NSA's Tips to Keep Your Phone from Tracking You

There is no signup information when creating an account, and one of the payment options is "cash in an envelope". Even if they're lying and do keep logs, it's as disconnected from your identity as I think is possible (assuming you do use that payment option instead of the others).

It's also what Mozilla VPN runs on.

They're the best VPN provider, hands down. They offer the best privacy protections of any provider at a very reasonable price, and the service itself is excellent.

I learnt a lot from that dude and have been using mullvad for years since since it's the only VPN provider I've ever personally met. Oh yeah, decent speeds etc as well :P

It feels awesome to be validated.

Years ago now, living in the US Virgin Islands, while drunk, I left the Ritz (great beach and bar) and requested that they get me a cab to my usual local bar that was stumbling distance to home. Upon arrival I realized I didn’t have my phone.

I’d left my laptop at the office, so I ran back there and used Find My iPhone. It was moving, so I assumed it was in the cab I’d been in. I locked it, added a display message, and used the office phone to call the Ritz and tell them... they called the cab company, and within 10 minutes the phone was back at the Ritz.

I’m positive that this was only because I’d used the cab company the Ritz contracts with and their drivers are terrified of losing a lucrative job, but it was a successful recovery in a territory not known for honesty.

Had I not had FMI enabled I probably wouldn’t have connected the dots, assumed I’d lost it on the beach, and lost my phone forever. As it was, I got my phone back and it only cost me an extra cab ride. I’ll never turn off FMI again, though.

Completely anecdotal, but my point is the system can actually work. At the very least I can lock the device and wipe its data.

If you are truly security paranoid, you write it off and get a new one. It will hopefully be secure enough that whoever got it won't be able to access it because they lack the passcodes, biometrics and bluetooth 2fa tokens you use to unlock it. If the cost of this scares you, perhaps the NSA/Mossad/whatever should not be in your threat model.

When my wife got her iPhone stolen in Rome, we were able to use the Find My Friends feature to watch it move across the country, and eventually end up in Tunisia. This was before you could remotely wipe an iPhone, so there was nothing I could do other than send angry text messages to whomever stole it.

There is no way to turn off iBeacon tracking on iPhones.

At this point you need to walk around with a faraday cage evidence bag to not have your phone stop fucking transmitting & receiving radio waves.

Wonder if they can track someone who is "lost in remote area without hope of being rescued."

Maybe if the phone is set on Survival Mode?

Almost like a video stream. Once in a while a keyframe and a stream of changes in between.

Ditto the proximity sensor: it's just a photocell and a simple room light could comprise a beacon. Flashing over, say 30hz would be invisible to us.

It doesn't matter. We've invested so heavily in offense that we can tell people how to defend themselves and we'll still own them.

Here's one of my favorite talks,

NSA TAO Chief on Disrupting Nation State Hackers

https://www.youtube.com/watch?v=bDJb8WOJYdA

This is the NSA Chief of Tailored Access Operations telling people how to defend themselves against the NSA (and other similar capabilities organizations), and it's all really valuable. None of it is fancy ML 0day detection or whatever, it's just about understanding your network better than an attacker can.

https://www.youtube.com/watch?v=y5g7Z1qC7-k

I’m sure NSA has an important role in managing the cyber risks of US citizens, in addition to the offensive ops.

https://www.nsa.gov/what-we-do/research/selinux/

> The NSA, the original primary developer of SELinux, released the first version to the open source development community under the GNU GPL on December 22, 2000.

https://en.wikipedia.org/wiki/Security-Enhanced_Linux

But let's be real, if you truly can evade them, you've probably already received a job offer.

Defense will always be harder than offense. The best you can do is make it extremely EXPENSIVE for an attacker. But can you outspend the NSA on your defense? (the answer is NO)

Not even Snowden thought it wise to reveal secrets related to ongoing operations. That would have been TOO expensive for him. We would not have known his name if he had done that.

Suffice to say, these attackers will already have ensured they maintain persistence even with closing their initial entry points.

Likewise, the NSA has many avenues to get into a device, or (more practically, when it concerns most of the public instead of specific users and devices they need access too) they use mechanisms that aren't affected.

As they've proven, they have a huge catalog of malware and similar, but that's for actual targets. People they already believe to be threats or targets, that they need to directly attack.

But for the majority of the public? The information will come from the companies themselves, not the user devices. Why would you spend thousands or millions on developing and maintaining an application you can put on everyone's devices, and may be removed, or even just disabled due to an upgrade (until you can patch it) when you can find and obtain data from a company that already has common apps on a device, across the public, and the public not only knows they are there, they WANT the app and will take steps to complain if access is rejected? And the companies will gather as much as they legally can (and sometimes more), put it into databases, sort it, categorize it, etc?

Why would you duplicate ALL of that, when you can just take the finished product, the sorted data that's stored, either legally and knowingly, or unknowingly from a company?

And you ensure that while you can maintain that access, either to the company or the device, you direct the users and company on how to protect themselves from random attacks, or other entities that want to target the users, often with automated software that hits the "low hanging fruit".

"Most likely?" More than Facebook or Google or some other human profiling company?