Hacker News Reader

Comment by crunchiebones | Hacker News Reader

it won't stop people getting multiple sim cards and registering those under different names

To get a sim card (even prepaid) in Austria you need to provide a valid ID/passport. If it's not an Austrian/German/Swiss ID you will need to go in person to activate your sim card. This would make it really difficult for someone to manage a few accounts.

You can buy sim cards on amazon from other EU countries.

So tell me how this will work. Will you swap SIM cards just to post anonymously sometimes and let the telecom providers (among others) find out what your other SIM cards are through your device ID? Or will you get a SIM card from another country to use exclusively and pay roaming costs / live with a worse data plan in Austria?

People apparently forget that telecoms providers cooperate with authorities, new legislation is planned for this too.

> So tell me how this will work. Will you swap SIM cards just to post anonymously sometimes and let the telecom providers (among others) find out what your other SIM cards are through your device ID? Or will you get a SIM card from another country to use exclusively and pay roaming costs / live with a worse data plan in Austria?

> People apparently forget that telecoms providers cooperate with authorities, new legislation is planned for this too.

Also remember that as soon as you connect to the cell phone network, your location is made known. If you ever slip up and use your personal and private sims in a more private place, you are likely to get caught. Coupled with other potential identifier leakage (like device id as you mentioned) the opsec bar is high for this use case.

Roaming costs are basically non-existant these days in the EU.

For me it is cheaper to use internet through roaming than buying local plan.

> Roaming costs are basically non-existant these days in the EU.

Data plans can be limited for other countries, even within the EU (and frequently are), i.e. if your prepaid contract allows 5GB monthly data transfer for free, the provider might limit this to 500MB for roaming and beyond that limit, you can pay a hefty fee per MB.

In general, prepaid cards aren't famous for having a generous data plan...

But in eu it's more like 20euros for 100go/month and 25go of roaming. The main problem is tje provider will close your account/ask you to pay more if you use roaming exclusively

Giffgaff in the UK gives you 20GB for £20 on pay as you go, and it can be used up to that limit anywhere in the EU. And you don't need a passport to get a simcard either.

> giffgaff runs on the O2 network

Eh, no thanks

You need almost no data to register an account.

You need passport or local id for prepaid purchase, at least in the EU countries to which I've been.

Czechia, Sweden, Finland, Ireland. There are more but plenty to pick from without registration and good prices.

I just bought a vodafone sim in the UK without ID. It is supposed to work all over Europe, but I only tried the Netherlands.

I cannot say for sure but as I remember EU countries eliminated roaming charges, even for prepaid. OTOH there are not so many EU countries that sell prepaid without ID.

"So tell me how this will work. Will you swap SIM cards just to post anonymously sometimes and let the telecom providers (among others) find out what your other SIM cards are through your device ID?"

Imagine connecting to the Internet using a non-phone ?

You use remote services that host your SIM card(s) for you. So you basically make VoIP calls that get routed to cellular networks.

How does your phone communicate with the "VoIP" provider?

You gotta use WiFi.

If it is like in Spain then the non-registered sim cards from other EU countries will simply not work if I remember correctly.

However I have heard that in Spain you could anyway buy unregistered sim cards from certain stores if you asked around and paid a bit more.

My non-registered Dutch t-mobile SIM worked fine in Spain a couple of weeks ago.

Sounds unlikely. I know quite many in Sweden who have unregistered SIM cards and I think I would have heard of if they did not work in Spain.

Alright then I am mistaken. But I do know for sure that you are required to show ID to get a sim card inside the country and there are no unregistered prepaid cards.

this will work for a minority who pay attention to privacy, though the majority just won't bother. The problem I think is that because it's being criminalized to have an anonymous SIM the average citizen will just comply while those who have something to say are silenced.

How is homeless situation in Austria? Thats how you get clean untraceable pre registered cards.

what you suggest is a really good technique which has the additional benefit of inheriting the social graph of whoever owned the phone before. it's easy to get them from immigrants in one of the mom+pop shops offering international "calling-home" services.

That sounds interesting. Can you elaborate for someone that is opsec-naive?

tbh I'd rather not considering how easy it is to give the wrong advise. OpSec is a deeply personal affair very everything you do (and don't do) needs to be tailored to what you're trying to protect and consistently (!!) revised.

I did a writeup that was aimed to illustrate the insane complexity of OpSec and for people to follow along to achieve better privacy (e.g. first install some browser plugins, then /etc/hosts blocking, then pi-hole, then Tor, etc ... so it gradually introduces people to the idea, until eventually the steps become too hard or impractical for them). Also be warned about the psychological pitfalls of what secrets/compartmentalization can do to the brain and remember that cops and spooks have specialists to support them while a lone wolf trying to protect themselves remains exposed to these dangers this can do to your mind.

some of the first couple of "Steps" from the document should be ignored in 2019 (or moved to the bottom - to where the more difficult points are listed - because people will get it wrong) and are no longer useful but the final points of the document give some tricks on how to hide completely. Things like sending a friend around the world with a budget of monthly $50,- debit card for beer money (under your name) remain highly relevant.

Other things are totally missing such as what to do if you think your phone is compromised or how to do damage control in general.

Again be warned that certain points are very dated and may not give you the protection they promise in 2019:

https://web.archive.org/web/20180714043311/https://iotdarwin...

> Use a burner phone with a prepaid SIM to safely enable 2-Factor Authentication (2FA) without leaking your primary mobile number to any «cloud based data-krakens». Nokia’s relaunch of the 3110 is OK for that purpose and doesn’t immediately out you as somebody holding a burner phone in their hands. But the problem is that it has a GPS chip and camera. Probably a show-stopper for stricter scenarios. Just get any cheap phone that doesn’t include the word «smart» in the name. You want to be able to text and that’s it. Consider buying a used prepaid SIM for a few extra bucks from somebody not associated to you and who hasn’t advertised this to you before either. In some countries this might be your only choice meanwhile. Immigrants are usually happy to sell their prepaid SIM for some extra cash. This gives you a number including all existing metadata (call and movement history visible to the operator and the spooks) already associated to that device and its previous owner. You have now purchased the «cover» of a whole network of people connected to the previous owner. This adds plausible deniability to what would otherwise be a pristine dataset (starting from zero). You will also inherit any active tracking that the original device owner themselves might have already accumulated. So if you’re unlucky you may buy the phone from someone under active surveillance. However the idea is that as data-sets age they increase in value to anyone studying them (and people who do are never your friends regardless if you have anything to hide). In other words, what we did above with TrackMeNot/AdNauseum, we’re now repeating with a prepaid SIM from a stranger.

I don’t recall doing that with a Hofer SIM card. However major other networks go a longer way recording who you are.

Then you probably bought your SIM before 2019-01-01. Old SIM cards will have to be registered until September or they must be deactivated.

I bought a burner phone in February (cash, no ID) and there was a HoT-SIM with it. I didn't try using it though.

Check https://www.hot.at/aktivierung/index.html for details for HoT users.

Only selling SIM cards with an ID, would.

And going to jail for 5-10 years if you're caught bypassing the law, would as well.

It's not yet clear (at least to the public) how the registration will actually work on a technical level. I think the idea is that there will be third party services who are responsible for validating the identity of a user (similar to what banks use for KYC purposes). Users could identify themselves via different means, e.g. by providing their phone number or by simply uploading an ID. But that's all speculation on my side.

The easiest way is when the user provides their phone number and confirms it by receiving a SMS. That's how users of public WiFi points are identified in Russia and how users of IM programs are supposed to be identified in near future.

If you're thinking about fake names, you'll get problems trying to register your SIM cards at the telecoms provider, they do ID checks now.

There was a practice in Germany where people traded registered pre-paid SIM cards openly on a website created for that purpose - which was perfectly legal[1].

However they stopped when a court shot down the surveillance law that made people concerned in the first place[2].

If Austrians are even half as privacy-conscious as Germans, expect much of the same happening.

1: https://datenschmutz.net/anonym-kommunizieren-simkarten-taus...

2: https://en.wikipedia.org/wiki/Data_retention#Germany

> If Austrians are even half as privacy-conscious as Germans, expect much of the same happening.

Possibly among groups of people who regularly break the law. I can't see a normal person willingly accepting this sort of risk (e.g. being persecuted for child pornography someone else downloaded) for no good reason.

Also, the authorities will find you anyway if you've ever used a SIM card with your real name in the same phone or even if you only bought the phone from a place where device IDs are registered (like Apple, presumably).

> I can't see a normal person willingly accepting this sort of risk

A lot of Germans did in fact do it. So... there. Even my father considered doing it, being ever suspicious of the handheld tracking device that is the smartphone we forced on him.

There's not much police will (or can) do once it's established that you traded SIM-cards. It's actually discussed in the first article I linked.

There's also a good chance you weren't even remotely physically close to the phone/sim when the crime was committed.

There's quite a few countries where you need to show a passport to register a sim card. Not sure if Austria is one.

I made a map with all European countries requiring an ID:

https://old.reddit.com/r/europe/comments/9ziqfi/european_cou...

Turkey goes further and requires registration of phones, too.

Turkey is not an European country. Having a few percents of the territory in Europe does not move you to Europe.

In Austria and Germany you can't get any SIM without ID as of now.

So if you are a criminal that needs disposable SIM cards you just pay some cash-strapped person to get a bunch of prepaid ones for you.

The point is you have a path to trace if needed. Say some criminal has done that, they've established some kind of contact with the "cash strapped person" to do so - either electronically or in person. Electronic traces are pretty feasible for major nation states to uncover since they're ingesting packet traffic metadata from the whole internet traffic of countries. In-person traces can often be covered by surveillance camera records etc etc. Once there is a point of entry, there is usually a path for entities with governmental powers to investigate.

If you are a criminal, then you can just buy SIM cards from someone or from country that doesn't require indetification.

Do they also make it illegal to sell SIMs between private parties?

Since late year, SIM cards require registration with your real name (in Austria).

Of course you could still get your hands on one registered to another name, but it's no longer trivial to get an anonymous card here.

You can just get them from other countries like Sweden who allow anonymous SIM cards.

Reply on news.ycombinator.com