4 ms·

When it came out that government was looking at all of the data on the internet, there was a massive effort to move to https. Everyone got involved. Why can't

When it came out that government was looking at all of the data on the internet, there was a massive effort to move to https. Everyone got involved. Why can't these same companies and organizations push for phones to be anonymous? Why should a 'phone' be primarily a person tracker that happens to have voice communications built in?

gruez 4y ago
It's literally not possible because the mobile network needs to know where your phone is so it can route packets to the tower that you're connected.
- tomohawk 4y ago
  But it doesn't need to know who you are. The whole problem is that a person's identity is more and more entangled with a tracking device.
  - gruez 4y ago
    In that case you can just get a burner phone + data SIM, and route all your calls/texts via VOIP provider.
    - giraffe_lady 4y ago
      I saw a post a few months ago where an actual mobile security expert publicly said they did not have very high confidence in their own ability to cleanly buy and use a burner if the stakes were high eg government actively trying to build a case against them. Since then I've been very skeptical of all claims of what you can "just" do to avoid being tracked. This problem can't be solved by individual action or paranoia it's too big and complex now.
      - gruez 4y ago
        >an actual mobile security expert publicly said they did not have very high confidence in their own ability to cleanly buy and use a burner if the stakes were high eg government actively trying to build a case against them. I'm not sure what the threat model here is. If the "government actively trying to build a case against them" involves government agents following you in unmarked vans, then the government being able to track you through your SIM should be the least of your worries. If you're merely on some government watchlist (ie. there aren't agents following you), I don't see how it would be hard to cleanly buy a burner phone/sim, especially in the post pandemic age where face masks are socially acceptable.
        giraffe_lady 4y ago
        I think "you want to do a communication that can't be later printed out and used against you publicly" is the threat model. You can't really protect yourself from the US government in any meaningful sense if they decide to end or ruin your life, but what I described above seems like a reasonable thing that people would want to do for reasons both legal and not.
      - convivialdingo 4y ago
        Agreed... Pure conjecture on my part, and I haven’t worked in this area but I had lots of friends in gov security and mobile standards groups. Nobody I’ve talked to thinks it’s possible to stay anonymous on any commercial cellular network. You might be able to push a few anonymous phone calls or surf a few hours but soon your typical browsing habits, app usage and contacts will match you up with similar existing profiles based purely on the metadata. Honestly just narrowing it down to a few dozen people is good enough to get unmasked.
slackfan 4y ago
The Federal Government purges data that was non-encrypted after a number of years. The Federal Government retains a copy of all https-encrypted communications indefinitely on the understanding that the encryption may be broken at some point. The push to HTTPS was gleefully supported by the US federal government. HTTPS is not a panacea, and is generally useless for most non-sales applications.
- Xorlev 4y ago
  You're neglecting to consider the most important aspect of HTTPS, even if you don't care about privacy or believe the encryption will eventually be broken: integrity. HTTPS significantly raises the bar on MITM attacks, such as ISPs adding or replacing ads with their own. It also prevents folks sitting in the same coffeeshop as you from snooping. Calling "generally useless" is incredibly uncharitable.
  - slackfan 4y ago
    Considering that HTTPS completely and utterly fails to solve its stated purpose of cryptographic verification of content, it's basically security theater, the last vestiges of which have been completely broken by LetsEncrypt. But I'm a luddite who also thinks we shouldn't have gone beyond HTML 4.01 as a spec, and that JS in the browser is a pox upon the web.
- sneak 4y ago
  This is not accurate.
  - kevin_thibedeau 4y ago
    All encrypted communications are treated as foreign origin regardless of its true origin. The US government uses this twist of illogic to justify their domestic collection.
    - WebbWeaver 4y ago
      Sorry, do you know where I can find information about this?
arrozconcosas 4y ago
A large portion of the market for anonymous phones are for illegal purposes. For any company doing this at scale, they are inevitably confronted with this fact and can get in a lot of trouble if they are proven to be knowingly supporting crime groups/individuals.
salawat 4y ago
In order for info to get from here to there: The phone network requires a geophysical route/medium across which to shluff a packet. Said packet is destined for an endpoint. Said endpoint is associated with a payer. Said payer, in order to pay, is virtually guaranteed to have had to do KYC at some point. Ergo, if you can call, you can be tracked with only knowledge of the endpoint, and the topology of the networking medium. Nature of the beast I'm afraid. Your forebearers wanted this. Are you not pleased? Does this mot make you feel safe? They worked very hard on it... For your safety, you see!
j-james 4y ago
Do correct me if I'm wrong: but the push to HTTPS was mostly for its resistance to MITM attacks from bad-behaving ISPs and public WiFi, no? I really struggle to believe that the most powerful nation-state in the world would not be able to get certificates from certificate authorities overwhelmingly also hosted in the States. And besides, most information relevant to the government is just who's connecting to what, which is necessarily done unencrypted (via DNS or otherwise). Directly answering your question: because phone companies are natural monopolies, and have strong incentives to prevent any public-access provider that wouldn't need unique identifiers tied to billing information from coming in. Location tracking is a direct consequence of cell towers only having a limited range: and because telcos have no real competitors, there's no way a privacy-centered carrier that sells itself on not doing anything with that data can pop up. I do wish public access LTE existed in a similar form to free WiFi or municipal broadband. Or even just more municipal broadband. This article is about individual apps siphoning location data to the US government à la Tim Hortons, though, not phone providers themselves tracking users, although that also does happen.

gruez 4y ago

It's literally not possible because the mobile network needs to know where your phone is so it can route packets to the tower that you're connected.

tomohawk 4y ago
But it doesn't need to know who you are. The whole problem is that a person's identity is more and more entangled with a tracking device.
- gruez 4y ago
  In that case you can just get a burner phone + data SIM, and route all your calls/texts via VOIP provider.
  - giraffe_lady 4y ago
    I saw a post a few months ago where an actual mobile security expert publicly said they did not have very high confidence in their own ability to cleanly buy and use a burner if the stakes were high eg government actively trying to build a case against them. Since then I've been very skeptical of all claims of what you can "just" do to avoid being tracked. This problem can't be solved by individual action or paranoia it's too big and complex now.
    - gruez 4y ago
      >an actual mobile security expert publicly said they did not have very high confidence in their own ability to cleanly buy and use a burner if the stakes were high eg government actively trying to build a case against them. I'm not sure what the threat model here is. If the "government actively trying to build a case against them" involves government agents following you in unmarked vans, then the government being able to track you through your SIM should be the least of your worries. If you're merely on some government watchlist (ie. there aren't agents following you), I don't see how it would be hard to cleanly buy a burner phone/sim, especially in the post pandemic age where face masks are socially acceptable.
      - giraffe_lady 4y ago
        I think "you want to do a communication that can't be later printed out and used against you publicly" is the threat model. You can't really protect yourself from the US government in any meaningful sense if they decide to end or ruin your life, but what I described above seems like a reasonable thing that people would want to do for reasons both legal and not.
    - convivialdingo 4y ago
      Agreed... Pure conjecture on my part, and I haven’t worked in this area but I had lots of friends in gov security and mobile standards groups. Nobody I’ve talked to thinks it’s possible to stay anonymous on any commercial cellular network. You might be able to push a few anonymous phone calls or surf a few hours but soon your typical browsing habits, app usage and contacts will match you up with similar existing profiles based purely on the metadata. Honestly just narrowing it down to a few dozen people is good enough to get unmasked.

slackfan 4y ago

The Federal Government purges data that was non-encrypted after a number of years. The Federal Government retains a copy of all https-encrypted communications indefinitely on the understanding that the encryption may be broken at some point. The push to HTTPS was gleefully supported by the US federal government. HTTPS is not a panacea, and is generally useless for most non-sales applications.

Xorlev 4y ago
You're neglecting to consider the most important aspect of HTTPS, even if you don't care about privacy or believe the encryption will eventually be broken: integrity. HTTPS significantly raises the bar on MITM attacks, such as ISPs adding or replacing ads with their own. It also prevents folks sitting in the same coffeeshop as you from snooping. Calling "generally useless" is incredibly uncharitable.
- slackfan 4y ago
  Considering that HTTPS completely and utterly fails to solve its stated purpose of cryptographic verification of content, it's basically security theater, the last vestiges of which have been completely broken by LetsEncrypt. But I'm a luddite who also thinks we shouldn't have gone beyond HTML 4.01 as a spec, and that JS in the browser is a pox upon the web.
sneak 4y ago
This is not accurate.
- kevin_thibedeau 4y ago
  All encrypted communications are treated as foreign origin regardless of its true origin. The US government uses this twist of illogic to justify their domestic collection.
  - WebbWeaver 4y ago
    Sorry, do you know where I can find information about this?

arrozconcosas 4y ago

A large portion of the market for anonymous phones are for illegal purposes. For any company doing this at scale, they are inevitably confronted with this fact and can get in a lot of trouble if they are proven to be knowingly supporting crime groups/individuals.

salawat 4y ago

In order for info to get from here to there: The phone network requires a geophysical route/medium across which to shluff a packet. Said packet is destined for an endpoint. Said endpoint is associated with a payer. Said payer, in order to pay, is virtually guaranteed to have had to do KYC at some point. Ergo, if you can call, you can be tracked with only knowledge of the endpoint, and the topology of the networking medium. Nature of the beast I'm afraid. Your forebearers wanted this. Are you not pleased? Does this mot make you feel safe? They worked very hard on it... For your safety, you see!

j-james 4y ago

Do correct me if I'm wrong: but the push to HTTPS was mostly for its resistance to MITM attacks from bad-behaving ISPs and public WiFi, no? I really struggle to believe that the most powerful nation-state in the world would not be able to get certificates from certificate authorities overwhelmingly also hosted in the States. And besides, most information relevant to the government is just who's connecting to what, which is necessarily done unencrypted (via DNS or otherwise). Directly answering your question: because phone companies are natural monopolies, and have strong incentives to prevent any public-access provider that wouldn't need unique identifiers tied to billing information from coming in. Location tracking is a direct consequence of cell towers only having a limited range: and because telcos have no real competitors, there's no way a privacy-centered carrier that sells itself on not doing anything with that data can pop up. I do wish public access LTE existed in a similar form to free WiFi or municipal broadband. Or even just more municipal broadband. This article is about individual apps siphoning location data to the US government à la Tim Hortons, though, not phone providers themselves tracking users, although that also does happen.