5 ms·

PGPP – a new type of service that gives you private mobile connectivity

64 points by jacooper 4y ago

richardwhiuk 4y ago
I can't imagine any MNO would accept this as an MVNO.
- 310260 4y ago
  They don't necessarily have to. It can be an always-roaming service. Similar to what JT and Truephone offer.
  - lxgr 4y ago
    Roaming still requires a contractual agreement between home and visited network.
deleted 4y ago
[deleted]
omegacharlie 4y ago
Am I forgetting something or does merely changing the IMSI while doing nothing about IMEI just lead to a security theatre mentality when fake BTS can still track the device by the IMEI?
adg001 4y ago
IMSI is not the only identifier available to mobile networks and attackers alike. Does PGPP provide IMEI randomization? What stops the mobile networks from tracking you using the IMEI associated to the ephemeral IMSIs? Answer found in the linked paper: """ For many devices, the IMEI can be changed through soft- ware, often without root access. We envision a PGPP MVNO would allow for subscribers to present their unchanged de- vice IMEI, giving the PGPP operator the opportunity to check against a EIR to verify the phone has not been reported as stolen. At that point, the IMEI could be reprogrammed to a single value, similar to our changes to the SUPI. Additionally, PGPP users can readily switch SIMs to different handsets (IMEIs) at-will. Note that different jurisdictions have differ- ent rules about whether, how, and by whom an IMEI can be changed, so only in some cases IMEI changes require cooper- ation with the MVNO. ... A PGPP-based carrier is data-only, with voice and messaging provided by third parties. """ So, the next question is: if voice is provided by third parties (i.e., relies on the actual IMSI/IMEI), what stops the mobile operator from correlating the presence of the IMSI/IMEI to the ephemeral IMSIs/IMEIs, so as to infer the real network identity behind the randomised IDs?
- richardwhiuk 4y ago
  I suspect they assume that voice would be provided by something OTT - e.g. Signal.
  - kornhole 4y ago
    But you still need to make and receive regular OTA calls and SMS at times. This is where VOIP is needed such as voip.ms, Twilio, Google voice.. Voip.ms with Linphone app and SMS app called VOIP.MS on android have worked well for me. I occasionally and rarely use a burner sim but do everything over WIFI with VPN.
    - richardwhiuk 4y ago
      If you are making regular OTA calls and SMS, you are probably giving up any hope of truly private mobile connectivity.
      - kornhole 4y ago
        Of course, but sometimes you need to call a store, bank, or barber over the only channel available. Some services still rely on SMS authentication.
prvit 4y ago
The branding is pretty revealing. They’re calling this “PGPP” because they want to sell to drug dealers. Various “secured” encrypted phones have been sold as “PGP phones” for years now regardless of underlying the technology having anything to do with PGP.
- ziddoap 4y ago
  >They’re calling this “PGPP” because they want to sell to drug dealers. Can you explain how this follows? It sounds like you're claiming that the only people who have an interest in privacy are drug dealers? Which would be a pretty ridiculous take, if that's what you're implying.
  - prvit 4y ago
    Drug dealers make up like 90+% of the market for expensive cryptophones. There’s been a bunch of companies selling “PGP phones” specifically to drug dealers. Many of these have been shut down by LE. If you look, you’ll find that most of them unsurprisingly maintain physical storefronts in drug dealing hotspots like Marbella. The idea isn’t that only drug dealers care about privacy, it’s that they’re the people with enough disposable cash and few enough brain cells to buy this stuff.
- notjulianjaynes 4y ago
  I thought it t was a pun on 3GPP.
  - prvit 4y ago
    That’s only credible if we’re to believe that they know literally nothing about the market they’re entering.
    - notjulianjaynes 4y ago
      I think, especially in the wake of EFF's Fog Data broker investigation, the idea that drug dealers are the only market for a tracking resistant mobile device is untrue. (Although I guess I'd buy that drug dealers are more receptive than the general public to something branded as "PGP." But I'm one of those strawmen on the other side of this debate (a journalist) and such a product is appealing to me. If it's not appealing to the general public that is IMO a lack of education on the topic. That said, I have not reviewed how this is particular thing is supposed to work, and my assumption is that it is An0m v2 until proven otherwise. Additionally, doesn't Signal require a phone number to sign up? If this service provides no phone number how does that work?
herodotus 4y ago
Perhaps someone can explain this. If Alice calls Bob, her carrier has to be able to locate Bob to make his phone ring. Therefore, Bob can always be tracked. I do not see how this can be overcome. Seems to me that this service is a perpetual motion machine.
- im3w1l 4y ago
  There are many ways to solve this. The simplest one is that Bob owns a trusted server that always knows where he is. He uses a few proxies in series to connect to this server. When Alice wants to call Bob she contacts his server.
traceroute66 4y ago
> We envision a PGPP MVNO .... Ok, that's cute. I hope you know how hard it is to setup an MVNO these days. It also kind of rules out that little thing called roaming, which is kinda popular these days.
- 310260 4y ago
  MVNOs rule out roaming? Since when?
  - traceroute66 4y ago
    > MVNOs rule out roaming? Since when? You miss the point entirely. Of course traditional MVNOs don't rule out roaming. The problem comes when you think you can hide behind a fancy privacy-preserving MVNO. Due to the very fundamentals of how roaming works ... that...aint ..gonna ...happen.
apienx 4y ago
Damning conclusions in TFP. https://arxiv.org/pdf/2009.09035.pdf https://arxiv.org/pdf/2009.09035.pdf "In addition, law enforcement has long demanded backdoor access to private user devices and user data [61]. We do not believe that users of PGPP, in its current form, would be capable of withstanding targeted legal or extra-legal attacks by nation-state organizations (e.g., the FBI or NSA)" Randomizing the IMSI is great and all, but it only protects against >20-year old interception techniques (e.g. Stingrays). Nothing to see here.
- dane-pgp 4y ago
  > In addition, law enforcement has long demanded backdoor access to private user devices and user data Law enforcement has long demanded all sorts of things, but the presence of such a demand doesn't mean that they have the backdoors which that statement insinuates. If anything, the fact that law enforcement is having to publicly beg for private access suggests that they don't already have it (unless you believe that is a bluff). > capable of withstanding targeted legal or extra-legal attacks by nation-state organizations If your threat model includes "nation states are going to break their own laws to attack me" then you're not safe even if you never use a phone. In fact, you're not safe even if you never commit a crime.
edf13 4y ago
So you can get 30 IMSI switches per month... that doesn't sound like anywhere near enough for me. Also - what happens if you're on a low traffic cell site and make the change. Suddenly a new IMSI appears on that tower (With a big jump from it's last location). I'm pretty sure I could track someone with this service.
barathr 4y ago
Not sure how this ended up on the front page again, but FWIW we discuss a lot of the privacy goals of the system here: https://invisv.com/articles/pgpp-more.html https://invisv.com/articles/pgpp-more.html There are fundamental tradeoffs here, so it's good for users to know what they're interested in protecting against, compare against the security model that the system provides, and determine if it works for them and their needs.

64 points by jacooper 4y ago

richardwhiuk 4y ago

I can't imagine any MNO would accept this as an MVNO.

310260 4y ago
They don't necessarily have to. It can be an always-roaming service. Similar to what JT and Truephone offer.
- lxgr 4y ago
  Roaming still requires a contractual agreement between home and visited network.

deleted 4y ago

[deleted]

omegacharlie 4y ago

Am I forgetting something or does merely changing the IMSI while doing nothing about IMEI just lead to a security theatre mentality when fake BTS can still track the device by the IMEI?

adg001 4y ago

IMSI is not the only identifier available to mobile networks and attackers alike. Does PGPP provide IMEI randomization? What stops the mobile networks from tracking you using the IMEI associated to the ephemeral IMSIs? Answer found in the linked paper: """ For many devices, the IMEI can be changed through soft- ware, often without root access. We envision a PGPP MVNO would allow for subscribers to present their unchanged de- vice IMEI, giving the PGPP operator the opportunity to check against a EIR to verify the phone has not been reported as stolen. At that point, the IMEI could be reprogrammed to a single value, similar to our changes to the SUPI. Additionally, PGPP users can readily switch SIMs to different handsets (IMEIs) at-will. Note that different jurisdictions have differ- ent rules about whether, how, and by whom an IMEI can be changed, so only in some cases IMEI changes require cooper- ation with the MVNO. ... A PGPP-based carrier is data-only, with voice and messaging provided by third parties. """ So, the next question is: if voice is provided by third parties (i.e., relies on the actual IMSI/IMEI), what stops the mobile operator from correlating the presence of the IMSI/IMEI to the ephemeral IMSIs/IMEIs, so as to infer the real network identity behind the randomised IDs?

richardwhiuk 4y ago
I suspect they assume that voice would be provided by something OTT - e.g. Signal.
- kornhole 4y ago
  But you still need to make and receive regular OTA calls and SMS at times. This is where VOIP is needed such as voip.ms, Twilio, Google voice.. Voip.ms with Linphone app and SMS app called VOIP.MS on android have worked well for me. I occasionally and rarely use a burner sim but do everything over WIFI with VPN.
  - richardwhiuk 4y ago
    If you are making regular OTA calls and SMS, you are probably giving up any hope of truly private mobile connectivity.
    - kornhole 4y ago
      Of course, but sometimes you need to call a store, bank, or barber over the only channel available. Some services still rely on SMS authentication.

prvit 4y ago

The branding is pretty revealing. They’re calling this “PGPP” because they want to sell to drug dealers. Various “secured” encrypted phones have been sold as “PGP phones” for years now regardless of underlying the technology having anything to do with PGP.

ziddoap 4y ago
>They’re calling this “PGPP” because they want to sell to drug dealers. Can you explain how this follows? It sounds like you're claiming that the only people who have an interest in privacy are drug dealers? Which would be a pretty ridiculous take, if that's what you're implying.
- prvit 4y ago
  Drug dealers make up like 90+% of the market for expensive cryptophones. There’s been a bunch of companies selling “PGP phones” specifically to drug dealers. Many of these have been shut down by LE. If you look, you’ll find that most of them unsurprisingly maintain physical storefronts in drug dealing hotspots like Marbella. The idea isn’t that only drug dealers care about privacy, it’s that they’re the people with enough disposable cash and few enough brain cells to buy this stuff.
notjulianjaynes 4y ago
I thought it t was a pun on 3GPP.
- prvit 4y ago
  That’s only credible if we’re to believe that they know literally nothing about the market they’re entering.
  - notjulianjaynes 4y ago
    I think, especially in the wake of EFF's Fog Data broker investigation, the idea that drug dealers are the only market for a tracking resistant mobile device is untrue. (Although I guess I'd buy that drug dealers are more receptive than the general public to something branded as "PGP." But I'm one of those strawmen on the other side of this debate (a journalist) and such a product is appealing to me. If it's not appealing to the general public that is IMO a lack of education on the topic. That said, I have not reviewed how this is particular thing is supposed to work, and my assumption is that it is An0m v2 until proven otherwise. Additionally, doesn't Signal require a phone number to sign up? If this service provides no phone number how does that work?

herodotus 4y ago

Perhaps someone can explain this. If Alice calls Bob, her carrier has to be able to locate Bob to make his phone ring. Therefore, Bob can always be tracked. I do not see how this can be overcome. Seems to me that this service is a perpetual motion machine.

im3w1l 4y ago
There are many ways to solve this. The simplest one is that Bob owns a trusted server that always knows where he is. He uses a few proxies in series to connect to this server. When Alice wants to call Bob she contacts his server.

traceroute66 4y ago

> We envision a PGPP MVNO .... Ok, that's cute. I hope you know how hard it is to setup an MVNO these days. It also kind of rules out that little thing called roaming, which is kinda popular these days.

310260 4y ago
MVNOs rule out roaming? Since when?
- traceroute66 4y ago
  > MVNOs rule out roaming? Since when? You miss the point entirely. Of course traditional MVNOs don't rule out roaming. The problem comes when you think you can hide behind a fancy privacy-preserving MVNO. Due to the very fundamentals of how roaming works ... that...aint ..gonna ...happen.

apienx 4y ago

Damning conclusions in TFP. https://arxiv.org/pdf/2009.09035.pdf https://arxiv.org/pdf/2009.09035.pdf "In addition, law enforcement has long demanded backdoor access to private user devices and user data [61]. We do not believe that users of PGPP, in its current form, would be capable of withstanding targeted legal or extra-legal attacks by nation-state organizations (e.g., the FBI or NSA)" Randomizing the IMSI is great and all, but it only protects against >20-year old interception techniques (e.g. Stingrays). Nothing to see here.

dane-pgp 4y ago
> In addition, law enforcement has long demanded backdoor access to private user devices and user data Law enforcement has long demanded all sorts of things, but the presence of such a demand doesn't mean that they have the backdoors which that statement insinuates. If anything, the fact that law enforcement is having to publicly beg for private access suggests that they don't already have it (unless you believe that is a bluff). > capable of withstanding targeted legal or extra-legal attacks by nation-state organizations If your threat model includes "nation states are going to break their own laws to attack me" then you're not safe even if you never use a phone. In fact, you're not safe even if you never commit a crime.

edf13 4y ago

So you can get 30 IMSI switches per month... that doesn't sound like anywhere near enough for me. Also - what happens if you're on a low traffic cell site and make the change. Suddenly a new IMSI appears on that tower (With a big jump from it's last location). I'm pretty sure I could track someone with this service.

barathr 4y ago

Not sure how this ended up on the front page again, but FWIW we discuss a lot of the privacy goals of the system here: https://invisv.com/articles/pgpp-more.html https://invisv.com/articles/pgpp-more.html There are fundamental tradeoffs here, so it's good for users to know what they're interested in protecting against, compare against the security model that the system provides, and determine if it works for them and their needs.