back

by matheusmoreira·6d ago·view on hn ↗
> Until recently, only spies and criminals had to worry this obsessively about their private statements being picked up by electronic equipment.

> But soon, the average person might need to deploy surveillance countermeasures.

Already there. If you want privacy and anonymity online, you're looking at literal terrorist cell tier tradecraft. That means pulling up documents written by people from the "counterterrorism community" and "intelligence community" and learning how all of these "clandestines" operate.

Unlinking one's identity from one's actions and speech requires some serious OPSEC now. It requires constant, never ending effort. It requires perfect execution and discipline.

7 comments
Using GrapheneOS makes you a terrorist now. I'm a terrorist.
Since the courts decided you have to use your fingerprint to unlock your phone (because they decided that's not giving up your password and they can't compel you to give up your password), what if you use your fingerprint to wipe your phone? But you don't tell anyone ahead of time when they force you to use it. I'm sure you'd be arrested at the least.

I can't be the only person who has thought of this.

A password is considered (by courts) to be testimony. Face, gesture or fingerprints are considered things like keys which you can be forced/compelled to turn over when commanded by law enforcement. Therefore, only passwords, which will require a court order to unlock, are secure enough for now.
Fingerprint and PIN unlock, but only PIN unlocks it and fingerprint is always duress? That's a good idea.
> you have to use your fingerprint to unlock your phone

Nitpick, but that's only if you have biometric authentication configured in the first place, which you aren't compelled to do.

IANAL, but I would bet that's still destruction of evidence. Judges are human, for better or worse, and can see the intention behind cute tricks like this.

It might work if your fingerprint was used while you were unconscious, but any solution that starts with "setup a trigger that wipes a device" is already on shaky grounds.

Best approach is to shadow-ban the user when they do a secret gesture before logging in. No wiping necessary. Easiest implementation is to just log them into a shadow account.
This would still be destruction of evidence - virtually your only defense against that would be if it was not triggered by you.
Using a duress PIN or other duress feature is now considered destroying evidence so YMMV
I used GrapheneOS without a sim card for 4 months and the battery life was great. I put a sim card in, and since then (2 months) the battery dies twice as fast no matter which profile it's in, and dies faster even on airplane mode. I left it at 80% the other day and went out, came back 6 hours later and it was dead and red hot.

Maybe it's just a dodgy phone, maybe it's not doing something on the less-trackable sim connection, but I realised I can never really know.

Yes you can. Open settings and search "log". View log and see EVERYTHING your phone does without your input. Expect to spend hours just going back thru that day.
What model do you have?

The pixel 6a does terribly when it is in 5g mode, something abput the hardware is broken or bugged. My friend who has a 6a has to keep it in 4g only mode or sacrifice battrry life.

lasts for days with a pixel 9. literally don't need to plug it in for a couple days at a stretch

might just be an older phone and older battery

We're all terrorists here.

Own a general purpose computer you can run arbitrary software on, not just corporation and government approved software? You're clearly a money laundering drug trafficking child molesting terrorist.

Don't worry, the arbitrary software is probably running under Intel's ME or AMD's PSP.
This is why we should all be stopping, or at least minimizing, the use of our phones. The point is it’ll make the corporations more mad and that will get the government to change. money changes everything
Let’s be real, it’s an important topic.
> Using GrapheneOS makes you a

According to?

Friend of a friend retired several years ago from Intel. He'll go into detail about all the ways you're being spied on. He won't let you into his house with a smartphone; you have to turn it off and leave it in your car.

I used to think he was just paranoid...

The fun part about this comment is that we don't know if "Intel" is the company, or the term for the IC. I'm pretty sure it's equally likely to be either meaning, and no surprise based on whichever is correct.
In this case, it's Intel the processor company
there is quite a lot of industrial espionage happening with Intel and AMD, so I wouldn't be surprised if they are, in fact, extra paranoid
The likelihood is 100% that it is the company.
> He won't let you into his house with a smartphone

His mistrust might be about the phone's owner and the recording apps they might use, more than the smartphone itself.

Socially it's much safer to direct suspicion at "the smartphone" rather than the people invited to your house.

A visitor who wants to record will just have a second recording device. Asking nicely to leave the phone behind could only protect from spying the phone owner never intended.
To be fair, most phones have invasive Google/Apple/Chinese OEM services that work with high privileges and are invasive on their own, without apps. The share of people using degoogled OSes is small enough to assume it isn't the case. And, to be fair, if someone has a degoogled phone, you'd probably know that by now (I say as also a degoogled user XD)
> He'll go into detail about all the ways you're being spied on.

Don't doubt it for even a second.

How about a Faraday box, by the door? Take to the next level with acoustic insulation, just in case there's a record-now, upload-later mode.
> How about a Faraday box, by the door?

Not as easy as one may think. If you put a phone in a generic waterproof metal box (metal junction or biscuit box for instance) and call it with another one, most of the time it will still ring...

or just get on the alternet. If you and your peers care about communicating and you dont feel like doing state witch craft, the easiest thing is to just setup your own opt in systems and not use facebook, etc. run your own IRC server, file share, whatever. self host. it's easier than ever. Don't use discord, run your own communities, etc.
“Chief, we got a citizen here with a suspiciously small online footprint. Investigate further?”
And this is what I worry about. Seriously. My online footprint is minimal. I just hope gov will be still incompetent and lazy...
IIRC ICE has detained people trying to enter America without social media apps.
wise move, they could be radical anarcho-boomerists
it's kinda like how the old FBI email monitoring thing, CARNIVORE, automatically flagged anyone talking about BSD for a 2nd scan
I met the parent comment downvoted: I don't know why, given e.g. the rule from the current administration in the USA that, for visitors, the absence of social network profiles is to be taken as cause for suspicion.
I've applied to jobs recently that require listing LinkedIn profile. Don't see how that is legal. I always put something like idonthavesocialmedia.com but I imagine it's a strike against me according to see brainless HR drone who sees it as problematic
> Unlinking one's identity from one's actions and speech

This is an odd formulation. What is one's identity other than one's actions (physical body) and speech (mental state serialized into language)?

They’re talking about having personas for different purposes. Very simplified Example: Only talking about topic XYZ over tor with good opsec; talking about topic ABC openly.
Identity is what links them together.
This is paranoid. It is not that hard. HN famously can’t keep people out of here. They make new accounts. It’s not enough to IP ban. It’s impossible to retarget people even without vpn, all I need is a different cell tower.

I interact at various levels of anon all the time, it’s easy just cover your:

-Network (geo/IP)

-Device (useragent, cookies)

-Fingerprints (browser vendor, screen size)

And you’re off to trolling

Good luck keeping law enforcement from finding your location if they really don't like you.
While this is true, it's not an all-or-nothing game. A little bit of countersurveillance is better than none, even if you're not that savvy. We can win by gradually raising the per capita cost of surveillance until it's infeasible to surveil everybody. Individual digital sovereignty will be achieved eventually, but we won't get there in a single step. Start small and iterate. Even simple things like periodically wiping browser cache or changing the apps you use can meaningfully raise the cost.