mattowen_uk 5y ago

When did we all become so paranoid? Pagers used to be used by millions of people, in thousands of companies. 99.999% of the messages sent would have been utterly mundane. Stuff like 'call the office' or 'go to place x'. Just like our chat platforms of today, the data just isn't that interesting. Pagers were good for the era they were invented for, and at scale ended up being almost free to operate for the companies that used them. Encrypting stuff requires CPU grunt that pagers simply did not have, especially when the driver was to have as long battery life as possible. If anything, I miss that simpler era when we didn't have to assume that everybody in the chain was a bad actor trying steal our information.

minitoar 5y ago
Even Caesar encrypted his pages.
Spooky23 5y ago
We didn’t assume because of ignorance. Innocence lost. Plenty of people were listening - there’s an archive from 9/11/01 that was released with many of the pages in lower Manhattan that day. Police routinely monitored this stuff, and it’s reputed that PIs, ambulance chasing attorneys, etc did the same. Was it relevant/meaningful to when my mom was going to pick me up from work at the mall was a page? Probably not.
klyrs 5y ago
> When did we all become so paranoid? One industry that makes extensive use of pagers is health care. Frequently, personal and identifying information (PII) is transmitted over pages. By all rights, this is a violation of privacy laws (e.g. HIPAA). Why does a desire for privacy constitute paranoia? Pagers aren't only a technology of yesteryear -- they're still in use by millions of hospital staff. Despite the availability of cheap & easy strong crypto today, the technology is still stuck in the past. I'd wonder why, but upgrading infrastructure is expensive and it will probably take a class-action suit to make continued privacy violations more expensive than upgrades.
- deleted 5y ago
  [deleted]
- mikecsh 5y ago
  >> I'd wonder why I'm a doctor, and whilst I despise carrying a pager it does have some benefits over more modern alternatives in some scenarios. Mobile (cell) reception in hospitals is generally very poor and wifi connectivity is also generally poor. Trying to rely on either of those to deliver critical communication (e.g. bleeps to the crash team to respond to a cardiac arrest) is more unreliable than the hospital blasting a simple radio signal that any pagers within a few mile radius will always receive and decode appropriately. For less critical communications (e.g. where you might bleep someone to contact them to a refer a patient to their specialty) there is a (slow) move towards messaging apps or email. These solutions do not yet have the immediacy and reliability of a simple pager for critical applications.

dmd 5y ago

My employer (a large healthcare company) has been shown over and over that they're broadcasting PHI in the clear over pagers, and that this is bad, and their response every time has been "the paging company assures us it is secure". Evidence doesn't matter, only the word 'secure' in their contract with the paging company does, so it's "not their fault".

77pt77 5y ago
Worse. If you show that it's trivially insecure, you are now the suspect/perpetrator. Never break these illusions. Keep your mouth shut.
- WrtCdEvrydy 5y ago
  Even as the dedicated security contact whose job is it to test this shit, you will be looked at as a dickhead for pointing that we just spent 30k on something we can't use.
somedangedname 5y ago
I once asked a med student why pagers continued to see use in a medical setting over mobile phones. The response: doctors could use a phone to receive urgent notifications but the lower delivery guarantee for messages meant that they wouldn't be covered by their hospital's malpractice insurance for cases arising from late or non receipt of messages. Not sure if true but could be a strong incentive to ignore security complaints.

nixgeek 5y ago

It has been possible to get encrypted pagers in the U.S. for some time now. This clearly doesn't mean everyone adopts it.