Hacker News Reader

Comment by obenn | Hacker News Reader

The premise of essentially proxying customers into a major carrier in aggregate to preserve privacy is an interesting one.

I use such a service for home internet in Ottawa, Canada (https://ncf.ca) and it’s been working great - with much better customer service.

View on HN

I'd be super uncomfortable to tie my account recoveries and stuff to a SIM technically subscribed to by another entity... But if I wanted a phone for leaking or whistleblowing, it's hard to imagine a better choice of service.

I would worry that since this service would be of such limited appeal, as you mention, that it might make these users more likely targets of spying and counterintelligence operations (I assume you're talking about government leaks and whistleblowing).

You should be super uncomfortable to tie your account recoveries to any carrier, though. Don't use phone recovery.

Yeah, too bad there are still a lot of services where phone recovery is the only option.

Interesting. Similar premium. Their 50/10 costs the same as my 1000/1000.

Then consider yourself lucky. Their 50/10 costs about the same as 30/? Where i live, and 1000/1000 isn't even available.

As an aside, I really hope NCF gets access to Bell Fiber!

From their last major newsletter they are planning cable service rollout eventually, probably on Rogers. It's active in some low-income housing already I think.

The stopper for Bell Fiber FTTH is Bell blocking resale of service on their pure fiber lines to 3rd parties. I don't remember any specific dates but the CRTC is bound to hopefully force their hand one day.

I am too hoping they one day offer it, I love NCF.

Hello fellow NCF user! I love their network and customer services. The price is higher than other 3rd parties but everything else about them is perfect for an ISP. Painless, accessible, simple signup with excellent, stable service.

Who does the proxying? Does it expose all your traffic to yet another entity?

Well I think the idea is that you are simply exposing your identity to a different entity, not another one, since your identity isn't passed down the chain.

Given that it's (probably?) impossible to use cellular internet without handing over your ID to at least one entity, the target audience of this plan is probably one that would prefer that entity to be one for which privacy is a primary concern.

(This is why I always wished Apple would become a cellular provider.)

In the US, you can buy prepaid sim cards with cash and without ID.

But I believe these are scrutinized pretty heavily. I saw an article Woz wrote and you have to call someone before they are activated - I guess that might be a 6dof thing to identify your habits.

I know of a hackerspace where people go buy and activate prepaid sims then toss them in a communal bowl.

Take a sim leave a sim.

There are always ways around this nonsense.

I live in the US and I've definitely bought sim cards and activated phones without sharing an ID.

I even proceeded to (unknowingly) break the law with one of the phones I bought from target. (apparently you're not supposed to use prepaid phones for balloon tracking.)

Not that it matters, they can still subpoena the place you got the phone from and now they have a video of you.

In today's world you will be wearing a mask so if you add a ballcap and keep your head down, identification will be difficult.

This is perhaps the first time in generations the outcome of a major negative world event made more privacy socially acceptable.

And keep your electronic devices off.

Target uses your devices radios to track your movements in a store. I wonder if they also use it to correlate cash purchases.

One of many articles about this: https://www.theguardian.com/technology/2016/jan/21/shops-tra...

What? LOL this isn't the 1990's, there's gait detection now.

Okay, so stick a pebble in one shoe.

While one can still buy a prepaid SIM card without ID in the USA (though I don’t expect that to remain the case for long), there are plenty of OPSEC slipups: if you top up your account with a bank card in your own name, the mobile provider will associate your identity with the SIM card. If you leave the phone with that card turned on overnight at your own home, it is trivial for the mobile provider or authorities to link that SIM to your own identity, etc.

Sorry to be blunt, but you have no idea how "Targeting" works on Advertising/Telephone co.

When Verizon/Att/Tmo/etc sells your information to Advertising companies, they will "infer" your identity. They do not care if phone SIM have your ID associated. That ID is built from traffic.

If they see DNS requests to real state sites, they may put you in a bucket that says "high income", if they see searches (via DNS hijack to when you search by your addressbar like tmo does) for things like fastfood breakfast delivery, up in the "low income" bucket you go. Also, it will always have your Phone number.

Then those Advertising companies "enrich" this data with data from google or others, and can pin point you by email plus all the correlated data. Happy that you have facebook two factor auth to your SMS now?

It shocks me that people in this forum are completely oblivious to Tracking and think that the aborted "think of the children" law that requires you present an ID to buy a phone line has any importance...

So, to conclude, the traffic here is observed by the proxing entity, by the tel co, etc.

Isn't this the same thing as a VPN?

I think it additionally protects people from identifying you by your phone number without a subpoena.

No, it's a financial blind: from the telco's point of view, the only subscriber is Purism. From your point of view, your telco is Purism.

Nevertheless, once you start spending 8 hours/day in the same spot for days on end, it will be pretty easy to link you from tower records to traffic, and then to your real world identity.

Those like me who dislike cell carriers selling our location data are best off using cellular data sparingly and not consistently at fixed locations when there is available wifi.

Combining this with financial blinding and you can likely use LTE at a protest in an oppressive country without much chance you get pinned down there and arrested later.

This: you can keep a Librem 5’s modem’s hardware kill switch flipped to off when you’re staying in the same place for 8 hours.

In the USA, of you want to use all the features, the IRS and many banks _require_ an cell phone registered in your name to prove your ID.

Assumedly, this number will not work for that...

EDIT:Bi previously said that the irs required you to have a phone in your name. That was incorrect. I meant to refer to the full secure online access: You can verify by phone or mail, and they disabled mail option during covid a while ago.

https://www.irs.gov/individuals/secure-access-how-to-registe...

None of the banking I have ever done has involved a phone number other than confirming that the phone I am calling from matches the number I entered in online banking, and receiving 2FA codes to that number.

When I opened the account in person, I needed a photo ID (driver license) and social security card (proof of SSN). Online, I surprisingly did not need the driver license at all, just had to provide SSN and e-sign a thousand forms. Phone number was not required and was not checked beyond confirming it was mine with a text code.

Update: I guess I spoke to soon--just received a notice about the following being added to the ToS for my brokerage account:

> “You also authorize your wireless carrier (AT&T, Sprint, T-Mobile, US Cellular, Verizon, or any other branded wireless operator) to disclose information about your wireless account, such as your mobile number, name, address, email, network status, customer type, customer role, billing type, mobile device identifi ers (IMSI and IMEI) and other sub-scriber status, subscriber method and device details, if available, to support identity verifi cation, fraud avoidance, and other uses in support of trans-actions for the duration of your business relationship with us . This information may also be shared with other companies to support your transactions with us and for identity verifi cation and fraud avoidance purposes . See our Privacy Policy for how we treat your data .”

I use Visible (a Verizon MVNO), which doesn't participate in these systems. Recently I had to verify with the IRS. While I couldn't use my phone to instantly verify, I was still able to be verified by them sending me a postcard. Annoying, but certainly not required.

That sounds like it’s more secure.

During covid, they weren't offering the authorization by mail. Not sure of current status.

Can you contrast visible with US mobile? I chose US mobile over straight talk because they allowed tethering…

StraightTalk allows upto 10GB of tethering on non-AT&T sim cards with the "unlimited" plan. On AT&T sim cards with a limited-data plan, they don't care if you tether.

I hadn't heard of this carrier before and it made me curious what the rest of their privacy was like, and whether this part of a overall policy. I didn't see explicit mention of opting out of the systems you mentioned. Is that stated anywhere officially, or is it just unofficial?

Their privacy stance overall looks just ok, maybe somewhat above average.

It does make me wonder how strong of a privacy stance Purism will take, or will be able to take as a service provider.

Some emphasis added, and some info trimmed (noted with ellipses ...)

https://www.visible.com/legal/privacy/

... I. COLLECTION OF INFORMATION We collect information when you use our service. This includes information about the calls you make and receive, text messages you send and receive, ___websites you visit, mobile applications you use___, and wireless network and device information, including location, Internet protocol (IP) address and connection speed, mobile telephone number, ___device and advertising identifiers___, browser type, and operating system. Some Visible devices include Verizon-provided system applications that collect information about network and device conditions, which is used to secure and improve our network and services. ...

II. USE OF INFORMATION

... * Determine products and services that may interest you and market them to you, including on Visible sites and apps and on others’ sites, services, apps and devices as described in Section V below ...

III. DISCLOSURE OF INFORMATION

* Authorized service providers and partners. We share your information with service providers and partners that help us with a variety of things, including development and delivery of our sites, apps and service. ... ... * Aggregated and De-identified Information. We may aggregate or otherwise de-identify information and use it for our own purposes or share it with third parties for their own purposes. ...

... Your Right to Say “Do Not Sell”

The CCPA gives you the right to say no to the sale of personal information.

We do not sell information that personally identifies you such as your name, telephone number, mailing address or email address.. We allow Verizon Media and third-party advertising companies to collect information about your activity on our website and in our app, for example through cookies and similar technologies, mobile ad identifiers, pixels, web beacons and social network plugins. These ad entities use information they collect to help us provide more relevant Visible advertisements and for other advertising purposes. This activity may be considered a sale under the CCPA. Visit the Digital Advertising Alliance's Consumer Choices page to learn more about how you can limit this type of advertising. App users can opt out by using your device settings to “Limit Ad Tracking” (for iOS devices) or “Opt out of Ads Personalization” (on Android devices) ...

(edit: formatting)

sounds like they want to do the "fraud location check ping on your phone" that seems to be happening on many carriers.

> In the USA, the IRS and many banks _require_ an cell phone registered in your name to prove your ID.

The IRS most certainly does not require a cell phone registered in your name, nor could they.

> The IRS most certainly does not require a cell phone registered in your name

They don't but the alternative 2FA for them was a letter mailed through USPS.

I had to do that back in the day when Google Fi wasn't recognized by the IRS as a mobile phone.

Young people think they are clued into privacy, but it's all the old geezers who don't want to learn to use electronics who create demand for the the paper option. I wonder what will happen after they have died off.

I’m not sure why it’s being downvoted, in the UK a phone account in your name is one of the most common forms of ID there is no universal government issued ID, not everyone has a drivers license or a passport and if you are living in a flat share or student accommodations you won’t have utility bills in your name.

So people with landlines can't pay taxes?

Last time I manually filled taxes this wasn't something I had to do.

> the IRS and many banks _require_ an cell phone registered in your name to prove your ID.

That has not been my experience with the IRS and my banks.

Reply on news.ycombinator.com