5 ms·

> Yes, in an ideal world, none of this would be a problem. But that's not the world we have right now, and I don't believe that minor modifications of this conc

by derefr 2y ago

> Yes, in an ideal world, none of this would be a problem. But that's not the world we have right now, and I don't believe that minor modifications of this concept of device can improve the state of it. I've been trying for years to figure out how to make digital consumer tech less-toxic, and the only conclusions I've come to are, "You can't." I don't see what's so hard about it. Root your (Android) phone; throw any app you want to use into Ghidra and strip out all but the desired functionality. Presuming you only need a few key apps, it would take maybe a few days every few months to keep it going against updates (or less if you can come up with dynamic-library-shim approaches to modding, instead of using binary patching.) In other words: rather than waiting for an open-source mobile ecosystem that'll never come, we should just be treating mobile devices like we do game consoles: seeing them as something to be jailbroken, modchipped, hacked, brute-forced, overridden, key-extracted, etc. Made to do what you want, and only what you want, when you want — source-availability be damned. It's not a solution for everybody, but it can be a solution for those who know how to do it. (And if there were a thriving ecosystem of people doing this work, then the work itself could be repackaged for cargo-cult consumption by those who don't really understand it, but are willing to follow a "modding guide" or pay to have it done by some guy on eBay.) --- I should note separately that if you're concerned about being tracked, a flip-phone is still a terrible thing to carry around (if you're carrying it with the battery + SIM card both in it, which I assume you are.) Cellular carriers are 10x as nosy (and state-actor-infested) as the average app company. Cellular baseband chips will still be passively pinging nearby radio towers with the phone's IMEI and the SIM card's ICCID, even while the phone is "off" — as long as its battery isn't dead/removed. Smartphones can't prevent their baseband chipsets from pinging towers any more than flip-phones can, of course — but at least if you're using a smartphone with only an eSIM, then (on a jailbroken device) you can at least install a background service that will have the application processor tell the eSIM chip to present itself as unpopulated whenever the phone is locked; and perhaps send a command to scramble the baseband's configured IMEI right before telling it to go to airplane mode, too. (I presume here that you would be willing to trade off being unreachable by calls except when "ready", for not having your location tracked by the carrier except when your phone is awake + unlocked + being interacted with. You'd still be reachable by text — SMSes get buffered in the receiving SMSC until the subscriber comes back online!)

dogman144 2y ago
I think you have the right mindset about the most ideal approach, but how-to guides on how to do this *such that* it is only *a few days every few months* to maintain a setup like that are few and far between... as in there aren't any. Sure - same page, digital sovereignty isn't free, if you want it have to work for it. But, speaking as a technical securtiy user myself, and have worked with ghidra, I have zero context on how to take the approach you call for that cleanly strips out the bad stuff without buying me, what would feel to be likely, hours upon hours of troubleshooting dependencies for core functionality that I inadvertantly broke due to the surgery... such that I'm back to not carrying a smart device or being ok with a fliphone traingulating me. One approach I have thought through with effective (I think? still considering this) privacy outcomes is leveraging LLCs and related device plans as a "cloaking" mechanism. If my current phone stays at my house always, I travel locally with a fliphone, and travel with a network of smart phones under LLCs, that could be enough to throw off the tracking effectively while only (maybe?) exposing data that's already exposed in public records.
Syonyk 2y ago
I don't get nearly enough benefit from a smartphone to bother with any of that sort of deep aggressive reverse engineering and patching. It's not worth the time. I don't have a spare "few days every few months" that I want to dedicate to reverse engineering apps that are purpose built to work against my will. > In other words: rather than waiting for an open-source mobile ecosystem that'll never come, we should just be treating mobile devices like we do game consoles: seeing them as something to be jailbroken, modchipped, hacked, brute-forced, overridden, key-extracted, etc. Made to do what you want, and only what you want, when you want — source-availability be damned. Except there are far easier to use options that aren't nearly so locked down, should I want to do general purpose computing. I think the most recent game console I owned was a Wii, but I treated it largely as a fixed purpose device that did a few things well. I generally move around with my flip phone in airplane mode, then shut down (airplane mode saves state across power cycles, so I can power it on if I want to take a picture of a flyer for some event without having it ping out). But I'll ask for a citation on "Pinging towers while powered off." I'm aware of some attacks on devices that fake a poweroff, but based on "battery state of charge when powered down" analysis (which admittedly isn't very deep), I've seen no evidence of any sort of substantial power draw when shut down - and some of the places I go, there aren't any towers nearby, so it would have to try fairly hard to reach one. But I'm really not sure of how much of your high effort spitball here is actually things doable, or if you assume I've got the time to fully reverse engineer a modern device to, say, scramble the IMEI in the baseband (it seems like the sort of thing there wouldn't be a command to do, so that implies remote code exploits in the baseband to be able to add that capability). It's way, way easier to just not carry a phone.

by derefr 2y ago

dogman144 2y ago

I think you have the right mindset about the most ideal approach, but how-to guides on how to do this *such that* it is only *a few days every few months* to maintain a setup like that are few and far between... as in there aren't any. Sure - same page, digital sovereignty isn't free, if you want it have to work for it. But, speaking as a technical securtiy user myself, and have worked with ghidra, I have zero context on how to take the approach you call for that cleanly strips out the bad stuff without buying me, what would feel to be likely, hours upon hours of troubleshooting dependencies for core functionality that I inadvertantly broke due to the surgery... such that I'm back to not carrying a smart device or being ok with a fliphone traingulating me. One approach I have thought through with effective (I think? still considering this) privacy outcomes is leveraging LLCs and related device plans as a "cloaking" mechanism. If my current phone stays at my house always, I travel locally with a fliphone, and travel with a network of smart phones under LLCs, that could be enough to throw off the tracking effectively while only (maybe?) exposing data that's already exposed in public records.

Syonyk 2y ago

I don't get nearly enough benefit from a smartphone to bother with any of that sort of deep aggressive reverse engineering and patching. It's not worth the time. I don't have a spare "few days every few months" that I want to dedicate to reverse engineering apps that are purpose built to work against my will. > In other words: rather than waiting for an open-source mobile ecosystem that'll never come, we should just be treating mobile devices like we do game consoles: seeing them as something to be jailbroken, modchipped, hacked, brute-forced, overridden, key-extracted, etc. Made to do what you want, and only what you want, when you want — source-availability be damned. Except there are far easier to use options that aren't nearly so locked down, should I want to do general purpose computing. I think the most recent game console I owned was a Wii, but I treated it largely as a fixed purpose device that did a few things well. I generally move around with my flip phone in airplane mode, then shut down (airplane mode saves state across power cycles, so I can power it on if I want to take a picture of a flyer for some event without having it ping out). But I'll ask for a citation on "Pinging towers while powered off." I'm aware of some attacks on devices that fake a poweroff, but based on "battery state of charge when powered down" analysis (which admittedly isn't very deep), I've seen no evidence of any sort of substantial power draw when shut down - and some of the places I go, there aren't any towers nearby, so it would have to try fairly hard to reach one. But I'm really not sure of how much of your high effort spitball here is actually things doable, or if you assume I've got the time to fully reverse engineer a modern device to, say, scramble the IMEI in the baseband (it seems like the sort of thing there wouldn't be a command to do, so that implies remote code exploits in the baseband to be able to add that capability). It's way, way easier to just not carry a phone.