Hacker News Reader

Comment by GaryNumanVevo | Hacker News Reader

Pro-tip: If you want fairly good OPSEC when going to a protest, get a burner Android phone, put it on airplane mode with WIFI only. Then purchase a couple of Comcast / Xfiniti logins off the web, and use those to connect to "xfiniti-wifi" hotspots. Most cities have them, the speeds are fairly decent too.

We're truly living in the panopticon

View on HN

In Portland hundreds of demonstrators used the mesh-networking app Bridgefy, and some affinity groups used goTennas which even served streaming movies, music, and documentaries that spoke to the revolutionary tenor.

How does bridgefy make money? It's not open source. The website leads to a level 3 default page.

How do you know the feds don't own it?

In general, it is best to assume that the feds own everything and work from there.

Through the pandemic, Xfinity is offering anyone free guest access, so for at least the next few months, you don't need to even buy logins. https://corporate.comcast.com/press/releases/comcast-extends...

Note, this only works on the xfinity "public wifi stations" rather than the xfinity ssid's from home routers.

If you want to access the home router networks, you still need to pay for an account.

Yup thanks for the clarification

"Pro-tip: If you want fairly good OPSEC when going to a protest, get a burner Android phone, put it on airplane mode with WIFI only."

I don't have a use for such a thing, but if I did, I think I would get an Apple iPod touch which has no cellular capabilities at all ...

If you have gapps installed (every stock ROM unless you're in china), you should probably assume google is tracking your location through wifi networks. As such, you should probably install lineageos for additional security.

This is more reason then ever to flash a generic android image.

Google does track your wifi and have amassed a huuuuuge library of SSID name, freq, mac addresses and this is what they use alongside IP geo location for google maps and other services.

It's good and also bad. And if you restrict these things, you "look" like a bot so you have increased friction to accessing information!

The looking like a bot, makes sense I get that and ddos prevention but it goes in a circle, doesn't it?

iPhone is not the answer either, but an iphone w/ no google apps doesn't mean you're free from the ecosystem.

> This is more reason then ever to flash a generic android image.

This doesn't really exist. It's not like a Linux distro, each specific device requires a specific device-tree, a separate image. postmarketOS and others are trying to change this.

Maybe I'm being overly paranoid, but if you're arrested, what's stopping the cops from matching the phones MAC to public wifi connections?

This might be helpful: https://support.apple.com/en-us/HT211227

> To reduce this privacy risk, iOS 14, iPadOS 14, and watchOS 7 include a feature that periodically changes the MAC address your device uses with each Wi-Fi network. This randomized MAC address is your device's private Wi-Fi address for that network—until the next time it joins with a different address.

iOS 14 is in beta, but has been pretty solid for me. https://beta.apple.com/sp/betaprogram/

Since Android 9 there is an option to use randomized MACs for the actual connection (not just probing).

Most folks won't be aware of an option unless it is default.

On my Samsung Galaxy S10e (Android 10) it is the default

That's for probing only, randomization on connection is accessible via developer options only.

The defaults changed in Android 10:

[Starting] In Android 10, MAC randomization is enabled by default for client mode, SoftAp, and Wi-Fi Direct.

https://source.android.com/devices/tech/connect/wifi-mac-ran...

Who's to say that a stingray won't overwrite those settings though?

The AOSP security model.

Realistically nothing, however if they're using a Stingray to target large swaths of people, you're more likely to avoid getting your phone pinged on WIFI. Not to mention going after specific MAC info from Xfinity takes a long time.

You should not have to be good at opsec or economically advantaged to be able to demonstrate.

Completely agree, between DHS compiling information on journalists and unmarked vans picking up protesters, it's like the Arab Spring

Then don't bring a cell phone to a protest?

It would certainly seem as if far and away the easiest and best opsec is to not have your phone on you or at least not turned on. Have people really become so dependent on their phones that the thought of being somewhere without one doesn't even come up as an option? I'd certainly at least turn my phone or a burner phone off before depending on not being compromised.

People are pretty dependent on their cell phones. It's our maps, ways out of places. You can even do bus tickets on them. It's our way to call for help, see if someone is okay. So it's weird not to have my phone on me.

The presence of cameras is important and the footage they have taken has made significant waves.

Use a camera?

But then you need both a camera and a cell phone(that you already have for the rest of life) to go to a protest

Are there documented examples of people in the US facing repercussions because they were known to have been at a protest?

Arrested for "your cell phone said you were at the protest" not so much. Arrested for "you were photographed throwing a molotov wearing a limited edition etsy shirt for which you left a review using the same handle as your instagram account" yeah. HN kinda considers that to be the same thing though.

Then again, what would happen to a protestor that actually protested in a non-violent manner? Let's specify in the US as I can only guess it would be much more dangerous to protest in a country without a protected constitutional right to do so. So a US citizen brings their cell phone to a protest, non-violently marches with their signs, sings some songs, yells some, gets dispersed in a violent manner and/or gets arrested. If their cell phone gets pinged in a Stingray sweep, what happens? What's the negative repercussions?

Their name goes in a file and they get added to various lists. Depending on which list you are on (and who else was at the protest) you will be eligible for further scrutiny. (Remember, everyone breaks dozens of laws a day, as none are meant to be enforced 100%.) Depending again on which lists you wind up on, you may find yourself unable to fly, ineligible for pre check, blocked from a government contract, failing an fbi background check, the target of yellow journalism, victim of police harassment, always missing flights due to random checks, or always being greeted by an entourage of your own at points of arrival. Have fun!

This is exactly why I'm 100% against the idea of using the "do not fly" lists to block citizens from firearm purchases.

Imagine being denied your Second Amendment rights because you went to a perfectly legal political protest the previous year and you're now on a list that you can't get off of.

I think the trump government has proven that the executive can do whatever it wants, and you're lucky when governments follow the constitution.

Following examples of different behaviour from the past 20 years:

The US can kidnap you, Ship you off to Guantanamo, Torture you, Assasinate you with a drone based missile

I read an interview with CBP folks where they consider the Portland protestors "enemy combatants" which is the same designation as "civilian killed by drone strike" in the middle east

From a low level, more likely perspective, they might leak your information to white supremacist groups, and then choose not to press charges when they do something bad to you? This is assuming you're black, mind you.

Not an option, modern protests are all about getting that viral video that makes the other side look bad.

Cops can still come and harass you by coming to your house if they can find you or you filmed something they don't like. One person who filmed apparent police violence in seattle had 5 cops come to his to arrest him for something random about another protest. They may have found him from the account he posted it on. In either case, there will be attempts to find some people who weren't involved in violence.

How things should be and how things actually are don't always line up.

Won't your wifi mac address be a unique identifier? Did google start doing wifi mac address randomization?

Yes: https://source.android.com/devices/tech/connect/wifi-mac-ran...

Are these logins legally purchasable or is there some black/grey market for them?

Sure, it comes "free" with every Xfinity internet plan. Ideally you would "borrow" someone else's account for a while.

Reply on news.ycombinator.com