Hacker News Reader

Comment by kchr | Hacker News Reader

You might want to use the term "single-purpose number" or something similar. Burner phone is colloquially used as a term for non-registered/anonymous phones, which this isn't. Sure it sounds cool but people might assume that's what they are buying...

View on HN

i was going to call you out for being overly precise, but given that this is literally hosted by essentially a Telecom company its a pretty valid point.

That being said, burner doesn't mean anonymous. Burner means disposable. Obviously you're not going to dispose of your account, application, and server every time you're done with the number.

It's also not even a phone. I guess its a phone application in the most minimal sense of the word..

So here's by detailed response https://www.twilio.com/blog/2017/07/building-a-fully-feature...

But I agree with kchr in principle. "Burner" may not mean anonymous but it's more often than not associated with anonymous and anonymity. It's the go-to perception or association if you will.

So I think kchr and I are saying the same thing: the article is using the burner/anonymity context as a little click-bait IMO and it's not a big deal but it's a valid point.

True, but it's mostly anonymous (but not subpoena-proof). There are multiple mobile apps that refer to themselves as "burners" (burn the number) but the same caveat applies.

>mostly anonymous >(but not subpoena-proof)

Then it's not anonymous, "mostly" or otherwise.

Any entity that is either subject to CALEA, or behaves as if it's subject to CALEA, is not your friend.

Note that Twilio, although not subject to CALEA, still behaves as if it is, bending over backward to honor any and all "lawful requests" for customer information, and requiring PII on account signup: https://www.twilio.com/legal/law-enforcement-guidelines

A valid search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel Twilio to provide the contents of communications sent or received through Twilio’s products or services.

How utterly unreasonable. Yeah, the man is totally trying to keep you down through Twilio.

No, that wasn't the point. The claim was that Twilio was "mostly anonymous", which isn't true.

If you're not a member operating under the criminal or civil justice system in the United States, it might be anonymous enough. Anonymous "enough" is all you'll usually get anyway. If you want to get technical, there's no such thing as true anonymity. Of course, whether or not "enough is enough" is, as always, going to depend on your threat model.

> The claim was that Twilio was "mostly anonymous", which isn't true.

If you accept that anonymity isn't a purely true/false proposition, which you are doing by using the word "mostly," having your identity only available to law enforcement after a court order has been issued seems like a textbook instance of "mostly anonymous."

Aren't we comparing this to a cell phone and service I could buy from CVS with cash and no ID?

Possibly? In this sort of continuum of anonymity we're talking about, that's probably a lot more anonymous (but it isn't fully anonymous unless you're paying someone else to buy the phone for you in a different city, and they don't know who you are, and probably some other things I'm not paranoid enough to think of).

It's still fine to say Twilio is "mostly anonymous," and objecting to that - that Twilio is "mostly anonymous" - on the basis that law enforcement can find out who you are with a court order is very silly. As if a service that requires due process of law to uncover any information about you is morally or practically equivalent to having your name and address in the white pages.

It's not any more anonymous than any other cell phone if "anonymous" simply means it's not listed anywhere.

So should we just say it's not anonymous at all? Eliminate the whole notion of "mostly anonymous?" That's what the argument was. If Twilio isn't "mostly anonymous," what is? And why the heck does having subscriber data available via court order eliminate something from the "mostly anonymous" category?

edit: by the way, I never said '"anonymous" simply means it's not listed anywhere'

You can't see the difference between something where it's difficult to even figure out who the user is and something else where anonymity depends entirely on you trusting the service provider and them not being subject to a court order?

At a nesting depth of six or seven comments, is it really productive to reply with rhetorical questions that don't even respond to the comment? Of course I can see the difference. I just don't understand what it is about the level of privacy that comes from requiring a court order to access user information that moves a service from "mostly anonymous" to "not anonymous at all." It seems like a highly ideological rather than a practical position to take.

If you care about anonymity because you're, I don't know, some sort of dissident, then the kind of anonymity offered here is absolutely useless.

I'm sure we can all agree that "mostly anonymous" isn't good enough for a dissident, but holy fuck what a useless subthread you started. Or I started. Dear God.

You're free to quit participating in the conversation whenever. Moaning about the content of it being "useless" is even more "useless."

It's ironic: the above reply is the first time you've responded to something I actually wrote. I almost admire the fact that it's impossible to tell whether I'm being trolled or whether you are actually like this.

Is the only way I can "respond to something you actually wrote" by repeating key words and phrases from your post? I reject your notion of "mostly anonymous" as essentially impossible to distinguish from "not anonymous."

>having your identity only available to law enforcement after a court order

or after a security breach...or after access by a third party without a court order (however unlawful it might be)...

I meant in the general use case, where I talk/text a random person and then "burn" the number.

I don't think that's what most people think when they hear "burner phone".

Well, the subpoenas tend to be the downfall of phone use. This is certainly a good deal less anonymous than buying a sim and minutes with cash.

It's not anonymous at all. Twilio requires PII to register an account and they log all communications. I've never used their voice services so I don't know if those are recorded but everything else is. It's fantastic for debugging and horrifying to think of what might happen if someone compromised an account.

Reply on news.ycombinator.com