I value the privacy so I don't own or use cellphone.
How did you post this comment?
Computers, ever heard of them ?
How a Hacker Proved Cops Used a Stingray to Find Him
11–20 of 164 posts
Re: How a Hacker Proved Cops Used a Stingray to Find Him
#12Re: How a Hacker Proved Cops Used a Stingray to Find Him
#13Jesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.
It's quite the thing. I profiled it with and without ads, and it looks like the ads are the culprit. There are two of them just sitting there using CPU time the entire time the page is open. (I had two Facebook ads that had animated text being typed. They continued to use 100% of the CPU even when the animation was complete.)
There should really be some sort of CPU/power budget enforced by one's phone on a per page basis. If there's no user action going on, a page should only be allowed to run a certain number of instructions.
Re: How a Hacker Proved Cops Used a Stingray to Find Him
#14Re: How a Hacker Proved Cops Used a Stingray to Find Him
#15I value the privacy so I don't own or use cellphone.
I lost my phone somewhat recently. It's been great: I read more books, and get a lot less distractions throughout the day. The privacy implication is a huge bonus.
The main drawback have been that people rarely label apartment doorbells anymore, so if you don't know which button to press you're in trouble. Another is getting hold of old friends if you don't know their email address (I don't have Facebook either).
Overall, I'm fairly content with the situation, and am seriously considering not getting a new one. Another benefit is that I'm more likely to bring my laptop if I go somewhere, and thus when I do connect to the internet and have time to kill, I often get work done instead of mindlessly browsing HN/reddit or playing games.
Re: How a Hacker Proved Cops Used a Stingray to Find Him
#16Earlier quoted context omitted.
Computers, ever heard of them ?
Parent’s point was probably that the connection used is still traceable
Except that:
1) If you do it from home, the govt already knows where you live, or you can use proxies, or Tor, or a VPN.
2) If you don't do it from home, you are practically anonymous if you change your mac address and use someone else's wireless network, which are ubiquitous today in airports, restaurants, etc.
Re: How a Hacker Proved Cops Used a Stingray to Find Him
#17Jesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.
I keep JS turned off by default on my phone and make exceptions. Brave browser makes it super easy to do this. Politico was actually the reason I started doing this.
Re: How a Hacker Proved Cops Used a Stingray to Find Him
#18The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…
Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into.
The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, things might be different.
I've asked this question over the years since the 1980s: Given that we thought source based routing was a thing, its understandable we designed for simpler times with src IP in the packet but given its not a thing now, and privacy is, why do we still send the src IP in the packet? It doesn't mean anything useful, to most agents. NAT/CGN devices don't actually care, they want you to be consistent about which interface you arrive on, and the 5-tuple has it, but other things could be used which have no end-to-end impact. Beyond the NAT/CGN boundary, nobody cares, routing is solely on the destination and the ASN of the transits. Once at the destination, the payload is available, to find the originators address, to return things.
Src IP is not actually neccessary, in the IP layer. (in theory)
Re: How a Hacker Proved Cops Used a Stingray to Find Him
#19The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…
Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…
If the source IP is encrypted, the recipient needs to decrypt it first in order to be able to send a response. To decrypt it, it needs to either have some shared secret with the sender, or the sender needs to use the recipient's private key.
The parties cannot obtain the shared secret the usual way, the Diffie-Helman exchange. It cannot be performed, because it requires back-and-forth communication, which we are trying to establish in the first place. Of course, we'd still need to use certificates signed by public authorities to deal with the standard MitM concerns.
The alternative would be for the sender to use the recipient's public key to encrypt the source IP address. That would require a DNS-like system that would store and serve public keys corresponding to a given IP address you are trying to communicate with. This is something doable, especially in IPv6 world where you don't really have to reuse IPv6 addresses, but it leads to all kinds of practical problems, figuring out which is probably best left as an exercise for the reader.
Re: How a Hacker Proved Cops Used a Stingray to Find Him
#20I value the privacy so I don't own or use cellphone.
I lost my phone somewhat recently. It's been great: I read more books, and get a lot less distractions throughout the day. The privacy implication is a huge bonus. The main drawback have been that people rarely label apartment doorbells anymore, so if you don't know which button to press you're in trouble. Another is getting hold of old friends if you don't know their email address (I don't have Facebook either). Ove…
You must not be looking for work, or for that matter have a job.
My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.