4 ms·

If it takes research by a leading academic to uncover this device behavior then what hope is there for us mere morals who don't want their identity to be tracke

If it takes research by a leading academic to uncover this device behavior then what hope is there for us mere morals who don't want their identity to be tracked and traded? Is it impossible to use a smart phone with strict privacy, or just very difficult?

Am4TIfIsER0ppos 2y ago
> Is it impossible to use a smart phone with strict privacy? Yes. It is a surveillance device pushed by government for this reason.
- shadowgovt 2y ago
  It's also a surveillance device in its design. The mechanism of it is to connect to one or more third-party-owned towers to bidirectionally transpond data. By the nature of the machine, calculating roughly where the machine is every time it transponds is very straightforward. "I want to send and receive messages from you but you're not allowed to know anything about me" is, at first pass, a tall order. We can sort of get that from the postal system and very little else in terms of communications technologies (and even then, if you screw with the network the postal service in the US is empowered federally to hunt you down).
- master-lincoln 2y ago
  What makes you believe it is pushed by government (and which government?) and why do you think that government wants to collect private info of everybody without letting them know and is there any evidence for it? Sorry for all these questions, but without them answered your claim sounds like a conspiracy theory.
  - fifticon 2y ago
    in my country there are plenty of critical services you basically can't access without mobile apps. e.g. interacting with medical services, and official personal id app.
  - dredmorbius 2y ago
    One project strongly resembling this was called NTIS, the National Strategy for Trusted Identities in Cyberspace, detailed in a 2011 O'Reilly Radar piece by Alex Howard, now only available via archive: "A Manhattan Project for online identity: A look at the White House's National Strategy for Trusted Identities in Cyberspace" <https://web.archive.org/web/20110506083805/http://radar.oreilly.com/2011/05/nstic-analysis-identity-privacy.html https://web.archive.org/web/20110506083805/http://radar.orei...> In part: The NSTIC proposes the creation of an "identity ecosystem" online, "where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities." The strategy puts government in the role of a convener, verifying and certifying identity providers in a trust framework. I'd learned about this in 2018/19 as Google+ was shutting down, through a Search Engine Journal piece (leveraging Howard's earlier article heavily), similarly only available as an archive, with the original article substituted in place with another at the same URL. This one by Kristine Schachinger: "In Memoriam: The Rise, Fall & Death of Google Plus" ...Google was only going to be one of many identity service providers for a program run by the Federal Government called the NSTIC, or National Strategy for Trusted Identities in Cyberspace.... <https://web.archive.org/web/20181220165659/https://www.searchenginejournal.com/google-plus-history-death/283685/ https://web.archive.org/web/20181220165659/https://www.searc...> I'll note that neither article makes a direct link to mobile phones / smartphones, but clearly as those became widespread and individually identified with a single person for the most part, use of phone numbers as unique identifiers became widespread. Indeed, on Google+, over four billion accounts were eventually compiled, those being automatically granted to every registered Android device through about 2016 (the practice stopped about then). Google increasingly required phone numbers for account registration and recovery, "bribing" G+ members with "vanity" account names if they'd supply same.[1] The use of phone numbers as account validation tokens on numerous other services is now widespread. ________________________________ Notes: 1. I resisted the bait. Ironically, the vanity names couldn't be mapped back to the 20-ish digit UUID that otherwise identified accounts, and those who did make use of the nonnumeric IDs were largely excluded from archival efforts to save G+ content when the service shut down in 2019. I managed to create at least two backups of my own (non-vain) content, for what that's worth.
  - Am4TIfIsER0ppos 2y ago
    It is a conspiracy theory. My theory is that big tech and government collaborate to surveil us all, sometimes willingly, sometimes openly. All governments at all levels. Ever see a government service, office, or bureau talk of an app or show a QR code? That is a carrot for those who already use and stick for those who don't. Sometimes there is a paper form you can get and sometimes not. Do you recall all those covid apps? Why? Because the government desires to know, for a variety of reasons. The US so they can watch your small payments. Europe so they can watch your speech and carbon footprint. Used to be so they could track you if you had a 1% deadly disease. [EDIT] Evidence? Snowden's leaks and what I mentioned already
- pessimizer 2y ago
  Smartphone isn't really even a device category, it's a legal category. I barely ever use my phone as a phone; I don't talk on it, I type on it and tap on it; it's just a computer and an access point to networks. But it's a special kind of computer where all the laws are different, I have different rights when I'm near it or using it, and I am in constant battle with the companies that sold the phone to me to 1) try to keep my life as private as I can and 2) not pay them a commission on things I buy. But what can I say about my phone that I couldn't now say about my TV, or my car? This will never become less dangerous, this will become increasingly more dangerous.
ugurs 2y ago
Switching to an alternative on Android, like GrapheneOS or CalyxOS, can help you regain some of the privacy you've lost. If you are an Apple user, good luck.
RandomBacon 2y ago
It might be that our only choice is something like the Librem 5 phone. Disclaimer: I have a Librem 5 but don't use it. I use GrapheneOS on a Pixel. GrapheneOS isn't supposed to be for privacy though, as they focus on security instead. I don't think it would be too much to ask for a little help on the privacy front, but that might be ignorant of me.
grayhatter 2y ago
It's not hard for you mere mortals to figure out that all software from the company that tracks you is going to track you. If your privacy requirements are so strict that you can't permit any information to flow back to Google, consider GraphineOS or any other degoogled rom. This isn't a hard thing to do. For what it's worth, I disagree with a number of the most important conclusions the author makes in the paper.
- cptskippy 2y ago
  Doesn't GrapheneOS only support Google Phones? Do we know everything that's running on a Pixel? At a minimum there's an unknown Qualcomm RTOS running the baseband.
  - grayhatter 2y ago
    GraphineOS only target's phones with better than average hardware security, yes and you think the Qualcomm RTOS can do what exactly? > Do we know everything that's running on a Pixel? did you mean hardware, or software?
    - nehal3m 2y ago
      >and you think the Qualcomm RTOS can do what exactly? Well that's the point, it's a black box so there's no telling what it can and can't do. There's what Qualcomm says it can do, and then there's what it can do.
      - grayhatter 2y ago
        Then that's a really weak point. There's a lot of things we know it can't do. It can't break the encryption between software, and remote servers. It also can't cause the phone to levitate. It also can't recharge my battery. As a rule, I don't worry unlikely hypotheticals, because doing so is a needless denial of service on my brain. Saying it's a blackbox is true, but that doesn't mean you get to invent random things to worry about, without direct evidence it's connected to the specific device we're discussing. But do think I should at least try to meet you half way, so maybe I can preempt a few things that used to be true or possible. The baseband also can't install software into my android OS. It also can't directly read memory from my phone. It can't directly control my phone's bootup. These are things poorly designed phones used to be able to do, that aren't possible on the Pixel line of hardware because it was designed to prevent them. That's why GraphineOS targets the pixel line. Because it's hardware is designed in a way to enable a secure device.
MYEUHD 2y ago
Install a custom Rom, and don't install google apps. If you need some functionality from google play services, there's microg.
GeekyBear 2y ago
Even when you carry a dumb phone, your cellular carrier tracks your location via cell tower triangulation. It's less accurate than GPS, but constant. > The FCC said it found the carriers each sold access to its customers’ location information to ‘aggregators,’ who then resold access to the information to third-party location-based service providers. https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/ https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wire...
- like_any_other 2y ago
  You don't leave a leak in a boat unplugged just because it's not the only one.
- deleted 2y ago
  [deleted]
- knowitnone 2y ago
  Yes except they only have your location and that may not be acceptable to some. Google on the otherhand has much more than just your location - everything you look at, everything you buy, every email/text conversation
  - GeekyBear 2y ago
    Your cellular carrier also has your identity and your billing address. Companies that have chosen a surveillance capitalism business model have way more personal data, but they claim that they aren't selling that data to anyone willing to cut them a check the way that the carriers and app developers do. However, data hordes stored by Google/Facebook/etc are still subject to warrants, so how much do you trust that warrants will not be abused?
knowitnone 2y ago
How about not buying into the Google/Microsoft/Apple/Samsung/etc ecosystem?
skeledrew 2y ago
It takes more effort, but far less than you're thinking I wager. I protect myself from Google - and a few others - as much as is practical for me through firewalling. On both my previous and current device I have never signed into a Google account, all of Google's apps are disabled (except the gallery, as disabling it breaks a key integration), and Rethink DNS manages all outgoing network connections at the app level. I use Aurora to access the Play Store (and also F-Droid and Obtainium), FairMail for email, and a variety of other alternatives. It takes a bit to get it all configured initially, but once done it's sufficiently smooth sailing with occasional tweaks. The only thing that annoys me sometimes is that notifications no longer work properly for many apps, as the majority use Google's notifications service. Accessing OS updates may also become problematic, depending on the device OEM.

Am4TIfIsER0ppos 2y ago

> Is it impossible to use a smart phone with strict privacy? Yes. It is a surveillance device pushed by government for this reason.

shadowgovt 2y ago
It's also a surveillance device in its design. The mechanism of it is to connect to one or more third-party-owned towers to bidirectionally transpond data. By the nature of the machine, calculating roughly where the machine is every time it transponds is very straightforward. "I want to send and receive messages from you but you're not allowed to know anything about me" is, at first pass, a tall order. We can sort of get that from the postal system and very little else in terms of communications technologies (and even then, if you screw with the network the postal service in the US is empowered federally to hunt you down).
master-lincoln 2y ago
What makes you believe it is pushed by government (and which government?) and why do you think that government wants to collect private info of everybody without letting them know and is there any evidence for it? Sorry for all these questions, but without them answered your claim sounds like a conspiracy theory.
- fifticon 2y ago
  in my country there are plenty of critical services you basically can't access without mobile apps. e.g. interacting with medical services, and official personal id app.
- dredmorbius 2y ago
  One project strongly resembling this was called NTIS, the National Strategy for Trusted Identities in Cyberspace, detailed in a 2011 O'Reilly Radar piece by Alex Howard, now only available via archive: "A Manhattan Project for online identity: A look at the White House's National Strategy for Trusted Identities in Cyberspace" <https://web.archive.org/web/20110506083805/http://radar.oreilly.com/2011/05/nstic-analysis-identity-privacy.html https://web.archive.org/web/20110506083805/http://radar.orei...> In part: The NSTIC proposes the creation of an "identity ecosystem" online, "where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities." The strategy puts government in the role of a convener, verifying and certifying identity providers in a trust framework. I'd learned about this in 2018/19 as Google+ was shutting down, through a Search Engine Journal piece (leveraging Howard's earlier article heavily), similarly only available as an archive, with the original article substituted in place with another at the same URL. This one by Kristine Schachinger: "In Memoriam: The Rise, Fall & Death of Google Plus" ...Google was only going to be one of many identity service providers for a program run by the Federal Government called the NSTIC, or National Strategy for Trusted Identities in Cyberspace.... <https://web.archive.org/web/20181220165659/https://www.searchenginejournal.com/google-plus-history-death/283685/ https://web.archive.org/web/20181220165659/https://www.searc...> I'll note that neither article makes a direct link to mobile phones / smartphones, but clearly as those became widespread and individually identified with a single person for the most part, use of phone numbers as unique identifiers became widespread. Indeed, on Google+, over four billion accounts were eventually compiled, those being automatically granted to every registered Android device through about 2016 (the practice stopped about then). Google increasingly required phone numbers for account registration and recovery, "bribing" G+ members with "vanity" account names if they'd supply same.[1] The use of phone numbers as account validation tokens on numerous other services is now widespread. ________________________________ Notes: 1. I resisted the bait. Ironically, the vanity names couldn't be mapped back to the 20-ish digit UUID that otherwise identified accounts, and those who did make use of the nonnumeric IDs were largely excluded from archival efforts to save G+ content when the service shut down in 2019. I managed to create at least two backups of my own (non-vain) content, for what that's worth.
- Am4TIfIsER0ppos 2y ago
  It is a conspiracy theory. My theory is that big tech and government collaborate to surveil us all, sometimes willingly, sometimes openly. All governments at all levels. Ever see a government service, office, or bureau talk of an app or show a QR code? That is a carrot for those who already use and stick for those who don't. Sometimes there is a paper form you can get and sometimes not. Do you recall all those covid apps? Why? Because the government desires to know, for a variety of reasons. The US so they can watch your small payments. Europe so they can watch your speech and carbon footprint. Used to be so they could track you if you had a 1% deadly disease. [EDIT] Evidence? Snowden's leaks and what I mentioned already
pessimizer 2y ago
Smartphone isn't really even a device category, it's a legal category. I barely ever use my phone as a phone; I don't talk on it, I type on it and tap on it; it's just a computer and an access point to networks. But it's a special kind of computer where all the laws are different, I have different rights when I'm near it or using it, and I am in constant battle with the companies that sold the phone to me to 1) try to keep my life as private as I can and 2) not pay them a commission on things I buy. But what can I say about my phone that I couldn't now say about my TV, or my car? This will never become less dangerous, this will become increasingly more dangerous.

ugurs 2y ago

Switching to an alternative on Android, like GrapheneOS or CalyxOS, can help you regain some of the privacy you've lost. If you are an Apple user, good luck.

RandomBacon 2y ago

It might be that our only choice is something like the Librem 5 phone. Disclaimer: I have a Librem 5 but don't use it. I use GrapheneOS on a Pixel. GrapheneOS isn't supposed to be for privacy though, as they focus on security instead. I don't think it would be too much to ask for a little help on the privacy front, but that might be ignorant of me.

grayhatter 2y ago

It's not hard for you mere mortals to figure out that all software from the company that tracks you is going to track you. If your privacy requirements are so strict that you can't permit any information to flow back to Google, consider GraphineOS or any other degoogled rom. This isn't a hard thing to do. For what it's worth, I disagree with a number of the most important conclusions the author makes in the paper.

cptskippy 2y ago
Doesn't GrapheneOS only support Google Phones? Do we know everything that's running on a Pixel? At a minimum there's an unknown Qualcomm RTOS running the baseband.
- grayhatter 2y ago
  GraphineOS only target's phones with better than average hardware security, yes and you think the Qualcomm RTOS can do what exactly? > Do we know everything that's running on a Pixel? did you mean hardware, or software?
  - nehal3m 2y ago
    >and you think the Qualcomm RTOS can do what exactly? Well that's the point, it's a black box so there's no telling what it can and can't do. There's what Qualcomm says it can do, and then there's what it can do.
    - grayhatter 2y ago
      Then that's a really weak point. There's a lot of things we know it can't do. It can't break the encryption between software, and remote servers. It also can't cause the phone to levitate. It also can't recharge my battery. As a rule, I don't worry unlikely hypotheticals, because doing so is a needless denial of service on my brain. Saying it's a blackbox is true, but that doesn't mean you get to invent random things to worry about, without direct evidence it's connected to the specific device we're discussing. But do think I should at least try to meet you half way, so maybe I can preempt a few things that used to be true or possible. The baseband also can't install software into my android OS. It also can't directly read memory from my phone. It can't directly control my phone's bootup. These are things poorly designed phones used to be able to do, that aren't possible on the Pixel line of hardware because it was designed to prevent them. That's why GraphineOS targets the pixel line. Because it's hardware is designed in a way to enable a secure device.

MYEUHD 2y ago

Install a custom Rom, and don't install google apps. If you need some functionality from google play services, there's microg.

GeekyBear 2y ago

Even when you carry a dumb phone, your cellular carrier tracks your location via cell tower triangulation. It's less accurate than GPS, but constant. > The FCC said it found the carriers each sold access to its customers’ location information to ‘aggregators,’ who then resold access to the information to third-party location-based service providers. https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/ https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wire...

like_any_other 2y ago
You don't leave a leak in a boat unplugged just because it's not the only one.
deleted 2y ago
[deleted]
knowitnone 2y ago
Yes except they only have your location and that may not be acceptable to some. Google on the otherhand has much more than just your location - everything you look at, everything you buy, every email/text conversation
- GeekyBear 2y ago
  Your cellular carrier also has your identity and your billing address. Companies that have chosen a surveillance capitalism business model have way more personal data, but they claim that they aren't selling that data to anyone willing to cut them a check the way that the carriers and app developers do. However, data hordes stored by Google/Facebook/etc are still subject to warrants, so how much do you trust that warrants will not be abused?

knowitnone 2y ago

How about not buying into the Google/Microsoft/Apple/Samsung/etc ecosystem?

skeledrew 2y ago

It takes more effort, but far less than you're thinking I wager. I protect myself from Google - and a few others - as much as is practical for me through firewalling. On both my previous and current device I have never signed into a Google account, all of Google's apps are disabled (except the gallery, as disabling it breaks a key integration), and Rethink DNS manages all outgoing network connections at the app level. I use Aurora to access the Play Store (and also F-Droid and Obtainium), FairMail for email, and a variety of other alternatives. It takes a bit to get it all configured initially, but once done it's sufficiently smooth sailing with occasional tweaks. The only thing that annoys me sometimes is that notifications no longer work properly for many apps, as the majority use Google's notifications service. Accessing OS updates may also become problematic, depending on the device OEM.