Hacker News Reader

Comment by bonoboTP | Hacker News Reader

People won't enter their real info, especially if they are doing shady stuff worthy of investigating.

Doesn't necessarily matter if what they're actually doing is tracking an IMEI or SIM connection to the area and are fishing for evidence of shady intent via entering false information. MAC addresses from a device that doesn't do MAC randomization are also good for that sort of thing. Android devices can also be tracked via advertising id's if the user doesn't reset it and you haven't pissed off Google. I draw the line at assigning what are effectively UUID's to people specifically because they are so often abused in that manner.

Across the pond, things work a bit differently, and the criminal justice systems are a bit lower friction for the authorities as I understand it. Not that I'm criticizing mind. The American System has not endeared itself to me as of late.

SIMs are out of the question for public wifi hotspots - to authenticate a SIM (via EAP-SIM or EAP-AKA) you need an existing relationship with the mobile carrier.

When it comes to MAC addresses, 1) there isn’t a central registry of addresses anyway so having the MAC address alone won’t help much in an investigation, 2) it can be set by the user so malicious users will fake their MAC address and 3) for privacy reasons most devices nowadays will generate unique MAC addresses for each network.

That's why I caveated the MAC, but if you managed to catch a non randomizing device or a randomizing device that hasn't disconnected (dumped in trash outside for instance) or which was powered down on network and not powered on until after arrest, you can still hit paydirt.

The IMEI and advertising ids are the more pressing ones though. Never underestimate the deanonymyzing power of someone else's UUID you aren't even aware you have.

Another angle is that devices that randomize will “reuse” the random address for the same SSID, afaik. So even the random Mac may be of value over time.

Look at the Silk Road investigation. They collected circumstantial evidence by linking the originating IP address, where the suspect lived and when DPR was logged in.

I understood that Silk Road was a case of parallel construction, the Feds had a way to directly break the veil of TOR but didn't want to let on.

I really don't think so. There was an externally verifiable chain of evidence created by Ulbricht through random tidbits of sloppy opsec on a few occasions, enough of them for him to eventually be identified and caught. So if these existed (and they did, because they could be clearly pointed to), there was no need for parallel construction, and if there was no need for it, it presumably wouldn't have been used just because. Furthermore, if they were going to use it anyhow, why wait so long to do so when they had the needed formal evidence anyhow?

I understand your position, but the judge is probably going to answer that it's not a bar owner's job to decide which laws are good enough to be respected.

Due to the cost and risk involved, few cases go to jury trial... BUT if it's anything like the US a jury technically could consider things like this and refuse to render a guilty verdict.

In France, if I recall, isn't it usually a panel of judges? I don't think they use a jury.

Quick perusal indicates Cour d'assises is the only court with a jury analog, and it only deals with matters where the penalty would result in a >10 year sentence if I'm reading it correctly.

Man, this is the french justice system, not the US. Jury trial (assises) doesn't happen for anything short of blood crimes.

On the other hand, plea deals are not a thing either, so if the state decides to press charges, you're definitely going to see a judge.

Reply on news.ycombinator.com