Hacker News Reader

Comment by jeffbee | Hacker News Reader

TL;DR it's a radio in your pocket that constantly announces its identity. I'm quite interested in the fact that people don't realize this. Is it a generational split between people who can remember when we did not all have radios in our pockets and those who can't, or ??? The fact that an always-on radio you carry everywhere can be used to track you seems like the #1 most obvious thing about the technology.

View on HN

I feel like you're ignoring a key point here, which is that these stingray devices can MitM your phone by forcing it to send essentially unencrypted messages. That's both more technically complicated and more serious than passive tracking.

I don't think OP is ignoring any points. It is a statement of fact that we've been carrying around what ultimately amount to high power RFID surveillance devices in our pockets for about 20-30 years now (en masse). There are also many on this board at this very moment who can remember life before any of this technology or concern was a thing.

In 1990, if you walked to the store without telling anyone where you were going, you were basically a ghost as far as anyone else was concerned. In 2020, even if you leave all of your digital electronics at home, you will probably be detected by someone else's electronics.

OP is sort of shrugging off the information in this article by saying that it should be common sense that by carrying a phone you are trackable. I don't really disagree with that. But a major point of the article is that not only are you trackable, but you can be actively surveilled or even have your text messages spoofed, which is not common knowledge and isn't really encapsulated by the "radio in your pocket" analogy

> these stingray devices can MitM your phone by forcing it to send essentially unencrypted messages.

Earlier Harris equip did that by forcing 2g mode but 2g is being turned off: https://1ot.mobi/resources/blog/a-complete-overview-of-2g-3g...

I'm less familiar with the capabilities of current IMEI catchers tho.

> Earlier Harris equip did that by forcing 2g mode but 2g is being turned off

Even if the carriers switch off all their 2G towers (which happened here in .au years back), I wonder how many handsets will still happily connect to a Stingray-type device that offers it a 2G connection?

You can't expect end users with little-to-no technical know-how to have the same common knowledge that you do.

I watched a doco last night where researchers put a sounding beacon inside a shark.

Inside it! They said something like "these sharks are used to cuts and scrapes and heal quickly."

It's no wonder people don't immediately associate their phone with a locating beacon.

Maybe I'm not translating correctly "sounding beacon", but I would assume that what you see was just an (I don't know the exact term) "electronic tag". This is standard procedure in ecology, veterinary and animal husbandry. We did it sometimes. Is a rice grain size object, and does not left any noticeable scar in fishes.

All good, I don’t have any issue with attaching or implanting tracking devices for research purposes in what looks like a wholly harmless way.

From what they were saying, it emitted a ping every ten minutes, wasn’t entirely clear if it was acoustic or radio. Shark didn’t seem to mind.

Well, why not? How can we improve general technological literacy? I don't want people to memorize the protocols, but I do want them to have the foundation of knowledge that would allow them to conclude that if the phone company can connect calls to your mobile handset, then they can also figure out roughly where it is. I'd also like for people to have the basic knowledge required to understand that GPS does not track you. It's the other way around. I'd like everyone to understand that mass and energy are conserved, the Earth orbits the Sun, etc.

Abstracting away all of the details underlying the tech is a double edged sword. On one side, you get massively higher adoption due to a lower barrier to entry. On the other, you now have a massive population of folks who don’t understand the the “fundamentals”.

I’m not sure we “need” to improve the general understanding. I mean how many ppl know how to change their own car tires or oil? If anything you just keep creating niches for ppl to make livings in.

"Why does anyone need to know" is a restrictive premise.

In my experience, what follows it are less rights, less ability, greater compliance & increased malleability (eg: susceptibility to "election meddling").

The median IQ is 100, meaning half of all people have IQs below 100. Many of them did not grow up in an environment that pushes lifelong learning. Lots of people do what they've been trained to do and nothing more, which is good! Our society needs people like that. But expecting people like that to think for themselves is a sure way to become needlessly frustrated.

edit: switched average to median.

The measure that describes what you state would be the median, which is defined as the point at which there are as many values above as below.

Averages will skew with large outliers on either side. E.g. if Bezos and I are alone in a room together, the average person in that room has $95B dollars. (Granted, in an n=2 situation, the median isn't meaningful either)

You're right, this has been fixed. Thanks!

> How can we improve general technological literacy?

Fund schools.

Provide mandatory technical and privacy education.

> I'd also like for people to have the basic knowledge required to

Fund schools.

> Fund schools.

Hire tech capable teachers that care. Funding only works if it's toward this specific end.

> Hire tech capable teachers that care.

I know teachers who make < $30k/year and have to pay out-of-pocket for supplies. Good luck attracting tech talent with that salary.

So, again: fund schools.

You've misrepresented my premise by quoting it without the context.

Funding incapable teachers can't advance your goal. As long as the plan is "Fund schools." and nothing at all follows the period "." then students will have properly funded incapable teachers.

Source: Father to 5, who've attended 25 years of well funded and less funded schools. That's well over 100 teachers I've met with & learned about. Zero teachers understood technology on a level that would enable them to teach the nuances of technology safety. Many (if not most) would have been handicapped by the misunderstandings they held about tech.

Funding alone won't fix the decades of neglect, social norms built around that dysfunction, and the incompetent leadership many schools systems suffer with. But it's a necessary first step. If you don't fix the other pieces though, even higher pay won't keep the people around who should be there. I have known some teachers who tried their damnedest and were very competent, but burned out quickly.

I think the real thing there is pay teachers more.

Just funding schools doesn't mean teachers will be paid

>would allow them to conclude that if the phone company can connect calls to your mobile handset, then they can also figure out roughly where it is

To be fair, people have trouble concluding they can be tracked or found when they sign in to a service and are asked repeatedly if said service can have access to their location, then use said service to check in or announce their location publicly.

Every professional, expert, specialist, or technician feels this way about the stuff they know. "Why don't people know [basic thing about their work]? What a bunch of uneducated morons." The answer is because if they knew all the basic stuff about all those fields to be what those experts judge to be informed consumers, and took the time to apply that knowledge, they wouldn't have any time left to 1) actually buy products and services, or 2) learn what they need to know about their own field. Also because being an uninformed consumer works out more-or-less OK much of the time, largely because regulation prevents the worst sorts of abuses.

In the specific case of tracking/spying I'd imagine lots of people (not most, but many) have considered the possibility, then dismissed it without looking into it any further because it seems like something that would obviously already be illegal, and assuming things that seem like they ought to already be illegal are already illegal often gets one to the correct conclusion—just not this time. Those sorts probably assume that if a law enforcement agency gets a warrant or something then they might start tracking locations using cell phones, but not that the cell phone company is already doing that 100% of the time to everyone, since, again, it really seems like something that'd be illegal. I think a lot of the "information economy" falls in this blind spot—that credit card companies would be selling your purchase history or google/your-ISP would be recording every single website you visit also seem, intuitively, like things that'd be very illegal, for example.

I guess we will disagree on what is or should be obviously illegal. What your phone does is the functional equivalent of you walking down the street shouting your phone number. It does not strike me as obviously wrong for people to hear it.

the article also goes into the fact that these stingray devices can send text messages from your phone number and listen to your phone calls in real time. I dont think your analogy really captures that, and it's hard to imagine an argument for that being legal (at least without a warrant)

I just mean that it's the kind of thing many people who have some concept of how cell phones work might assume is illegal because tracking a bunch of people and storing all that info, or broad, non-tightly-targeted-and-regulated use of things like stingrays, and the various other things service providers and law enforcement do to spy on people really do seem pretty similar to stalking and warrantless search and various other activities that are illegal (so, obviously that would be too, how could it not be, one might reason), and so they might be surprised that a capability they know or suspect exists in the technology is used the way it is and to the extent that it is by both private parties and law enforcement. Their not thinking about their cell phone as a device that spies on them or is otherwise very untrustworthy might not be because they don't know what the tech might do but because they've assumed exercising those capabilities would be illegal.

I suppose similar reasoning is how we arrive at our judgements on most questions of legality, personally, when deciding how to behave and what to worry about others doing day-to-day. Like, I definitely can't show you the statute that says driving the wrong way on the highway is illegal, rather than just a very bad idea, and I'm not sure I've even ever been told specifically that that is illegal let alone done the research to makes sure it's illegal—but nonetheless, I'm pretty sure it is. So, I would guess some people surprised that their cell phones spy on them in certain ways are more surprised that they are being used that way and not that they could be used that way.

[EDIT] to stretch the analogy further, if I were surprised to learn that some delivery company had found a way to reduce delivery times by driving the wrong way on the highway, the fact that vehicles are technically capable of driving the wrong way on the highway wouldn't be the part that I found surprising.

In a general sense, our problem isn't surveillance but disproportional surveillance. It's generally appropriate for LEO to have access to the same data that all of us do. The problem is when 'privacy' or security laws restrict you and I from data but not the people who regularly exercise their exclusive powers to ruin lives.

This seems like a common tv and movie plot point though. If you don’t want to be found you have to destroy or lose your phone.

Most folks generally understand how radio works.

Do the math.

The odds of someone targeting you (just for kicks) aren't that high.

But don't tell Glenn Greenwald that cause then he has to go find something else to scare you with, to capture your attention in our current useless "state of fear" preserving info tsunami ecosystem.

But anyway lets do the math...

The US has 200 cops per million. Lets say 1% of that million are born douchebags and there is another 1% who have turned douchebagy for whatever reason.

So you have 200 cops to deal with 20000 bad guys per million. So in general they have enough going on keeping them occupied.

Now even if you assume they don't spend any time doing their job and all of them spend all their time fixating on you and no one else, the chances of them picking on you out of the million other options are still pretty low.

What makes it even lower is if you apply the 2% douchebag rule to the cops themselves, you get probably 2 bad apples in that 200.

But to indulge you lets apply it also to anyone who has access to the same privacy violating tech - bank managers, google engineers, telco engineers, the military, rich ppl etc. Keep adding whatever category you feel like and applying the 2% rule. You wont raise the odds too badly.

Your comment comes off pretty condescending and dismissive, which clouds a valid point. It's not likely you will be individually targeted by law enforcement.

The scarier proposition to me is bulk collection and latent analysis.

I think you can change that to "if you are not politically active, you are unlikely to be targetted"

On the other hand, if you are known to criticise police actions, it's likely that they will be targetting you. The BLM leaders probably haven't connected to a real cellphone tower in years

It doesn't have to target you directly in order to have a significant negative impact on your life.

Reply on news.ycombinator.com