Comment by jasonpeacock | Hacker News Reader

Comment by jasonpeacock | Hacker News Reader

Parent Full thread

A very important note: Pages are plaintext, they are not encrypted. Anyone with a radio can receive and decode all pages sent within reception range of that radio.

(which is evident when you read the article, but not called out explicitly)

This is a big deal for any use which involves private/sensitive/confidential data, as it can inform eavesdroppers about current issues, internal tools/architecture, personnel status, etc.

For example, do you want to know when a major cloud company is having an internal outage? Listen for pages which follow their internal notification format. Or maybe you want to know if a critical patient at a hospital is having troubles - listen for pages to their doctor. Does the military command center use pagers (I hope not) - that could be interesting too...

If your employer is using pagers, raise this issue to their security team (and share this great page showing how easy it is to eavesdrop). At the least, the pager messages should be as vague/simple as possible while still being useful. At the best...don't use pagers.

Pagers are already a poor choice - messages are delivered "with best effort" but there's no guaranteed sending, no receipt, no retries. If you're out of range (or signal blocked), the message is lost, and it's up to the sender to implement their own ack & retry system.

(I carried a pager for work for almost 15yrs)

My employer (a large healthcare company) has been shown over and over that they're broadcasting PHI in the clear over pagers, and that this is bad, and their response every time has been "the paging company assures us it is secure". Evidence doesn't matter, only the word 'secure' in their contract with the paging company does, so it's "not their fault".

Worse. If you show that it's trivially insecure, you are now the suspect/perpetrator.

Never break these illusions. Keep your mouth shut.

Even as the dedicated security contact whose job is it to test this shit, you will be looked at as a dickhead for pointing that we just spent 30k on something we can't use.

I once asked a med student why pagers continued to see use in a medical setting over mobile phones.

The response: doctors could use a phone to receive urgent notifications but the lower delivery guarantee for messages meant that they wouldn't be covered by their hospital's malpractice insurance for cases arising from late or non receipt of messages.

Not sure if true but could be a strong incentive to ignore security complaints.

>Pagers are already a poor choice - messages are delivered "with best effort" but there's no guaranteed sending, no receipt, no retries.

They were pretty good towards the end of their reign when 2-way pagers came out. We were able to easily implement something where the system would keep paging you until you responded with an "I've got it" ack or a "Hand it off to the secondary" response, both of them an easy pick-list item.

When did we all become so paranoid?

Pagers used to be used by millions of people, in thousands of companies. 99.999% of the messages sent would have been utterly mundane. Stuff like 'call the office' or 'go to place x'.

Just like our chat platforms of today, the data just isn't that interesting.

Pagers were good for the era they were invented for, and at scale ended up being almost free to operate for the companies that used them.

Encrypting stuff requires CPU grunt that pagers simply did not have, especially when the driver was to have as long battery life as possible.

If anything, I miss that simpler era when we didn't have to assume that everybody in the chain was a bad actor trying steal our information.

> When did we all become so paranoid?

One industry that makes extensive use of pagers is health care. Frequently, personal and identifying information (PII) is transmitted over pages. By all rights, this is a violation of privacy laws (e.g. HIPAA).

Why does a desire for privacy constitute paranoia?

Pagers aren't only a technology of yesteryear -- they're still in use by millions of hospital staff. Despite the availability of cheap & easy strong crypto today, the technology is still stuck in the past. I'd wonder why, but upgrading infrastructure is expensive and it will probably take a class-action suit to make continued privacy violations more expensive than upgrades.

>> I'd wonder why

I'm a doctor, and whilst I despise carrying a pager it does have some benefits over more modern alternatives in some scenarios.

Mobile (cell) reception in hospitals is generally very poor and wifi connectivity is also generally poor. Trying to rely on either of those to deliver critical communication (e.g. bleeps to the crash team to respond to a cardiac arrest) is more unreliable than the hospital blasting a simple radio signal that any pagers within a few mile radius will always receive and decode appropriately.

For less critical communications (e.g. where you might bleep someone to contact them to a refer a patient to their specialty) there is a (slow) move towards messaging apps or email. These solutions do not yet have the immediacy and reliability of a simple pager for critical applications.

I'm curious about the use of pagers in healthcare. I work in an industry that would love to have pagers for on call events, but service has proven unreliable (especially indoors) unless you build out your own dedicated wireless infrastructure for every building you are working in.

We have alternative secure voice/data communication, but they tend to either be bulky or have strict storage and carry restrictions.

Would love a small reliable pager system to carry on our person that would simply let us know to check in.

All of the pager architecture in the US seems to have disappeared in the marketplace.

Seems like it'd be a plausible (small) business idea. A $10 SDR stick with a piece of wire as an antenna is enough to pick up pager signals, and I doubt you'd need a much more advanced setup to transmit. A 100 or 400 MHz license in the US costs maybe $500 for a decade. Mounted at the right spot, you wouldnt need much power to cover a large area with a single transmitter, though basements are always going to be trouble.

> A $10 SDR stick with a piece of wire as an antenna is enough

That doesn’t sound like mission-critical levels of reliability.

My point was the technology is cheap - there are certainly better dedicated, inexpensive chips that could be used to make a simple wireless messaging system.

I'm curious what personal health information would be transmitted via a pager anyway? I assume a doctor would only need to know a room number and maybe code or chief complaint in the page?

I see other commenters mentioning some PHI is being shared via pagers and I am unclear what that may be ?

In my experience (UK) there is no personal information transmitted. There are two main types of bleeps:

1. Sending the number of a telephone extension you want the recipient of the bleep to call. For example, if I need a cardiology opinion, I will bleep the cardiologist with a telephone extension and wait for them to (hopefully) call back while I am still but he phone and before it is called by anyone else. This data is not sensitive. These are the types of bleeps which are being replaced slowly by asynchronous communication via apps

2. Emergency bleeps which are designed to alert a specific group of people on the arrest team to respond to an emergency. These usually work quite differently. Instead of 1:1 they are 1:many and usually carry a different alert tone, followed by a (generally poor quality) audio alert of the operator saying something like "paediatric cardiac arrest inbound to ED, ETA, 5 minutes". Again these carry no sensitive data.

Yeah from what I have heard from Canadian based doctors the pagers are used for almost identically the same as what you described for the UK.

Pagers get used for PII, and if somebody thinks it doesn't happen, they're simply confident that their experience is representative. It happens, and quite frequently, in Canada.

https://www.trendmicro.com/vinfo/id/security/news/vulnerabil...

Yeah what you linked me to talks about I believe the same case another user already linked to. It was more correct for me to say I was speaking more about the Ontario, Canada healthcare system as that is the one I work within. The healthcare systems are mostly run at the provincial level so it can be hard to talk about the countries healthcare as a whole as it can often vary province to province.

I’ve listened to pages in large Canadian cities in the past for fun. Pages at the local hospital often included patient names and diagnosis or analysis results.

Yeah from what it sounds like there were some incidents in the news in BC in 2019 and it sounds like a lot of hospitals may have adopted new procedures since then? Not sure if you've been listening to any recent ones?

It's kinda hard also to figure out which areas may be doing it and which aren't as the different provinces are kinda run independently.

Yes that was before 2019 so maybe it has changed now.

here's an article with examples: https://www.kansascity.com/news/business/health-care/article...

basically, they broadcast patient name, initial diagnosis etc

Weird, as the other commenter mentioned their's in the UK don't have patient information in them. In fact the medical professional I know in Canada have pagers that give essentially the same information about the UK commenters. It's either an extension to call, or for a code.

Maybe countries like the UK and Canada are more strict about personal health information and have kept personal info out of pagers? I know working in healthcare systems in Canada I would get in trouble even if I used a medical software to look myself up in it.

Here's a Canada example (apparently patient transport coordination, fixed after media attention): https://www.ctvnews.ca/health/pager-systems-used-in-healthca...

Ah, interesting. The only people I've actually talked to before about the pagers were from Ontario and the healthcare is mostly managed at the provincial level. So not sure if this was a problem in Ontario or not. I am sure at some point all the hospitals were doing this and eventually switched over to the new way that doesn't do this.

However being a 911 dispatcher for the EMS system here I can say that our radios are not encrypted and can be listened to online by anyone. We mention addresses, chief complaints, and anything else that may be relevant for the paramedics. Patient names would not be given over radios nor would other private info like if the building has an access code. Anything that is private like that is indicated to the paramedics by saying something like "call for access code". Then they call the landline and get the info that way.

In my opinion though, knowing addresses and medical conditions going on can still be a bit sensitive in nature. The police here recently switched to encrypted radios. It was nice sometimes to listen to the scanner, but at the same time it's understandable why it's less than ideal having open radios.

If you reread me, you'll find my "why" isn't "why use pagers", it's "why don't pagers implement even basic crypto"

Ah yes - sorry, I read that too quickly. The answer to that (at least limited to my experience of pagers in many UK hospitals) is that they don't carry any sensitive data at all.

There are a lot of other issues with them though. There are few companies supplying them so they are actually very expensive. Consequently in our publicly funded health service they are not replaced often and many are in a poor state with batteries held in by tape etc.

The main issues from perspective as a user is the synchronous model of communication that they enforce. Unless something is an emergency, it's an unnecessarily disruptive workflow.

There are usually a limited number of phones on a ward, which are usually very busy lines. Using pagers for routine communication means:

1. Physically move myself to a location with a phone 2. Wait for phone to be free 3. Call a number to send the bleep 4. Wait for a response (bearing in mind the recipient needs to be free, move to a phone, wait for that phone to be free, and call back) 5. Guard the phone from others using it until I receive the call 6. Hope that no one else calls the phone in the meantime

Bearing in mind that everyone is always busy in hospital this is a huge source of frustration and wasted time, hence the move towards secure messaging apps for these scenarios. Unfortunately these are mostly being built as silos rather than interoperable communication networks.

As mentioned above, for actually alerting a group of people to an emergency when you need an immediate response, pagers are still hard to beat.

We didn’t assume because of ignorance. Innocence lost.

Plenty of people were listening - there’s an archive from 9/11/01 that was released with many of the pages in lower Manhattan that day.

Police routinely monitored this stuff, and it’s reputed that PIs, ambulance chasing attorneys, etc did the same. Was it relevant/meaningful to when my mom was going to pick me up from work at the mall was a page? Probably not.

It used to be pretty difficult to capture, record and process all that data. Now you can do it yourself for next to nothing. And so can anyone else.

How much CPU does it require, realistically, to implement an asymmetric + XOR cipher? Each pager would have a key pair provisioned by the provider. The provider would generate a unique key for each message and then use the pager's public key to encrypt that and send it along with the XOR-ed message. I'd bet you could decrypt that on a weak-ass microcontroller.

Paging never really passed 1980s technology. Sure, its easy enough to en/decrypt short messages now with nearly zero battery use, but it was probably deemed unnecessary at the time.

edit: looks like someone bolted AES onto FLEX: https://americanmessaging.net/elite/

Paging was also highly interested in making sure every bit that went over the air generated revenue, so adding bits to provide security was a hard sell. FLEX and ReFLEX are 90's technology.

Well one thing that is a difference is that receiving paging feeds was not as trivial back then as it is now.

Grab a $10 rtlsdr and free software and you're set. Back in the 90s you needed serious hardware to do this.

Even Caesar encrypted his pages.

It has been possible to get encrypted pagers in the U.S. for some time now. This clearly doesn't mean everyone adopts it.

Reply on news.ycombinator.com