[alphaursaemin]

If I was an intelligent person, I would use a basic phone for making phone calls and not carry surveillance devices on my person or have them in my house. This way I would not have to worry about keeping up with agencies that operate above the law, are accountable to none, and operate with huge budgets to subvert the ethics and mores of capable people.

[tivert]

> If I was an intelligent person, I would use a basic phone for making phone calls and not carry surveillance devices on my person or have them in my house. This way I would not have to worry about keeping up with agencies that operate above the law...

Why do you assume a "basic phone" would protect you in any way? It's far more likely to only be capable of insecure, easily interceptable forms of communication (e.g. SMS). Also, it's software is likely much worse than more popular phones (e.g. an egregious example is cheap Android phones shipping with malware preinstalled).

[slim]

it would protect him because he will communicate much less using it

[KingOfCoders]

If I was an intelligent person, I would not spend so much time on HN writing comments. But hey! ;-)

[alphaursaemin]

I am crushed by the awareness of my shortcomings, brother.

[this_steve_j]

This is probably my favoritest hot retake I have seen in awhile.

[narrator]

Have a really small 4g hotspot hotglued to a tiny Linux computer running the Tails distribution read-only with a removable SD card with all your data and no executable code on it if you're a real cypherpunk.

[KMag]

Why a hotspot instead of a USB 4g modem? Concerned about 4g hardware/driver vulns but not WiFi hardware/driver vulns?

Edit: yes, I guess you're concerned about sim-resident malware exploiting the modem, exploiting the rest of the machine via USB.

Also, if you're that paranoid, you should probably be running something seL4-based to better compartmentalize compromises.

[predictabl3]

We really ought to push for something better than Tails. I'd love to run something like it on an aarch64-linux or riscv64-linux board. I'd love to run something that doesn't have a hacked, nearly broken debian boot process, which broke the ability to kexec it many versions ago, etc.

/me keeps (semi-)patiently waiting for SpectrumOS... https://spectrum-os.org/

[capableweb]

I'm guessing you're connecting to 4G with a sim card? Essentially a small computer, so you're exposed that way regardless.

[narrator]

The 4g is in the hotspot that you're connecting to via wifi from the mini-computer. That way you don't have baseband firmware exploits to deal with on the linux machine like you would now with a traditional android phone. 4G firmware are all binary blobs that probably have backdoors.

[kortilla]

Hotspot. You assume the hotspot is compromised and only connect via WiFi

[ransackdev]

If the hotspot were compromised, why would you connect to it at all?

[kortilla]

Because you want internet. The attack surface against your laptop is only the WiFi interactions.

A WiFi access point has far less capability to hack its clients than a baseband firmware on an LTE modem with direct memory access to the host.

This is basic opsec stuff. If you’re interested it is a cool rabbit hole to go down just to see how insecure standard systems are.

[ransackdev]

So am I to understand that from an OpSec perspective, connecting a machine to a known compromised system, is ok to do, “because you want internet”?

Maybe because I’m not opsec and don’t know my ass from a hole in the ground, but my security recommendation would be, no, do not purposely connect your machine to a known compromised system regardless of its advertised purpose, attack vectors, attack surface, probability of unwanted exploitation, or justification as to why it’s necessary to do so, because you’re exposing yourself, and possibly corporate machine and network, to compromise. Find a trusted system (aka audited and considered reasonably low risk while acknowledging no system can ever be deemed fully secure and trust, or zero trust is a large determining factor) and consider the compromised machine as not existing at all, therefore not being an option at all, because connecting to it would go against common sense and 8th graders practice better security habits

[FieryTransition]

I think sim cards have been able to run java for quite a while[0], and who knows what else they can do. So I guess encrypted post cards it is.

[0] https://www.extremetech.com/defense/161870-the-humble-sim-ca...

[Cthulhu_]

I'm not sure what you understand to be a "basic phone", but they are easily intercepted and traced (triangulation from mobile phone towers, it's how the emergency services can locate you if you dial 112 all across Europe).

[alphaursaemin]

Communication has always been known to be a risky endevour with potential for various compromises, even for sovereigns. That telephony and now network communication infrastructure the world over is minimally at risk of, if not subject to, surveillance is understood.

Carrying a general purpose computer of substantial complexity that is equipped with state of the art sensors, optics, and components (including ai), which is then topped with yet another thick complex layer of software, which is subject to known and unknown access (by various parties), is not the same thing as a telephone (analog, digital, wired, or not).

Today, unless in a secured EM cage, there really aren't that many places where you can be certain you can have a private conversation, face to face. Visiting friends? Alexa and friends may be listening. Even the lousy TV sets :) Walk in the park? Your companion likely has a smartphone.

A healthy society requires the availability of private spaces and private interactions. When a citizenry becomes aware of pervasive surveillance it self censors. Self censorship prevents airing of views in an unemcumberred manner. When views are constrained, problems remain unaddressed.

Tyranny typically thrives in such insecure and non-optimal circumstances.

[nvy]

>Today, unless in a secured EM cage, there really aren't that many places where you can be certain you can have a private conversation, face to face.

Even then the assurance is only so high. Governments operate what are called SCIFs, Secure Compartmentalized Information Facilities, where they not only conduct physical exclusion and EM hardening but also acoustic damping so that an adversary can't, in theory, listen through the walls with a fancy stethoscope or a laser microphone.

There's a scene from Neuromancer where Molly and Case pay another character for a private discussion room, which is basically a cyberpunk SCIF. I've always found that scene oddly prescient; privacy today is quickly becoming a luxury.

[runjake]

Basic phones are computers running pretty shoddy operating system distributions, like BREW, with serious security issues.

If anything, you're making yourself more vulnerable with a basic phone over an iPhone or Android device with proper security practices.

[londons_explore]

One where you have to wind the handle to make a bell ring at the other end?

[hbn]

Any self-respecting security industry veteran only communicates using 2 cans on a string

[Ozzie_osman]

You would need to, also, only communicate with other "intelligent person"s because otherwise you might be in the clear but the folks you call may not.

[codetrotter]

I tried going back to a basic phone again for a few months some years ago.

Tbh the only two positives were:

- Battery would last several days on a single charge. I had totally forgotten that that used to be the case.

- Less time wasted on social media etc.

But the drawback was immense!

For one, it was not until I put my smart phone away that I realised just how valuable Google Maps is to me.

And of course, a lot of my communications with other people are in various apps these days. SMS is just not very useful at all now.

So the lesson learned was that it is better to have a smart phone.

[daneel_w]

> "- Battery would last several days on a single charge. I had totally forgotten that that used to be the case."

Several days? Surely you meant weeks? Unless you spent an hour or two calling on the phone every day, of course.

I get 5-10 days out of my iPhone depending on desire for leisure. In the "dumb" era the number was about 2-3 weeks, even when I was young and always texting throughout the day.

[codetrotter]

> I get 5-10 days out of my iPhone depending on desire for leisure

I probably use the phone a lot more than you. My iPhone has to be charged at least twice a day, and it’s not even that old. My current iPhone is an iPhone 14 Pro.

[daneel_w]

Yeah that definitely sounds like you're constantly on the phone - or at the very least keep everything and then some running in the background with app refresh and location services etc. enabled.

[codetrotter]

Guilty as charged :p

[seized]

Don't you mean discharged?

[smoldesu]

> Unless you spent an hour or two calling on the phone every day, of course.

That's what people are using iPhones for these days?

[daneel_w]

Talking on the phone, like some sort of psychopath...

[the_pwner224]

Any modern smartphone will have several days of battery life, if not more, if you use it as a dumb phone (WiFi & mobile data turned off, only using it for calls & SMS). My Galaxy S5 (~8 years old now?) passively discharged at 1% per day with WiFi & data disabled.

[hsudvsish]

isn't an regular offline gps device an option?

[sethherr]

No traffic updates, no transit directions, no bike directions.

It’s very much worse

[daneel_w]

Not to mention that map application availability was equal to zero unless using the very latest breed of pre-smart phones from the late 2000s, and even then it was so-so.

[codetrotter]

Many of my searches in Google maps are also for things like grocery stores etc. With a regular offline gps device I would not have that

[badpun]

> surveillance devices on my person or have them in my house.

Unfortunately, even if you trust your "basic" phone to not be compromised, it still means you can't have a personal computer. From what I've read, that's the strategy used on the Kremlin - for security reasons, they banned computers and went back to typewriters.

[fsflover]

"Basic phone" can easily spy on you, too. Perhaps you need a phone with open schematics and hardware kill switches.

[tiahura]

Don’t forget the foil!

[flerchin]

So you'd make your phone calls in the clear?

[SV_BubbleTime]

Are you implying that calls made from smart phones are anything but on the clear? Are you making all your voice calls using some merging other than the phone app?

[Tepix]

Many calls are made using apps these days. WhatsApp alone had more than 15 billion voice minutes on average per day back in 2020.

If your phone and the phone of the other party are not compromised, it is indeed possible to conduct end-to-end encrypted calls with perfect forward secrecy.

[Scoundreller]

Trick is to do the on-the-fly encryption and decryption in your own brain.

Getting the key length up is a real challenge tho.

But WhatsApp (or… anything) would be great if it could easily share PGP coded messages scanned in via QR codes.

[BobbyJo]

> If your phone and the phone of the other party are not compromised, it is indeed possible to conduct end-to-end encrypted calls with perfect forward secrecy.

That's something you can never rely on though.

[SV_BubbleTime]

And let’s be honest, you would be foolish to think WhatsApp isn’t compromised by intelligence agencies.

[predictabl3]

I uh, y'all do know there are open source voip apps, right? You can fire up most any popular Matrix client and call me E2EE right now.

[Scoundreller]

And has been used as a vector of device compromise itself.

[cj]

A lot of people (especially outside the US) use whatsapp, etc, for calling which happens over data/wifi rather than traditional cellular.