4 ms·
You stop using your cell phone for anything important, or anything that can't be gotten through other means trivially. Practically, this means you use your cel
by Syonyk 3y ago
You stop using your cell phone for anything important, or anything that can't be gotten through other means trivially.
Practically, this means you use your cell phone for phone calls (the metadata is public, and I assume anyone who wants to listen in can already do so), and for SMS/MMS messages (see above, except I don't think the contents are quite as protected as voice).
You disable location services, you don't install anything of any interest on your "daily carry" phone, and you regularly shut it down for periods of time to build the expectation that your device is regularly offline. Let it run out of battery. Cultivate the "senile old senior" approach to using your phone. Leave it behind.
And then carry a small laptop, preferably running Qubes, for "everything else," and either use Tor or your own VPN infrastructure (ideally shared with friends) for access.
... and start cultivating ways of life that are offline first, that don't rely on consumer electronics (or the upstream companies) to behave as anything other than the data-grubbing, data-selling sorts they've reliably proven to be.
Yeah. It sucks. The past 20 years of consumer electronics turn out to have been rotten on the vine, actively working against your own interests, comically insecure (so even if they're not just streaming your data off to whoever pays/demands, it's not hard to extract), etc.
I don't have any better answers. I've been trying for about the last 5 years to figure out a solution, and I just can't come up with anything reasonable that still involves using consumer electronics for much more than toy uses. Apple looked better for a while, but then lost their head with the on-device CSAM scanning stuff and, while I like it, Lockdown is a simple admission that they cannot build secure software against nation-state level adversaries. Plus, most of their updates are "Oh, yeah, so, update this now, we have reason to believe [solid proof and won't say it, usually...] that this fixes things under active exploit." But, hey, we've got MeMojis and such now!
We have built too much complexity into our systems (see all the uarch vulns that are fundamentally a result of chasing performance over everything) to understand, to reason about, and we can't fix the problems of complexity with yet more complexity (as the last 5 years of papers demonstrate, often to comedic effect, about how the uarch vuln mitigations open up this other channel). And the software isn't any better.
I don't see the path forward other than simply opting out, and building systems that no longer rely on vulnerable pocket computers that leak literally everything you're doing to whoever might care.