8 ms·

The same probably goes for other MVNO carriers such as Mint and Ting. The PII and billing data is with the MVNO carriers. I buy my SIM cards anonymously. I nev

The same probably goes for other MVNO carriers such as Mint and Ting. The PII and billing data is with the MVNO carriers. I buy my SIM cards anonymously. I never use cellular near my house and only use it for data over a VPN. So it would not affect me if all of their data was breached.

chairmanwow1 4y ago
Lol this is not the same with most people. Pretty incredible if true. Timing attacks are pretty powerful though. Only one person has likely been to all the same places at you at the same time over the past week.
- kornhole 4y ago
  I don't have a regular movement pattern and only activate the SIM when needed. I also rotate SIM's with my partner to confuse things more. We are part of a budding trend.
  - rrdharan 4y ago
    If you really want to be safe you should eat your SIM card. https://youtu.be/wxJkLKjdMcc https://youtu.be/wxJkLKjdMcc
  - KennyBlanken 4y ago
    [flagged]
    - yjftsjthsd-h 4y ago
      > You're paranoid-delusional, and engaging in cargo-cult spycraft where your education seems to be mostly centered around watching hollywood "lone wolf, former spy / contract killer trying to stay off the radar" type movies. > you're nowhere near as interesting or important as you seem to think you are. You actually had some decent points; are the aggressive personal attacks really necessary? Or as the site guidelines put it, > When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
      - KennyBlanken 4y ago
        Fine, I'll try to dial it back. Also: telling someone they're not remotely as interesting as they think they are is not an insult, it's a factual statement that nobody who engages in the sort of tracking OP is worried about, would be interested in tracking the vast, vast vast majority of us. But since you're quoting the rule book, I'll qualify it.
        dang 4y ago
        It's certainly an insult. Stating facts (let's assume you're right about that) can still be insults. Imagine telling a middle schooler all about about the acne on their face. p.s. I posted https://news.ycombinator.com/item?id=34606566 https://news.ycombinator.com/item?id=34606566 before seeing this subthread; I didn't mean to pile on. But yes, please dial it back. You've broken the site guidelines a great deal and I don't want to ban you.
    - dang 4y ago
      We've asked you before not to post personal attacks to HN. If you keep breaking the site guidelines this we are going to have to ban you. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/item?id=33292588 https://news.ycombinator.com/item?id=33292588 (Oct 2022) https://news.ycombinator.com/item?id=32729960 https://news.ycombinator.com/item?id=32729960 (Sept 2022) https://news.ycombinator.com/item?id=32729939 https://news.ycombinator.com/item?id=32729939 (Sept 2022) https://news.ycombinator.com/item?id=31842940 https://news.ycombinator.com/item?id=31842940 (June 2022) https://news.ycombinator.com/item?id=30436952 https://news.ycombinator.com/item?id=30436952 (Feb 2022) https://news.ycombinator.com/item?id=30433141 https://news.ycombinator.com/item?id=30433141 (Feb 2022) https://news.ycombinator.com/item?id=28948931 https://news.ycombinator.com/item?id=28948931 (Oct 2021)
Someone1234 4y ago
> only use it for data over a VPN Unless you run this yourself, I don't understand why you nor anyone thinks that adds to their data integrity? VPNs can, have, and are the subject of break-ins and have their own agenda and or government oversight. People think that VPNs are this magical black box that makes you secure and private, because the YouTube ads told everyone so, the reality is that you are just adding an extra point of trust or potential failure. The needle has barely moved. All while making performance, in particular latency, worse.
- tesseract 4y ago
  We concentrated in one place the internet traffic of people who care enough about privacy that they are willing to pay for an extra service. What could go wrong!?
- kornhole 4y ago
  Yes I know the trust requirement of VPN's and hear this all the time. I run my own VPN. The point is that the carrier has too little data to identify me.
- cbsks 4y ago
  In the context of not trusting your ISP (the mobile provider in this case) a VPN provides a lot of security. You aren’t “adding an extra point of trust or potential failure”, you are choosing to trust your VPN provider instead of your ISP.
  - ehhthing 4y ago
    VPNs still have massive problems with network diversity. They often rely on a tiny subset of transit providers, usually just Cogent/HE/Telia and some straight up all run on the same network, usually M247. While a carrier like Comcast has thousands of peering agreements and much more diverse routing. This means all traffic coming out of a VPN is viewable by a tiny group of network providers. Sure, I would probably trust Cogent over Comcast, but the current state of the VPN market seems very stagnant in actually diverse network routing. It's really hard to recommend a VPN for people who are actually privacy conscious simply because you're moving your data to a handful of transit providers that aren't put under nearly as much scrutiny as a normal consumer ISP.
deleted 4y ago
[deleted]
Arnavion 4y ago
>The same probably goes for other MVNO carriers such as Mint and Ting. The PII and billing data is with the MVNO carriers. Are you sure? In the previous T-Mo breach Ting claimed the opposite. https://help.ting.com/hc/en-us/community/posts/4405384603291-T-Mobile-Hacked-Data https://help.ting.com/hc/en-us/community/posts/4405384603291... >the kind of Ting Mobile customer data at issue in this data breach is not stored on T-Mobile servers. Ting Mobile holds its own customer database on our own servers. The kind of data T-Mobile does have access to are things that are network-specific, like your phone number, SIM card number, usage data, and IMEI. >T-Mobile does not have access to the Ting Mobile database of names, email addresses, credit card information, etc. Your information is protected and secure from what the hackers claim to have collected.
- kornhole 4y ago
  Thanks. I was not sure. MVNO contracts could differ. This gives me more reason to hide my identity by using SIM cards carefully.
ShredKazoo 4y ago
What threat model does this help with?
- ravel-bar-foo 4y ago
  Phone carrier metadata tracking for https and MITM and advertisement insertion into non-secured web pages.
  - sofixa 4y ago
    > MITM and advertisement insertion into non-secured web pages. Which for all intents and purposes don't exist anymore.
- kornhole 4y ago
  This is for anybody who does not want their call and SMS history, location history, or billing information leaked, breached, or sold to government or commercial entities.
poisonbug 4y ago
> I buy my SIM cards anonymously. What's the methodology for doing this successfully?
- kornhole 4y ago
  Use cash to buy prepaid SIM card from someplace like Bustbuy. Use virtual card from service such as privacy.com to add funds. Never make calls or SMS with the SIM card number. Instead use VOIP such as jmp.chat or voip.ms.

chairmanwow1 4y ago

Lol this is not the same with most people. Pretty incredible if true. Timing attacks are pretty powerful though. Only one person has likely been to all the same places at you at the same time over the past week.

kornhole 4y ago
I don't have a regular movement pattern and only activate the SIM when needed. I also rotate SIM's with my partner to confuse things more. We are part of a budding trend.
- rrdharan 4y ago
  If you really want to be safe you should eat your SIM card. https://youtu.be/wxJkLKjdMcc https://youtu.be/wxJkLKjdMcc
- KennyBlanken 4y ago
  [flagged]
  - yjftsjthsd-h 4y ago
    > You're paranoid-delusional, and engaging in cargo-cult spycraft where your education seems to be mostly centered around watching hollywood "lone wolf, former spy / contract killer trying to stay off the radar" type movies. > you're nowhere near as interesting or important as you seem to think you are. You actually had some decent points; are the aggressive personal attacks really necessary? Or as the site guidelines put it, > When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
    - KennyBlanken 4y ago
      Fine, I'll try to dial it back. Also: telling someone they're not remotely as interesting as they think they are is not an insult, it's a factual statement that nobody who engages in the sort of tracking OP is worried about, would be interested in tracking the vast, vast vast majority of us. But since you're quoting the rule book, I'll qualify it.
      - dang 4y ago
        It's certainly an insult. Stating facts (let's assume you're right about that) can still be insults. Imagine telling a middle schooler all about about the acne on their face. p.s. I posted https://news.ycombinator.com/item?id=34606566 https://news.ycombinator.com/item?id=34606566 before seeing this subthread; I didn't mean to pile on. But yes, please dial it back. You've broken the site guidelines a great deal and I don't want to ban you.
  - dang 4y ago
    We've asked you before not to post personal attacks to HN. If you keep breaking the site guidelines this we are going to have to ban you. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/item?id=33292588 https://news.ycombinator.com/item?id=33292588 (Oct 2022) https://news.ycombinator.com/item?id=32729960 https://news.ycombinator.com/item?id=32729960 (Sept 2022) https://news.ycombinator.com/item?id=32729939 https://news.ycombinator.com/item?id=32729939 (Sept 2022) https://news.ycombinator.com/item?id=31842940 https://news.ycombinator.com/item?id=31842940 (June 2022) https://news.ycombinator.com/item?id=30436952 https://news.ycombinator.com/item?id=30436952 (Feb 2022) https://news.ycombinator.com/item?id=30433141 https://news.ycombinator.com/item?id=30433141 (Feb 2022) https://news.ycombinator.com/item?id=28948931 https://news.ycombinator.com/item?id=28948931 (Oct 2021)

Someone1234 4y ago

> only use it for data over a VPN Unless you run this yourself, I don't understand why you nor anyone thinks that adds to their data integrity? VPNs can, have, and are the subject of break-ins and have their own agenda and or government oversight. People think that VPNs are this magical black box that makes you secure and private, because the YouTube ads told everyone so, the reality is that you are just adding an extra point of trust or potential failure. The needle has barely moved. All while making performance, in particular latency, worse.

tesseract 4y ago
We concentrated in one place the internet traffic of people who care enough about privacy that they are willing to pay for an extra service. What could go wrong!?
kornhole 4y ago
Yes I know the trust requirement of VPN's and hear this all the time. I run my own VPN. The point is that the carrier has too little data to identify me.
cbsks 4y ago
In the context of not trusting your ISP (the mobile provider in this case) a VPN provides a lot of security. You aren’t “adding an extra point of trust or potential failure”, you are choosing to trust your VPN provider instead of your ISP.
- ehhthing 4y ago
  VPNs still have massive problems with network diversity. They often rely on a tiny subset of transit providers, usually just Cogent/HE/Telia and some straight up all run on the same network, usually M247. While a carrier like Comcast has thousands of peering agreements and much more diverse routing. This means all traffic coming out of a VPN is viewable by a tiny group of network providers. Sure, I would probably trust Cogent over Comcast, but the current state of the VPN market seems very stagnant in actually diverse network routing. It's really hard to recommend a VPN for people who are actually privacy conscious simply because you're moving your data to a handful of transit providers that aren't put under nearly as much scrutiny as a normal consumer ISP.

deleted 4y ago

[deleted]

Arnavion 4y ago

>The same probably goes for other MVNO carriers such as Mint and Ting. The PII and billing data is with the MVNO carriers. Are you sure? In the previous T-Mo breach Ting claimed the opposite. https://help.ting.com/hc/en-us/community/posts/4405384603291-T-Mobile-Hacked-Data https://help.ting.com/hc/en-us/community/posts/4405384603291... >the kind of Ting Mobile customer data at issue in this data breach is not stored on T-Mobile servers. Ting Mobile holds its own customer database on our own servers. The kind of data T-Mobile does have access to are things that are network-specific, like your phone number, SIM card number, usage data, and IMEI. >T-Mobile does not have access to the Ting Mobile database of names, email addresses, credit card information, etc. Your information is protected and secure from what the hackers claim to have collected.

kornhole 4y ago
Thanks. I was not sure. MVNO contracts could differ. This gives me more reason to hide my identity by using SIM cards carefully.

ShredKazoo 4y ago

What threat model does this help with?

ravel-bar-foo 4y ago
Phone carrier metadata tracking for https and MITM and advertisement insertion into non-secured web pages.
- sofixa 4y ago
  > MITM and advertisement insertion into non-secured web pages. Which for all intents and purposes don't exist anymore.
kornhole 4y ago
This is for anybody who does not want their call and SMS history, location history, or billing information leaked, breached, or sold to government or commercial entities.

poisonbug 4y ago

> I buy my SIM cards anonymously. What's the methodology for doing this successfully?

kornhole 4y ago
Use cash to buy prepaid SIM card from someplace like Bustbuy. Use virtual card from service such as privacy.com to add funds. Never make calls or SMS with the SIM card number. Instead use VOIP such as jmp.chat or voip.ms.