Live data from Hacker News

The StingRay Is Why the 4th Amendment Was Written (2017)

fee.org

41–50 of 155 posts

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#41
post #32
post #30

Earlier quoted context omitted.

Right. I guess that phones can't update without direct cellular or WiFi connectivity. But I don't know. Is that true? Could one somehow enable updates through pure TCP/IP?

You can update iOS devices through iTunes via USB, or buy an ethernet adapter.

But your computer does need internet, see https://support.apple.com/en-us/HT201442

> If your computer can’t communicate with Apple's software update server, you might see one of these messages.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#42

Between this example and “no knock” warrants (where people get killed, including police) I think it seems obvious that people have forgotten what the point of a warrant is. A warrant is suppose to prevent either of the two cases from resulting in lengthy court battles or death from confusion, and it’s very simple: YOU SHOW THE PERSON BEING SEARCHED THE WARRANT IN ADVANCE! That is how you gain authorization... somehow…

I'm not sure where you are getting this definition of the purpose for warrants, but it's not based on any historical fact that I'm aware of.

The way I'm aware of history, a warrant simply allows for an individual or group to take an action on behalf of the state, specifically by statement from a judge, which would have otherwise been illegal. For some individuals and groups, specifically sworn Law Enforcement officers, they fall within warrant exceptions or broad granted "warrant authorities."

It has no relation to a suspect being notified of a warrant and there is no legal mandate to notify the suspect as far as I am aware.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#44
I work in the field of cell network security research and want to help clear up some misinformation I'm seeing in these comments.

First, I just want to highlight that reason cell site simulators (the more general term for StingRays/IMSI-catchers) exist is because cell phones cannot authenticate all messages coming from cell towers. I'm seeing some vague comments about "a lack of encryption", but it's primarily more of an authentication issue.

You can read more about why it's primarily an authentication issue + how some of the relevant types of cell network attacks work in this technical post I wrote for EFF: https://www.eff.org/wp/gotta-catch-em-all-understanding-how-...

There are some interesting proposals for fixing this lack of authentication using a certificate-based PKI system, the most promising being this paper from Purdue: https://relentless-warrior.github.io/index.php/publications/.... This solution is very far from production-ready, but it's a much-needed step in the right direction.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#45
post #43

Back in 1989, I had this dream that the Poqet PC would evolve into a smartphone. And that one could install Linux or *BSD on it. But no, it just died.

An android phone already runs Linux; you can use it as such, and in many cases gain root.

OTOH what's happening in the baseband processor is impenetrable, and that processor has much more control over the device than a cellular modem would.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#46

Between this example and “no knock” warrants (where people get killed, including police) I think it seems obvious that people have forgotten what the point of a warrant is. A warrant is suppose to prevent either of the two cases from resulting in lengthy court battles or death from confusion, and it’s very simple: YOU SHOW THE PERSON BEING SEARCHED THE WARRANT IN ADVANCE! That is how you gain authorization... somehow…

I'm not sure where you are getting this definition of the purpose for warrants, but it's not based on any historical fact that I'm aware of. The way I'm aware of history, a warrant simply allows for an individual or group to take an action on behalf of the state, specifically by statement from a judge, which would have otherwise been illegal. For some individuals and groups, specifically sworn Law Enforcement officer…

The definition they use follows from the definition you use, but is dependent on the times. If you are given authority to act on a warrant by the state, then you show that to the person you're investigating so they don't shoot you for being on their property.

Without the warrant, they have every right to shoot a strange person walking through their property without permission. Since this was before the concept of Law Enforcement officers (I feel like people forget cops haven't always been a thing in the U.S.), people wouldn't just accept some nobody in a uniform as a person of authority.

There weren't cops, so the warrant was the only way to show you had the authority of the state.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#47

I work in the field of cell network security research and want to help clear up some misinformation I'm seeing in these comments. First, I just want to highlight that reason cell site simulators (the more general term for StingRays/IMSI-catchers) exist is because cell phones cannot authenticate all messages coming from cell towers. I'm seeing some vague comments about "a lack of encryption", but it's primarily more o…

We have SIM cards for 30 years to authenticate unique users to the network, but those same cards can't authenticate the network? No, this is entirely by choice and could have been trivially solved. They just forgot the "server certificate" part.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#48
post #47

I work in the field of cell network security research and want to help clear up some misinformation I'm seeing in these comments. First, I just want to highlight that reason cell site simulators (the more general term for StingRays/IMSI-catchers) exist is because cell phones cannot authenticate all messages coming from cell towers. I'm seeing some vague comments about "a lack of encryption", but it's primarily more o…

We have SIM cards for 30 years to authenticate unique users to the network, but those same cards can't authenticate the network? No, this is entirely by choice and could have been trivially solved. They just forgot the "server certificate" part.

I'd say it's less a "choice" than an "oversight". SIM cards solve the problem of "how do we know if Random Phone is attached to an account and the bill is paid?" The question of "how does the phone know it's talking to a real tower" was never even ASKED, as the very idea would have seemed preposterous.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#49

Between this example and “no knock” warrants (where people get killed, including police) I think it seems obvious that people have forgotten what the point of a warrant is. A warrant is suppose to prevent either of the two cases from resulting in lengthy court battles or death from confusion, and it’s very simple: YOU SHOW THE PERSON BEING SEARCHED THE WARRANT IN ADVANCE! That is how you gain authorization... somehow…

> That’s literally the fundamental purpose of a constitutional warrant!

This sounds revisionist. Bounties, paid on warrants calling for the suspect dead or alive, were common and legal through American history.

Re: The StingRay Is Why the 4th Amendment Was Written (2017)

#50
post #48
post #47

Earlier quoted context omitted.

We have SIM cards for 30 years to authenticate unique users to the network, but those same cards can't authenticate the network? No, this is entirely by choice and could have been trivially solved. They just forgot the "server certificate" part.

I'd say it's less a "choice" than an "oversight". SIM cards solve the problem of "how do we know if Random Phone is attached to an account and the bill is paid?" The question of "how does the phone know it's talking to a real tower" was never even ASKED, as the very idea would have seemed preposterous.

The movie War Games came out 36 years ago, so the claim that no-one was even asking themselves about the value of authentication in public services all these years seems preposterous.
Post reply on HN