9 ms·

The protester's guide to smartphone security

479 points by nameequalsmain 2y ago

mtlynch 2y ago
>Some law enforcement agencies use "stingrays," devices which can impersonate a cell tower to track visitors to an area. While the capabilities of the most modern ones isn't fully known, you should definitely protect yourself from the subset of stingrays which abuse the lower security standards of older, 2G networks. Good tip! I didn't know about disabling 2G support on my phone.
- xinayder 2y ago
  I just checked my Samsung S21 and there's no option to disable 2G. I can choose 3G only, or if I want to use 4G/5G I need to enable 2G as well.
diggan 2y ago
If you're attending a large-scale protest, it's likely that the cell-towers (or stingrays) won't be able to handle everyone who is connected anyways, so worth planning to use apps that can chat over P2P WiFi or Bluetooth together with the rest of your friends. This also allows you to continue using Airplane Mode the entire time, while being able to communicate with people nearby. Alternatively, investing in walkie-talkies that have encryption can be worth it as well, but unsure how legal they are around the world, think some countries put restrictions on those so you might have to acquire them while vacationing somewhere else. It's mentioned in the body of the article, but get the feeling most people could miss it: Absolute best idea is to leave your "personal" phone at home! Either get a secondary (burner) phone with nothing useful on it and no real names, or skip out on the phone fully. If you do get a secondary phone, make sure it has a removable battery and keep it out from the phone until you arrive at location and as soon as you move, remove battery again.
- qwerty_clicks 2y ago
  What apps do you recommend with p2p messaging?
  - diggan 2y ago
    Lots of groups have used https://briarproject.org/ https://briarproject.org/ successfully in the past, I've heard. Assumes you're using Android though which if you're using a burner, you most likely are.
    - mmooss 2y ago
      > successfully Successfully in terms of communication or in terms of security? Successful communication is easy if you don't worry about security. Just post it on Instagram. How do you know if your security is successful? How do you know if your messages were intercepted and read, your app was hacked, data was extracted from it, etc.? The attackers (authorities or otherwise) are not going to tell you.
      - thwackamole 2y ago
        > Successful communication is easy if you don't worry about security. Just post it on Instagram. Nope, assume Meta is captured and will suppress such communication. https://news.ycombinator.com/item?id=42777938 https://news.ycombinator.com/item?id=42777938 https://www.bbc.com/news/articles/c4g32yxpdz0o https://www.bbc.com/news/articles/c4g32yxpdz0o This has been widely replicated on inauguration day before being rolled back. I would assume any social media site whose CEO attended is captured as well.
      - TheSpiceIsLife 2y ago
        I’d go as far as to assume there’s no evading surveillance in a strict sense. If you attend, leave your phone home (atypical usage), go with other people / meet them there / other people you know are there (facial recognition / gait analysis / clothing preference) those are all good data points to predict with high probability where you are and what you’re up to, especially given your typical movements, data usage patterns, purchasing habits, friends / acquaintances / social media interactions are all in at least a few databases. Take the security measures you’re willing to make the tradeoffs for. If history is anything to go by, we’re only ever an election, or other political churn, away from your particular sets of beliefs / identifiers being persecuted, or at least your least favourite political prisoners being released and coming after you. And, as you allude to, relying on the security practices of others has its own problems. Even Perfect Forward Secrecy etc etc provides little help against Rubber Hose Cryptography.
- morkalork 2y ago
  How safe is Bluetooth really? Cities has scanners used to track devices for monitoring road congestion, malls have scanners to measure foot traffic. I have to believe that anyone with access to stingray type of device can track Bluetooth as well.
  - theoreticalmal 2y ago
    Don’t both Apple and Android implement random BT MAC addresses specifically to prevent this kind of tracking?
    - mmooss 2y ago
      There could be other fingerprints besides MAC addresses.
    - snypher 2y ago
      How about my smartwatch, or my $29 earbuds? They are always conveniently near the 'random mac' and can be used to fingerprint.
      - AlphaCerium 2y ago
        don't bring them to a protest, simple :)
        grugagag 2y ago
        Yeah, not sure many people are aware their beloved tech is spying on them. At this point face recognition and other tech can make it such that everyone is traced, filed and automatically sent summons of some sort.
  - diggan 2y ago
    Usually, protests are located in one somewhat easily defined area, until you cannot be there anymore or the goal has moved somewhere else. So then you need to get to another spot, this is the moment you disconnect your battery until you've arrived at the other place. So yeah, they'd be able to say that "person A was at location B and later C", but not necessarily the way there or after/before those specific locations. I agree that the safest is to assume they can definitely track you no matter what protocol/antenna you use, so you have to chose what moment it's OK to be tracked (like large groups).
- tehjoker 2y ago
  The battery thing can be important. One strategy law enforcement uses is to force your phone into a high energy state and zap the battery very quickly.
  - theoreticalmal 2y ago
    What does this mean? What does the zapping accomplish?
    - Cpoll 2y ago
      I'm guessing in this context it means drain the battery. I haven't heard of this technique, but it seems plausible, by tricking the phone into constantly transmitting over WiFi or cell.
      - dinosaurdynasty 2y ago
        I wonder how useful purism phones are for this (all external communication, including GPS, has hardware shutoffs). They are expensive though...
        DaSHacka 2y ago
        Couldn't you achieve the same by just enabling airplane mode or similar on regular devices? I don't think niche devices with hardware killswitches should be necessary
        snypher 2y ago
        My S23 enters airplane mode and the WiFi and Bluetooth are still connected... Airplane mode isn't what it used to be!
        portaouflop 2y ago
        I just have a 20 yo Nokia - doesn’t have all the fancy stuff, only can send texts
- timewizard 2y ago
  Keep in mind "Mens rea." If you are implicated in the crimes of the crowd all of these actions may be used to increase the penalties you face. Even if you "trust" the crowd, somehow, you should remember that agent provocateurs exist. You might ask what attending a large scale protest is intended to achieve and decide for yourself if the personal risks are worth it.
  - 6LLvveMx2koXfwn 2y ago
    And if those risks are too great due to state over-reach, best stay at home.
    - nonrandomstring 2y ago
      That seems too lenient on yourself. Why not do the right thing and hand yourself into the Inquisitor General for wrong-think about protesting? Maybe they'll go easy on you.
      - _DeadFred_ 2y ago
        At the least you should confess your temptation to wrongthink at the nearest Larry Ellison AI monitoring 'oracle'. Landru...I mean Oracle AIs maintain social order through their constant AI vigilance. The good is the harmonious continuation of the Body.
  - neilv 2y ago
    > You might ask what attending a large scale protest is intended to achieve and decide for yourself if the personal risks are worth it. True. But keep in mind that demonstration size can have an impact. Even just relatively large, not even a Million Man March. For example, relevant to recent news magnifying vile Nazi-saluting imbecile demographics: They tried to pull that at an event in Boston in 2017, but tens of thousands of counter-demonstrators showed up. https://en.wikipedia.org/wiki/Boston_Free_Speech_Rally https://en.wikipedia.org/wiki/Boston_Free_Speech_Rally We need more reminders that the US can be good people.
- giantg2 2y ago
  "investing in walkie-talkies that have encryption can be worth it as well" Generally not allowed in many bands in the US. Motorola sells some AES walkies. They're really the only ones I know of, and they're very expensive.
  - echoangle 2y ago
    Well the whole point of hiding your tracks is evading law enforcement, why would you care if it’s illegal? Or is it because of the „only do one crime at a time“ thing?
    - giantg2 2y ago
      Why do you assume this is about doing illegal things? This is about protests, many of which never turn into riots or illegal acts.
      - echoangle 2y ago
        I was thinking along the lines of „the state wants to oppress the protestors and makes it illegal“, but if you just want to avoid surveillance at a legal protest, yeah, you’re right.
        JumpCrisscross 2y ago
        Going into a protest with illegal communication devices is almost a direct sabotage of the protest's intent. It gives law enforcement a legitimate reason to act, even if almost certainly ex post facto. And it paints the protest as wilfully illegal--you went in intending to break the law.
        paulryanrogers 2y ago
        If you're protesting an oppressive regime then it's likely most privacy respecting methods are illegal.
- _DeadFred_ 2y ago
  Burner phones aren't safe. Security through obscurity worked with the 1990s cell network but not with today's vast logging/geolocation tagging.
  - scarface_74 2y ago
    The idea is that they can’t tie the phone to a person. You also have to make sure you don’t get the burner phone some place with cameras.
    - BrandonMarc 2y ago
      While true, I'm kinda wondering if that's even possible ...
    - kevin_thibedeau 2y ago
      Once the phone is on, they can tie it to a person with geolocation. Either directly if you do it at home, or indirectly when traveling in a vehicle associated with you.
      - scarface_74 2y ago
        The rule is that you don’t use your burner phone at home, you use it when you are at the protest.
        Animats 2y ago
        If you have two phones both turned on and they both move around similarly, they can be associated later.
        scarface_74 2y ago
        They also tell you to keep one off until you get to the place. Never have both phones on at the same time. This is all well documented https://www.offgridweb.com/preparation/burner-phone-basics-how-to-set-up-an-anonymous-prepaid-phone/amp/ https://www.offgridweb.com/preparation/burner-phone-basics-h...
- nostradumbasp 2y ago
  Turn your phone off, and wrap it in 5 layers of tin foil. Or like you said leave the stupid thing at home.
  - HumanOstrich 2y ago
    Hey that should go well with my tin foil hat.
    - nostradumbasp 2y ago
      They actually sell those now. Well they use "faraday fabric". So that's another solution, but your phone one your head and put a foil hat on it.
- esperent 2y ago
  > so worth planning to use apps that can chat over P2P WiFi or Bluetooth together with the rest of your friends I can't even get Bluetooth audio to work reliably in a crowded cafe, are you sure these other protocols would fare better?
  - pclmulqdq 2y ago
    Messaging doesn't have the same real-time requirements. It's still often flaky.
- AnarchismIsCool 2y ago
  .....please don't rely on cell towers being too overloaded to track you. The rest of the advice is solid.....but the premise is just gonna get you v&.
  - diggan 2y ago
    My note about overloaded towers is not about that they'll be unable to track you, but you'll be unable to use public internet to communicate with the rest of your group.
- Xen9 2y ago
  Absolutely best idea is to make an encrypted PDA & play forensic scientist by recording everything. 1. Get a Google Pixel 9, 9 Pro, or 9 Pro XL smartphone (Cellebrite-proofn at time of writing). 2. Verify images & GOS. 3. Disable biometrics & wireless connections. 4. Memorize with Anki or your own head a new, NIST-compliant passphrase with ≥ 8+ words. 3. Get a cover for the smartphone. 4. Buy EMI tape and electrically insulating waterproof tape. 5. Tape the insides of the cover with EMI, layering it & govering the inner walls as well, no gaps (overlay two adjacent layer always, say ≥ 1 cm, if possible) 6. Add one layer of the other tape to insides of the cover 7. Story inside your underpants 24/7 powered off when you don't use it. My setup is more secure than not having phone, a Qubes laptop, a 2G burner, or not having phone.
  - dartos 2y ago
    How is it more secure than not having a phone?
    - MrDrMcCoy 2y ago
      By capturing evidence of what happens to you that cannot be tampered with.
      - deleted 2y ago
        [deleted]
      - redeux 2y ago
        But that’s not security, it’s usability. Just by virtue of taking your phone to a less safe place you’re lowering its security. Taking a small offline camera would be a lot more secure if your concern is recording the events.
      - dartos 2y ago
        Any honest threat model assumes that any internet-connected device is already compromised…
  - thunfischbrot 2y ago
- deleted 2y ago
  [deleted]
djoldman 2y ago
> If you lose your phone, you may be able to locate or wipe your phone remotely depending on the model... > Please be aware of the legal consequences of these actions. Wiping your device or revoking online account access could lead to obstruction of justice or destruction of evidence charges in some jurisdictions. This can be really serious. It is far better to never have/collect/obtain data in the first place.
- diggan 2y ago
  It got me curious; lets say I go to a protest, lose my phone and wipe it remotely. I couldn't possibly know who exactly got it (since I lost it) so if I remote wipe it while in police custody, could they really get you for "obstruction of justice" for example? Wouldn't that require intent?
  - djoldman 2y ago
    I am not a lawyer. You just don't even want to be at the "proving intent" stage. If you had a function/service that just automatically wiped your device at intervals, regardless of where you were and what you were doing, that might be more defensible than wiping manually. Best is if your device can't be locked and doesn't have any evidence of anything at all.
  - layman51 2y ago
    There’s a setting on iPhone called “Erase Data” which will erase the data on it after 10 consecutive failed passcode attempts. That seems like a recommended setting for any smartphone to be honest, especially if it is used for business.
    - scarface_74 2y ago
      Which is only effective on iOS against law enforcement before first unlock.
  - lukan 2y ago
    If you lost it and no police took it from you, wiping is the normal action.
jsheard 2y ago
Most of this applies wherever but do check your local laws where applicable, I know that in the UK you can be compelled to provide a PIN/password under some circumstances.
qwerty_clicks 2y ago
Almost too many steps to remember here. Would it be possible for an app to prompt you to do all this? An app can bring up settings to allow your camera access, why not to quickly change those other settings?
tomphoolery 2y ago
> However, in this situation it may make more sense to disable biometric authentication. In Face ID, there's a setting that requires direct eye contact in order to open your phone. Highly recommend enabling this when feeling insecure about someone forcing you to open your phone (if it's not already on by default) because it means somebody forcing you to open your phone with Face ID can be easily defeated by simply closing your eyes. I tried this a number of times during the BLM protests, and I/nobody else could get my phone to unlock unless my eyes were open and looking right at it. So with Face ID, I think it's actually way more secure to have biometric authentication turned on, using this setting. The thumbprint stuff might be a good idea to avoid though. (WARNING: This will make your phone pretty much impossible to unlock with your face if you're inebriated on anything. Ask me how I know. xD You should probably disable it after the protest.)
- ryankrage77 2y ago
  This has failed me. I was mugged while black out drunk, and they succesfully unlocked my phone, unlocked my banking app, etc, despite me having the eye contact feature enabled.
  - fastball 2y ago
    How do you know what happened if you were blackout drunk?
- theoreticalmal 2y ago
  While this is good info, it should also be known that in the USA, a judge (maybe and police officer?) can legally command you to unlock your phone via biometrics, but they cannot legally command you to unlock via password or passphrase. “Legally command” = command you to do something with the force of law, and legally punish you if you resist
  - kevindamm 2y ago
    The reasoning behind this is that your fingerprints and face etc. are public knowledge. Whereas you can retain your right to remain silent (about your password/PIN), failing to provide these aspects of your person can be viewed as not cooperating.
tehjoker 2y ago
If you're this worried, don't bring your phone lol. If you need to take pictures (and don't take identifiable pics of people without consent), just bring a camera. Otoh, the main function of protests is to get media attention, so if they don't get publicized there was basically no point unless they evolve into direct action. If you're interested in this second point, read https://www.amazon.com/If-We-Burn-Protest-Revolution/dp/1541788974 https://www.amazon.com/If-We-Burn-Protest-Revolution/dp/1541...
- jMyles 2y ago
  > don't take identifiable pics of people without consent Hard disagree. Public events are public events. My conclusion, based on experience at street protests, historic trends, and current political events, is that there have been significant actions by provocateurs over the past decade or more, and particularly in Portland in 2020. Taking and posting pictures of these people is an important act. It the internet age makes this tactic impossible, it will be a huge win. The upside is nonexistent anyway: the state is photographing everyone at these events, so you taking an additional photo does not change the risk surface for anyone with regard to state retaliation.
  - nxobject 2y ago
    As another Portlander, disagree with exceptions: surveillance footage made it harder to identify people from top down angles, and it meant that a lot of people had their charges dismissed because of that. (I will need to look it up.) The bigger risk to a protest movement, I would argue, is an opposing agent provocateurs trying to get people doxxed. That risk to more people outweighs getting minority of provocateurs shut down. (On the other hand, you’re also right that agent provocateurs are old COINTELPRO-era tactics used by the state and right wingers against protest movements.) When it comes to tactics to keep yourself safe when protesting, there aren’t ultimately too many hard beliefs to be had, especially when the right are perfectly happy to collaborate with the state.
    - rightbyte 2y ago
      >The bigger risk to a protest movement, I would argue, is an opposing agent provocateurs trying to get people doxxed. That wouldn't be an agent provocateur right?
nxobject 2y ago
Re: iPhones - these suggestions are really good, AND it shows how hard it is to keep track of the attack surface of all of modern iOS features. I wish Lockdown Mode also set these hardening features on: it seems useless to harden your phone against spyware if you can still be surveilled in other ways.
upofadown 2y ago
Briar messenger is specifically designed for things like protests. I think I would prefer it over Signal. The article says: >Signal has responded to 6 government requests since 2016, and in each case the only information they were able to provide was at most: ... That is the all the information they claimed they had. We have no way to know what they actually collect. Briar runs P2P over Tor so they can't collect data, even if they should want to. Whatever is used, an article like this should remind the potential protester to turn on disappearing messages with an appropriately short interval. The powers that be might use something like a Cellebrite box to get all your old messages by cracking the phone security.
- fph 2y ago
  Signal is open source and ships with verified builds, so yes, we have a way to know what they actually collect.
  - upofadown 2y ago
    I meant at the server. We have no way to know that is running there.
    - mmooss 2y ago
      The server is open source too. You could download it and run your own server, afaik.
      - TiredOfLife 2y ago
        Signal occasionally drops something that could be the server code. When they were working on their cryptocurrency they didn't release anything for over a year.
    - chikere232 2y ago
      isn't that what the e2e encryption is for? I guess they could collect metadata of course
    - 2y ago
throeuurir 2y ago
[flagged]
- LAC-Tech 2y ago
  The great thing about this article is that it's equally applicable to both far left and far right posters. Very inclusive <3
cmxch 2y ago
A sufficiently motivated state actor will have little issue with finding what they want/need, no matter what measures are taken.
- tonymet 2y ago
  protesters deal with various agencies from private security, city police on up to federal FBI etc. These measures will help in the most common scenarios and prevent further escalation. 99.999% of protestors are not going against NSA counter-intel teams, they are encountering low-level private security or police who escalate the situation. Every security practice is a risk/reward. The measures being offered here are no-cost measures which can reduce the exposure of evidence to casual security / police.
AtlasBarfed 2y ago
Th smartphone is the greatest mass surveillance device ever conceived, although AI monitored camera networks will probably exceed it very soon. There are basically no countermeasures. Which means freedom is truly at the discretion of the powerful, because once the government goes North Korea there is no going back. I actually think the biggest threat to humanity in the Great Filter sense is authoritarianism, more than nuclear Armageddon, grey too, or super AI. Nothing can stop by he centralization of power that AI provides to the powerful, and the fact the elite have been brazenly antidemocratic and anti- institutionalism in public and podcasting platform is this election cycle is frightening.
- mmooss 2y ago
  > Nothing can stop by he centralization of power that AI provides to the powerful The social acceptance of defeatism and quitting is incredible - they couldn't have a more ideal opposition. You'll never win if you quit before you start. It's mass cowardice in the face of danger, with an excuse of course.
- AnarchismIsCool 2y ago
  Weapons evolve, defenses evolve. There are ways of trivially defeating cell phone tracking, and there are ways of trivially defeating AI cameras (850 ways specifically). Some auth dipshit will probably come up with some other way of betraying the working class and the cycle will repeat itself.
  - CamperBob2 2y ago
    This would be the same 'working class' that just re-elected Trump?
unethical_ban 2y ago
It's unfortunate that Briar is android-only. I know it is due to Apple restrictions on battery usage (afaik). But it is decentralized and can operate locally over wifi and Bluetooth. These seem like good practical steps. GrapheneOS has duress pins (type it in, and the phone is wiped). It has secondary pins for biometric - the intent being that your real password is a long passphrase, and "quick " unlock is bio+pin. I would add to this list some method of uploading video live to another service, in a way that the video can't be deleted via the phone. I know those exist for the express purpose of civil rights, I think the aclu has a list somewhere.
raybb 2y ago
404 Media just released a great related article "The Powerful AI Tool That Cops (or Stalkers) Can Use to Geolocate Photos in Seconds" https://www.404media.co/the-powerful-ai-tool-that-cops-or-stalkers-can-use-to-geolocate-photos-in-seconds/ https://www.404media.co/the-powerful-ai-tool-that-cops-or-st...
- gruez 2y ago
  What does this have to do with protests? Aren't protests by definition events where the organizers want people to be aware of?
  - tejtm 2y ago
    Protest also attract polarizing provocateurs, you may not want to be associated with all that is done in your name.
- dang 2y ago
  HN had a thread about that tool last year: AI Photo Geolocation - https://news.ycombinator.com/item?id=40232755 https://news.ycombinator.com/item?id=40232755 - May 2024 (102 comments)
WarOnPrivacy 2y ago
Old phones are an underappreciated resource, imo. I keep a few handsets around for apps I don't want on my daily driver (ex:food ordering, 2FA). More in line with the article: For alternate cell/SMS service I have a RedPocket SIM. (note: I see now it's $45/yr on ebay. I'm paying less, prob grandfathered).
- gruez 2y ago
  >Old phones are an underappreciated resource, imo. Not really. Old phones don't receive security patches and can be trivially unlocked to extract all relevant information. Sure, it might not have your nudes or bank login, but if you're using it to coordinate the protest that's plenty of incriminating evidence for the police. >For alternate cell/SMS service I have a RedPocket SIM. (note: I see now it's $45/yr on ebay. You have to be very careful with this, otherwise it's trivial to tie the phone/SIM back to you. Off the top of my head: * the billing/shipping address used to order the SIM * any payment information used to top-up the account * location correlations with any other devices you own (for instance, if your burner phone pings the same towers as your primary phone for an extended period of time) * using it for anything other than protests (eg. as a "burner" number when applying for jobs to avoid spam)
  - WarOnPrivacy 2y ago
    > Not really. Old phones don't receive security patches. For a phone that was off until 2 hours ago and it's only login is the app they comm with, there don't seem to be a lot of meaningful risk vectors. > and can be trivially unlocked to extract all relevant information. The unlocker will maybe get one app login and 2 hours of location data. > if you're using it to coordinate the protest that's plenty of incriminating evidence for the police. It's one app login and 2 hours of location data. Most of that same info can be gleaned by directly observing the individual.
  - 542354234235 2y ago
    It depends on the threat model. A local police force vacuuming up cell data looking for easy targets and ways to intimidate protestors is different than a targeted investigation by a state actor to identify everyone at all costs. The Jan 6 insurrection is a good example of how difficult it is in a real world scenario to ID specific people in a large protest, and many of them got caught because they talked about it afterward on Facebook. If you are cell phone 2,347 on a spreadsheet of 33,422 phones and the number has no associated locational data, open source information, etc. you are way safer than bringing your regular phone, while not being an easy target and being able to communicate if you need to.
iseanstevens 2y ago
Also Meshtastic.org is a cheap (various <$50 options) open source LoRa based hardware bridge (or standalone device) that can be used with an app over bluetooth (or WiFi web interface). It supports strong encryption layer and over 1 km/mile per “hop” in most circumstances. Designed originally for off grid, it’s very flexible and pretty polished. Abstracts your phone into a UI. Has a whole ecosystem behind it. I’ve been using it for festivals and tracking my vehicles (high theft area) for years. Very handy should infra not be available. Should be great for protests also :)
- nightpool 2y ago
  This would depend on your phone being able to permanently disable its radio, right? I don't know if I would trust my phone well enough for that, I would be worried even in airplane mode about it making some small beacon checks.
  - _heimdall 2y ago
    There are a few devices floating around with a hardware switch built in. If you use a Pixel, grapheme OS is probably pretty trustworthy so you at least no there's nothing nefarious down to the OS level. But yeah, in general if you take a phone just assume it's tracking you or at least making it possible for those with access to know you where there.
  - AnarchismIsCool 2y ago
    There are Meshtastic devices with keyboards that don't require a phone
- red0point 2y ago
  Do you have any information about the privacy achievable by Meshtastic? From a quick glance it looks like it‘s using static NodeIDs derived from the Bluetooth MAC address in the always unencrypted Packet Header. So not only can you sniff these messages from far away at greatly simplified complexity when comparing to cellular communication, but also tie it to the hardware that you carry with you. Mesh networks sure have its uses, but I‘d be wary of their offered privacy in the presence of adversaries you could be facing at protests!
liontwist 2y ago
I don’t understand the issue. Protesting is legal. Are we advocating for illegal activity?
- MengerSponge 2y ago
  1) Protesting is illegal in many parts of the world. 2) Authoritarians have been known to act illegally to solidify their power.
  - liontwist 2y ago
    Are we imagining only “good guys” will be the ones breaking the law?
    - MengerSponge 2y ago
      No, basically by definition. What's your point?
- Almondsetat 2y ago
  >Protesting is legal first of all, where? secondly, what has legality of protest got to do with privacy?
  - liontwist 2y ago
    The concern of your phone being taken by authorities or capturing incriminating evidence
    - Almondsetat 2y ago
      Are you making the "if you've got nothing to hide" argument?
      - liontwist 2y ago
        That would be sharing your phone and password with the police because there is nothing to hide. I’m asking why you’re expecting to be booked by authorities and your phone confiscated for attending a “protest”.
giantg2 2y ago
Most of this is everyday security. "Avoid External Storage" They missed part with this. You could use external storage just for your current recording purposes so you can pop the SD card and take it with you if you think your phone will be taken.
scarface_74 2y ago
This is what the other side is telling law enforcement about iOS devices. https://cellebrite.com/en/glossary/bfu-iphone-mobile-device-forensics/ https://cellebrite.com/en/glossary/bfu-iphone-mobile-device-... iOS is amazing insecurely to a determined law enforcement agency after the first unlock when you turn your phone on. And a mitigation that Apple is doing. https://lonelybrand.com/blog/iphones-operating-on-ios-18-1-will-automatically-restart-and-switch-to-lockdown-mode-following-prolonged-durations-of-inactivity/ https://lonelybrand.com/blog/iphones-operating-on-ios-18-1-w... As far as having a strong pin to help protect you, it won’t protect you from rubber hose decryption.
- echoangle 2y ago
  > As far as having a strong pin to help protect you, it won’t protect you from rubber hose decryption. I wonder why no one adds a „decoy pin“ which looks like it unlocks the device but secretly deletes sensitive data. Probably, most people don’t see rubber hose cryptography as a real threat, and in most cases, they’re probably right.
  - scarface_74 2y ago
    I don’t have any trust in the police or even more so the various 3 letter agencies.
    - 542354234235 2y ago
      It isn’t about trust, it is about how likely you are to encounter a risk and how big that risk, if encountered, is. Do you own a hazmat suit? A nuclear bunker? Did you install a 5-point harness and wear a helmet when you drive? Could you be tortured for information by the police? Yes. Is that in any way likely at all? No. Taking reasonable precautions against likely actions by law enforcement is better than acting like all things are possible so no point in doing anything.
      - scarface_74 2y ago
        The chance of encountering a police that operates unlawfully - especially since they have qualified immunity is a very big risk. The chance of other police covering for them is close to 100%
idlewords 2y ago
Unfortunately this is a topic that attracts LARPers. Remember that if things get spicy, you are not going to settings nerd your way out of a bad interaction with the police. Tech advice for legal and illegal protests is pretty much diametrically opposite, and advice for countries like the United States is much different than for somewhere like Egypt. It's complicated!
- vueko 2y ago
  The fact that rubber-hose cryptanalysis exists doesn't mean that cryptography is useless. While settings nerding is indeed probably of limited use if you have a direct encounter with authorities, settings nerding can prevent being caught up in a dragnet search for, say, every cell service subscriber present at a protest gone sour, just as ubiquitous cryptography probably can't keep you safe from dedicated NSA attention but can protect against warrantless dragnet fishing expeditions. As pointed out elsewhere, the line between legal and illegal protest is very blurry and can shift rapidly; if anything, the only way to be sure you're not going to a protest that could eventually be classed as illegal is to never go to a protest, regardless of how pure your intentions are.
- ants_everywhere 2y ago
  What a lot of people don't realize is that a lot of the protests are organized by people who do not care if you get hurt, arrested, or die. In the US, Russian operatives organize a lot of the protests that turn violent. They also organize the counter protests. In other countries, protests are often organized by foreign entities. The organizers will have good opsec, but everyone else is just (metaphorically) cannon fodder as far as the organizers are concerned. It's been this way for decades. The Soviet Union organized protests in other countries for pretty much its entire existence. The US helped the Polish anti-authoritarian Solidarity movement and several others.
  - deleted 2y ago
    [deleted]
  - Aeolun 2y ago
    > What a lot of people don't realize is that a lot of the protests are organized by people who do not care if you get hurt, arrested, or die. I mean, that’s kind of a given even for the protests that are legitimate. They really only happen when people reach a point of no return, and the organizers are more likely to be fanatics in the first place.
maybejustmaybe 2y ago
Technically you could piggy back on another protocol and obfuscate your comms. Like piggy backing in an envelope across https connections from server to server. Nobody is looking there. And even if they are, good luck decrypting that. Looks like a legit site but it is actually a proxy for delivery encrypted payloads.
xyst 2y ago
yes, will need this in the upcoming class revolt.
rob_c 2y ago
It's called a burner phone. Learn from the professionals...
mastazi 2y ago
See also the EFF Surveillance Self-Defense guide for activists and protesters: https://ssd.eff.org/playlist/activist-or-protester https://ssd.eff.org/playlist/activist-or-protester
gonzo41 2y ago
You should be going into airplane mode at an isolated time before you get to the protest so you don't have a pattern of 10 friends all of a sudden dropping off the network together. Infact it's probably not the best idea to protest (in a crowd) anymore. The cops know how to kettle, and they have the tech edge. Activists need to think and act more asymmetrically.
G_o_D 2y ago
There are some apps that detect fake base stations monitoring your traffic There are apps that uses accelerometer and gyroscopic sensors to detect if phone is snatched execute certain action based on this Use app lock, so in case your phone is opened, apps will still be locked --> lock galley + filesExplorer(any) + settings + playstore + Browser(All installed) + Cloud/RemoteDrives(any) + Any syncing apps + Contacts + Email+messaging apps etc (Hell all apps for utmost paranoia) Use apps that remotely sync your phone specific folder/gallery every time new file is created (So when taking photos or recordinf something, if pbone got snatched, data is deleted + phone is broken or formattef/wiped against your will, your files have already synced to remote location so no worries Snoopsnitch https://f-droid.org/en/packages/de.srlabs.snoopsnitch/ https://f-droid.org/en/packages/de.srlabs.snoopsnitch/ Stayput https://f-droid.org/en/packages/org.y20k.stayput/ https://f-droid.org/en/packages/org.y20k.stayput/ plucklockex https://f-droid.org/en/packages/xyz.iridiumion.plucklockex/ https://f-droid.org/en/packages/xyz.iridiumion.plucklockex/
- ignoramous 2y ago
  > There are some apps that detect fake base stations monitoring your traffic Pixels (and soon other Android devices) have this functionality built-in: https://security.googleblog.com/2024/10/pixel-proactive-security-cellular-modems.html?m=1 https://security.googleblog.com/2024/10/pixel-proactive-secu...
deleted 2y ago
[deleted]
rowie 2y ago
Just use Meshtastic! ;-)
frontalier 2y ago
Mobile Phone Security For Activists and Agitators https://opsec.riotmedicine.net/downloads#mobile-phone-security https://opsec.riotmedicine.net/downloads#mobile-phone-securi...
nanna 2y ago
Or simply leave your phone at home. Need to meet with friends? Plan a meeting point. Need to take photos? Do you really? What right have you got to photo other people's faces? Just leave your damn phone at home.
- cluckindan 2y ago
  If you want to take photos, bring a good quality video camera, preferably with optical image stabilization. It’s much harder for disinformationists to deny or reframe a long, uncut video.
- Gasp0de 2y ago
  Taking video can protect against police brutality or false claims by the police. Although I agree that it also is dangerous.
bArray 2y ago
Potentially this is where the likes of the PinePhone should thrive [1]. As well as the methods suggested, you could have full disk encryption and just have the phone switch off if it suspects any shenanigans. If you want, it could still boot into an OS, but it just denies knowing about the encrypted disk. Done right, the image itself could be difficult to discern from something like a corrupted video file. > Your Risks at a Protest In addition, your SIM (likely traceable to you, especially if you have it) will be auto-connecting to their temporary telecom system (i.e. Stingray [2]), where they can find out the following: 1. That you were nearby to the event. 2. A tonne of operations available via the modem [3]. 3. If you speak to somebody locally (as part of the routing). 4. Shift your connection down to 2G/3G where it is easier to hack [4]. I think each person needs to consider their security model. [1] https://pine64.org/devices/pinephone/ https://pine64.org/devices/pinephone/ [2] https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker [3] https://www.electronicsforu.com/special/cool-stuff-misc/gsm-at-commands https://www.electronicsforu.com/special/cool-stuff-misc/gsm-... [4] https://www.eff.org/deeplinks/2020/06/your-phone-vulnerable-because-2g-it-doesnt-have-be https://www.eff.org/deeplinks/2020/06/your-phone-vulnerable-...
- Delk 2y ago
  Regarding #2, I thought AT commands were something you could send to your modem from your attached device. I'm not aware that they could be sent to a modem by another remote modem over the network link. Is that also possible?
  - bArray 2y ago
    You are correct, it's just there to give you an idea of the capabilities of the modem, what sorts of information it holds and what the cell tower may query.
scaredhana 2y ago
[flagged]

>Some law enforcement agencies use "stingrays," devices which can impersonate a cell tower to track visitors to an area. While the capabilities of the most modern ones isn't fully known, you should definitely protect yourself from the subset of stingrays which abuse the lower security standards of older, 2G networks. Good tip! I didn't know about disabling 2G support on my phone.

xinayder 2y ago
I just checked my Samsung S21 and there's no option to disable 2G. I can choose 3G only, or if I want to use 4G/5G I need to enable 2G as well.

diggan 2y ago

If you're attending a large-scale protest, it's likely that the cell-towers (or stingrays) won't be able to handle everyone who is connected anyways, so worth planning to use apps that can chat over P2P WiFi or Bluetooth together with the rest of your friends. This also allows you to continue using Airplane Mode the entire time, while being able to communicate with people nearby. Alternatively, investing in walkie-talkies that have encryption can be worth it as well, but unsure how legal they are around the world, think some countries put restrictions on those so you might have to acquire them while vacationing somewhere else. It's mentioned in the body of the article, but get the feeling most people could miss it: Absolute best idea is to leave your "personal" phone at home! Either get a secondary (burner) phone with nothing useful on it and no real names, or skip out on the phone fully. If you do get a secondary phone, make sure it has a removable battery and keep it out from the phone until you arrive at location and as soon as you move, remove battery again.

qwerty_clicks 2y ago
What apps do you recommend with p2p messaging?
- diggan 2y ago
  Lots of groups have used https://briarproject.org/ https://briarproject.org/ successfully in the past, I've heard. Assumes you're using Android though which if you're using a burner, you most likely are.
  - mmooss 2y ago
    > successfully Successfully in terms of communication or in terms of security? Successful communication is easy if you don't worry about security. Just post it on Instagram. How do you know if your security is successful? How do you know if your messages were intercepted and read, your app was hacked, data was extracted from it, etc.? The attackers (authorities or otherwise) are not going to tell you.
    - thwackamole 2y ago
      > Successful communication is easy if you don't worry about security. Just post it on Instagram. Nope, assume Meta is captured and will suppress such communication. https://news.ycombinator.com/item?id=42777938 https://news.ycombinator.com/item?id=42777938 https://www.bbc.com/news/articles/c4g32yxpdz0o https://www.bbc.com/news/articles/c4g32yxpdz0o This has been widely replicated on inauguration day before being rolled back. I would assume any social media site whose CEO attended is captured as well.
    - TheSpiceIsLife 2y ago
      I’d go as far as to assume there’s no evading surveillance in a strict sense. If you attend, leave your phone home (atypical usage), go with other people / meet them there / other people you know are there (facial recognition / gait analysis / clothing preference) those are all good data points to predict with high probability where you are and what you’re up to, especially given your typical movements, data usage patterns, purchasing habits, friends / acquaintances / social media interactions are all in at least a few databases. Take the security measures you’re willing to make the tradeoffs for. If history is anything to go by, we’re only ever an election, or other political churn, away from your particular sets of beliefs / identifiers being persecuted, or at least your least favourite political prisoners being released and coming after you. And, as you allude to, relying on the security practices of others has its own problems. Even Perfect Forward Secrecy etc etc provides little help against Rubber Hose Cryptography.
morkalork 2y ago
How safe is Bluetooth really? Cities has scanners used to track devices for monitoring road congestion, malls have scanners to measure foot traffic. I have to believe that anyone with access to stingray type of device can track Bluetooth as well.
- theoreticalmal 2y ago
  Don’t both Apple and Android implement random BT MAC addresses specifically to prevent this kind of tracking?
  - mmooss 2y ago
    There could be other fingerprints besides MAC addresses.
  - snypher 2y ago
    How about my smartwatch, or my $29 earbuds? They are always conveniently near the 'random mac' and can be used to fingerprint.
    - AlphaCerium 2y ago
      don't bring them to a protest, simple :)
      - grugagag 2y ago
        Yeah, not sure many people are aware their beloved tech is spying on them. At this point face recognition and other tech can make it such that everyone is traced, filed and automatically sent summons of some sort.
- diggan 2y ago
  Usually, protests are located in one somewhat easily defined area, until you cannot be there anymore or the goal has moved somewhere else. So then you need to get to another spot, this is the moment you disconnect your battery until you've arrived at the other place. So yeah, they'd be able to say that "person A was at location B and later C", but not necessarily the way there or after/before those specific locations. I agree that the safest is to assume they can definitely track you no matter what protocol/antenna you use, so you have to chose what moment it's OK to be tracked (like large groups).
tehjoker 2y ago
The battery thing can be important. One strategy law enforcement uses is to force your phone into a high energy state and zap the battery very quickly.
- theoreticalmal 2y ago
  What does this mean? What does the zapping accomplish?
  - Cpoll 2y ago
    I'm guessing in this context it means drain the battery. I haven't heard of this technique, but it seems plausible, by tricking the phone into constantly transmitting over WiFi or cell.
    - dinosaurdynasty 2y ago
      I wonder how useful purism phones are for this (all external communication, including GPS, has hardware shutoffs). They are expensive though...
      - DaSHacka 2y ago
        Couldn't you achieve the same by just enabling airplane mode or similar on regular devices? I don't think niche devices with hardware killswitches should be necessary
        snypher 2y ago
        My S23 enters airplane mode and the WiFi and Bluetooth are still connected... Airplane mode isn't what it used to be!
      - portaouflop 2y ago
        I just have a 20 yo Nokia - doesn’t have all the fancy stuff, only can send texts
timewizard 2y ago
Keep in mind "Mens rea." If you are implicated in the crimes of the crowd all of these actions may be used to increase the penalties you face. Even if you "trust" the crowd, somehow, you should remember that agent provocateurs exist. You might ask what attending a large scale protest is intended to achieve and decide for yourself if the personal risks are worth it.
- 6LLvveMx2koXfwn 2y ago
  And if those risks are too great due to state over-reach, best stay at home.
  - nonrandomstring 2y ago
    That seems too lenient on yourself. Why not do the right thing and hand yourself into the Inquisitor General for wrong-think about protesting? Maybe they'll go easy on you.
    - _DeadFred_ 2y ago
      At the least you should confess your temptation to wrongthink at the nearest Larry Ellison AI monitoring 'oracle'. Landru...I mean Oracle AIs maintain social order through their constant AI vigilance. The good is the harmonious continuation of the Body.
- neilv 2y ago
  > You might ask what attending a large scale protest is intended to achieve and decide for yourself if the personal risks are worth it. True. But keep in mind that demonstration size can have an impact. Even just relatively large, not even a Million Man March. For example, relevant to recent news magnifying vile Nazi-saluting imbecile demographics: They tried to pull that at an event in Boston in 2017, but tens of thousands of counter-demonstrators showed up. https://en.wikipedia.org/wiki/Boston_Free_Speech_Rally https://en.wikipedia.org/wiki/Boston_Free_Speech_Rally We need more reminders that the US can be good people.
giantg2 2y ago
"investing in walkie-talkies that have encryption can be worth it as well" Generally not allowed in many bands in the US. Motorola sells some AES walkies. They're really the only ones I know of, and they're very expensive.
- echoangle 2y ago
  Well the whole point of hiding your tracks is evading law enforcement, why would you care if it’s illegal? Or is it because of the „only do one crime at a time“ thing?
  - giantg2 2y ago
    Why do you assume this is about doing illegal things? This is about protests, many of which never turn into riots or illegal acts.
    - echoangle 2y ago
      I was thinking along the lines of „the state wants to oppress the protestors and makes it illegal“, but if you just want to avoid surveillance at a legal protest, yeah, you’re right.
      - JumpCrisscross 2y ago
        Going into a protest with illegal communication devices is almost a direct sabotage of the protest's intent. It gives law enforcement a legitimate reason to act, even if almost certainly ex post facto. And it paints the protest as wilfully illegal--you went in intending to break the law.
        paulryanrogers 2y ago
        If you're protesting an oppressive regime then it's likely most privacy respecting methods are illegal.
_DeadFred_ 2y ago
Burner phones aren't safe. Security through obscurity worked with the 1990s cell network but not with today's vast logging/geolocation tagging.
- scarface_74 2y ago
  The idea is that they can’t tie the phone to a person. You also have to make sure you don’t get the burner phone some place with cameras.
  - BrandonMarc 2y ago
    While true, I'm kinda wondering if that's even possible ...
  - kevin_thibedeau 2y ago
    Once the phone is on, they can tie it to a person with geolocation. Either directly if you do it at home, or indirectly when traveling in a vehicle associated with you.
    - scarface_74 2y ago
      The rule is that you don’t use your burner phone at home, you use it when you are at the protest.
      - Animats 2y ago
        If you have two phones both turned on and they both move around similarly, they can be associated later.
        scarface_74 2y ago
        They also tell you to keep one off until you get to the place. Never have both phones on at the same time. This is all well documented https://www.offgridweb.com/preparation/burner-phone-basics-how-to-set-up-an-anonymous-prepaid-phone/amp/ https://www.offgridweb.com/preparation/burner-phone-basics-h...
nostradumbasp 2y ago
Turn your phone off, and wrap it in 5 layers of tin foil. Or like you said leave the stupid thing at home.
- HumanOstrich 2y ago
  Hey that should go well with my tin foil hat.
  - nostradumbasp 2y ago
    They actually sell those now. Well they use "faraday fabric". So that's another solution, but your phone one your head and put a foil hat on it.
esperent 2y ago
> so worth planning to use apps that can chat over P2P WiFi or Bluetooth together with the rest of your friends I can't even get Bluetooth audio to work reliably in a crowded cafe, are you sure these other protocols would fare better?
- pclmulqdq 2y ago
  Messaging doesn't have the same real-time requirements. It's still often flaky.
AnarchismIsCool 2y ago
.....please don't rely on cell towers being too overloaded to track you. The rest of the advice is solid.....but the premise is just gonna get you v&.
- diggan 2y ago
  My note about overloaded towers is not about that they'll be unable to track you, but you'll be unable to use public internet to communicate with the rest of your group.
Xen9 2y ago
Absolutely best idea is to make an encrypted PDA & play forensic scientist by recording everything. 1. Get a Google Pixel 9, 9 Pro, or 9 Pro XL smartphone (Cellebrite-proofn at time of writing). 2. Verify images & GOS. 3. Disable biometrics & wireless connections. 4. Memorize with Anki or your own head a new, NIST-compliant passphrase with ≥ 8+ words. 3. Get a cover for the smartphone. 4. Buy EMI tape and electrically insulating waterproof tape. 5. Tape the insides of the cover with EMI, layering it & govering the inner walls as well, no gaps (overlay two adjacent layer always, say ≥ 1 cm, if possible) 6. Add one layer of the other tape to insides of the cover 7. Story inside your underpants 24/7 powered off when you don't use it. My setup is more secure than not having phone, a Qubes laptop, a 2G burner, or not having phone.
- dartos 2y ago
  How is it more secure than not having a phone?
  - MrDrMcCoy 2y ago
    By capturing evidence of what happens to you that cannot be tampered with.
    - deleted 2y ago
      [deleted]
    - redeux 2y ago
      But that’s not security, it’s usability. Just by virtue of taking your phone to a less safe place you’re lowering its security. Taking a small offline camera would be a lot more secure if your concern is recording the events.
    - dartos 2y ago
      Any honest threat model assumes that any internet-connected device is already compromised…
- thunfischbrot 2y ago
deleted 2y ago
[deleted]

djoldman 2y ago

> If you lose your phone, you may be able to locate or wipe your phone remotely depending on the model... > Please be aware of the legal consequences of these actions. Wiping your device or revoking online account access could lead to obstruction of justice or destruction of evidence charges in some jurisdictions. This can be really serious. It is far better to never have/collect/obtain data in the first place.

diggan 2y ago
It got me curious; lets say I go to a protest, lose my phone and wipe it remotely. I couldn't possibly know who exactly got it (since I lost it) so if I remote wipe it while in police custody, could they really get you for "obstruction of justice" for example? Wouldn't that require intent?
- djoldman 2y ago
  I am not a lawyer. You just don't even want to be at the "proving intent" stage. If you had a function/service that just automatically wiped your device at intervals, regardless of where you were and what you were doing, that might be more defensible than wiping manually. Best is if your device can't be locked and doesn't have any evidence of anything at all.
- layman51 2y ago
  There’s a setting on iPhone called “Erase Data” which will erase the data on it after 10 consecutive failed passcode attempts. That seems like a recommended setting for any smartphone to be honest, especially if it is used for business.
  - scarface_74 2y ago
    Which is only effective on iOS against law enforcement before first unlock.
- lukan 2y ago
  If you lost it and no police took it from you, wiping is the normal action.

jsheard 2y ago

Most of this applies wherever but do check your local laws where applicable, I know that in the UK you can be compelled to provide a PIN/password under some circumstances.

qwerty_clicks 2y ago

Almost too many steps to remember here. Would it be possible for an app to prompt you to do all this? An app can bring up settings to allow your camera access, why not to quickly change those other settings?

tomphoolery 2y ago

> However, in this situation it may make more sense to disable biometric authentication. In Face ID, there's a setting that requires direct eye contact in order to open your phone. Highly recommend enabling this when feeling insecure about someone forcing you to open your phone (if it's not already on by default) because it means somebody forcing you to open your phone with Face ID can be easily defeated by simply closing your eyes. I tried this a number of times during the BLM protests, and I/nobody else could get my phone to unlock unless my eyes were open and looking right at it. So with Face ID, I think it's actually way more secure to have biometric authentication turned on, using this setting. The thumbprint stuff might be a good idea to avoid though. (WARNING: This will make your phone pretty much impossible to unlock with your face if you're inebriated on anything. Ask me how I know. xD You should probably disable it after the protest.)

ryankrage77 2y ago
This has failed me. I was mugged while black out drunk, and they succesfully unlocked my phone, unlocked my banking app, etc, despite me having the eye contact feature enabled.
- fastball 2y ago
  How do you know what happened if you were blackout drunk?
theoreticalmal 2y ago
While this is good info, it should also be known that in the USA, a judge (maybe and police officer?) can legally command you to unlock your phone via biometrics, but they cannot legally command you to unlock via password or passphrase. “Legally command” = command you to do something with the force of law, and legally punish you if you resist
- kevindamm 2y ago
  The reasoning behind this is that your fingerprints and face etc. are public knowledge. Whereas you can retain your right to remain silent (about your password/PIN), failing to provide these aspects of your person can be viewed as not cooperating.

tehjoker 2y ago

If you're this worried, don't bring your phone lol. If you need to take pictures (and don't take identifiable pics of people without consent), just bring a camera. Otoh, the main function of protests is to get media attention, so if they don't get publicized there was basically no point unless they evolve into direct action. If you're interested in this second point, read https://www.amazon.com/If-We-Burn-Protest-Revolution/dp/1541788974 https://www.amazon.com/If-We-Burn-Protest-Revolution/dp/1541...

jMyles 2y ago
> don't take identifiable pics of people without consent Hard disagree. Public events are public events. My conclusion, based on experience at street protests, historic trends, and current political events, is that there have been significant actions by provocateurs over the past decade or more, and particularly in Portland in 2020. Taking and posting pictures of these people is an important act. It the internet age makes this tactic impossible, it will be a huge win. The upside is nonexistent anyway: the state is photographing everyone at these events, so you taking an additional photo does not change the risk surface for anyone with regard to state retaliation.
- nxobject 2y ago
  As another Portlander, disagree with exceptions: surveillance footage made it harder to identify people from top down angles, and it meant that a lot of people had their charges dismissed because of that. (I will need to look it up.) The bigger risk to a protest movement, I would argue, is an opposing agent provocateurs trying to get people doxxed. That risk to more people outweighs getting minority of provocateurs shut down. (On the other hand, you’re also right that agent provocateurs are old COINTELPRO-era tactics used by the state and right wingers against protest movements.) When it comes to tactics to keep yourself safe when protesting, there aren’t ultimately too many hard beliefs to be had, especially when the right are perfectly happy to collaborate with the state.
  - rightbyte 2y ago
    >The bigger risk to a protest movement, I would argue, is an opposing agent provocateurs trying to get people doxxed. That wouldn't be an agent provocateur right?

nxobject 2y ago

Re: iPhones - these suggestions are really good, AND it shows how hard it is to keep track of the attack surface of all of modern iOS features. I wish Lockdown Mode also set these hardening features on: it seems useless to harden your phone against spyware if you can still be surveilled in other ways.

upofadown 2y ago

Briar messenger is specifically designed for things like protests. I think I would prefer it over Signal. The article says: >Signal has responded to 6 government requests since 2016, and in each case the only information they were able to provide was at most: ... That is the all the information they claimed they had. We have no way to know what they actually collect. Briar runs P2P over Tor so they can't collect data, even if they should want to. Whatever is used, an article like this should remind the potential protester to turn on disappearing messages with an appropriately short interval. The powers that be might use something like a Cellebrite box to get all your old messages by cracking the phone security.

fph 2y ago
Signal is open source and ships with verified builds, so yes, we have a way to know what they actually collect.
- upofadown 2y ago
  I meant at the server. We have no way to know that is running there.
  - mmooss 2y ago
    The server is open source too. You could download it and run your own server, afaik.
    - TiredOfLife 2y ago
      Signal occasionally drops something that could be the server code. When they were working on their cryptocurrency they didn't release anything for over a year.
  - chikere232 2y ago
    isn't that what the e2e encryption is for? I guess they could collect metadata of course
  - 2y ago

throeuurir 2y ago

[flagged]

LAC-Tech 2y ago
The great thing about this article is that it's equally applicable to both far left and far right posters. Very inclusive <3

cmxch 2y ago

A sufficiently motivated state actor will have little issue with finding what they want/need, no matter what measures are taken.

tonymet 2y ago
protesters deal with various agencies from private security, city police on up to federal FBI etc. These measures will help in the most common scenarios and prevent further escalation. 99.999% of protestors are not going against NSA counter-intel teams, they are encountering low-level private security or police who escalate the situation. Every security practice is a risk/reward. The measures being offered here are no-cost measures which can reduce the exposure of evidence to casual security / police.

AtlasBarfed 2y ago

Th smartphone is the greatest mass surveillance device ever conceived, although AI monitored camera networks will probably exceed it very soon. There are basically no countermeasures. Which means freedom is truly at the discretion of the powerful, because once the government goes North Korea there is no going back. I actually think the biggest threat to humanity in the Great Filter sense is authoritarianism, more than nuclear Armageddon, grey too, or super AI. Nothing can stop by he centralization of power that AI provides to the powerful, and the fact the elite have been brazenly antidemocratic and anti- institutionalism in public and podcasting platform is this election cycle is frightening.

mmooss 2y ago
> Nothing can stop by he centralization of power that AI provides to the powerful The social acceptance of defeatism and quitting is incredible - they couldn't have a more ideal opposition. You'll never win if you quit before you start. It's mass cowardice in the face of danger, with an excuse of course.
AnarchismIsCool 2y ago
Weapons evolve, defenses evolve. There are ways of trivially defeating cell phone tracking, and there are ways of trivially defeating AI cameras (850 ways specifically). Some auth dipshit will probably come up with some other way of betraying the working class and the cycle will repeat itself.
- CamperBob2 2y ago
  This would be the same 'working class' that just re-elected Trump?

unethical_ban 2y ago

It's unfortunate that Briar is android-only. I know it is due to Apple restrictions on battery usage (afaik). But it is decentralized and can operate locally over wifi and Bluetooth. These seem like good practical steps. GrapheneOS has duress pins (type it in, and the phone is wiped). It has secondary pins for biometric - the intent being that your real password is a long passphrase, and "quick " unlock is bio+pin. I would add to this list some method of uploading video live to another service, in a way that the video can't be deleted via the phone. I know those exist for the express purpose of civil rights, I think the aclu has a list somewhere.

raybb 2y ago

404 Media just released a great related article "The Powerful AI Tool That Cops (or Stalkers) Can Use to Geolocate Photos in Seconds" https://www.404media.co/the-powerful-ai-tool-that-cops-or-stalkers-can-use-to-geolocate-photos-in-seconds/ https://www.404media.co/the-powerful-ai-tool-that-cops-or-st...

gruez 2y ago
What does this have to do with protests? Aren't protests by definition events where the organizers want people to be aware of?
- tejtm 2y ago
  Protest also attract polarizing provocateurs, you may not want to be associated with all that is done in your name.
dang 2y ago
HN had a thread about that tool last year: AI Photo Geolocation - https://news.ycombinator.com/item?id=40232755 https://news.ycombinator.com/item?id=40232755 - May 2024 (102 comments)

WarOnPrivacy 2y ago

Old phones are an underappreciated resource, imo. I keep a few handsets around for apps I don't want on my daily driver (ex:food ordering, 2FA). More in line with the article: For alternate cell/SMS service I have a RedPocket SIM. (note: I see now it's $45/yr on ebay. I'm paying less, prob grandfathered).

gruez 2y ago
>Old phones are an underappreciated resource, imo. Not really. Old phones don't receive security patches and can be trivially unlocked to extract all relevant information. Sure, it might not have your nudes or bank login, but if you're using it to coordinate the protest that's plenty of incriminating evidence for the police. >For alternate cell/SMS service I have a RedPocket SIM. (note: I see now it's $45/yr on ebay. You have to be very careful with this, otherwise it's trivial to tie the phone/SIM back to you. Off the top of my head: * the billing/shipping address used to order the SIM * any payment information used to top-up the account * location correlations with any other devices you own (for instance, if your burner phone pings the same towers as your primary phone for an extended period of time) * using it for anything other than protests (eg. as a "burner" number when applying for jobs to avoid spam)
- WarOnPrivacy 2y ago
  > Not really. Old phones don't receive security patches. For a phone that was off until 2 hours ago and it's only login is the app they comm with, there don't seem to be a lot of meaningful risk vectors. > and can be trivially unlocked to extract all relevant information. The unlocker will maybe get one app login and 2 hours of location data. > if you're using it to coordinate the protest that's plenty of incriminating evidence for the police. It's one app login and 2 hours of location data. Most of that same info can be gleaned by directly observing the individual.
- 542354234235 2y ago
  It depends on the threat model. A local police force vacuuming up cell data looking for easy targets and ways to intimidate protestors is different than a targeted investigation by a state actor to identify everyone at all costs. The Jan 6 insurrection is a good example of how difficult it is in a real world scenario to ID specific people in a large protest, and many of them got caught because they talked about it afterward on Facebook. If you are cell phone 2,347 on a spreadsheet of 33,422 phones and the number has no associated locational data, open source information, etc. you are way safer than bringing your regular phone, while not being an easy target and being able to communicate if you need to.

iseanstevens 2y ago

Also Meshtastic.org is a cheap (various <$50 options) open source LoRa based hardware bridge (or standalone device) that can be used with an app over bluetooth (or WiFi web interface). It supports strong encryption layer and over 1 km/mile per “hop” in most circumstances. Designed originally for off grid, it’s very flexible and pretty polished. Abstracts your phone into a UI. Has a whole ecosystem behind it. I’ve been using it for festivals and tracking my vehicles (high theft area) for years. Very handy should infra not be available. Should be great for protests also :)

nightpool 2y ago
This would depend on your phone being able to permanently disable its radio, right? I don't know if I would trust my phone well enough for that, I would be worried even in airplane mode about it making some small beacon checks.
- _heimdall 2y ago
  There are a few devices floating around with a hardware switch built in. If you use a Pixel, grapheme OS is probably pretty trustworthy so you at least no there's nothing nefarious down to the OS level. But yeah, in general if you take a phone just assume it's tracking you or at least making it possible for those with access to know you where there.
- AnarchismIsCool 2y ago
  There are Meshtastic devices with keyboards that don't require a phone
red0point 2y ago
Do you have any information about the privacy achievable by Meshtastic? From a quick glance it looks like it‘s using static NodeIDs derived from the Bluetooth MAC address in the always unencrypted Packet Header. So not only can you sniff these messages from far away at greatly simplified complexity when comparing to cellular communication, but also tie it to the hardware that you carry with you. Mesh networks sure have its uses, but I‘d be wary of their offered privacy in the presence of adversaries you could be facing at protests!

liontwist 2y ago

I don’t understand the issue. Protesting is legal. Are we advocating for illegal activity?

MengerSponge 2y ago
1) Protesting is illegal in many parts of the world. 2) Authoritarians have been known to act illegally to solidify their power.
- liontwist 2y ago
  Are we imagining only “good guys” will be the ones breaking the law?
  - MengerSponge 2y ago
    No, basically by definition. What's your point?
Almondsetat 2y ago
>Protesting is legal first of all, where? secondly, what has legality of protest got to do with privacy?
- liontwist 2y ago
  The concern of your phone being taken by authorities or capturing incriminating evidence
  - Almondsetat 2y ago
    Are you making the "if you've got nothing to hide" argument?
    - liontwist 2y ago
      That would be sharing your phone and password with the police because there is nothing to hide. I’m asking why you’re expecting to be booked by authorities and your phone confiscated for attending a “protest”.

giantg2 2y ago

Most of this is everyday security. "Avoid External Storage" They missed part with this. You could use external storage just for your current recording purposes so you can pop the SD card and take it with you if you think your phone will be taken.

scarface_74 2y ago

This is what the other side is telling law enforcement about iOS devices. https://cellebrite.com/en/glossary/bfu-iphone-mobile-device-forensics/ https://cellebrite.com/en/glossary/bfu-iphone-mobile-device-... iOS is amazing insecurely to a determined law enforcement agency after the first unlock when you turn your phone on. And a mitigation that Apple is doing. https://lonelybrand.com/blog/iphones-operating-on-ios-18-1-will-automatically-restart-and-switch-to-lockdown-mode-following-prolonged-durations-of-inactivity/ https://lonelybrand.com/blog/iphones-operating-on-ios-18-1-w... As far as having a strong pin to help protect you, it won’t protect you from rubber hose decryption.

echoangle 2y ago
> As far as having a strong pin to help protect you, it won’t protect you from rubber hose decryption. I wonder why no one adds a „decoy pin“ which looks like it unlocks the device but secretly deletes sensitive data. Probably, most people don’t see rubber hose cryptography as a real threat, and in most cases, they’re probably right.
- scarface_74 2y ago
  I don’t have any trust in the police or even more so the various 3 letter agencies.
  - 542354234235 2y ago
    It isn’t about trust, it is about how likely you are to encounter a risk and how big that risk, if encountered, is. Do you own a hazmat suit? A nuclear bunker? Did you install a 5-point harness and wear a helmet when you drive? Could you be tortured for information by the police? Yes. Is that in any way likely at all? No. Taking reasonable precautions against likely actions by law enforcement is better than acting like all things are possible so no point in doing anything.
    - scarface_74 2y ago
      The chance of encountering a police that operates unlawfully - especially since they have qualified immunity is a very big risk. The chance of other police covering for them is close to 100%

idlewords 2y ago

Unfortunately this is a topic that attracts LARPers. Remember that if things get spicy, you are not going to settings nerd your way out of a bad interaction with the police. Tech advice for legal and illegal protests is pretty much diametrically opposite, and advice for countries like the United States is much different than for somewhere like Egypt. It's complicated!

vueko 2y ago
The fact that rubber-hose cryptanalysis exists doesn't mean that cryptography is useless. While settings nerding is indeed probably of limited use if you have a direct encounter with authorities, settings nerding can prevent being caught up in a dragnet search for, say, every cell service subscriber present at a protest gone sour, just as ubiquitous cryptography probably can't keep you safe from dedicated NSA attention but can protect against warrantless dragnet fishing expeditions. As pointed out elsewhere, the line between legal and illegal protest is very blurry and can shift rapidly; if anything, the only way to be sure you're not going to a protest that could eventually be classed as illegal is to never go to a protest, regardless of how pure your intentions are.
ants_everywhere 2y ago
What a lot of people don't realize is that a lot of the protests are organized by people who do not care if you get hurt, arrested, or die. In the US, Russian operatives organize a lot of the protests that turn violent. They also organize the counter protests. In other countries, protests are often organized by foreign entities. The organizers will have good opsec, but everyone else is just (metaphorically) cannon fodder as far as the organizers are concerned. It's been this way for decades. The Soviet Union organized protests in other countries for pretty much its entire existence. The US helped the Polish anti-authoritarian Solidarity movement and several others.
- deleted 2y ago
  [deleted]
- Aeolun 2y ago
  > What a lot of people don't realize is that a lot of the protests are organized by people who do not care if you get hurt, arrested, or die. I mean, that’s kind of a given even for the protests that are legitimate. They really only happen when people reach a point of no return, and the organizers are more likely to be fanatics in the first place.

maybejustmaybe 2y ago

Technically you could piggy back on another protocol and obfuscate your comms. Like piggy backing in an envelope across https connections from server to server. Nobody is looking there. And even if they are, good luck decrypting that. Looks like a legit site but it is actually a proxy for delivery encrypted payloads.

xyst 2y ago

yes, will need this in the upcoming class revolt.

rob_c 2y ago

It's called a burner phone. Learn from the professionals...

mastazi 2y ago

See also the EFF Surveillance Self-Defense guide for activists and protesters: https://ssd.eff.org/playlist/activist-or-protester https://ssd.eff.org/playlist/activist-or-protester

gonzo41 2y ago

You should be going into airplane mode at an isolated time before you get to the protest so you don't have a pattern of 10 friends all of a sudden dropping off the network together. Infact it's probably not the best idea to protest (in a crowd) anymore. The cops know how to kettle, and they have the tech edge. Activists need to think and act more asymmetrically.

G_o_D 2y ago

There are some apps that detect fake base stations monitoring your traffic There are apps that uses accelerometer and gyroscopic sensors to detect if phone is snatched execute certain action based on this Use app lock, so in case your phone is opened, apps will still be locked --> lock galley + filesExplorer(any) + settings + playstore + Browser(All installed) + Cloud/RemoteDrives(any) + Any syncing apps + Contacts + Email+messaging apps etc (Hell all apps for utmost paranoia) Use apps that remotely sync your phone specific folder/gallery every time new file is created (So when taking photos or recordinf something, if pbone got snatched, data is deleted + phone is broken or formattef/wiped against your will, your files have already synced to remote location so no worries Snoopsnitch https://f-droid.org/en/packages/de.srlabs.snoopsnitch/ https://f-droid.org/en/packages/de.srlabs.snoopsnitch/ Stayput https://f-droid.org/en/packages/org.y20k.stayput/ https://f-droid.org/en/packages/org.y20k.stayput/ plucklockex https://f-droid.org/en/packages/xyz.iridiumion.plucklockex/ https://f-droid.org/en/packages/xyz.iridiumion.plucklockex/

ignoramous 2y ago
> There are some apps that detect fake base stations monitoring your traffic Pixels (and soon other Android devices) have this functionality built-in: https://security.googleblog.com/2024/10/pixel-proactive-security-cellular-modems.html?m=1 https://security.googleblog.com/2024/10/pixel-proactive-secu...

deleted 2y ago

[deleted]

rowie 2y ago

Just use Meshtastic! ;-)

frontalier 2y ago

Mobile Phone Security For Activists and Agitators https://opsec.riotmedicine.net/downloads#mobile-phone-security https://opsec.riotmedicine.net/downloads#mobile-phone-securi...

nanna 2y ago

Or simply leave your phone at home. Need to meet with friends? Plan a meeting point. Need to take photos? Do you really? What right have you got to photo other people's faces? Just leave your damn phone at home.

cluckindan 2y ago
If you want to take photos, bring a good quality video camera, preferably with optical image stabilization. It’s much harder for disinformationists to deny or reframe a long, uncut video.
Gasp0de 2y ago
Taking video can protect against police brutality or false claims by the police. Although I agree that it also is dangerous.

bArray 2y ago

Potentially this is where the likes of the PinePhone should thrive [1]. As well as the methods suggested, you could have full disk encryption and just have the phone switch off if it suspects any shenanigans. If you want, it could still boot into an OS, but it just denies knowing about the encrypted disk. Done right, the image itself could be difficult to discern from something like a corrupted video file. > Your Risks at a Protest In addition, your SIM (likely traceable to you, especially if you have it) will be auto-connecting to their temporary telecom system (i.e. Stingray [2]), where they can find out the following: 1. That you were nearby to the event. 2. A tonne of operations available via the modem [3]. 3. If you speak to somebody locally (as part of the routing). 4. Shift your connection down to 2G/3G where it is easier to hack [4]. I think each person needs to consider their security model. [1] https://pine64.org/devices/pinephone/ https://pine64.org/devices/pinephone/ [2] https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker [3] https://www.electronicsforu.com/special/cool-stuff-misc/gsm-at-commands https://www.electronicsforu.com/special/cool-stuff-misc/gsm-... [4] https://www.eff.org/deeplinks/2020/06/your-phone-vulnerable-because-2g-it-doesnt-have-be https://www.eff.org/deeplinks/2020/06/your-phone-vulnerable-...

Delk 2y ago
Regarding #2, I thought AT commands were something you could send to your modem from your attached device. I'm not aware that they could be sent to a modem by another remote modem over the network link. Is that also possible?
- bArray 2y ago
  You are correct, it's just there to give you an idea of the capabilities of the modem, what sorts of information it holds and what the cell tower may query.

scaredhana 2y ago

[flagged]