Living Surveillance Free for a Day | Hacker News Reader

Living Surveillance Free for a Day

nymag.com

30 pointskaa210242 comments

I've been doing this for the last month and a half, to an extent.

I've got a spare laptop running a relatively minimal installation and it connects only to other Wifi networks (never any of my own). Thanks to iptables, I can restrict outgoing traffic to only that which is running over Tor. Yes, it's slow as molasses but for general web browsing I've gotten used to it (just don't try to create an HN account over Tor -- a nice little hellban will quickly follow).

I've got a new e-mail account that I registered while connected over some random hotspot several miles away using a Visa gift card I'd purchased a few months before. It's this account that I use (only over Tor, of course!) to participate in various public mailing lists.

My iPhone (which I hope to trade in fairly soon) is off more than it's on. I often simply leave it at home while I'm gone for the day. I haven't really missed it and, on the few occasions I've actually needed to get ahold of someone, it hasn't been difficult to find someone to let me borrow their phone for a moment or deliver a quick message for me. I barely even text anymore, who knows who is reading the messages I do send.

I work for an ISP and I have some things I want to do there too. I've pretty much got free reign to do whatever I want (as long as it doesn't cost my boss anything!) so I'll be bringing up a Tor exit node in the near future as well (I'm aware of the implications -- I don't care). I'm hoping to have a talk with my boss (who is 100% driven by the almighty dollar) about offering up anonymous VPN services and accepting Bitcoin to pay for that.

On the ISP network, I've now gotten ~1200 residential customers (to whom it doesn't make a difference) using private IP addresses and hope to add many, many more to that figure. A Cisco ASA5520 performs NAT but doesn't log NAT translations. If I get a "who had this IP at this time?" request, well, I don't know, sorry. Deal with it.

I "get a check" from Google every month for the ads on my blog (okay, technically it's a direct deposit). That was basically just a bit of extra money that sits in my business account. It's been going to the EFF recently.

I've stopped paying for things with debit/credit cards. If I pull up my account history, I can count the number of transactions in the last 45 days on one hand and nearly all of them are ATM withdrawals. Hell, I stopped using my "loyalty card" at the supermarket and had a random stranger get me a new one that isn't tied to anyone's identity.

These recent revelations, thanks to Snowden, have completely changed my behaviors. I'm not a "tinfoil hat" type or paranoid in the least, but I am completely pissed off. I may only be one person and there's only so much I can do but I will do everything I can to throw the smallest wrench possible into this unconstitutional surveillance that's going on.

It's already a slippery slope and the NSA has been doing the equivalent of pouring 55 gallon drums of Astroglide on a slip-and-slide that's laid out on a steep hill.

(Sorry for the rambling wall of text.)

I've been thinking about getting an "loyalty card" untied to my person but I haven't figured out a way to do this other than getting somebody to sign up and give me his card. This is because (at least here) they will send you your card in the mail, you can't really lie about any contact information.

you could have a ring of people, with their own loyalty cards, use them for a bit, rotate around, offset any loyalty points differences with a bitcoin transfer.

In my experience, 90% of the time the clerk will swipe their own loyalty card if you claim you don't have one, so you get the benefit of any available discounts while remaining anonymous.

Highly depends on the store. In my experience only one supermarket here will do that, every other store will not. Another point, you can't earn gas points and save money on gas later on doing that. Another point, with my loyalty card on certain purchases at Walgreens and every time I fill a prescription there I earn points which can then be spent like cash there later on. It's a pretty generous program, actually, I have earned a couple hundred dollars.

You could try standing outside the store in the parking lot and asking other customers if they want to trade cards with you to avoid getting tracked.

Just remember not to use your credit card to make any purchases when using someone else's loyalty card, because then your identity will be linked to the loyalty card from then on.

Do you have to use the card itself? Here, if you don't have your card, you can use your phone number. Have the card sent to a "fake" address and just remember the phone number you provided. (Pick an address where someone moved about 8 months or so ago or pick a big apartment building and it will probably get trashed by the receipient instead of being sent back.)

What happens if you lose the card? Do replacement cards get mailed, too?

"using a Visa gift card I'd purchased a few months before"

If you purchased the gift card with another card they still can trace your e-mail address back to you.

Unique e-mail address -> Unique Visa gift card -> unique credit card

Cash. And I never "registered" it online (intentionally).

> If I get a "who had this IP at this time?" request, well, I don't know, sorry. Deal with it.

Who posted this fantasy about raping a woman that has now gone missing? Oh well I don't know. Deal with it.

Your smug attitude seems less impressive when you apply it to a real situation.

To be a real situation, it has to have actually happened. Do you have any example of such?

Nothing I can reveal publicly, but if you look at statistics for searches of emails etc it is quite a common thing investigating someone's wherabouts. Missing, kidnapped or wanted, the tools and requirements are the same.

Where could I find such statistics, please? I'm struggling to find the right keywords.

I have to say I'm having trouble finding the information. I've definitely seen statistics made public before now but I'm at a loss to provide them.

Suffice to say though that unless you believe these situations don't exist, they are a legitimate reason to be able to search emails. If someone has been missing for a week, their phone records and email records and browsing history are probably the best possible clues that exist.

I find it hard to believe that the IP logs were ever the only option of identifying the perpetrator of any such crime, yes. People usually have emails with other kind of ID, usually much more reliable than an IP.

This is the same 'Think of the women and children!!!' argument that hasn't ever been a valid excuse for surveillance.

Where is your historical opposition to phone records, or search warrants or any of the other tools of surveillance and investigation used in crime?

Who are talking about surveillance? We are talking about identification of an IP adress. If they were asking for everything his user has done in the past century, and a direct fiber to every data... it would be surveillance but who were using a single ip during a single moment, this is not surveillance.

Not everyone is ready to concede their freedom for relative security.

Security is only good as long as the government isn't corrupt. The exact same mechanism that can help find this victim also grants the government with more power which in turn can be used to create other victims.

> Not everyone is ready to concede their freedom for relative security.

Yes they are, every single one of us lives in a society with a police force, with restrictions on ownership of everything from firearms to particular types of plant.

Don't give me this idealistic nonsense, the fact is that we are all willing to concede freedoms.

Does anyone have an option of living in a society without a police force? Not that I would, but it seems misleading to claim that we are necessarily willing and/or ready when there is no real choice.

It's an interesting question really, and it's not as simple as a binary choice. Fundamentally to have a functional society you need to have regulations, an authoritative hierarchy of some form (even if it's direct democracy) and a way to physically coerce those who do not obey rules.

The idea that this isn't a sacrifice of freedom would also be misleading, as it certainly is. When people say they won't sacrifice freedom I see it as just ignorant of the struggle and hardship required to establish the regulations that allow for an actual free society.

I could go on for hours, but won't.

There's a very large body of political philosophy that disagrees with your fundamental assertion, though. Not everyone agrees with the Hobbesian notion of the state of permanent war in the lack of a State, or that such top-down authority is inevitable, even if they are acquainted with the argument in its favor.

In any case, that may make someone misguided, but not necessarily willing.

Exactly. Anti-authoritarian people are like fairies. Even if they would exist they shouldn't because they're dangerously not conforming to our single-minded view of the world ;)

That wasn't really my main point though. Obviously freedom and security are a tradeoff but they're intrinsically related. How much more freedom are you willing to concede to live in a safer world ? How much taste of the life are you willing to remove to live longer in a bubble of safety ? Not everyone has the the same level of acceptance and it's only natural that some try to fight back the current trend.

I think the hypothetical niche of technologically savvy rapists trying to remain anonymous and untracable, yet willing to post rape fantasies in a (presumably) public forum is pretty small. Definitely not large enough to warrant logging everything. Additionally, you're implying that's the be-all-end-all lead on that case.

In this analogy the rapist would not be technologically savvy, just a regular internet user who is now undetectable because an ignorant person in the middle assumed removing logs was a good thing.

I'm not assuming that this would happen regularly, I'm just laughing at the idea that not keeping logs is actually going to help or protect anyone, when in reality it's just likely to hurt.

http://www.techweb.com/news/231602248/lulzsec-suspect-learns...

hidemyass logs everything.

Pro tip: setting up an auto-responder on your regular email account pointing people to your surveillance-free account is not generally regarded as best practices.

Inaccurate headline aside (the author is candid about the limitations of what he's doing), it's a good illustration of how hard it is to cut down your profile significantly, and the kind of trade offs you have to think about.

> I have to switch my iPhone to airplane mode

This doesn't work. The iPhone still tracks your location even when in airplane mode. To test:

1) Turn on Airplane mode 2) Take a picture 3) Turn off Airplane mode 4) Go to Photos app, "Places" tab. Note that the picture you took has been correctly geolocated.

The only way to not be tracked by your smartphone is to leave it in a Faraday device of some kind, like a refrigerator.

EDIT: Ok, not a fridge. Thanks, Titanous.

A refrigerator isn't a Faraday cage.

http://makezine.com/2013/06/26/edward-snowden-can-a-refriger...

Airplane serves to avoid transmitting; GPS receivers (like smartphones) don't transmit, therefore airplane mode doesn't disable it. That said, it should be enough to switch to Airplane mode and disable the GPS.

But cellphones is general are tracking devices par excellence. One-way pagers are safer, but the message is transmitted in clear-text.

I'm not sure that's correct. Phones don't talk to satellites for geolocation, they talk to towers. If they are talking to towers then they are not passive, but active. That means that even in airplane mode you are still being actively tracked if the phone can see a tower.

Phone with GPS - such as the iPhone - don't need to talk to anything to geolocate, they just need to listen to the incessant signals sent down by the GPS satellites.

Talking to cell towers can assist the GPS receiver[1], but it's not required.

[1]: http://en.wikipedia.org/wiki/Assisted_GPS

Phone(or really, GPS receivers in general) don't need to talk to anything in order to figure out their location.

A solution that's a bit more portable than a refrigerator: do a web search for "conductive fabric".

Buy some and use it (perhaps inside a lining of regular fabric) to create a pouch or a bag. Put your phone(s) in there.

So this seems like an odd statement: "Bitcoins are, in many ways, the ultimate underground currency. They’re even better than Visa gift cards, since they don’t involve a credit card company or a bank at all, and since they exist only as untraceable strings of letters and numbers." (keyword being "untraceable").

Especially as this person specifically mentions Tor as only doing a "fairly good job of keeping its users anonymous."

I'm not sure I understand. What's odd about that statement? I got big into Bitcoins about two years ago, meeting a random stranger in a bar to buy $9,000 worth in cash, but the statement is true unless I've missed something (I haven't kept up with the state of Bitcoin so perhaps I am?).

I meant that if you're going to call out Tor as "reasonably safe", it seems that you'd want to have the same warning for Bitcoins. My impression has been that Bitcoin isn't "untraceable" simply because of the public ledger that is out there. I just found it interesting that he called out Tor but lauded Bitcoin's security more. Not a big deal.

Gotcha, thanks.

"I also cover the cameras on my laptop, desktop, and cell phone with snippets of electrical tape, since savvy hackers can gain control of them remotely."

One thing he missed is the built-in microphone on his laptop and cell phone. That can also be controlled and listened-in to remotely, and it's usually harder to completely disable (unlike a webcam).

Yes, you could epoxy it shut, but even then it could still function (though with greatly reduced fidelity).

Disabling it completely would require opening up your laptop/cellphone case and unplugging the mic: something that would probably void your waranty and could be a nightmare to reassemble, depending on your hardware skills and the laptop/cellphone model you own.

This reminds me of the documentary "Erasing David": "After anonymously setting up private investigators Cerberus Investigations Limited to trace him, he tries to disappear."

http://erasingdavid.com/

The author sounds like a way over-wired gearhead to start with. He every latest gadget and app. No wonder it takes an effort toget off the grid.

Reply on news.ycombinator.com