Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The protester's guide to smartphone security

privacyguides.org

Post reply on HN
Print view View original

141–150 of 246 posts

Re: The protester's guide to smartphone security

#141

Post by RiverCrochet »

theoreticalmal wrote: post #14
tehjoker wrote: post #13

Earlier quoted context omitted.

The battery thing can be important. One strategy law enforcement uses is to force your phone into a high energy state and zap the battery very quickly.

What does this mean? What does the zapping accomplish?

Guessing from things I've heard, take this with a grain of salt:

- In order for most cellular protocols to work successfully, it's necessary for the transmission power level (phone to tower and tower to phone) to be lowest possible.

- So that tx power has to be constantly modulated because the phone's distance is always changing as it moves, meaning the optimum power level is always changing.

- The tower is in control of this - it tells the phone how powerful to transmit, and this can be done for each device.

- So I would suppose a malicious party in control of the tower could simply tell the phone to transmit at max power, which will drain batteries quickly, especially if the connection is being actively used I guess. This may have interference considerations but if the tower is really a box on top of a car or truck it may not really matter.

- I don't know how the phone is prevented from connecting to closer non-malicious towers.

Re: The protester's guide to smartphone security

#142

Post by upofadown »

tptacek wrote: post #117
upofadown wrote: post #36

Earlier quoted context omitted.

I meant at the server. We have no way to know that is running there.

The point of end-to-end encrypted messaging is not having to care about what the server is running, which is why the threat models for most academic cryptographic research on these things is "assume a compromised server", and, if that gets you real compromises, the protocol is considered broken.

End to end encryption protects content. It doesn't protect things like information about who is talking to who. For that you need something like an onion network. As already mentioned, Briar uses Tor for that. Signal claims to not collect such information but my point is that we have no way to know what they collect. Claims don't count for anything for these sorts of things..

Re: The protester's guide to smartphone security

#143

Post by grugagag »

AlphaCerium wrote: post #64
snypher wrote: post #54

Earlier quoted context omitted.

How about my smartwatch, or my $29 earbuds? They are always conveniently near the 'random mac' and can be used to fingerprint.

don't bring them to a protest, simple :)

Yeah, not sure many people are aware their beloved tech is spying on them. At this point face recognition and other tech can make it such that everyone is traced, filed and automatically sent summons of some sort.

Re: The protester's guide to smartphone security

#144

Post by Muromec »

TheSpiceIsLife wrote: post #108
mmooss wrote: post #39

Earlier quoted context omitted.

> successfully Successfully in terms of communication or in terms of security? Successful communication is easy if you don't worry about security. Just post it on Instagram. How do you know if your security is successful? How do you know if your messages were intercepted and read, your app was hacked, data was extracted from it, etc.? The attackers (authorities or otherwise) are not going to tell you.

I’d go as far as to assume there’s no evading surveillance in a strict sense. If you attend, leave your phone home (atypical usage), go with other people / meet them there / other people you know are there (facial recognition / gait analysis / clothing preference) those are all good data points to predict with high probability where you are and what you’re up to, especially given your typical movements, data usage pa…

>If history is anything to go by, we’re only ever an election, or other political churn, away from your particular sets of beliefs / identifiers being persecuted, or at least your least favourite political prisoners being released and coming after you.

it goes other way around too - you are only one election cycle away to be pardoned.

And if the protest is succrssfull, you dont need a pardon anyway.

Source -- been to places, done the things, a special law shields me from the thiengs being brough up by autorities

Re: The protester's guide to smartphone security

#146

Post by AnarchismIsCool »

red0point wrote: post #73
iseanstevens wrote: post #55

Also Meshtastic.org is a cheap (various It supports strong encryption layer and over 1 km/mile per “hop” in most circumstances. Designed originally for off grid, it’s very flexible and pretty polished. Abstracts your phone into a UI. Has a whole ecosystem behind it. I’ve been using it for festivals and tracking my vehicles (high theft area) for years. Very handy should infra not be available. Should be great for prot…

Do you have any information about the privacy achievable by Meshtastic? From a quick glance it looks like it‘s using static NodeIDs derived from the Bluetooth MAC address in the always unencrypted Packet Header. So not only can you sniff these messages from far away at greatly simplified complexity when comparing to cellular communication, but also tie it to the hardware that you carry with you. Mesh networks sure ha…

For the next few years it's fine. Functionally the feds just don't have the infrastructure to care about Meshtastic. In a decade maybe that'll change but two decades in the best they can do against drones is receive the ID DJI manufactured ones voluntarily broadcast and lookup the owner if they registered it correctly.

They're far dumber than most people give them credit, unless you off a rich guy they just don't have the resources to even think about penetrating anything but cell networks.

The encryption is pretty good, they're not likely to break it any time soon. The device MACs are whatever, unless you go to protests then go wandering around an urban area with the same radios for an extended period of time they're not going to do shit about it. They would have to geolocate from the RF emission and that's difficult to do to an accuracy necessary to uniquely identify you. Further, LoRa is still a bit of a pain to work with outside of using vendor chips which don't have non-cooperative DF capability so we're in the realm of expensive custom solutions from an RF shop which is far more money than the feds are willing to spend to dragnet a couple people.

Re: The protester's guide to smartphone security

#147

Post by AnarchismIsCool »

nightpool wrote: post #63
iseanstevens wrote: post #55

Also Meshtastic.org is a cheap (various It supports strong encryption layer and over 1 km/mile per “hop” in most circumstances. Designed originally for off grid, it’s very flexible and pretty polished. Abstracts your phone into a UI. Has a whole ecosystem behind it. I’ve been using it for festivals and tracking my vehicles (high theft area) for years. Very handy should infra not be available. Should be great for prot…

This would depend on your phone being able to permanently disable its radio, right? I don't know if I would trust my phone well enough for that, I would be worried even in airplane mode about it making some small beacon checks.

There are Meshtastic devices with keyboards that don't require a phone

Re: The protester's guide to smartphone security

#148

Post by AnarchismIsCool »

diggan wrote: post #3

If you're attending a large-scale protest, it's likely that the cell-towers (or stingrays) won't be able to handle everyone who is connected anyways, so worth planning to use apps that can chat over P2P WiFi or Bluetooth together with the rest of your friends. This also allows you to continue using Airplane Mode the entire time, while being able to communicate with people nearby. Alternatively, investing in walkie-ta…

.....please don't rely on cell towers being too overloaded to track you. The rest of the advice is solid.....but the premise is just gonna get you v&.

Re: The protester's guide to smartphone security

#149

Post by AnarchismIsCool »

ants_everywhere wrote: post #122
idlewords wrote: post #99

Unfortunately this is a topic that attracts LARPers. Remember that if things get spicy, you are not going to settings nerd your way out of a bad interaction with the police. Tech advice for legal and illegal protests is pretty much diametrically opposite, and advice for countries like the United States is much different than for somewhere like Egypt. It's complicated!

What a lot of people don't realize is that a lot of the protests are organized by people who do not care if you get hurt, arrested, or die. In the US, Russian operatives organize a lot of the protests that turn violent. They also organize the counter protests. In other countries, protests are often organized by foreign entities. The organizers will have good opsec, but everyone else is just (metaphorically) cannon fo…

Reputable sources or stop spreading fud

Re: The protester's guide to smartphone security

#150

Post by AnarchismIsCool »

iseanstevens wrote: post #55

Also Meshtastic.org is a cheap (various It supports strong encryption layer and over 1 km/mile per “hop” in most circumstances. Designed originally for off grid, it’s very flexible and pretty polished. Abstracts your phone into a UI. Has a whole ecosystem behind it. I’ve been using it for festivals and tracking my vehicles (high theft area) for years. Very handy should infra not be available. Should be great for prot…

I spend a lot of time in the RF space and Meshtastic is by far the most mature system out there for instant ad-hoc secure digital communications.

However...

The first rule of emergency communications is that if you can conceive of the need in the future, you need to practice using it now. Getting people to download the meshtastic app or figuring out a weird setting is a lot easier when you have working uncensored internet.

Post reply on HN