4 ms·

Automatic license plate scanning is bad enough, but at least some people are concerned about it. Meanwhile, the much more detail information that the phone comp

by pdkl95 11y ago

Automatic license plate scanning is bad enough, but at least some people are concerned about it. Meanwhile, the much more detail information that the phone companies gather for themselves and the NSA as part of COTRAVELER[1] has apparently been entirely forgotten. Building a map of where your license plate has been is bad enough. The map of which {micro,pico,femto}cell you phone has been near will contain far more detailed travel information. It didn't even require any clever hacks or software vulnerabilities; COTRAVELER only required writing a few INNER JOIN / WHERE clauses. It doesn't even use any private information: it only needs the metadata. Unfortunately, I expect that the conclusion - that it is probably a bad idea in the long run for everybody to be carrying a radio transponder in their pocket - is going to be ignore (or actively avoided). Cognitive dissonance can be a powerful motivator, and these properties - necessarily common to all mobile communication devices are very dissonant with the common socially-acceptable addiction to social media and "being available" that keeps everybody tied to cell phone. [1] http://www.washingtonpost.com/apps/g/page/world/how-the-nsa-is-tracking-people-right-now/634/ http://www.washingtonpost.com/apps/g/page/world/how-the-nsa-...

new299 11y ago
> necessarily common to all mobile communication devices I think there are possible technical solutions if there was a will to adopt them. The main problem is authenticating with the network, if unauthenticated wireless networks were generally available then it would likely make tracking harder. I think even if you are paying for network access then there could be technical solutions to the problem. Perhaps authentication tokens which were purchased but not linked to a user. I guess fundamentally, breaking apart network access authentication and user identification/authentication would be good. But I agree, I doubt people are motivated enough to seek out a solution.
- pdkl95 11y ago
  While I don't completely rule-out the possibility of finding a technical solution, if such a solution exists it is going to be really hard to find. Re-associating "anonymized" tokens is a lot easier than it looks in many situations, and it doesn't take much data leakage to JOIN tables together. I would love to be wrong on this topic. It would be absolutely incredible if someone can invent a way to make mobile devices still work without leaking any information that can be tracked. I totally agree with separating authentication from authorization; we need to do that anywhere it is possible, not just for mobile devices. Unfortunately, the trend has been in the reverse direction. :/
  - new299 11y ago
    I would have thought the problem in mobile networks might be easier than elsewhere. Where the wireless network is public infrastructure, for example, if devices used randomized MACs then I'd imagine it'd make them much harder to track. You'd still need to authenticate with a VOIP provider. But by breaking out these services I would guess it would make tracking much harder.
pdkl95 11y ago
Hmm... as the multiple down-voters left no explanation... I wonder which motivation is more likely: cell-phone addicts that don't want o think about long-term consequences of their habit, JTRIG-style trolling that doesn't like discussion about COTRAVELER, or one of the enemies I've made that like to down-vote most of my posts.

by pdkl95 11y ago

new299 11y ago

> necessarily common to all mobile communication devices I think there are possible technical solutions if there was a will to adopt them. The main problem is authenticating with the network, if unauthenticated wireless networks were generally available then it would likely make tracking harder. I think even if you are paying for network access then there could be technical solutions to the problem. Perhaps authentication tokens which were purchased but not linked to a user. I guess fundamentally, breaking apart network access authentication and user identification/authentication would be good. But I agree, I doubt people are motivated enough to seek out a solution.

pdkl95 11y ago
While I don't completely rule-out the possibility of finding a technical solution, if such a solution exists it is going to be really hard to find. Re-associating "anonymized" tokens is a lot easier than it looks in many situations, and it doesn't take much data leakage to JOIN tables together. I would love to be wrong on this topic. It would be absolutely incredible if someone can invent a way to make mobile devices still work without leaking any information that can be tracked. I totally agree with separating authentication from authorization; we need to do that anywhere it is possible, not just for mobile devices. Unfortunately, the trend has been in the reverse direction. :/
- new299 11y ago
  I would have thought the problem in mobile networks might be easier than elsewhere. Where the wireless network is public infrastructure, for example, if devices used randomized MACs then I'd imagine it'd make them much harder to track. You'd still need to authenticate with a VOIP provider. But by breaking out these services I would guess it would make tracking much harder.

pdkl95 11y ago

Hmm... as the multiple down-voters left no explanation... I wonder which motivation is more likely: cell-phone addicts that don't want o think about long-term consequences of their habit, JTRIG-style trolling that doesn't like discussion about COTRAVELER, or one of the enemies I've made that like to down-vote most of my posts.