Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PGPP (Pretty Good Phone Privacy) Beta Launch

invisv.com

Post reply on HN
Print view View original

41–50 of 104 posts

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#41

Post by prschmitt »

jimhi wrote: post #40

You assign users a temporary IMSI which is done in the cloud right? How does this protect against IMSI catchers and Stingrays if they are done local to you? Local cell tower spoofing? Also, this is just for data? So if you have another SIM for voice/SMS this is completely negated?

By decoupling the user identity from a permanent, globally unique IMSI, we make IMSI catcher / Stingray attacks less "useful" as the IMSI is changing and isn't tied to the user. They can attack your IMSI, but it won't be tied to you and it is ephemeral.

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#42

Post by sneak »

selectodude wrote: post #34
nibbleshifter wrote: post #31

Earlier quoted context omitted.

> There are credit cards that aren't linked to a person My desire to know more intensifies.

https://www.amexgiftcard.com/ Go to the grocery store, buy with cash, you're good to go.

No. All payment cards in the United States require strong government identity and KYC, per US federal law. To activate these cards you must provide identity information. Providing false information is a crime.

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#43

Post by codethief »

barathr wrote: post #2

Just wanted to say hi – I’m one of the co-founders of this effort and would love to answer any questions or discuss further. Also wanted to add, since this is a common question: does PGPP protect all identifiers or just some? As with most privacy systems, just some. Our aim is twofold: 1) to decouple a user's human identity from their network identities (mobile and Internet) and 2) randomize their network identities.…

Hi barathr, thanks for joining the discussion! Having had a brief look at your paper and the Usenix slides[0], I've got three questions:

- Given that your Android app is security-critical for its users, are you planning on open-sourcing it in the near future?

- How exactly does your app work on Android? How does it rotate the IMSI? (I don't know a lot about eSIMs but I would have thought a regular app can't easily change the carrier/network settings.)

- As for the relay functionality, I suppose on Android this "simply" sets up a VPN once the network connection is established?

[0]: https://www.usenix.org/conference/usenixsecurity21/presentat...

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#44

Post by biktor_gj »

sneak wrote: post #27
barathr wrote: post #24

Earlier quoted context omitted.

This is one of the problems with mobile -- there's isn't any one universally correct answer to this (or most questions), so I'll answer to the best of my knowledge. IMSIs are what are associated with your identity (because it's your SIM and service) in a normal mobile plan, and it's what was (is?) used by carriers when they aggregate / analyze / sell location data. IMEIs can be queried by a network core (not the towe…

> IMEIs can be queried by a network core (not the tower) and US carriers probably do this every once in a while to check against their stolen phone database. It can be changed on some devices but not others. It's not inherently tied to you as a person but of course it is tied to that device. It's also linked to the rotating IMSI, so all of the rotating IMSIs that are used at the times the IMEI is interrogated are lin…

Probably on every connect, there are ways to randomize your IMEI on every boot on certain phones though (that might be not very legal in some countries)

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#45

Post by chmod775 »

I don't like that this is piggybacking on the recognizable name of an open standard and not-for-profit software while being considerably less open (Where's the RFC? Where's the source code?) and being for-profit.

This is a bit like calling your company "Red Cross Pharmaceuticals" despite not being affiliated with them.

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#46

Post by nibbleshifter »

cmroanirgo wrote: post #35
nibbleshifter wrote: post #31

Earlier quoted context omitted.

> There are credit cards that aren't linked to a person My desire to know more intensifies.

You can buy visa gift cards for cash

I haven't been able to do that in Europe without providing ID for well over a decade.

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#47

Post by mrex »

throwaway81523 wrote: post #37
barathr wrote: post #2

Just wanted to say hi – I’m one of the co-founders of this effort and would love to answer any questions or discuss further. Also wanted to add, since this is a common question: does PGPP protect all identifiers or just some? As with most privacy systems, just some. Our aim is twofold: 1) to decouple a user's human identity from their network identities (mobile and Internet) and 2) randomize their network identities.…

Um what? Is PRZ involved? Is he ok with your using that name? He had something called PGPFone a long time ago, though it didn't get much traction. There have also been tons of other encrypted voice programs. Obscuring traffic patterns without stupendous amounts of dummy traffic is quite difficult. That someone is connected to your network at all is already a huge giveaway. I have trouble seeing how something like thi…

>He had something called PGPFone a long time ago, though it didn't get much traction.

Does anyone have a copy of it? I can't find it ANYWHERE. Actually used it way back when, it worked surprisingly OK and was the first softphone I used.

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#48

Post by jjulius »

sneak wrote: post #42
selectodude wrote: post #34

Earlier quoted context omitted.

https://www.amexgiftcard.com/ Go to the grocery store, buy with cash, you're good to go.

No. All payment cards in the United States require strong government identity and KYC, per US federal law. To activate these cards you must provide identity information. Providing false information is a crime.

>No.

No. Gift cards can be purchased in-person in the US, with cash. Said gift cards are activated at the register upon purchase. These can then be gifted to someone else, and further activation (or registering your personal information with the card) is not required.

Edit: I just checked the Visa gift card issuer's site for a card I have (and never had to activate or provide personal information to), and for shopping online it just says:

>In the Payment Method section, enter the Card information as you would a credit or debit card. In the Billing Address section, fill in your name and address.

So when I check out online, I can enter any information that I like, presumably as long as it ties back to a valid address of some kind - there is zero effort on the part of the card issuer to verify that I am who I say I am. I would only need a PIN when making purchases with it as a debit card in-person. I should make it clear that I'm not saying that providing false information is legal, just that the point about being required to provide "strong government identity" to activate gift cards has been false for a long time.

Re: PGPP (Pretty Good Phone Privacy) Beta Launch

#50

Post by throwaway67743 »

I commented on a previous post and while it's sort of been answered here i think it still merits being included: https://news.ycombinator.com/item?id=32397969

I still do find it disingenuous to omit it entirely as it implies that all possible issues are averted which they absolutely are not, even if IMEI wasn't a factor.

Post reply on HN