Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a Hacker Proved Cops Used a Stingray to Find Him

politico.com

Post reply on HN
Print view View original

21–30 of 164 posts

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#21

Post by Ao7bei3s »

ggm wrote: post #18
panarky wrote: post #6

The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

* Secure handshaking requires interactivity, unless you share secrets with your actual partner (no, your CA trust store isn't enough) in advance. So your first packet would leak it.

* To return ICMP error messages ("destination unreachable"), otherwise you'd have long timeouts.

* Ratelimiting outside the server (e.g. DDOS protection). Many ISPs do actually filter source IPs. (Of course you can't on the backbone, any there are plenty shady AS.)

* Leaving it off won't help against correlation attacks.

* Most applications will need it, so it makes sense to have it in the network layer instead of coming up with incompatible implementations above.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#22

Post by l_t »

Aloha wrote: post #20
ymse wrote: post #15

Earlier quoted context omitted.

I lost my phone somewhat recently. It's been great: I read more books, and get a lot less distractions throughout the day. The privacy implication is a huge bonus. The main drawback have been that people rarely label apartment doorbells anymore, so if you don't know which button to press you're in trouble. Another is getting hold of old friends if you don't know their email address (I don't have Facebook either). Ove…

You must not be looking for work, or for that matter have a job. My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.

I don't see a strong reason for a software developer to need a phone:

- Async communication (slack/email) can be checked at your computer.

- Voice calls are usually done with your computer anyway.

- If you are on call, an old-fashioned pager can be used.

Frankly, although I do have a smartphone, I wouldn't want a job where I was required to use it, or one where I was expected to be available at all times unless on call.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#23

Post by mehrdadn »

ggm wrote: post #18
panarky wrote: post #6

The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

How would you return errors if the destination is known to be unreachable?

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#24

Post by Swizec »

Aloha wrote: post #20
ymse wrote: post #15

Earlier quoted context omitted.

I lost my phone somewhat recently. It's been great: I read more books, and get a lot less distractions throughout the day. The privacy implication is a huge bonus. The main drawback have been that people rarely label apartment doorbells anymore, so if you don't know which button to press you're in trouble. Another is getting hold of old friends if you don't know their email address (I don't have Facebook either). Ove…

You must not be looking for work, or for that matter have a job. My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.

There are a lot of jobs you can do without a phone. Like starbucks barista, or software engineer.

And the jobs that require a phone often come with a phone provided. So you still don’t need one yourself.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#25

Post by ymse »

Aloha wrote: post #20
ymse wrote: post #15

Earlier quoted context omitted.

I lost my phone somewhat recently. It's been great: I read more books, and get a lot less distractions throughout the day. The privacy implication is a huge bonus. The main drawback have been that people rarely label apartment doorbells anymore, so if you don't know which button to press you're in trouble. Another is getting hold of old friends if you don't know their email address (I don't have Facebook either). Ove…

You must not be looking for work, or for that matter have a job. My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.

Ha, funny you should mention that. I am in fact looking for a job. Luckily the one interview I've had since losing the phone was on-site.

If I need to participate in on-call rotation or similar, I expect the employer to issue a phone. For a remote job, I will obviously get one myself -- but then strictly for job-related activities.

(by the way, if anyone is looking for an experienced infrastructure engineer/"DevOps" guy, give me a cal...errh email)

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#26

Post by mthoms »

alistproducer2 wrote: post #17
erentz wrote: post #2

Jesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.

I keep JS turned off by default on my phone and make exceptions. Brave browser makes it super easy to do this. Politico was actually the reason I started doing this.

Just one of many great reasons to use Brave.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#27

Post by lhuser123 »

mthoms wrote: post #26
alistproducer2 wrote: post #17

Earlier quoted context omitted.

I keep JS turned off by default on my phone and make exceptions. Brave browser makes it super easy to do this. Politico was actually the reason I started doing this.

Just one of many great reasons to use Brave.

Wao, just installed Brave and it also has fingerprinting protection. Does that really works ? I didn’t find it in Firefox.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#29

Post by MaulingMonkey »

ymse wrote: post #25
Aloha wrote: post #20

Earlier quoted context omitted.

You must not be looking for work, or for that matter have a job. My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.

Ha, funny you should mention that. I am in fact looking for a job. Luckily the one interview I've had since losing the phone was on-site. If I need to participate in on-call rotation or similar, I expect the employer to issue a phone. For a remote job, I will obviously get one myself -- but then strictly for job-related activities. (by the way, if anyone is looking for an experienced infrastructure engineer/"DevOps"…

A skype number or somesuch might do in a pinch even for phone interviews.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#30

Post by MaulingMonkey »

l_t wrote: post #22
Aloha wrote: post #20

Earlier quoted context omitted.

You must not be looking for work, or for that matter have a job. My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.

I don't see a strong reason for a software developer to need a phone: - Async communication (slack/email) can be checked at your computer. - Voice calls are usually done with your computer anyway. - If you are on call, an old-fashioned pager can be used. Frankly, although I do have a smartphone, I wouldn't want a job where I was required to use it, or one where I was expected to be available at all times unless on ca…

Ditto. ~9 months into my current software developer gig and the only time I used it for work was when the company internet was down, and the data service was bad enough that I barely even used it for that. The idea that they anyone "must not [...] for that matter have a job" if they don't miss their phone is bogus.
Post reply on HN