Earlier quoted context omitted.
Encryption does not fix this completely even if you assume all texts and voice calls are encrypted. The metadata is equally important: - your location in time and space - the numbers you contacted - the duration of contact
Metadata is useful but it's a stretch to call it equally important as actual call content. If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls?
The StingRay Is Why the 4th Amendment Was Written (2017)
21–30 of 155 posts
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#22Why does law enforcement bother? Can't they just get the info from the telcos?
That requires a warrant. Surprised the FCC allows them to tamper with peoples phones tbh. Its all sketchy as heck and flawed if cases are dismissed when they question how the tech works.
All rather moot as these things are mostly used for various forms of illegal surveillance. The police have to keep their activity as secret as possible. That includes the fact that they are using them in the first place.
This whole issue isn't new. The police normally do, or get others to do, surveillance that is illegal in various ways. The existence of these sorts of devices is an expression of a kind of desperation. Privacy is getting too good. So this might actually be a good thing if this forces a long overdue discussion.
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#23Seems like a strong case for encryption. Why is it even possible for these devices to read your info?
One of the key functions of a cell tower is to know what devices are connecting to it. This is important information for things like routing calls, delivering messages, etc. As you say, all of that can and should be encrypted. With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable par…
The comment from mirimir elsewhere in this thread reminds me that this is kind of an overstatement, or at least that the details are complicated.
You could gain a lot of privacy in this regard by separating mobile data services from telephony and identity. For example, you could imagine paying for mobile data anonymously, either using existing prepaid mobile data services or using a hypothetical future service with blinded payment tokens and only extremely-ephemeral device identifiers. Then you could imagine getting all of your identity and communications services from someone totally independent of your mobile data provider. If the mobile data provider cooperated with your application-layer communications service provider more than you wanted, you could try to create your own service instead, or try to route at least the messaging setup part of the process via Tor or other proxies, so that the mobile data operator and application-layer intermediaries didn't even know about the connection.
I'm not sure anyone other than privacy advocates would consider this progress relative to the current situation; certainly carriers and governments would like it a lot less (it might already be illegal in some jurisdictions in various ways), and most users would probably find that it increased cost while decreasing reliability and usability of some services. It could also make it harder to use the network to investigate or deter device theft, as well as harder to investigate application-layer fraud and account hijacking.
To be clear about what could change, it's true that towers will always know which devices are connecting to them at a particular moment, but this could in principle be separated from billing, identity, and any kind of persistent identifier. So they don't have to know that a particular device is being used by you, or that a particular device is being used by the same person who uses a particular application-layer identity.
The other problem in trying to get there right now without carriers' and governments' cooperation is that, since you can't rotate hardware identifiers on GSM interfaces, a carrier can see your movement patterns for the lifetime of your use of a particular device, and can probably determine that those movement patterns are similar enough to another device's movements that they're probably used by the same person.
Sometime I hope to write a long article on possible non-metadata-collecting mobile communications futures. It's a really interesting topic.
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#24Earlier quoted context omitted.
Encryption does not fix this completely even if you assume all texts and voice calls are encrypted. The metadata is equally important: - your location in time and space - the numbers you contacted - the duration of contact
Metadata is useful but it's a stretch to call it equally important as actual call content. If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls?
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#25Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#26Wasn't this behaviour already ruled unconstitutional in Kyllo v United States ( https://en.wikipedia.org/wiki/Kyllo_v._United_States )?
> Kyllo then petitioned the Supreme Court for a writ of certiorari, which was granted.
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#27the simple solution is for cell phones to have a whitelist of cell towers that they connect to with GPS locations of those towers, it could even compare against known databases of towers [0]... Until some software like that gets implemented, this will keep happening. [0] https://opencellid.org/
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#28Seems like a strong case for encryption. Why is it even possible for these devices to read your info?
Because phones are totally insecure. The only secure option is using an external WiFi or cellular data router for Internet connectivity. The router can of course be geolocated. And adversaries may gain some access. But it should be possible to prevent access through it to the phone. That is, it's a firewall. Then do end-to-end encrypted Internet stuff, messaging and VoIP. And by using some mix of VPNs and Tor, advers…
The only exception to this is the checkm8 vulnerability, which can be performed on an A11 and older chips (so iPhone XR/XS/XS+ and 11/11 pro/11 pro max aren't vulnerable) from DFU mode, which doesn't need the device passcode.
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#29Seems like a strong case for encryption. Why is it even possible for these devices to read your info?
Because phones are totally insecure. The only secure option is using an external WiFi or cellular data router for Internet connectivity. The router can of course be geolocated. And adversaries may gain some access. But it should be possible to prevent access through it to the phone. That is, it's a firewall. Then do end-to-end encrypted Internet stuff, messaging and VoIP. And by using some mix of VPNs and Tor, advers…
Re: The StingRay Is Why the 4th Amendment Was Written (2017)
#30Earlier quoted context omitted.
Because phones are totally insecure. The only secure option is using an external WiFi or cellular data router for Internet connectivity. The router can of course be geolocated. And adversaries may gain some access. But it should be possible to prevent access through it to the phone. That is, it's a firewall. Then do end-to-end encrypted Internet stuff, messaging and VoIP. And by using some mix of VPNs and Tor, advers…
iOS's only security issue is users not updating and being vulnerable to well known vulnerabilities. Neither iOS nor Android will survive a truly targeted nation state attack, but for most people 0-days aren't worth protecting against. The only exception to this is the checkm8 vulnerability, which can be performed on an A11 and older chips (so iPhone XR/XS/XS+ and 11/11 pro/11 pro max aren't vulnerable) from DFU mode,…
Is that true?
Could one somehow enable updates through pure TCP/IP?