6 ms·

It depends on what your threat model is. If its individuals, local law enforcement, or even national law enforcement (context dependent) you are trying to hide

It depends on what your threat model is. If its individuals, local law enforcement, or even national law enforcement (context dependent) you are trying to hide from, you can obtain phones with cash and make it very difficult to link them to you (use a sim card bought with cash and never give out that number, use a VOIP service for your primary number, use an OS that doesn't send back much telemetry, turn off location, never use the phone near your home, etc). If your threat model includes targeted attack by a major intelligence agency, just accept that you are likely screwed.

FridayoLeary 5y ago
What will happen when hiding even small illegal activities becomes impossible?
- hedgedoops2 5y ago
  Selective prosecution
- lifeisstillgood 5y ago
  This depends on your threat model (what is illegal, who chooses to prosecute, etc) I was driving home today and the satnav warned us about driving over speed limit (74 mph on UK motorway). Ok. But the solution to that is technology - and organisation. There are speed cameras on this road. But most of the time they don't take images or don't trigger an action. If every road camera triggered a warning / fine on every violation then speeding would stop in a few months. Is that something socially beneficial ? Probably. Would it be disruptive and cause great anger and political resentment? Yes. That is one tiny example but I think that pretty much every criminal act can be detected with technology - it's going to become which one we care enough about to prosecute and which we give up and decriminialise?
  - zizee 5y ago
    > which we give up and decriminialise Or governments will continue to have those laws on the books and prosecute them with discretion (which is what happens today). It is very convenient for those in power when every person is already guilty of something.
    - lifeisstillgood 5y ago
      That is the point - a "free and fair" society will prosecute everyone equally. And the impact of that will either make us all modify out behaviour so we are not all guilty or modify the laws so we are not all guilty. If society is not free or fair, that's the problem to fix first.
  - wolverine876 5y ago
    The problem is applying those rules to people whom the government wants to persecute.
dredmorbius 5y ago
Any phone's location and call history will effectively identify it. Location can be determine with sufficient accuracy for this purpose from cell-tower connections. More so as 5G, with its greater tower density and shorter range, is rolled out. (An actual 5G threat you can get behind.)
- wolverine876 5y ago
  They specified using a VOIP number, so there are no calls associated with the phone by the cellular service provider. Wouldn't the attacker need access to both the VOIP service, to obtain the IP address, and the cellular provider, to link the IP address to a device and obtain the location? If you add a VPN to the stack, the VOIP service doesn't know your IP (though I wonder if a VOIP service would work well through a VPN, due to added latency).
  - dredmorbius 5y ago
    So, now you have two problems. If you're making VOIP calls over a device that is itself connected to mobile networks ... you've still got the connectivity of the device itself to track. Presumably that's a long-lived relationship. At this point the information is limited to location data, but that, at the postal-code level is again sufficient to identify 90% of individuals within the US, based largely on residential and workplace locations. The notion of having short-lived individually-attributable 5G connection history, perhaps through a dongle- or tether-swapping system, in which many individuals utilise devices for a short period of time, might work. With a sufficient budget, disposable devices might also be an option. (As the cost of SBCs / SOCs falls through $0.10/device, the disposable option might be tractable, leaving SIM card provisioning as the bottleneck.) The tether is connected over WiFi (the MAC address space is already repetitive, and MAC addresses can be arbitrarily changed at the OS kernel level), giving a two-stage connection to the actual mobile network itself. Frequently-relocating (via a swap) or short-lived / previously unknon tethers, as identified through IMEI is required for mobile connections to work, would still be possible, but at a much greater workload. (I'm very sketch on how 5G identifies specific devices, take what I'm saying here with a few kilos of salt.) I'd still have concerns with a VOIP device that itself has access to information and computing capabilities, but at least the degree of tracking that's possible over a PSTN direct-dialed mobile handset on a 4G/5G network would be sharply reduced. Other threat vectors remain. Burner phones on a one-use / short-use cycle would probably be preferable.
Teichopsia 5y ago
I'm going to go on a tangent if you don't mind. I was recently asked how to make an anonymous post to a local news organization where all they wanted to do was hide their IP. I said if their only worry is the news organization then a VPN would be enough... Now that I'm reading your comment I'm having second thoughts whether it was right.
throwawayboise 5y ago
The opsec you'd have to maintain is more than most untrained people can pull off. One slip up and you're exposed.
SV_BubbleTime 5y ago
> use a sim card bought with cash Varies by country I’m sure, but I was surprised how difficult it was to buy a SIM in Indonesia and Malaysia without an ID. Even little shops wanted an ID or passport number to type in to activate it.
- a_bonobo 5y ago
  Same in Australia, buying a SIM card is impossible without ID by law. https://mojoknows.com.au/en/prepaid-sim-card-activation-in-australia https://mojoknows.com.au/en/prepaid-sim-card-activation-in-a... For Australians that's driver license, for visitors that's passport + visa too, with a visa-validity check.
- nivenkos 5y ago
  Same in Sweden, a pain if you just come for a little time.
entropea 5y ago
>use a sim card bought with cash and never give out that number This is near impossible now. I tried a few years ago to get an anonymous phone to activate an anonymous twitter account and you have to provide too much information to activate the sim card across the major providers and other companies that use their infrastructure.
- eythian 5y ago
  It depends where you are. Some countries require ID, some don't. Last I bought one in New Zealand it didn't require anything, but I know Australia does.
snarf21 5y ago
That might be true now, but very soon you won't be able to buy a SIM without AML/KYC laws kicking in. We will be living in a complete surveillance state in our lifetimes.

FridayoLeary 5y ago

What will happen when hiding even small illegal activities becomes impossible?

hedgedoops2 5y ago
Selective prosecution
lifeisstillgood 5y ago
This depends on your threat model (what is illegal, who chooses to prosecute, etc) I was driving home today and the satnav warned us about driving over speed limit (74 mph on UK motorway). Ok. But the solution to that is technology - and organisation. There are speed cameras on this road. But most of the time they don't take images or don't trigger an action. If every road camera triggered a warning / fine on every violation then speeding would stop in a few months. Is that something socially beneficial ? Probably. Would it be disruptive and cause great anger and political resentment? Yes. That is one tiny example but I think that pretty much every criminal act can be detected with technology - it's going to become which one we care enough about to prosecute and which we give up and decriminialise?
- zizee 5y ago
  > which we give up and decriminialise Or governments will continue to have those laws on the books and prosecute them with discretion (which is what happens today). It is very convenient for those in power when every person is already guilty of something.
  - lifeisstillgood 5y ago
    That is the point - a "free and fair" society will prosecute everyone equally. And the impact of that will either make us all modify out behaviour so we are not all guilty or modify the laws so we are not all guilty. If society is not free or fair, that's the problem to fix first.
- wolverine876 5y ago
  The problem is applying those rules to people whom the government wants to persecute.

dredmorbius 5y ago

Any phone's location and call history will effectively identify it. Location can be determine with sufficient accuracy for this purpose from cell-tower connections. More so as 5G, with its greater tower density and shorter range, is rolled out. (An actual 5G threat you can get behind.)

wolverine876 5y ago
They specified using a VOIP number, so there are no calls associated with the phone by the cellular service provider. Wouldn't the attacker need access to both the VOIP service, to obtain the IP address, and the cellular provider, to link the IP address to a device and obtain the location? If you add a VPN to the stack, the VOIP service doesn't know your IP (though I wonder if a VOIP service would work well through a VPN, due to added latency).
- dredmorbius 5y ago
  So, now you have two problems. If you're making VOIP calls over a device that is itself connected to mobile networks ... you've still got the connectivity of the device itself to track. Presumably that's a long-lived relationship. At this point the information is limited to location data, but that, at the postal-code level is again sufficient to identify 90% of individuals within the US, based largely on residential and workplace locations. The notion of having short-lived individually-attributable 5G connection history, perhaps through a dongle- or tether-swapping system, in which many individuals utilise devices for a short period of time, might work. With a sufficient budget, disposable devices might also be an option. (As the cost of SBCs / SOCs falls through $0.10/device, the disposable option might be tractable, leaving SIM card provisioning as the bottleneck.) The tether is connected over WiFi (the MAC address space is already repetitive, and MAC addresses can be arbitrarily changed at the OS kernel level), giving a two-stage connection to the actual mobile network itself. Frequently-relocating (via a swap) or short-lived / previously unknon tethers, as identified through IMEI is required for mobile connections to work, would still be possible, but at a much greater workload. (I'm very sketch on how 5G identifies specific devices, take what I'm saying here with a few kilos of salt.) I'd still have concerns with a VOIP device that itself has access to information and computing capabilities, but at least the degree of tracking that's possible over a PSTN direct-dialed mobile handset on a 4G/5G network would be sharply reduced. Other threat vectors remain. Burner phones on a one-use / short-use cycle would probably be preferable.

Teichopsia 5y ago

I'm going to go on a tangent if you don't mind. I was recently asked how to make an anonymous post to a local news organization where all they wanted to do was hide their IP. I said if their only worry is the news organization then a VPN would be enough... Now that I'm reading your comment I'm having second thoughts whether it was right.

throwawayboise 5y ago

The opsec you'd have to maintain is more than most untrained people can pull off. One slip up and you're exposed.

SV_BubbleTime 5y ago

> use a sim card bought with cash Varies by country I’m sure, but I was surprised how difficult it was to buy a SIM in Indonesia and Malaysia without an ID. Even little shops wanted an ID or passport number to type in to activate it.

a_bonobo 5y ago
Same in Australia, buying a SIM card is impossible without ID by law. https://mojoknows.com.au/en/prepaid-sim-card-activation-in-australia https://mojoknows.com.au/en/prepaid-sim-card-activation-in-a... For Australians that's driver license, for visitors that's passport + visa too, with a visa-validity check.
nivenkos 5y ago
Same in Sweden, a pain if you just come for a little time.

entropea 5y ago

>use a sim card bought with cash and never give out that number This is near impossible now. I tried a few years ago to get an anonymous phone to activate an anonymous twitter account and you have to provide too much information to activate the sim card across the major providers and other companies that use their infrastructure.

eythian 5y ago
It depends where you are. Some countries require ID, some don't. Last I bought one in New Zealand it didn't require anything, but I know Australia does.

snarf21 5y ago

That might be true now, but very soon you won't be able to buy a SIM without AML/KYC laws kicking in. We will be living in a complete surveillance state in our lifetimes.